Subject: wildcards and CNAMEs

From: [email-masked]
Date: Wed, 12 Jun 2002 13:39:57 +1000

I suspect no one though people would want to use a CNAME
	wildcard record when RFC 1034 was written.

	The problem is that CNAMEs are not illegal with wildcard
	records and depending upon how you interperet RFC 1034
	Section 4.3.2 Step 3 and the query type you can get wildcard
	CNAMES records being honored or ignored.

	If you make a query with a type CNAME quite clearly they
	are supposed to match.  If you make a query with type !=
	CNAME there is ambiguity.  If you don't match you then get
	the situation where a cache will return different results
	depending upon whether there was a cached CNAME record or
	not.

	Currently different implementation match/don't match the
	wildcard CNAME record when the query type != CNAME.

	Mark
-- 
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE:	+61 2 9871 4742		         INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alexis Yushin <[email-masked]>
Date: Wed, 12 Jun 2002 14:39:30 +0200 (CEST)

Mark,

>	depending upon whether there was a cached CNAME record or

It is not clear to me where you base your conclusion upon that
wildcard CNAMEs can be ignored? Once you matched the wildcard for
whatever query type and found a CNAME, I would expect the implementation
to restart the query.

Are you trying to point out at the flow ambiguity where 3.a implicitly
states that a whole QNAME has to be matched in order to restart the
query with CNAME and that 3.a preceeds 3.c?

Common sense tells me that once a query resolved to CNAME it should be
restarted with the QNAME in the CNAME whether the CNAME owner name
was wildcard or not. Is there some problem I'm missing here?

Alexis

---

From: [email-masked]
Date: Thu, 13 Jun 2002 00:34:54 +1000

> was wildcard or not. Is there some problem I'm missing here?

            If the "*" label does exist, match RRs at that node
            against QTYPE.  If any match, copy them into the answer
            section, but set the owner of the RR to be QNAME, and
            not the node with the "*" label.  Go to step 6.

	The question is does "match RRs at that node against QTYPE"
	match the CNAME record when QTYPE != CNAME.  When read in
	conjuction with the description earlier in the section it
	has been argued that it doesn't as CNAME is explicitly
	mentioned to be looked for when a match fails.

            If the data at the node is a CNAME, and QTYPE doesn't
            match CNAME, copy the CNAME RR into the answer section
            of the response, change QNAME to the canonical name in 
            the CNAME RR, and go back to step 1.

	There is atleast one implementation where the match is not
	made so this is not a academic issue.  The same zone produces
	different results in different implementations.
	
	Mark

---

From: Alexis Yushin <[email-masked]>
Date: Wed, 12 Jun 2002 16:57:17 +0200 (CEST)

I see what you mean. Common sense tells me that the 

needs to be extended with 3.a:

		if the match fails and...

My arguement is that wildcards have to do with matching the domain
name and CNAME's with matching the query type and should not affect
each other. Once a wildcard was found it should be resolved exactly
the same way as if a whole domain name was found.

Side issue, is using wildcards with referrals specifically forbidden?
I believe so but cant find the reference.

Alexis

---

From: [email-masked]
Date: Thu, 13 Jun 2002 01:22:59 +1000

> the same way as if a whole domain name was found.

	Which is what named does.

---

From: Paul Vixie <[email-masked]>
Date: Wed, 12 Jun 2002 08:27:25 -0700

> each other.  ...

CNAME affects name lookup, as does wildcard processing, and they interact.

> I believe so but cant find the reference.

NS also affects name lookup, and occurs "earlier than" wildcard processing
such that you don't check for the presence of wildcards until after you
know what zone you're in.  [RFC2181 6] clarifies this somewhat -- a "*"
label would be inside the zone and below the zone cut, and would not be
seen in the parent zone even if present, and would thus have no meaning.

---

From: Alexis Yushin <[email-masked]>
Date: Wed, 12 Jun 2002 17:48:01 +0200 (CEST)

>CNAME affects name lookup, as does wildcard processing, and they interact.

Really? Just kidding. What I meant is that either not clearly explained
in 1034 the lookup algorithm is in fact consist of (at least) two major
steps:

1) search for the queried domain name: either complete match, referral,
wildcard or authoratively not found.

2) search for the queried type: either not found (empty answer section),
found or cname.

It always happens in the same order. Once you resolved the domain name
you have an answer, either of listed in 2. If you resolved it to cname,
dname or God knows what else the followup standards may come up with you
may have to restart the query, but once again you will be doing first
step 1 and then step 2.

>seen in the parent zone even if present, and would thus have no meaning.

What I meant was if it is implicitly forbidden to:

*.customers.com.	IN	NS	ns1.servers.net.

It doesnt make sense to me but we're talking about RFC's here.

Alexis