1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
|
Response Differences Between
Bind 8.4.4 and NSD 2.0.0.
Daniel Karrenberg <daniel.karrenberg@ripe.net>
Erik Rozendaal <erik@nlnetlabs.nl>
Version: 1.2
Abstract
This note describes observed differences in responses between the DNS
server implementations.
Contents
0. Introduction
0.1 Changes
1. Authoritative Only Differences
1.1 d-bcacheglu - Out-of-Zone Glue
1.2 d-nnocachns - Non Authoritative Answers
2. Bind Bugs
2.1 b-multrrset - Multiple RRSets in Response
2.2 b-rootdot - bind does not return NXDOMAIN on 'root.'
2.3 b-nonxdom - bind misses NXDOMAIN when no zone cut
2.4 n-clrcdbit - NSD clears CD bit in response
3. Functionality Differences
3.1 d-nnotimpny - NSD returns Refused on notify requests
3.2 d-nrefclass - NSD returns Refused on unknown class/type
3.3 d-nonrefut - NSD returns no data on refused update
3.4 d-bindchaos - NSD does not implement the bind. TLD in class CHAOS
4. Design Dependent Differences
4.1 Different Name Encoding
A. Comparison of responses to root queries.
B. Comparison of responses to NL TLD queries.
0. Introduction
The observed differences are described. The names of the differences
refer to the statistics in Appendix A, which describe observations of
the differences in responses to real queries to a root name server and
a TLD name server.
0.1 Changes
Bind 8.3.4 to 8.3.6: The d-bcacheglu, d-nnocachns, and b-multrrset
differences are fixed in bind.
NSD 1.2.2 to 1.4.0-alpha1: NSD now does dynamic name encoding, so the
d-nameencod and d-nameencom differences no longer occur.
1. Authoritative Only Differences
The most frequently occurring differences are due to the fact that NSD
is a true 'authoritative only' server. As such it does not return as
much non-authoritative data as bind8 does. We do not expect these
differences to cause problems in resolvers.
1.1 d-bcacheglu - Out-of-Zone Glue
NOTE: This no longer applies to bind 8.3.6-REL.
Bind8 answers queries for out-of-zone (glue) A RRs
non-authoritatively; NSD does not and provides a referral.
Analysis:
Authoritative only service should not provide non authoritative data.
Example:
bind8: 115 21412 - 1/2/2
A? NS1.FASTSERVER.NL.;
ns1.fastserver.nl. a 80.84.226.95;
fastserver.nl. ns ns1.fastserver.nl.
fastserver.nl. ns ns2.fastserver.nl.;
ns1.fastserver.nl. a 80.84.226.95
ns2.fastserver.nl. a 80.84.226.98;
NSD: 99 21412 - 0/2/2
A? NS1.FASTSERVER.NL.;
fastserver.nl. ns ns1.fastserver.nl.
fastserver.nl. ns ns2.fastserver.nl.;
ns1.fastserver.nl. a 80.84.226.95
ns2.fastserver.nl. a 80.84.226.98;
1.2 d-nnocachns - Non Authoritative Answers
Bind8 answers queries with non-authoritative data; NSD does not and
provides a referral. This also happens on type=ANY queries. In
essence it is the same difference as d-bcacheglue, just differentiated
from glue information for analysis purposes.
Analysis:
Authoritative only service should not provide non authoritative data.
Example:
bind8: 139 25304 - 3/0/3
NS? flightcam.de.;
flightcam.de. ns ns.kdt.de.
flightcam.de. ns ns2.kdt.de.
flightcam.de. ns ns.wtal.de.;
ns.kdt.de. a 195.8.224.1
ns2.kdt.de. a 195.8.224.2
ns.wtal.de. a 212.17.226.130;
NSD:139 25304 - 0/3/3
NS? flightcam.de.;
flightcam.de. ns ns.kdt.de.
flightcam.de. ns ns2.kdt.de.
flightcam.de. ns ns.wtal.de.;
ns.kdt.de. a 195.8.224.1
ns2.kdt.de. a 195.8.224.2
ns.wtal.de. a 212.17.226.130;
2. Bind Bugs
Some differences are due to bind bugs and/or bind answers not
conforming to the Internet standards.
2.1 b-multrrset - Multiple RRSets in Response
NOTE: This no longer applies to bind 8.3.6-REL (and later).
NSD does not send an RRset more than once in a response as per RFC2181
section 5.5.
Bind8 is observed to send the same RRset in both the answer and
Additional sections. This is not conforming to the standard.
Analysis:
NSD answers correctly as per the standard. Some incorrect and
particularly naive resolver implementations could be affected. No
such implementation is known.
Example:
bind8: 24531*- q: A? A.ROOT-SERVERS.NET. 1/4/4
A.ROOT-SERVERS.NET. A 198.41.0.4
ns: ROOT-SERVERS.NET. NS A.ROOT-SERVERS.NET.,
ROOT-SERVERS.NET. NS f.ROOT-SERVERS.NET.,
ROOT-SERVERS.NET. NS j.ROOT-SERVERS.NET.,
ROOT-SERVERS.NET. NS k.ROOT-SERVERS.NET.
ar: A.ROOT-SERVERS.NET. A 198.41.0.4,
f.ROOT-SERVERS.NET. A 192.5.5.241,
j.ROOT-SERVERS.NET. A 198.41.0.10,
k.ROOT-SERVERS.NET. A 193.0.14.129 (178)
NSD: 24531*- q: A? A.ROOT-SERVERS.NET. 1/4/3
A.ROOT-SERVERS.NET. A 198.41.0.4
ns: ROOT-SERVERS.NET. NS A.ROOT-SERVERS.NET.,
ROOT-SERVERS.NET. NS F.ROOT-SERVERS.NET.,
ROOT-SERVERS.NET. NS J.ROOT-SERVERS.NET.,
ROOT-SERVERS.NET. NS K.ROOT-SERVERS.NET.
ar: F.ROOT-SERVERS.NET. A 192.5.5.241,
J.ROOT-SERVERS.NET. A 198.41.0.10,
K.ROOT-SERVERS.NET. A 193.0.14.129 (162)
2.2 b-rootdot - bind does not return NXDOMAIN on 'root.'
Bind does not answer NXDOMAIN on queries for 'root.' while this domain
does not exist in class IN.
Analysis:
Bind has a pseudo domain root. somewhere. NSD does not.
2.3 b-nonxdom - bind misses NXDOMAIN when no zone cut
Bind8 refers to itself if it is asked for an authoritative answer in
cases where there is no zone cut but other data.
Analysis:
A bind bug.
Example:
zone file:
www.pool-effekt 86400 IN A 194.246.96.72
bind8: 82 889 *- 0/1/0
A? pool-effekt.de.;
de. soa dns.denic.de. ops.denic.de. 2002031701 10800 7200 3600000 3600;
NSD: 82 889 *- 0/1/0 NXDOMAIN
A? pool-effekt.de.;
de. soa dns.denic.de. ops.denic.de. 2002031701 10800 7200 3600000 3600;
2.4 n-clrcdbit - NSD clears CD bit in response
NSD clears the CD header-bit in responses, bind copies it from the
query. Security unaware servers should clear this bit as per RFC1035
4.1.1.
This difference no longer occurs with bind 8.4.4 (and maybe earlier
versions).
Analysis:
A bind bug.
3. Functionality Differences
The next group of differences are due to the fact that NSD does not
implement some functionality that is requested. This is a design
choice and should not cause resolver problems at all.
3.1 d-nnotimpny - NSD returns Refused on notify requests
NSD returns NOTIMP to notify operations and does not return the
original query.
Example:
bind8: 29 0 - 0/0/0 notify ServFail
SOA? smgcinc.com.;
NSD: 12 0 *- 0/0/0 notify NotImp;
Analysis:
NSD does not implement Notify and answers accordingly.
3.2 d-nrefclass - NSD returns Refused on unknown class/type
NSD returns the error code REFUSED to queries with an unknown class or
RR type. bind returns SERVFAIL.
Analysis:
This is a permanent error. Interpretation of the protocol standard
differs.
Example:
bind8: 32 1388 - 0/0/0 ServFail
Type0 (Class 256)? 10.225.125.182.;
NSD: 32 1388 - 0/0/0 Refused
Type0 (Class 256)? 10.225.125.182.;
3.3 d-nonrefut - NSD returns no data on refused update
NSD does not return the original message data on refused updates.
Analysis:
Interpretation of the RFCs differs. Original data is not necessary,
dropping it increases DoS resilience.
Example:
bind8: 63 7610 - 1/1/0 update Refused
SOA? .;
doydoy.res.hmc.edu. (class 254) a 192.17.0.1;
doydoy.res.hmc.edu. a 134.173.62.172;
NSD: 12 7610 - 0/0/0 update Refused;
3.4 d-bindchaos - NSD does not implement the bind. TLD in class CHAOS
NSD does not implement the pseudo TLD 'bind' in class CHAOS to make
server characteristics available via the query interface. NSD does
implement the (proposed) 'server' pseudo TLS in class CHAOS instead.
NOTE: This no longer applies to NSD 1.2.3 and later.
4. Design Dependent Differences
This group of differences contains minor variations of responses due
to different design choices. Starting with NSD-1.4.0 there are no
differences due to design choices anymore.
4.1 Different Name Encoding
NOTE: This no longer applies to NSD 1.4.0.
Since NSD pre-computes its answers for efficiency, in a very few cases
its name encoding differs from that generated by bind8. These cases
occur when the parts of the answer can be encoded using parts of the
question.
The different encoding can affect the answer in three different,
increasingly severe ways.
- same response (d-nameencod)
The content of the response is exactly the same, just encoded
differently. The only effect of this is a slightly increased length
of the response. In our observations the total output bandwidth
increase caused by this is negligible. It is shown as "Added Bytes:"
in the comparisons.
- same answer (d-nameencom)
The answer is the same; the additional section is shortened by one
or more RRsets. This may cause some loss of optimization in
resolvers that may need additional queries to obtain some of the
omitted information. Note again that the answer is fully
transmitted and thus the 'truncated answer' bit is not set. The
total number of omitted RRs is noted in the comparisons. We have
only observed this when responding to queries for unusually long
names. The maximum omission observed was 1 RR.
Note that beginning with NSD 1.1.0 this difference has not occurred
in the traces we've used to compare BIND and NSD.
- truncated answer
This is when the answer would be truncated and the 'truncated
answer' bit set. We have not observed this at all.
Analysis:
This is an expected differences caused by design choices.
Appendix A
Comparison of responses to root queries:
--------------------------------------------------------------------------
Total Answers: 899262
Skipped ambiguous changes: 34 / 0.00%
--------------------------------------------------------------------------
d-nrefclass 254 / 0.03%
d-nnotimpup 55 / 0.01%
parseerror 28 / 0.00%
d-nnotimpny 4 / 0.00%
other 2 / 0.00%
--------------------------------------------------------------------------
Total Different Responses 343 / 0.04%
==========================================================================
d-nnotimpny - nsd returns NotImp on notify requests: 4 / 1.17%
d-nnotimpup - nsd returns NotImp on update requests: 55 / 16.03%
d-nrefclass - nsd returns Refused on unknown class/type: 254 / 74.05%
other - Unknown Differences: 2 / 0.58%
parseerror - Could not parse tcpdump output correctly: 28 / 8.16%
--------------------------------------------------------------------------
Total Differences 343 /100.00%
==========================================================================
Appendix B
Comparison of responses to NL TLD queries:
--------------------------------------------------------------------------
Total Answers: 71178
Skipped ambiguous changes: 1901 / 2.67%
--------------------------------------------------------------------------
d-nnotimpup 1925 / 2.70%
d-nnotimpny 270 / 0.38%
--------------------------------------------------------------------------
Total Different Responses 2195 / 3.08%
==========================================================================
d-nnotimpny - nsd returns NotImp on notify requests: 270 / 12.30%
d-nnotimpup - nsd returns NotImp on update requests: 1925 / 87.70%
--------------------------------------------------------------------------
Total Differences 2195 /100.00%
==========================================================================
|
