Subject: Re: [lamps] [Spasm] Erratum 4988

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Wed, 5 Jul 2017 16:18:16 -0700

No comments in the last couple weeks. Phillip, would you like to write
up the current version in a new erratum?

On 06/23/2017 05:15 PM, Jacob Hoffman-Andrews wrote:
> This version looks good to me. Good catch to whoever pointed out
> Unbound's hard limit. And thanks to Phillip for pushing this through
> multiple revisions. Any other thoughts from the list?
>
> On 06/22/2017 12:52 PM, Phillip Hallam-Baker wrote:
>>
>> In response to comments by a non list subscriber:
>>
>>
>> s/follow the CNAME record/follow the CNAME record chain
>>
>> s/ten or fewer/8 or fewer/
>>
>>
>> The first is just for clarity and the second is because it turns out
>> that unbound has a hard limit of 8 CNAME records to follow in a chain
>> which provides a justification for a number that was previously
>> arbitrary.
>>
>>
>> If there is a revision of RFC1035 to specify a limit it will
>> certainly follow unbound unless there is another library in common
>> use with a different limit.
>>
>>
>>
>> Corrected Text
>>
>> --------------
>>
>>    Let CAA(X) be the record set returned in response to performing a CAA
>>
>>    record query on the label X, P(X) be the DNS label immediately above
>>
>>    X in the DNS hierarchy, and A(X) be the target of a CNAME or DNAME
>>
>>    alias record chain specified at the label X.
>>
>>  
>>
>>    o  If CAA(X) is not empty, R(X) = CAA (X), otherwise
>>
>>  
>>
>>    o  If A(X) is not null, and CAA(A(X)) is not empty, then R(X) =
>>
>>       CAA(A(X)), otherwise
>>
>>  
>>
>>    o  If X is not a top-level domain, then R(X) = R(P(X)), otherwise
>>
>>  
>>
>>    o  R(X) is empty.
>>
>>  
>>
>>   Thus, when a search at node X returns a CNAME record, the CA will
>>
>>   follow the CNAME record chain to its target. If the target label 
>>
>>   contains a_ _CAA record, it is returned.
>>
>>
>> ​O​
>> therwise, the CA continues the search at
>>
>>   the parent of node X.
>>
>>  
>>
>>   Note that the search does not include the parent of a target of a
>>
>>   CNAME record (except when the CNAME points back to its own path).
>>
>>  
>>
>>  To prevent resource exhaustion attacks, CAs should limit the length of
>>
>>   CNAME chains that are accepted. However CAs MUST process CNAME
>>
>>   chains that contain 8 or fewer CNAME records.
>>
>>
>> On Wed, Jun 14, 2017 at 7:11 PM, Phillip Hallam-Baker
>> <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>     The RFC Editor has deleted all three of the existing errata. I
>>     would like for the next errata to be the very last.
>>
>>      
>>
>>     Could people read, review and state if this works for them?
>>
>>     ​ This text is the same as the one I posted to CABForum earlier
>>     with the one exception being that I capitalized Otherwise in the
>>     place it needed it.​
>>
>>
>>      
>>
>>     Original Text
>>
>>     -------------
>>
>>        Let CAA(X) be the record set returned in response to
>>     performing a CAA
>>
>>        record query on the label X, P(X) be the DNS label immediately
>>     above
>>
>>        X in the DNS hierarchy, and A(X) be the target of a CNAME or DNAME
>>
>>        alias record specified at the label X.
>>
>>      
>>
>>        o  If CAA(X) is not empty, R(X) = CAA (X), otherwise
>>
>>      
>>
>>        o  If A(X) is not null, and R(A(X)) is not empty, then R(X) =
>>
>>           R(A(X)), otherwise
>>
>>      
>>
>>        o  If X is not a top-level domain, then R(X) = R(P(X)), otherwise
>>
>>      
>>
>>        o  R(X) is empty.
>>
>>      
>>
>>      
>>
>>     Corrected Text
>>
>>     --------------
>>
>>        Let CAA(X) be the record set returned in response to
>>     performing a CAA
>>
>>        record query on the label X, P(X) be the DNS label immediately
>>     above
>>
>>        X in the DNS hierarchy, and A(X) be the target of a CNAME or DNAME
>>
>>        alias record chain specified at the label X.
>>
>>      
>>
>>        o  If CAA(X) is not empty, R(X) = CAA (X), otherwise
>>
>>      
>>
>>        o  If A(X) is not null, and CAA(A(X)) is not empty, then R(X) =
>>
>>           CAA(A(X)), otherwise
>>
>>      
>>
>>        o  If X is not a top-level domain, then R(X) = R(P(X)), otherwise
>>
>>      
>>
>>        o  R(X) is empty.
>>
>>      
>>
>>       Thus, when a search at node X returns a CNAME record, the CA will
>>
>>       follow the CNAME record to its target. If the target label
>>     contains a
>>
>>       CAA record, it is returned.
>>
>>     ​O​
>>     therwise, the CA continues the search at
>>
>>       the parent of node X.
>>
>>      
>>
>>       Note that the search does not include the parent of a target of a
>>
>>       CNAME record (except when the CNAME points back to its own path).
>>
>>      
>>
>>      To prevent resource exhaustion attacks, CAs should limit the
>>     length of
>>
>>       CNAME chains that are accepted. However CAs MUST process CNAME
>>
>>       chains that contain ten or fewer CNAME records.
>>
>>      
>>
>>       Processing for DNAME is exactly the same as for CNAME. Note
>>     that since
>>
>>       DNAME records are implemented by creating the corresponding CNAME
>>
>>       records on the fly, it is only necessary for DNAME records to
>>     appear
>>
>>       on the wire for purposes of DNSSEC.
>>
>>
>>
>>
>> _______________________________________________
>> Spasm mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/spasm
>
>
>
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Sun, 9 Jul 2017 14:24:34 -0700

Ping on this?

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 10 Jul 2017 11:07:57 -0400

https://www.rfc-editor.org/errata/eid5065

I did change the should to a SHOULD as the context was obviously normative.
Not that it makes much difference..

I will talk to the RFC Editor staff in Prague and anyone else who might
need to approve getting the status set to Held for Document Update

On Sun, Jul 9, 2017 at 5:24 PM, Jacob Hoffman-Andrews <[email-masked]> wrote:

> This version looks good to me. Good catch to whoever pointed out Unbound's
> hard limit. And thanks to Phillip for pushing this through multiple
> revisions. Any other thoughts from the list?
>
> The first is just for clarity and the second is because it turns out that
> unbound has a hard limit of 8 CNAME records to follow in a chain which
> provides a justification for a number that was previously arbitrary.
>
>
> If there is a revision of RFC1035 to specify a limit it will certainly
> follow unbound unless there is another library in common use with a
> different limit.
>
>
>
> Corrected Text
>
> --------------
>
>   contains a CAA record, it is returned.
>
> ​O​
> On Wed, Jun 14, 2017 at 7:11 PM, Phillip Hallam-Baker <
> [email-masked]> wrote:
>
>> The RFC Editor has deleted all three of the existing errata. I would like
>> for the next errata to be the very last.
>>
>>
>>
>> ​ This text is the same as the one I posted to CABForum earlier with the
>> one exception being that I capitalized Otherwise in the place it needed it.​
>>
>>
>>
>>
>> Original Text
>>
>> -------------
>>
>>   follow the CNAME record to its target. If the target label contains a
>>
>>   Processing for DNAME is exactly the same as for CNAME. Note that since
>>
>>   records on the fly, it is only necessary for DNAME records to appear
>>
> Spasm mailing [email-masked]://www.ietf.org/mailman/listinfo/spasm
>
>
>
>
> Spasm mailing [email-masked]://www.ietf.org/mailman/listinfo/spasm
>
>
>

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Mon, 10 Jul 2017 18:57:56 -0700

On 07/10/2017 08:07 AM, Phillip Hallam-Baker wrote:
> I will talk to the RFC Editor staff in Prague and anyone else who
> might need to approve getting the status set to Held for Document Update
Great, thanks. Would you be able to email them to get the ball rolling
before Prague? The implementation date for the CA/Browser forum CAA
enforcement is September, and it would be good to have this wrapped up
and balloted before then.