Subject: wrt comparison of dns names

From: =JeffH <[email-masked]>
Date: Mon, 08 Jun 2009 15:34:17 -0700

a sub-topic of the -tls-server-id-check thread(s) is one of "comparison of dns 
names" (aka "comparison of domain names", "domain name comparison", "domain 
name match(ing)", "domain-match{es,ing}", etc.).

A specfic example is Section 3.1 "Comparison of DNS Names" in 
draft-saintandre-tls-server-id-check-00.

FWIW, I have searched pretty high and fairly low and not found a comprehensive 
approach to this "Comparison of DNS Names" thing, but a fair number of somewhat 
specific approaches, e.g. in addition to the above there's at least: in 
RFC52080 section 4.2.1.10.  Name Constraints, RFC2109 section 2. Terminology, 
RFC2965 Terminology, RFC2818 section 3.1.  Server Identity, to some extent 
section 7.  Processing Rules for Internationalized Names of RFC5280.

My particular application having a client that needs to extract the dns name 
from an incomming message, and then look it up in a client-maintained cache to 
see if we've "seen" it before, and also that any.subdomain.domain.tld matches 
an entry for domain.tld (eg a form of "wildcarding" is in effect).

I can certainly write the algorithm sorta yet again for my particular case, but 
having one that is a shared resource at the spec level that one could reference 
might be a good thing too.

Have I missed it, does such exist?

thanks,

=JeffH

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 08 Jun 2009 17:42:39 -0500

=JeffH wrote:
> a sub-topic of the -tls-server-id-check thread(s) is one of "comparison 
> of dns names" (aka "comparison of domain names", "domain name 
> comparison", "domain name match(ing)", "domain-match{es,ing}", etc.).
> 
> FWIW, I have searched pretty high and fairly low and not found a 
> comprehensive approach to this "Comparison of DNS Names" thing, [...]
> I can certainly write the algorithm sorta yet again for my particular 
> case, but having one that is a shared resource at the spec level that 
> one could reference might be a good thing too.
> 

Jeff: We did something similar for sip in domain-certs (see
http://tools.ietf.org/html/draft-ietf-sip-domain-certs-04).
Specifically, S7.1 talks about finding the value in SAN, S7.2
talks about matching the values, including wild-carding,
and so on.

domain-certs has been through WGLC in the SIP WG and was
influenced heavily by input from the PKIX WG.  It is making
its way to the IESG right now.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
Web:   http://ect.bell-labs.com/who/vkg/