{"action":"created","issue":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/5074","repository_url":"https://api.github.com/repos/PowerDNS/pdns","labels_url":"https://api.github.com/repos/PowerDNS/pdns/issues/5074/labels{/name}","comments_url":"https://api.github.com/repos/PowerDNS/pdns/issues/5074/comments","events_url":"https://api.github.com/repos/PowerDNS/pdns/issues/5074/events","html_url":"https://github.com/PowerDNS/pdns/pull/5074","id":209630840,"number":5074,"title":"RFC: Allow AXFR of nsec3 narrow zones","user":{"login":"baloo","id":59060,"avatar_url":"https://avatars.githubusercontent.com/u/59060?v=3","gravatar_id":"","url":"https://api.github.com/users/baloo","html_url":"https://github.com/baloo","followers_url":"https://api.github.com/users/baloo/followers","following_url":"https://api.github.com/users/baloo/following{/other_user}","gists_url":"https://api.github.com/users/baloo/gists{/gist_id}","starred_url":"https://api.github.com/users/baloo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/baloo/subscriptions","organizations_url":"https://api.github.com/users/baloo/orgs","repos_url":"https://api.github.com/users/baloo/repos","events_url":"https://api.github.com/users/baloo/events{/privacy}","received_events_url":"https://api.github.com/users/baloo/received_events","type":"User","site_admin":false},"labels":[{"id":37445974,"url":"https://api.github.com/repos/PowerDNS/pdns/labels/auth","name":"auth","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-02-23T01:02:36Z","updated_at":"2017-02-24T18:36:25Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/PowerDNS/pdns/pulls/5074","html_url":"https://github.com/PowerDNS/pdns/pull/5074","diff_url":"https://github.com/PowerDNS/pdns/pull/5074.diff","patch_url":"https://github.com/PowerDNS/pdns/pull/5074.patch"},"body":"I believe it's okay to allow axfr on narrow zone and that it does not\r\nintroduces security problems.\r\n\r\nThe narrow mode will dynamically create a nsec3 range around the\r\nrecord.\r\n\r\nSomething like:\r\n```\r\n$ dig +dnssec aaaab.meeeee.eu.\r\n;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28784\r\n;; AUTHORITY SECTION:\r\nhkvb2h0gtd2nbiuk741aab6cbkl1fsg8.meeeee.eu. 10800 IN NSEC3 1 0 3 EA33014A HKVB2H0GTD2NBIUK741AAB6CBKL1FSGA\r\n```\r\n\r\nIn this example, the hash of `aaaab.meeeee.eu.` is `hkvb2h0gtd2nbiuk741aab6cbkl1fsg9.meeeee.eu`\r\nwhich translate to a NSEC3 record like:\r\n```\r\nhkvb2h0gtd2nbiuk741aab6cbkl1fsg8.meeeee.eu. 10800 IN NSEC3 1 0 3 EA33014A HKVB2H0GTD2NBIUK741AAB6CBKL1FSGA\r\n\\------------------------------/                           \\------------/ \\------------------------------/\r\n                     |                                           |                      |\r\nStart of the range --/                                           |                      |\r\nAlg + Salt (NSEC3PARAM) -----------------------------------------/                      |\r\nEnd of the range   ---------------------------------------------------------------------/\r\n```\r\n\r\nWhile correct, this is not **exact**. The range could be larger than\r\nthat. In my case, the largest range could be:\r\n```\r\nftdcumdfkc5rqsv077mjp9v0bb19c6ev.meeeee.eu. 10800 IN NSEC3 1 0 3 EA33014A I2UF1DNHSOTNACGN056KBFGBFPIICNMG A AAAA RRSIG\r\n```\r\n\r\nBecause `]hkvb2h0gtd2nbiuk741aab6cbkl1fsg8;hkvb2h0gtd2nbiuk741aab6cbkl1fsga[`\r\nis a subset of `]ftdcumdfkc5rqsv077mjp9v0bb19c6ev;i2uf1dnhsotnacgn056kbfgbfpiicnmg[`\r\nboth are correct, the later being the largest range possible.\r\n\r\nThis would make the primary reply differently than a slave. While this\r\nmay looks strange, I believe this is accepted by all the RFC I know.\r\n\r\nNot being 100% sure, I'd prefer to ask. Please let me know if I forgot\r\nsomething or if you'd prefer to hide this under a tunable (a domain\r\nmetadata maybe).\r\n\r\n### Short description\r\n<!-- Write a small description of what this Pull Request fixes or provides, including the issue #s -->\r\n\r\n### Checklist\r\n<!-- please indicate if any of these things are done/included with this Pull Request. Not all boxes need to be checked for the Pull Request to be accepted -->\r\nI have:\r\n- [x] read the [CONTRIBUTING.md](https://github.com/PowerDNS/pdns/blob/master/CONTRIBUTING.md) document\r\n- [x] compiled and tested this code\r\n- [ ] included documentation (including possible behaviour changes)\r\n- [ ] documented the code\r\n- [ ] added or modified regression test(s)\r\n- [ ] added or modified unit test(s)\r\n- [ ] <!-- remove this line if your PR is against master --> checked that this code was merged to master\r\n"},"comment":{"url":"https://api.github.com/repos/PowerDNS/pdns/issues/comments/282368606","html_url":"https://github.com/PowerDNS/pdns/pull/5074#issuecomment-282368606","issue_url":"https://api.github.com/repos/PowerDNS/pdns/issues/5074","id":282368606,"user":{"login":"baloo","id":59060,"avatar_url":"https://avatars.githubusercontent.com/u/59060?v=3","gravatar_id":"","url":"https://api.github.com/users/baloo","html_url":"https://github.com/baloo","followers_url":"https://api.github.com/users/baloo/followers","following_url":"https://api.github.com/users/baloo/following{/other_user}","gists_url":"https://api.github.com/users/baloo/gists{/gist_id}","starred_url":"https://api.github.com/users/baloo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/baloo/subscriptions","organizations_url":"https://api.github.com/users/baloo/orgs","repos_url":"https://api.github.com/users/baloo/repos","events_url":"https://api.github.com/users/baloo/events{/privacy}","received_events_url":"https://api.github.com/users/baloo/received_events","type":"User","site_admin":false},"created_at":"2017-02-24T18:36:25Z","updated_at":"2017-02-24T18:36:25Z","body":"This includes the commit from #5083 which fixes axfr rectify (no nsec3 records for ENT with unsafe DS)"}}
{"actor":{"display_login":"baloo"}}