• no (unregistered)
    Comment held for moderation.
  • (nodebb)

    The problem isn't, as such, people failing to distinguish between "flag in bit zero, zeroes in all other bits" versus "octet that is the whole flag".

    No, it is "bit zero is on the left (most significant bit)" versus "bit zero is on the right (least significant bit)". With a bit (sorry) of the first part mixed in. Then again, we cannot tell whether the programmer is confused on "which end is bit zero" or confused on "is it a bitflag with zero on the left or is it a whole zero/one field taking the whole octet".

    And don't forget the other two definitions of bit numbers in octets: bits are numbered 1 to 8 with 1 on the left versus 1 on the right, so there's no "bit zero" at all. In the past (much less today), all four schemes (0-7, 7-0, 1-8, 8-1) have been used, usually depending on the vendor that's providing the bitfields in question.

    I personally prefer 7-0 (0 is LSB) because 1 << bitnumber directly gives the right value, but https://datatracker.ietf.org/doc/html/rfc1035 says that for RFC purposes, it's 0-7 (0 is MSB). :(

  • no (unregistered) in reply to Steve_The_Cynic
    Comment held for moderation.
  • klinsten1 (github)

    i find this a bit confusing

  • some guy (unregistered)

    what percentage of the people using this field have actually read the RFC? Not many. Probably a number that rounds down to zero, if we're being honest.

    :pendant: depending on whether you're rounding to the nearest 100, this is probably always true.

  • tatoun (unregistered)
    Comment held for moderation.
  • (nodebb) in reply to Steve_The_Cynic

    I think I agree. This is clearly a case of the programmer seeing that you need to set bit 0 of the flags field (8 bits) and not realising that bit 0 is the most significant bit, not the least significant bit. In particular, the paragraph in RFC6844 before the quoted paragraphs says this:

    A CAA RR consists of a flags byte and a tag-value pair referred to as a property. Multiple properties MAY be associated with the same domain name by publishing multiple CAA RRs at that domain name. The following flag is defined:

    Any programmer (many of whom do understand bits, believe it or not) is going to think "bit field". But they are also going to think bit 0 is the LSB unless they are aware that things are done differently in networking.

    Note that later in the RFC in section 5.1 under "syntax" we have this:

    Note that according to the conventions set out in [RFC1035], bit 0 is the Most Significant Bit and bit 7 is the Least Significant

    If you read the whole RFC, you will get it right. However, people clearly don't read the whole RFC.

    I was going to criticise LetsEncrypt for their "work around". but what they do is safer than adhering strictly to the standard. If somebody bodges their CAA record in this way, intending it to be critical, it will still be treated as such instead of having the issuer issue a certificate it shouldn't.

Leave a comment on “A Bit of DNS”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article