[19126] in Kerberos_V5_Development
Re: Proposal for using NAPTR/URI records
daemon@ATHENA.MIT.EDU (Brandon Allbery)
Thu Feb 26 15:14:03 2015
From: Brandon Allbery <ballbery@sinenomine.net>
To: "nico@cryptonector.com" <nico@cryptonector.com>
Date: Thu, 26 Feb 2015 20:13:40 +0000
Message-ID: <1424981619.3235.10.camel@vikktakkht>
In-Reply-To: <20150226192045.GG9895@localhost>
Content-Language: en-US
Content-ID: <B23D0995044D154796037C8783BCADD0@mex05.mlsrvr.com>
MIME-Version: 1.0
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Thu, 2015-02-26 at 13:20 -0600, Nico Williams wrote:
> On Thu, Feb 26, 2015 at 07:19:27PM +0000, Brandon Allbery wrote:
> > On Thu, 2015-02-26 at 13:17 -0600, Nico Williams wrote:
> > > On Thu, Feb 26, 2015 at 05:15:15PM +0000, Brandon Allbery wrote:
> > > > On Thu, 2015-02-26 at 10:55 -0600, Nico Williams wrote:
> > > > > > 2. DNS stacks which drop queries for unknown QTYPEs.
> > > > >
> > > > > type=ANY.
> > > >
> > > > I've seen too many commodity routers that (a) insist on giving out the
> > > > address of their internal DNS caching server (b) silently drop any RR
> > > > they don't understand from cached/forwarded replies.
> > >
> > > How can (b) work in a DNSSEC world? I imagine the affected zones are
> > > opting out.
> >
> > You think commodity routers speak DNSSEC?
>
> No, but I'm asking what results. It must be equivalent to a timeout.
The router ignores DNSSEC (and EDNS for that matter) entirely, so you
get a timeout or you get no signature back ands it's on the client to
ignore them.
In any case, this will as a practical matter be deployed in places that
do not use DNSSEC.
--
brandon s allbery kf8nh sine nomine associates
allbery.b@gmail.com ballbery@sinenomine.net
unix openafs kerberos infrastructure xmonad http://sinenomine.net
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
