bugZoneCheck - Bugs: bug #32188, EDNS test makes a mistake on...

 
 

bug #32188: EDNS test makes a mistake on "payload size" semantics

Submitted by:  Stephane Bortzmeyer <bortzmeyer>
Submitted on:  Thu 20 Jan 2011 09:29:29 AM UTC  
 
Category: testsSeverity: Ordinary
Priority: 5 - NormalItem Group: Crash/Error
Status: ConfirmedPrivacy: Public
Assigned to: NoneOpen/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 20 Jan 2011 09:29:29 AM UTC, original submission:

The test for EDNS capabilities (necessary for DNSSEC) tests that the requested server sends back an EDNS packet and has a "payload size" >= 1024, regarded as the minimum value to do DNSSEC seriously (even if not mandated by the RFC).

But this comes from the expectation that the "payload size" indicates the maximum size the authoritative server can send. It does not seem true. RFC 2671, section 4.5, says that the "payload size" is the maximum you can receive, not the maximum you can send.

A typical example: as of today, Zonecheck cannot validate .NET:

,-------------.|
~~~~ | fatal || ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
`-------------'
f> does not support EDNS
=> k.gtld-servers.net/192.52.178.30

Because .NET name servers reply with a payload size of 512, despite the fact they can send the large DNSSEC responses:

% dig +dnssec @k.gtld-servers.net DNSKEY net.

; <<>> DiG 9.7.2-P3 <<>> +dnssec @k.gtld-servers.net DNSKEY net.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22203
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;net. IN DNSKEY
...

;; Query time: 20 msec
;; SERVER: 192.52.178.30#53(192.52.178.30)
;; WHEN: Thu Jan 20 10:25:40 2011
;; MSG SIZE rcvd: 889

So, the code in dnssec.rb:

def chk_edns(ns, ip)
...
return true if add.type == "OPT" && add.payloadsize > 1024

seems false.

Stephane Bortzmeyer <bortzmeyer>
Project Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bortzmeyer (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup1