Subject: question about "what is a legal name?"

From: Edward Lewis <[email-masked]>
Date: Tue, 1 Jun 2004 09:27:11 -0400

In the MARID WG, there is consideration being given to names such as 
the following:

    _marid.*.foo.com.

I've been saying that the name above is not legal, based on the words 
in RFC 1034, section 4.3.3 that define wild cards.  One answer I have 
received is that the above name is not a wild card, hence the 
restrictions that no "*" appear in the <domain> there is not valid.

I'd like to hear from others on this, whether the above name is legal 
or not, whether there is an interoperability issue stemming from the 
the lack of clarity in the documents.

Here's my take.  Looking at the tree of labels, I'm going to add 
a.foo.com and c.foo.com, leaving b.foo.com out.

           .
           |
          com
           |
          foo--------------------
           |     |             |
           *     a(.foo.com)   c(.foo.com)
           |
        _marid

What happens when a query arrives for b.foo.com?

I think the intent in the specs is to not use *.foo.com. as a "wild 
card".  From the definition of a wild card as "*.<domain without *>", 
I think the server ought not synthesize from that record.  This 
implies that the algorithm of "find the closest encloser, which is 
foo.com, and use the '*' labelled child for synthesis" has to be 
amended to watch out for '*' with children.

Another issue I can see of permitting such names is to start with 
just "*.foo.com." and not the "_marid" label.  Assuming the 
administrator is expecting "*.foo.com." to be a wild card, what 
happens when some one adds, via dynamic update, the label "_marid" 
below that domain?  Should this addition be barred from dynamic 
update?

These are two "corner cases" that arise from mid-tree * labels. 
Perhaps implementors feel that there's a way around this by adding 
flag bits on the labels or by implementing more rules for processing, 
but my *opinion* is that such names ought to be considered bad ju-ju.

(Note: I'm neglecting the "why" of even thinking of such a name.)
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

Even the voices inside my head are refusing to talk to me anymore.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 02 Jun 2004 11:23:43 +0900

Edward Lewis wrote:

> I've been saying that the name above is not legal, based on the words in 
> RFC 1034, section 4.3.3 that define wild cards.  One answer I have 

The text in 1034 allows for names like:

	_marid.*.foo.com

but not

	*.*.foo.com

nor

	_marid.*.*.foo.com

See below on why the latter is illegal.

> card".  From the definition of a wild card as "*.<domain without *>", I 
> think the server ought not synthesize from that record.

According to the explicit text of 1034, your guess is invalid.

According to 1034;

   The contents of the wildcard RRs follows the usual rules and formats for
   RRs.

the consequence of "_marid.*.foo.com" without explicit
"*.foo.com" is that the node "*.foo.com" does exist with
no data. NODATA will be answered to a query of "*.foo.com".

As 1034 says:

   A * label appearing in a query name has no special effect, but can be
   used to test for wildcards in an authoritative zone;

the implicit "*.foo.com" must be treated as wildcard with no data.

Does the behaviour satisfy requirements of the person in the MARID WG?

> what happens when some one adds, via dynamic update, the label
> "_marid" below that domain?

It has nothing to do with dynamic update. The result of dynamic update
will be that such a node had existed from the beginning.

							Masataka Ohta

---

From: Edward Lewis <[email-masked]>
Date: Tue, 1 Jun 2004 22:49:52 -0400

>See below on why the latter is illegal.

I missed why the latter is illegal, given that the first is okay.

Do you mean that there can be only one "*" in a name?  And that only 
if it is the least significant label does the name cause synthesis?

>no data. NODATA will be answered to a query of "*.foo.com".

What if there is data at *.foo.com.?  Is _marid.*.foo.com still legal?

E.g.:

     *.foo.com.           MX   10 host1.foo.com.
     _marid.*.foo.com.    TXT  "something important"

>Does the behaviour satisfy requirements of the person in the MARID WG?

Dunno...

---

From: Kevin Darcy <[email-masked]>
Date: Tue, 01 Jun 2004 23:03:27 -0400

Edward Lewis wrote:

> Do you mean that there can be only one "*" in a name? And that only if 
> it is the least significant label does the name cause synthesis?
>
>> According to 1034;
>>

I would think so. The existence of the _marid child should have no 
effect on the functioning of *.foo.com as a "default match", whether 
that match results in a wildcard synthesis, if one or more appropriate 
RRsets is present, or, if not present, just an early termination of the 
algorithm with a NODATA response.

- Kevin

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 02 Jun 2004 13:02:22 +0900

> I missed why the latter is illegal, given that the first is okay.

I mean "_marid.*.*.foo.com" implies "*.*.foo.com" exist (with no data),
which is illegal.

> it is the least significant label does the name cause synthesis?

Yes.

> What if there is data at *.foo.com.?  Is _marid.*.foo.com still legal?

Yes.

							Masataka Ohta