Subject: [dnsext] Case sensitivity of RDATA in PTR records

From: Vithalprasad Gaitonde <[email-masked]>
Date: Mon, 2 Sep 2013 18:13:43 +0000

Is a DNS server expected to preserve the case of domain names in resource record data of PTR records.

As per RFC 4343 - Domain Name System case insensitivity clarification<http://tools.ietf.org/html/rfc4343>, section 4 says -
While ASCII label comparisons are case insensitive, [STD13<http://tools.ietf.org/html/rfc4343#ref-STD13>] says case MUST be preserved on output and preserved when convenient on input.

But RFC RFC2535 - Domain Name System Security Extensions  section 8.1 says -
8.1 Canonical RR Form

   For purposes of DNS<http://www.bind9.net/rfc> security, the canonical form for an RR is the
   wire format of the RR with domain names (1) fully expanded (no name
   compression via pointers), (2) all domain name letters set to lower
   case, (3) owner name wild cards in master file form (no substitution
   made for *), and (4) the original TTL substituted for the current
   TTL.

RFC 3597 mentions
DNSSEC<http://www.dnssec.net/> Canonical Form and Ordering

   DNSSEC<http://www.dnssec.net/> defines a canonical form and ordering for RRs [RFC 2535<http://www.rfc-archive.org/getrfc.php?rfc=2535>]
   (section 8.1).  In that canonical form, domain names embedded in the
   RDATA are converted to lower case.

Are these standards contradicting vis-à-vis case (in)sensitivity of domain names. Or is the canonical form definition only  for constructing SIG RRs as mention in RFC 2535 section 8 -
"A canonical form and ordering within an RRset is necessary in consistently constructing and verifying SIG RRs"

Thanks,
Prasad

---

From: Mark Andrews <[email-masked]>
Date: Tue, 03 Sep 2013 09:26:08 +1000

In message <[email-masked]>, Vi
thalprasad Gaitonde writes:
> As per RFC 4343 - Domain Name System case insensitivity
> clarification<http://tools.ietf.org/html/rfc4343>, section 4 says -
> While ASCII label comparisons are case insensitive,
> [STD13<http://tools.ietf.org/html/rfc4343#ref-STD13>] says case MUST be
> preserved on output and preserved when convenient on input.
>
>    DNSSEC<http://www.dnssec.net/> defines a canonical form and ordering
> for RRs [RFC 2535<http://www.rfc-archive.org/getrfc.php?rfc=2535>]
> Are these standards contradicting vis-a-vis case (in)sensitivity of
> domain names. Or is the canonical form definition only  for constructing
> SIG RRs as mention in RFC 2535 section 8 -
> "A canonical form and ordering within an RRset is necessary in
> consistently constructing and verifying SIG RRs"

No, they are not contadictory.  For the purposes of sorting the
for records "B.example", "a.example", "[.example" and "C.example"
sort like this for:

	DNSSEC order:
		[.example
		a.example
		B.example
		C.example

Note case is preserved.

For comparison 
	ASCII order:
		B.example
		C.example
		[.example
		a.example

When signing or verifing you treat "B.example" as if it had been entered as
"b.example".

When transfering a zone. You look for a previous "B.example" (after
expanding compression pointers) if you have a record with "B.example"
in it when generating the compression pointer.  You do NOT look for
"b.example".  If you can't find "B.example", you add the label "B"
then look for "example" not "EXAMPLE" or "ExAmPlE".

Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Vithalprasad Gaitonde <[email-masked]>
Date: Tue, 3 Sep 2013 16:14:55 +0000

Thanks Mark for the clarification

Is DNS server expected to preserve case of the domain name in PTR RDATA.

For example - if a PTR record was created as follows -
1.0.0.10.in-addr.arpa   IN       PTR     A.ExAmPlE

Is the reverse lookup for 10.0.0.1 expected to return the name with the case preserved (A.ExAmPlE)

Prasad

-----Original Message-----
From: Mark Andrews [mailto:[email-masked]] 
Sent: Tuesday, September 3, 2013 4:56 AM
To: Vithalprasad Gaitonde
Cc: [email-masked]
Subject: Re: [dnsext] Case sensitivity of RDATA in PTR records

In message <[email-masked]>, Vi thalprasad Gaitonde writes:
> [STD13<http://tools.ietf.org/html/rfc4343#ref-STD13>] says case MUST 
> be preserved on output and preserved when convenient on input.
>
>    DNSSEC<http://www.dnssec.net/> defines a canonical form and 
> ordering for RRs [RFC 2535<http://www.rfc-archive.org/getrfc.php?rfc=2535>]
> domain names. Or is the canonical form definition only  for 
> constructing SIG RRs as mention in RFC 2535 section 8 - "A canonical 
> form and ordering within an RRset is necessary in consistently 
> constructing and verifying SIG RRs"

No, they are not contadictory.  For the purposes of sorting the for records "B.example", "a.example", "[.example" and "C.example"
sort like this for:

	DNSSEC order:
		[.example
		a.example
		B.example
		C.example

Note case is preserved.

For comparison 
	ASCII order:
		B.example
		C.example
		[.example
		a.example

When signing or verifing you treat "B.example" as if it had been entered as "b.example".

When transfering a zone. You look for a previous "B.example" (after expanding compression pointers) if you have a record with "B.example"
in it when generating the compression pointer.  You do NOT look for "b.example".  If you can't find "B.example", you add the label "B"
then look for "example" not "EXAMPLE" or "ExAmPlE".

Mark

---

From: Mark Andrews <[email-masked]>
Date: Wed, 04 Sep 2013 09:34:28 +1000

In message <[email-masked]>, Vi
> Is DNS server expected to preserve case of the domain name in PTR RDATA.

Yes.
 
> case preserved (A.ExAmPlE)

Yes.

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Wed, 4 Sep 2013 01:53:15 +0200

> 
> In message
> <[email-masked]
> acific.corp.microsoft.com>, Vi thalprasad Gaitonde writes:

I guess so if you are talking about the Linux system which is case
sensitive. But I don't think this can happen in windows DNS servers. I don't
have experience with the latest versions, but in the  older versions it
wasn't like this.

Hosnieh

---

From: Mark Andrews <[email-masked]>
Date: Wed, 04 Sep 2013 10:29:47 +1000

> have experience with the latest versions, but in the  older versions it

We are talking about what nameservers should do.  Yes there are
broken implementations out there.

Named isn't perfect in this respect as it doesn't correctly preserve
the case of owner names of records when adding them to the internal
databases.  Keeping a bit vector of the case of each octet in the
ownername with each record would be one way to address this without
consuming too much memory.

We don't currently do case preserving compression when responding
to general queries.  For PTR queries in the reverse tree this is
usually not a issue but for other queries it could be.

We do preserve case of rdata in ixfr and axfr transfers.

Mark