{"action":"created","issue":{"url":"https://api.github.com/repos/APNIC-Labs/draft-kskroll-sentinel/issues/16","repository_url":"https://api.github.com/repos/APNIC-Labs/draft-kskroll-sentinel","labels_url":"https://api.github.com/repos/APNIC-Labs/draft-kskroll-sentinel/issues/16/labels{/name}","comments_url":"https://api.github.com/repos/APNIC-Labs/draft-kskroll-sentinel/issues/16/comments","events_url":"https://api.github.com/repos/APNIC-Labs/draft-kskroll-sentinel/issues/16/events","html_url":"https://github.com/APNIC-Labs/draft-kskroll-sentinel/pull/16","id":309229164,"number":16,"title":"Proposed change to the Preconditions and the description of RFC8145 ","user":{"login":"gih900","id":3879184,"avatar_url":"https://avatars1.githubusercontent.com/u/3879184?v=4","gravatar_id":"","url":"https://api.github.com/users/gih900","html_url":"https://github.com/gih900","followers_url":"https://api.github.com/users/gih900/followers","following_url":"https://api.github.com/users/gih900/following{/other_user}","gists_url":"https://api.github.com/users/gih900/gists{/gist_id}","starred_url":"https://api.github.com/users/gih900/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gih900/subscriptions","organizations_url":"https://api.github.com/users/gih900/orgs","repos_url":"https://api.github.com/users/gih900/repos","events_url":"https://api.github.com/users/gih900/events{/privacy}","received_events_url":"https://api.github.com/users/gih900/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-28T05:47:53Z","updated_at":"2018-03-28T19:35:46Z","closed_at":null,"author_association":"COLLABORATOR","pull_request":{"url":"https://api.github.com/repos/APNIC-Labs/draft-kskroll-sentinel/pulls/16","html_url":"https://github.com/APNIC-Labs/draft-kskroll-sentinel/pull/16","diff_url":"https://github.com/APNIC-Labs/draft-kskroll-sentinel/pull/16.diff","patch_url":"https://github.com/APNIC-Labs/draft-kskroll-sentinel/pull/16.patch"},"body":"The first change is a minor revision to the description of RFC8145 to address a potential ambiguity of the expression\r\n\r\nThe second is more substantive - it reverses the intent of the change made in -09 where the phrase \"irrespective of whether validation was requested\" and instead adds an explicit precondition that the CD bit is not set in the query. This is to ensure that the behaviour of the resolver matches its intended behaviour when the new KSK is installed"},"comment":{"url":"https://api.github.com/repos/APNIC-Labs/draft-kskroll-sentinel/issues/comments/377009227","html_url":"https://github.com/APNIC-Labs/draft-kskroll-sentinel/pull/16#issuecomment-377009227","issue_url":"https://api.github.com/repos/APNIC-Labs/draft-kskroll-sentinel/issues/16","id":377009227,"user":{"login":"gih900","id":3879184,"avatar_url":"https://avatars1.githubusercontent.com/u/3879184?v=4","gravatar_id":"","url":"https://api.github.com/users/gih900","html_url":"https://github.com/gih900","followers_url":"https://api.github.com/users/gih900/followers","following_url":"https://api.github.com/users/gih900/following{/other_user}","gists_url":"https://api.github.com/users/gih900/gists{/gist_id}","starred_url":"https://api.github.com/users/gih900/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gih900/subscriptions","organizations_url":"https://api.github.com/users/gih900/orgs","repos_url":"https://api.github.com/users/gih900/repos","events_url":"https://api.github.com/users/gih900/events{/privacy}","received_events_url":"https://api.github.com/users/gih900/received_events","type":"User","site_admin":false},"created_at":"2018-03-28T19:35:46Z","updated_at":"2018-03-28T19:35:46Z","author_association":"COLLABORATOR","body":"On reflection, I think that the suggestion above to refer to the CD bit in the query is heading down the wrong path. Section 5.8 of RFC6840 states: \"validating resolvers SHOULD only set the AD bit when a response both meets the conditions listed in Section 3.2.3 of [RFC4035], and the request contained either a set DO bit or a set AD bit.\" (Interestingly, it does not mention the CD bit in the query, but thats a different issue and one for DNSSEC, not this sentinel.)\r\n\r\n\r\nHow about changing the first condition frm:\r\n\r\n\"The DNS response is DNSSEC validated, and the result of validation is \"Secure\"\r\n\r\nto:\r\n\r\n\"The DNS response is DNSSEC validated, the result of validation is \"Secure\" and the AD bit is to be set in the response\"\r\n\r\nThis leaves it to other DNSSEC RFCs to precisely define the preconditions as to setting the AD bit in a response, it does not attempt to update those RFCs, nor does it attempt to create a special validation processing path when processing a sentinel query."}}
{"actor":{"display_login":"gih900"}}