<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p>We run both 9.18 and 9.20. We currently have servers running:</p>
<blockquote>
<p>9.18.31<br>
9.18.33<br>
9.20.3<br>
9.20.5</p>
</blockquote>
<p>The 9.18 and 9.20 validating resolvers behave differently when
exposed to expired RRSIG records.</p>
<p>Both versions log errors of the type</p>
<p>
<blockquote type="cite">validating transfer3.rastglb.cdc.gov/A:
verify failed due to bad signature (keyid=13215): RRSIG has
expired</blockquote>
but 9.18 goes on to log</p>
<p>
<blockquote type="cite">validating transfer3.rastglb.cdc.gov/A: no
valid signature found</blockquote>
and returns a SERVFAIL</p>
<p>9.20 returns a fully validated response.<br>
</p>
<p>Both servers will return the same set of records (9.18 must be
queried with the +cd flag) when asked:<br>
</p>
<p>
<blockquote type="cite">transfer3.rastglb.cdc.gov. 5 IN
A 198.246.125.128<br>
<br>
transfer3.rastglb.cdc.gov. 5 IN RRSIG A 5 4 5
20250126201505 20241028201505 13215 rastglb.cdc.gov.
Kx+n+gsnq0BSko0tl/B3HftLDp1XtiIyImBnlE/dAWgv8VD8xwq4bPns
CO1R3k3beerK1UB/OpP9VKViRnN+3E4S5fg9vpZOFsDXB4T7PmDg5N12
PwN26IJC8BrvUnqkPFdYEJGzb+orKHZsa949shODtnAVkttC4NsYvIRq MR8=<br>
<br>
transfer3.rastglb.cdc.gov. 5 IN RRSIG A 8 4 5
20250309140556 20241209140556 43989 rastglb.cdc.gov.
XSLHv9vpeY9O0JdfxPzIrkJjU8CkfioV4S0dorRK6GL8DLHjqwpyyM1k
km2MjF/2lXMjAl+D4+QrNhQFfDo50njTbSKfDsDSWUZC/QffESlw6t6x
XdCrShtJ6YVYltK1FgWf5xOepxEFLw0pn7I2ntDmXVLwsNkapdKqGugt vzc=</blockquote>
</p>
<p>But 9.18 appears to stumble, and consider the presence of 13215
to be the end of the validation-road.</p>
<p>I found this in the release notes</p>
<p>
<blockquote type="cite">
<pre> --- 9.18.27 released ---
6374. [bug] Skip to next RRSIG if signature has expired or is in
the future rather than failing immediately. [GL #4586]
</pre>
</blockquote>
</p>
<p>But I'm not sure how to interpret it. Is it saying that GL#4586
has left a bug, and should be corrected as described? or is it
describing the behavior we should see in versions >= 9.18.27 ?<br>
</p>
<pre class="moz-signature" cols="72">--
--
Do things because you should, not just because you can.
John Thurston 907-465-8591
<a class="moz-txt-link-abbreviated" href="mailto:John.Thurston@alaska.gov">John.Thurston@alaska.gov</a>
Department of Administration
State of Alaska</pre>
</body>
</html>