Subject: [DNSOP] Perl related question on BULK RR

From: "Woodworth, John R" <[email-masked]>
Date: Mon, 27 Mar 2017 19:58:16 +0000

Apologies but I did not hear the full question regarding BULK RR's and the perl like back-references.  If you could please repeat the question we would be happy to comment.

Thanks,
John

-- THESE ARE THE DROIDS TO WHOM I REFER:
This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

---

From: Tony Finch <[email-masked]>
Date: Tue, 28 Mar 2017 11:19:10 +0100

Woodworth, John R <[email-masked]> wrote:

> Apologies but I did not hear the full question regarding BULK RR's and
> the perl like back-references.  If you could please repeat the question
> we would be happy to comment.

I didn't ask the question, but based on a quick look at the draft I think
there might be a fun problem.

Frequently, when you have string rewriting with substitution and
iteration, you have a Turing-complete esoteric programming system.

NAPTR very cunningly avoids this trap (IIRC) by constraining the rewrites
to be on a strictly monotonically reducing suffix of the input.

BULK does not itself have built-in iteration like NAPTR, but because it
synthesizes records it interacts with the DNS's existing resolver loops:
chasing delegations, and chasing CNAMEs and DNAMEs. Note that CNAMEs and
DNAMEs are also chased within authoritative servers.

So my question is, how does the BULK rewriting system interact with DNS
loops? Is there a CPU-eating tarpit in there?

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/  -  I xn--zr8h punycode
South Utsire: Northwesterly 4 or 5 backing southwesterly 3 or 4. Slight or
moderate. Fog patches, drizzle. Moderate or good, occasionally very poor.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 28 Mar 2017 11:16:30 -0500

On Tue, Mar 28, 2017 at 11:19:10AM +0100,
 Tony Finch <[email-masked]> wrote 

> loops? Is there a CPU-eating tarpit in there?

Also, I find that the Security Considerations section of
draft-woodworth-bulk-rr-05.txt is empty about the risk for
authoritative secondary servers. Once you enable BULK, you are at the
mercy of your master. (My registrar provides free secondary DNS
service. Their server hosts thousands of zones they do not manage or
control. I don't think they would be happy to enable BULK.)

Advice:

* a sub-section of Security Considerations section about this risk,

* suggestions that there SHOULD be a way to disable BULK processing
(or may be the opposite, make if off by default).

---

From: "Woodworth, John R" <[email-masked]>
Date: Tue, 28 Mar 2017 16:24:03 +0000

> -----Original Message-----
> From: DNSOP [mailto:[email-masked]] On Behalf Of Tony Finch
>
> > the perl like back-references.  If you could please repeat the
> > question we would be happy to comment.
>
> I didn't ask the question, but based on a quick look at the draft I
> think there might be a fun problem.
>
> NAPTR very cunningly avoids this trap (IIRC) by constraining the
> rewrites to be on a strictly monotonically reducing suffix of the
> input.
>
> BULK does not itself have built-in iteration like NAPTR, but because
> it synthesizes records it interacts with the DNS's existing resolver
> loops:
> chasing delegations, and chasing CNAMEs and DNAMEs. Note that CNAMEs
> and DNAMEs are also chased within authoritative servers.
>
> So my question is, how does the BULK rewriting system interact with
> DNS loops? Is there a CPU-eating tarpit in there?
>
Hi Tony,

Thank you for the excellent question.  I will need to run through some
logic exercises to attempt to create this scenario and if successful
work out a solution.

Thanks,
John
>
> Tony.
> --
> f.anthony.n.finch  <[email-masked]>  http://dotat.at/  -  I xn--zr8h
> punycode South Utsire: Northwesterly 4 or 5 backing southwesterly
> 3 or 4. Slight or moderate. Fog patches, drizzle. Moderate or good,
> occasionally very poor.
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: "John Levine" <[email-masked]>
Date: 28 Mar 2017 18:24:35 -0000

>to be on a strictly monotonically reducing suffix of the input.

Also, NAPTR does all of the complex stuff in the client applications.
All the DNS does is to return records.

>loops? Is there a CPU-eating tarpit in there?

Probably.

R's,
John