Subject: Re: Any decision on wildcard CNAME ?

From: [email-masked] (Ted Lindgreen)
Date: Sun, 12 Oct 2003 19:21:23 +0200

[Quoting masataka ohta, on Oct 12, 15:12, in "Re: Any decision on  ..."]

> > Second best is make it work, provided that does not further
> > complicate DNSSEC.  Leaving it inconsistent will make
> > implementing DNSSEC very difficult if not impossible.
> 
> My understanding is that the issue is orthogonal to DNSSEC complexity.

Then I am probably missing something. Please enlighten us on what
algoritme to use to prove correctness or non-existence of an RR
derived from expansion of a wildcard CNAME with its current definition?
We have great problems with this now, and want to get on with our work.

-- ted

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Mon, 13 Oct 2003 08:29:20 +1000

> We have great problems with this now, and want to get on with our work.
 
	You prove wildcard CNAMEs exactly the same way that you prove
	wildcard A records.

	Verify the name does not exist. (NSEC)
	Verify that expanded owner name matches the signature. (RRSIG).

	Banning records actually introduces MORE work for DNSSEC.  You
	then have to check that you are not receiving a banned record.
	
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Robert Elz <[email-masked]>
Date: Mon, 13 Oct 2003 19:52:14 +0700

Date:        Mon, 13 Oct 2003 08:29:20 +1000
    From:        [email-masked]
    Message-ID:  <[email-masked]>

  | 	Banning records actually introduces MORE work for DNSSEC.  You
  | 	then have to check that you are not receiving a banned record.

I have heard a similar sentiment (expressed in a different way) in
private mail (which I would prefer not to receive - everyone send opinions
to the list - unless you have an editorial not in the document)
though, which suggests that perhaps a clarification of the option
might be in order.

I'm not certain this is what Olaf had in mind when he suggested
this, but my impression of what "banning" the records would do
isn't quite like that.

That is, I don't think it is reasonable (or probably even possible)
to outlaw the transmission of a CNAME record that was constructed from
a wildcard, nor to force servers to barf on such things - as they might on
an RR like

	name IN A 1.2.3.4.5

but that making it illegal would be specified something like is currently
done when specifying that having the RDATA in an NS record be a CNAME
is illegal.

That is, if you do that, the server, caches, resolvers, may do anything
that like with your data, treat the record as if it doesn't exist, treat
it as if it does, with almost any meaning they like ... so just "don't
do that".

That is, provided we make it clear that a wildcard CNAME record isn't
something that should be expected to exist, and is not intended to be
handled (in any way at all), what implementations actually do should
one be found, is entirely their business - including "let's try and
make it work", "BARF loading the zone file and refuse to accept it",
"do according to what appears to be the strict interpretation of the
algorithm in 3.4.2 of 1034", or almost anything else (dumping core is
not included though...)

What effect that might have on the DNSSEC algorithms, especially wrt
non-existence, I have no idea.

kre