Subject: [lamps] CAA DNAME behavior is surprising

From: Andrew Ayer <[email-masked]>
Date: Thu, 24 Aug 2017 15:15:03 -0700

Roughly speaking, the CAA lookup algorithm in RFC 6844 section 4 says
that if X does not have a CAA record, but is an alias, then the CA
should look for a CAA record at the target of X.

Specifically, it defines "alias" to be either a CNAME or a DNAME:

"Let ... A(X) be the target of a CNAME or DNAME alias record specified
at the label X."

A straightforward interpretation of this language is that if you have
the following records:

sub1.example.com.  IN  DNAME  sub2.example.com.
sub2.example.com.  IN  CAA    0 issue "example.net"
example.com.       IN  CAA    0 issue "example.org"

then the only CA that is allowed to issue for sub1.example.com is
example.net.  This is the case even with erratum 5065.

However, this does not match the typical behavior of DNAME.  Per section 2.3
of RFC 6672:

"Unlike a CNAME RR, a DNAME RR redirects DNS names subordinate to its
owner name; the owner name of a DNAME is not redirected itself."

It's therefore rather surprising that CAA says you should follow the
DNAME target of X and use the CAA record there.  Given the above
records, I would expect example.org, not example.net, to be the only CA
that can issue for sub1.example.com.

Is this behavior intentional?  If so, what was its motivation?

Regards,
Andrew

---

From: "John Levine" <[email-masked]>
Date: 25 Aug 2017 02:13:11 -0000

In article <[email-masked]>,
>A straightforward interpretation of this language is that if you have

I think the obvious intention is to refer to a name at a CNAME or
below a DNAME.  We all understand that the DNAME's own name is not
redirected.

R's,
John

---

From: Andrew Ayer <[email-masked]>
Date: Fri, 25 Aug 2017 11:22:37 -0700

On 25 Aug 2017 02:13:11 -0000
"John Levine" <[email-masked]> wrote:

> >"Let ... A(X) be the target of a CNAME or DNAME alias record
> >specified at the label X."
> >

I agree this is how CAA should work.

Unfortunately, the language in RFC 6844 is quite explicit that a CAA
lookup be attempted at A(X), and A(X) is defined to be the target of a
DNAME alias record specified *at* the label X.

Thus, if you implement CAA as it's specified in RFC 6844, you end up
with the weird DNAME behavior.

I've submitted erratum 5097 which proposes to simply remove mention of
DNAME. Since DNAMEs cause CNAMEs to be synthesized for subordinate
names, it's unnecessary for the CAA algorithm to consider them
explicitly.

https://www.rfc-editor.org/errata/eid5097

Regards,
Andrew

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 25 Aug 2017 16:15:17 -0400

Please. No more errata to RFC 6844.

The point of the work in this WG is to specify a new discovery mechanism.
RFC 6844 already has an errata changing the semantics of the discovery
mechanism that was extensively reviewed.. We do not do errata of errata.

​The reason DNAME comes into it is DNSSEC. If you are processing DNSSEC
records then you will encounter DNAME on the wire. It is the only way that
they can be signed. So any description has to cope with that.​

On Fri, Aug 25, 2017 at 2:22 PM, Andrew Ayer <[email-masked]> wrote:

> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm
>

---

From: Andrew Ayer <[email-masked]>
Date: Mon, 28 Aug 2017 10:03:33 -0700

On Fri, 25 Aug 2017 16:15:17 -0400
Phillip Hallam-Baker <[email-masked]> wrote:

> The point of the work in this WG is to specify a new discovery
> mechanism. RFC 6844 already has an errata changing the semantics of
> the discovery mechanism that was extensively reviewed.. We do not do
> errata of errata.

This problem existed prior to and was not introduced by any other erratum,
including 5065.  It's an independent problem.

Should implementers of RFC 6844 follow the current wording - that is,
follow the target of the DNAME specified "at" the label X and do a CAA
lookup there?

> The reason DNAME comes into it is DNSSEC. If you are processing DNSSEC
> they can be signed. So any description has to cope with that.

Why does RFC 6844 need to get into the details of how DNAMEs are
validated?  It doesn't specify every other minute detail of how DNSSEC
works - nor does it need to.

Regards,
Andrew

---

From: "John Levine" <[email-masked]>
Date: 28 Aug 2017 19:00:00 -0000

>follow the target of the DNAME specified "at" the label X and do a CAA

Am I really the only one who looked at that sentence and read its
obvious correct meaning, names that a CNAME or DNAME redirects?

R's,
John

PS: in the legal world, one of the fixed principles of statutory
interpretation is that if a statement has one interpretation that is
sensible and another that is absurd, you use the sensible one and
don't waste time on the absurd one.