Subject: RE: a suggestion for super-wildcards

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 26 Jul 2006 08:12:47 -0700

> [mailto:[email-masked]] On Behalf Of Paul Vixie

> > > E.g., BIND's $GENERATE directive, on steroids.
> > 
> > I'm always puzzled by proposal to add in the DNS things that could 
> > otherwise be implemented by any preprocessor. ...
> 
> me too.  but i do want two new kinds of wildcards, which 
> cannot be done by preprocessors.  see below.  but first:
> 
> > For the same reason, I think that DNAMEs are a bad idea.
> 
> DNAME cannot be accomplished by a preprocessor.
> 
> but two kinds of wildcards which would help SRV a lot and be 
> generally useful, are nonterminal and per-qtype.

Could you elaborate?

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 26 Jul 2006 21:03:33 -0700

> From: [email-masked] [mailto:[email-masked]] 

> 	Did you even read what I proposed?  The above comments indicate
> 	that you didn't or that you failed to understand the proposal.

Yes, I am fully familiar with the limitations of that approach. I was the editor of XKMS which does precisely what you propose.

First you still have the discovery problem for the XKMS service. You have to have a way of discovering the policy service for each DNS node. So you end up with precisely the same set of problems only with SRV records.

Incidentally the same extension should be made to SRV and NAPTR, the idea is that superwildcards should be a generic mechanism applied to ANY prefixed lookup to a node.

If you are going to go find a policy distribution service you might as well retrieve the policy if it is as simple as 'I sign all mail' or 'I send no mail'. 

Clearly there is a balance point, I even propose retrieving longer policies via URL.

Whichever way you go though you need to employ the DNS as the signalling mechanism. There can only be one Internet name space.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 31 Jul 2006 17:13:28 -0700

> From: Doug Barton [mailto:[email-masked]] 

> The main difference I see is that crosses delegation points, 
> which still leads to confusion and problems of the "how did 
> something get into the foo.example.com zone that is not in 
> the foo.example.com zone file?" variety, although in the more 
> limited form that you describe, those questions may be in the 
> "trainable" category.

It doesn't. Not unless you can explain to me how to do that with a macro :-)

The parent zone could send the responses but it would not get asked the question if the requestor had already seen the delegation.

> > The folk who have done the empirics on this disagree.
> 
> Can you give some references? I'd love to educate myself more 
> on this topic.

Its mostly on the DKIM list I am afraid, not collected in a coherent way.

> >>> 1) Define a 'wilder card' ** that matches a node if the
> >> result would
> >>> otherwise be NO-DATA and which acts on subdomains as well
> >> As I said above, I do not support the latter in the way 
> that you are 
> >> proposing it.
> >> 
> >>> From a protocol point of view I think that we should do the
> >> first in
> >>> any case since it will ease the transition from non-compliant 
> >>> wildcards to compliant wildcards when DNSSEC is in use.
> >> Can you please flesh this out a bit, preferably with examples?
> 
> Did you intend to fill something in here?

Windows DNS already uses loose wildcards. If the cost of deploying dnssec is to redefine existing macros then dnnsec is a harder sell.

> > If you have fifty odd hosts this is a PITA.
> 
> Thanks, I'm glad to see that on this point at least I 
> understood you clearly. I solved this problem a long time ago 
> with preprocessors, so I stopped caring. :)

The idea here is to istitutionalize the principle of doing so.

> > So some DNS servers actually
> > specify wildcard semantics that have a looser match.
> 
> Which DNS servers?

Windows DNS, djbdns.