From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ie0-x231.google.com (mail-ie0-x231.google.com [IPv6:2607:f8b0:4001:c03::231]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id 27FBE21F29A for ; Thu, 24 Apr 2014 03:49:59 -0700 (PDT) Received: by mail-ie0-f177.google.com with SMTP id rl12so2075187iec.8 for ; Thu, 24 Apr 2014 03:49:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Q0WpztVXBOKMNAdpvjO+fCR2Qh7FkPCnlzm6P7+HYBA=; b=xno+6PdPrM9AVJGj9xjSbcsZKrMPVYhH/uU9GgdnVTemdl0BzqvTaYtTJf0X7pol0u K8OmQ4D0T8h0f4+fDsVF44pdb7MtWAGIAv9MrhvbHM+GM6aQavyFpqOODvhQjccwA4yI MkCAN7kxbgtUts30EQICrmnv38ah7FJCmT43wTvvhqPht8Ff2drpodX4O0HxbBa2SAyz iFeqT0l3hhV+gY0U03595ItlJkrC3RC9Ij1ERJZ0AkJL8Dejo+rEc4uqN3M7olrwQ8/Q D0uIASWHGtjH9ElYa1H2C15+sKX546TPBn9wTGxYtkc89Lw1IE9qsY90idtg0bN+VrJ+ N1Yg== MIME-Version: 1.0 X-Received: by 10.42.136.130 with SMTP id u2mr896670ict.51.1398336598307; Thu, 24 Apr 2014 03:49:58 -0700 (PDT) Received: by 10.64.238.70 with HTTP; Thu, 24 Apr 2014 03:49:58 -0700 (PDT) In-Reply-To: <5357E336.6070406@thekelleys.org.uk> References: <5357E336.6070406@thekelleys.org.uk> Date: Thu, 24 Apr 2014 12:49:58 +0200 Message-ID: From: Aaron Wood To: Simon Kelley Content-Type: multipart/alternative; boundary=90e6ba6e8c0637f7c504f7c79cd4 Cc: dnsmasq-discuss , cerowrt-devel Subject: Re: [Cerowrt-devel] [Dnsmasq-discuss] more dnssec failures X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Apr 2014 10:49:59 -0000 --90e6ba6e8c0637f7c504f7c79cd4 Content-Type: text/plain; charset=UTF-8 On Wed, Apr 23, 2014 at 5:58 PM, Simon Kelley wrote: > On 23/04/14 16:42, Dave Taht wrote: > > I will argue that a better place to report dnssec validation > > errors is the dnsmasq list. > > > > On Wed, Apr 23, 2014 at 8:31 AM, Aaron Wood wrote: > >> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: query[A] > >> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net from 172.30.42.99 > >> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: forwarded > >> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net to 8.8.8.8 > >> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: dnssec-query[DS] > >> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net to 8.8.8.8 > >> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: forwarded > >> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net to 8.8.4.4 > >> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: forwarded > >> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net to 8.8.8.8 > >> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: reply > >> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net is BOGUS DS > >> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: validation result > is > >> BOGUS > >> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: reply > >> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net is 2.20.28.186 > >> > >> This one validates via verisign, however. > >> > > Something strange in that domain. Turning off DNSSEC with the > checking-disabled bit, the original A-record query is OK .... > Dnsmasq does the DS query next because the answer to the A query comes > back unsigned, so dnsmasq is looking for a DS record that proves this is > OK. It's likely that Verisign does that top-down (starting from the > root) whilst dnsmasq does it bottom up. Hence Verisign never finds the > broken DS, whilst dnsmasq does. > > That's as good an analysis as I can produce right now. Anyone who can > shed more light, please do. > > (And yes, please report DNSSEC problems on the dnsmasq-discuss list for > preference.) > This is still persisting (and it appears to be blocking a bunch of Apple software update functions). From your comments, Simon, it sounds like you think this is an Akamai issue, and should be reported to them? Thanks, Aaron --90e6ba6e8c0637f7c504f7c79cd4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable



On Wed, Apr 23, 2014 at 5:58 PM, Simon Kelley <= ;simon@thekell= eys.org.uk> wrote:
On 23/04/14 16:42, Dave Taht= wrote:
> I will argue that a =C2=A0better place to report =C2=A0dnssec =C2=A0va= lidation
> errors is the dnsmasq =C2=A0list.
>
> On Wed, Apr 23, 2014 at 8:31 AM, Aaron Wood <woody77@gmail.com> wrote:
>> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: query[A]
>> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net from= 172.30.42.99
>> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: forwarded
>> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net to 8= .8.8.8
>> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: dnssec-query[DS]
>> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net to 8= .8.8.8
>> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: forwarded
>> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net to 8= .8.4.4
>> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: forwarded
>> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net to 8= .8.8.8
>> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: reply
>> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net is B= OGUS DS
>> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: validation result is
>> BOGUS
>> Wed Apr 23 15:13:05 2014 daemon.info dnsmasq[29719]: reply
>> e3191.dscc.akamaiedge.net.0.1.cn.akamaiedge.net is 2= .20.28.186
>>
>> This one validates via verisign, however.
>>

Something strange in that domain. Turning off DNSSEC with the
checking-disabled bit, the original A-record query is OK
= =C2=A0=C2=A0
....
=C2=A0
Dnsmasq does the DS query next because the answer to the A query comes
back unsigned, so dnsmasq is looking for a DS record that proves this is OK. It's likely that Verisign does that top-down (starting from the
root) whilst dnsmasq does it bottom up. Hence Verisign never finds the
broken DS, whilst dnsmasq does.

That's as good an analysis as I can produce right now. Anyone who can shed more light, please do.

(And yes, please report DNSSEC problems =C2=A0on the dnsmasq-discuss list f= or
preference.)

This is still persisting (= and it appears to be blocking a bunch of Apple software update functions). = =C2=A0From your comments, Simon, it sounds like you think this is an Akamai= issue, and should be reported to them?

Thanks,
Aaron
=C2=A0
--90e6ba6e8c0637f7c504f7c79cd4--