Subject: RE: I-D ACTION:draft-iab-dns-choices-00.txt

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 18 Oct 2004 10:07:47 -0700

> -----Original Message-----
> From: Alex Bligh [mailto:[email-masked]]
On 15 October 2004 12:38 -0700 "Hallam-Baker, Phillip" 
> <[email-masked]> wrote:
> 
> > *   The current wildcard, if www.example.com exists the
> >     wildcard *.example.com will NOT match for ANY record.
> >
> > *?  The wildcard people think they have and mostly want,
> >     TXT/*.example.com will match iff www.example.com exists
> >     but has no other TXT record.
> Does the latter (*?) actually need any protocol-level specification?
> 
> By which I mean is it not possible to
> a) On a strictly conformant server, emulate *? with a macro 
> (or similar),

All that is required is to document the wildcard usage and to define
an interchange format for it so that it can be used in zone transfers
and an appropriate NXT/NSEC usage.

The same applies for mid-level wildcards, _marid.*.example.com. It is not
rocket science.

I find it objectionable that we have people saying that the only
alternatives that can be considered here are prefixes without
wildcards or waiting for DNSEXT to deploy. There has been a real
alternative on the table that makes prefixes work as well as
new RRs but with a significantly lower impact on the deployed
infrastructure. Only parties that need wildcards need to upgrade
their servers.

I propose that the draft authors be asked to address these issues.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Robert Elz <[email-masked]>
Date: Tue, 19 Oct 2004 02:21:27 +0700

Date:        Mon, 18 Oct 2004 10:07:47 -0700
    From:        "Hallam-Baker, Phillip" <[email-masked]>
    Message-ID:  <[email-masked]>

  | > By which I mean is it not possible to
  | > a) On a strictly conformant server, emulate *? with a macro 
  | > (or similar),
  | 
  | All that is required is to document the wildcard usage and to define
  | an interchange format for it so that it can be used in zone transfers
  | and an appropriate NXT/NSEC usage.

The point is that there's no need for that - if we know what names exist
(which seems to be the case "people" actually want) then it's trivial
to pre-process the zone file and include whatever records that are wanted.

That is, the only issue here is saving typing time in the zone file,
which is a fine goal, but needs exactly no changes to the DNS to
satisfy (doesn't even require changes to DNS server implementations,
all of this can be done with a preprocessor tool, perhaps something
similar to the dns zone signer application(s)).

  | The same applies for mid-level wildcards, _marid.*.example.com. It is not
  | rocket science.

When you start looking at the the corner cases that need to be dealt with
to really make that work (cases which perhaps don't matter much to most
practical uses, but which need to be defined if anything like this was
to be added) you'll find that it isn't nearly as simple as it seems (to
even just be explicit about what this is really intended to mean, let
alone how to specify that precisely).

kre

---

From: Mark Andrews <[email-masked]>
Date: Tue, 19 Oct 2004 07:58:01 +1000

> infrastructure. Only parties that need wildcards need to upgrade

	What happens when you have a thousand such records for
	different protocols.  You then have to find each and every
	potential LHS and try to match those against the query.

	THIS DOES NOT SCALE.
 
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]