<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.19088"><LINK rel=stylesheet
href="BLOCKQUOTE{margin-Top: 0px; margin-Bottom: 0px; margin-Left: 2em}"></HEAD>
<BODY style="MARGIN: 10px; FONT-FAMILY: verdana; FONT-SIZE: 10pt">
<DIV><FONT size=2 face=Verdana>
<DIV><FONT size=2 face=Verdana></FONT> </DIV>
<DIV> </DIV>
<DIV><FONT size=3> when I use Unbound as validator to
test opt-out NSEC3, I found that in "wildcard expansion" case, Unbound response
with no AD flags, while in "wildcard no data" case, Unbound response with AD
flags. Is this a inconsistency? According to rfc 5155 "9.2. Use of the AD bit",
AD bit must not be set when response containing NSEC3 RR that covers the "next
closer" name has opt-out bit set.</FONT></DIV>
<DIV> </DIV>
<DIV> <FONT size=3>So maybe in both two cases Unbound
should not set AD bit?</FONT></DIV>
<DIV><FONT size=3></FONT> </DIV>
<DIV><FONT size=3> "wildcard expansion" case query has result
as follows:</FONT></DIV>
<DIV><FONT size=3></FONT> </DIV>
<DIV>
<DIV>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65187</DIV>
<DIV>;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 3</DIV>
<DIV></DIV>
<DIV> </DIV>
<DIV>;; OPT PSEUDOSECTION:</DIV>
<DIV>; EDNS: version: 0, flags: do; udp: 4096</DIV>
<DIV>;; QUESTION SECTION:</DIV>
<DIV>;b.wild.optout.example. IN A</DIV>
<DIV> </DIV>
<DIV></DIV>
<DIV>;; ANSWER SECTION:</DIV>
<DIV>b.wild.optout.example. 300 IN A 10.0.0.6</DIV>
<DIV>b.wild.optout.example. 300 IN RRSIG A 7 3 300 20110806020105 20110707020105 54458 optout.example. Epk2nJ16+JzMZOHVF0qa+65OxttM8pE25l3u+oLoWpPaGgF6udZmJfhU rw8LThrwYhb5JSxCo4jN7Z7LQa9+sVaWbXzKWD5uCbRcnHajV3bCF1vZ F1b0ZZcIfRLj2vOB</DIV>
<DIV></DIV>
<DIV> </DIV>
<DIV>;; AUTHORITY SECTION:</DIV>
<DIV>optout.example. 300 IN NS ns.optout.example.</DIV>
<DIV>optout.example. 300 IN RRSIG NS 7 2 300 20110806020105 20110707020105 54458 optout.example. HTWJ3lVz7+ksF3P/XEj+13JANSofH82mTQnEjBJghKl4NlxwofcB0L2q t468pfUHZFoZ/eQawhCHgJvppPUY3lXmOCMHD6YwwDklnYE5HcaLYnOP LxJK7Xr842o0BXb4</DIV>
<DIV>M4GQOHDDG61QJPFKMEQHRL8IPV8I63E4.optout.example. 3600 IN NSEC3 1 1 10 - QVSNM823Q1GIK9CRGG58TK9AOLCR0DC2</DIV>
<DIV>M4GQOHDDG61QJPFKMEQHRL8IPV8I63E4.optout.example. 3600 IN RRSIG NSEC3 7 3 3600 20110806020105 20110707020105 54458 optout.example. VplQeqb2QF71ZYLBR97H5uyzxuALj1NKcLXtDjFEjOlUjSIohyX3UXZ3 HIqkYm/HhsQ/HyeNHGH4hiCqOYjJnfgxlU67kfwhfr4qrkTYeBDxjTN+ nqJtA39H2YyE/0nt</DIV>
<DIV></DIV>
<DIV> </DIV>
<DIV>;; ADDITIONAL SECTION:</DIV>
<DIV>ns.optout.example. 300 IN A 10.53.0.3</DIV>
<DIV>ns.optout.example. 300 IN RRSIG A 7 3 300 20110806020105 20110707020105 54458 optout.example. cTk09mW73DrFu7LNgt0aMV8E3fgrBLuqADWEbb+ZaygfYJYWNF4Y+q+O 3iHgR6CBmW1soMGobwS8xSgNMTEMtPPKWUtnpESqsCRm48ryA+3+F46R mn2BPmgLF7G6E3Hg</DIV></DIV>
<DIV><FONT size=2 face=Verdana>
<DIV><FONT size=3> </FONT></DIV>
<DIV><FONT size=3></FONT> </DIV>
<DIV><FONT size=3></FONT> </DIV>
<DIV><FONT size=3> "wildcard no data" case as
follows:</FONT></DIV>
<DIV><FONT size=3></FONT> </DIV>
<DIV>
<DIV>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59596</DIV>
<DIV>;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 1</DIV>
<DIV></DIV>
<DIV> </DIV>
<DIV>;; OPT PSEUDOSECTION:</DIV>
<DIV>; EDNS: version: 0, flags: do; udp: 4096</DIV>
<DIV>;; QUESTION SECTION:</DIV>
<DIV>;b.wild.optout.example. IN AAAA</DIV>
<DIV></DIV>
<DIV> </DIV>
<DIV>;; AUTHORITY SECTION:</DIV>
<DIV>M4GQOHDDG61QJPFKMEQHRL8IPV8I63E4.optout.example. 3600 IN NSEC3 1 1 10 - QVSNM823Q1GIK9CRGG58TK9AOLCR0DC2</DIV>
<DIV>M4GQOHDDG61QJPFKMEQHRL8IPV8I63E4.optout.example. 3600 IN RRSIG NSEC3 7 3 3600 20110806020105 20110707020105 54458 optout.example. VplQeqb2QF71ZYLBR97H5uyzxuALj1NKcLXtDjFEjOlUjSIohyX3UXZ3 HIqkYm/HhsQ/HyeNHGH4hiCqOYjJnfgxlU67kfwhfr4qrkTYeBDxjTN+ nqJtA39H2YyE/0nt</DIV>
<DIV>EJ0VQS7A2RURJ4K5QLMURRQQGIG667KK.optout.example. 3600 IN NSEC3 1 1 10 - F1B8R8H9UMD9OS8NH6I63TOO0K39AB11 A RRSIG</DIV>
<DIV>EJ0VQS7A2RURJ4K5QLMURRQQGIG667KK.optout.example. 3600 IN RRSIG NSEC3 7 3 3600 20110806020105 20110707020105 54458 optout.example. AH+FOkZQXf91/tIXbRAuyO98uG3a5kC4A4o7kwzK1XV2PInh6mQD2MsY FkmrRU99EHkrsx8nMCq2p7oq2e2wHmwr7lOD+NrH0CO6QYUjs0TnT83n XLXpcXgn8QdkJ2GS</DIV>
<DIV>optout.example. 300 IN SOA mname1. . 2000042407 20 20 1814400 3600</DIV>
<DIV>optout.example. 300 IN RRSIG SOA 7 2 300 20110806020105 20110707020105 54458 optout.example. w/NZwX4wbCUhX9+oS8AetzARxIYN6JlD5RATXQtHRiG3hnlGAQmf0kcu YmE1VHtPZP99X+kCH6h+CG23Thesy29EdnHKyoAmymyeKRoOtrkC/I9h oPPx4ppfWwsIQ8hS</DIV></DIV></FONT></DIV>
<DIV align=left><FONT color=#c0c0c0 size=2
face=Verdana></FONT> </DIV></FONT></DIV>
<DIV><FONT size=2 face=Verdana></FONT> </DIV>
<DIV align=left><FONT color=#c0c0c0 size=2 face=Verdana>2011-07-07
</FONT></DIV><FONT size=2 face=Verdana>
<HR style="WIDTH: 122px; HEIGHT: 2px" align=left SIZE=2>
<DIV><FONT color=#c0c0c0 size=2 face=Verdana><SPAN>Jia Li</SPAN>
</FONT></DIV></FONT></BODY></HTML>