Skip to content

Rewrite of the specification of DNSSEC03#1189

Merged
matsduf merged 11 commits into
zonemaster:developfrom
matsduf:update-dnssec03
Nov 22, 2023
Merged

Rewrite of the specification of DNSSEC03#1189
matsduf merged 11 commits into
zonemaster:developfrom
matsduf:update-dnssec03

Conversation

@matsduf

@matsduf matsduf commented Jul 28, 2023

Copy link
Copy Markdown
Contributor

Purpose

This is a complete rewrite of the specification for DNSSEC03:

  • Format based on template
  • Updated to match new RFC
  • Extended to check not only iteration value, but also the other parameters in the NSEC3 record.

Context

Resolves #1177, #1047, #1039 and #948. Resolves does not necessarily mean that this PR follow the issues, but when this PR has been completed those issues can be closed.

This PR introduces a new argument name, which means that Argument list must be updated (-> see #1190).

When this PR has been completed, the implementation must also be rewritten.

Test zones are available in #1218.

How to test this PR

Review the specification.

@matsduf matsduf added the A-TestCase Area: Test case specification or implementation of test case label Jul 28, 2023
@matsduf matsduf added this to the v2023.2 milestone Jul 28, 2023
@matsduf matsduf requested review from a user, hannaeko, marc-vanderwal, mattias-p and tgreenx July 28, 2023 13:36
matsduf added a commit to matsduf/zonemaster that referenced this pull request Jul 30, 2023

@tgreenx tgreenx left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The specification reads well and I have not found any errors in the Test Procedure.

Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated

@matsduf matsduf left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tgreenx, thanks for your review!

Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
@matsduf matsduf requested a review from tgreenx August 1, 2023 11:06
tgreenx
tgreenx previously approved these changes Aug 2, 2023
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
@matsduf

matsduf commented Aug 2, 2023

Copy link
Copy Markdown
Contributor Author

@mustafa-alrifaee writes in #1177 (comment):

Regarding the new modification on the test case DNSSEC03, what is the expected behavior now if the NSEC3 Parameter Settings in the zone do not comply with RFC 9276? Will it trigger a warning? Does it make sense for the recommendation to be just a warning without failing the test?

Both non-zero iteration and non-empty salt will result in message tags (DS03_ILLEGAL_ITERATION_VALUE and DS03_ILLEGAL_SALT_LENGTH, respectively) have ERROR level as default values according to the proposal.

@mustafa-alrifaee, doesn't that meet your proposal?

tgreenx
tgreenx previously approved these changes Aug 2, 2023
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
marc-vanderwal
marc-vanderwal previously approved these changes Sep 13, 2023
@matsduf

matsduf commented Oct 25, 2023

Copy link
Copy Markdown
Contributor Author

However, as discussed in the last F2F, before we merge we should also have the specification of test zones (here or in another PR) for this Test Case.

Test zones are now available in #1218.

@matsduf

matsduf commented Oct 25, 2023

Copy link
Copy Markdown
Contributor Author

@tgreenx, please re-review this and #1218.

tgreenx added a commit to tgreenx/zonemaster-engine that referenced this pull request Nov 15, 2023
Follows speficiation update (zonemaster/zonemaster#1189).
Note that Prefix Suffix List check (step 13.2.2.1) is not yet implemented, as this service is not yet provided by Zonemaster.
tgreenx added a commit to tgreenx/zonemaster-engine that referenced this pull request Nov 15, 2023
Follows specifiation update (zonemaster/zonemaster#1189).
Note that Prefix Suffix List check (step 13.2.2.1) is not yet implemented, as this service is not yet provided by Zonemaster.

Also note that this commit does not update unit tests yet.
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md
tgreenx added a commit to tgreenx/zonemaster-engine that referenced this pull request Nov 16, 2023
Follows specifiation update (zonemaster/zonemaster#1189).
Note that Prefix Suffix List check (step 13.2.2.1) is not yet implemented, as this service is not yet provided by Zonemaster.

Also note that this commit does not update unit tests yet.
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
tgreenx
tgreenx previously approved these changes Nov 21, 2023
Comment thread docs/public/specifications/tests/DNSSEC-TP/dnssec03.md Outdated
@tgreenx tgreenx self-requested a review November 21, 2023 17:23
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
@matsduf

matsduf commented Nov 21, 2023

Copy link
Copy Markdown
Contributor Author

@tgreenx and @marc-vanderwal, please re-review.

@marc-vanderwal marc-vanderwal left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me!

@matsduf matsduf merged commit c85ca49 into zonemaster:develop Nov 22, 2023
@matsduf matsduf deleted the update-dnssec03 branch November 22, 2023 09:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-TestCase Area: Test case specification or implementation of test case

Projects

None yet

Development

Successfully merging this pull request may close these issues.

support RFC 9276-guidance for NSEC3 in DNSSEC03 testcase Update DNSSEC03 Missing case in DNSSEC03 NSEC3 iterations

3 participants