Subject: wild cards, CNAMEs and 1034's 4.3.2

From: Edward Lewis <[email-masked]>
Date: Tue, 17 Jun 2003 15:51:25 -0400

The second of three records that have come under question in looking 
at wild cards are CNAME's.  (A DNAME is just a CNAME synthesizer, 
I've already asked about them.)

When noodling over the server algorithm in 1034's 4.3.2, in step 3 we 
come to three steps - a,b and c.

In step 'a' exact matches (QNAME) are considered.  If the matching 
name owns a CNAME, the CNAME is followed.  The outcome of this step 
is either an answer or a CNAME referral.

In step 'b' zone cuts are considered.  All that is returned here are 
NS referrals.

In step 'c' wild card synthesis is considered.  (DNAME's definition 
extends what's in this step.)  If the QNAME can be matched by a wild 
card domain name, an answer is synthesized at this step.

In staring at step c, and looking at some implementations, it seems 
that step c could allow for '* CNAME' as having the same impact as 
'QNAME CNAME' does in step 'a'.  Now, purity to 1034 would say no, 
stop the search once we hit the wild card as the source of the 
answer.  But some are suggesting that we follow the CNAME.

If we follow the CNAME at a wild card, this would change the rule of 
having no more than 2 NXT's in a secured answer.  We'd have one NXT 
for each wild card matched, which maybe a string of '* CNAMEs'.

Here is what one person suggested for step c:

         If the "*" label does exist, look for a CNAME at that node.
         If found and QTYPE doesn't match CNAME, copy the CNAME RR into
         the answer section of the response, using QNAME as the owner
         name, and then change QNAME to the canonical name in the CNAME
         RR, and go back to step 1.  Otherwise, match RRs at the node
         against QTYPE.  If any match, copy them into the answer
         section, but set the owner of the RR to be QNAME, and not the
         node with the "*" label.  Go to step 6.

Any thoughts on this?
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

...as graceful as a blindfolded bull in a china shop...

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Fri, 20 Jun 2003 20:12:15 -0400

>         node with the "*" label.  Go to step 6.

No one has put a reply to this on namedroppers.  I wanted to point this out -

With 1034 as it stands now (amended by DNAME), there will only ever 
be up to two NXT's in the authority section.  One for any negative 
answer and one for the sole possible wild card.

If the above change is made, this limit is removed - since CNAME's at 
wild cards would be 'followed' now, it is possible to perform 
multiple wild card synthesis in chasing an answer.  Each needs an NXT 
(possibly) to prove that the name had to be changed.

Unlike the fear of uncountable NXTs we had before, the limit here is 
1:1 with respect to the number of CNAME "jumps" with the sole legit 
NXT easily identifiable at each "hop."

---

From: [email-masked]
Date: Sun, 22 Jun 2003 08:25:45 +1000

> NXT easily identifiable at each "hop."

	The additional NXT is not a reason to reject this change.

--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]