bugZoneCheck - Bugs: bug #32188, EDNS test makes a mistake on...

 
 

bug #32188: EDNS test makes a mistake on "payload size" semantics

Submitter:  Stephane Bortzmeyer <bortzmeyer>
Submitted:  Thu 20 Jan 2011 09:29:29 AM UTC
   
 
Category:  * tests Severity:  Ordinary
Priority:  5 - Normal Item Group:  * Crash/Error
Status:  Confirmed Privacy:  Public
Assigned to:  None Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 20 Jan 2011 09:29:29 AM UTC, original submission:  

The test for EDNS capabilities (necessary for DNSSEC) tests that the requested  server sends back an EDNS packet and has a "payload size" >= 1024, regarded as the minimum value to do DNSSEC seriously (even if not mandated by the RFC).

But this comes from the expectation that the "payload size" indicates the maximum size the authoritative server can send. It does not seem true. RFC 2671, section 4.5, says that the "payload size" is the maximum you can receive, not the maximum you can send.

A typical example: as of today, Zonecheck cannot validate .NET:

     ,-------------.|
~~~~ |    fatal    || ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     `-------------'
f> does not support EDNS
=> k.gtld-servers.net/192.52.178.30

Because .NET name servers reply with a payload size of 512, despite the fact they can send the large DNSSEC responses:

% dig +dnssec @k.gtld-servers.net DNSKEY net.

; <<>> DiG 9.7.2-P3 <<>> +dnssec @k.gtld-servers.net DNSKEY net.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22203
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;net.                           IN      DNSKEY
...

;; Query time: 20 msec
;; SERVER: 192.52.178.30#53(192.52.178.30)
;; WHEN: Thu Jan 20 10:25:40 2011
;; MSG SIZE  rcvd: 889

So, the code in dnssec.rb:

     def chk_edns(ns, ip)
...
        return true if add.type == "OPT" && add.payloadsize > 1024

seems false.



Stephane Bortzmeyer <bortzmeyer>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bortzmeyer (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code