Subject: Re: Wildcard NS and DNSSEC

From: [email-masked]
Date: Sun, 26 Oct 2003 03:11:16 -0800 (PST)

> In other words, wildcard NS records are technically legal.  I am
> not taking a position on whether or not they should be legal.

	perhaps this is the distinction btwn
	"newtonian DNS" and "quantum DNS" ... :)

>    *.example.net IN NS ns1.super-wcard.example.com.
>    *.example.net IN NS ns2.super-wcard.example.com.
> 
> (ns1 & ns2 are nameservers that can synthesize entire zones ending
> with example.net).

	what would the zone "*.example.net" look like?
	specifically the SOA.

> choking on this sort of response.  Additionally, you might be able to
> see that part of the standard wildcard validation is missing: proof
> that (at least) the wildcard actually exists.  This is, IMHO, because
> a wildcard NS RRset is a truly odd thing: the zone is synthesizing
> records for which it isn't even authoritative.

	again.. what are the contents fo the "wildcard zone"

> I suppose that it might be possible to handle this by adding another
> NSEC record for the wildcard, which may solve some nagging security
> issues, but would be a pretty odd special case.

	-IF- we go this far, then an NSEC rr for the wildcard 
	would be useful.

> 
> -- 
> David Blacka    <[email-masked]> 
> Sr. Engineer    Verisign Applied Research
> 
> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: masataka ohta <[email-masked]>
Date: Sun, 26 Oct 2003 21:35:46 +0900

David Blacka;

> I think that there is a conflict between the wildcard clarify and
> DNSSEC.  Section 6.2 of wildcard-clarify says (essentially):
> 
>    Is it not a protocol error to have a NS RR owned by a wild card
>    domian name, complimentary to the case of a SOA RR.  However, for
>    this to work, an implementation has to know how to synthesize a
>    zone.
> 

Hmmmmm, after rereading the paragraph, it seems to me that
the draft says something on a wildcarded authoritative NS (and
SOA), but perhaps not on a wildcarded referal NS.

However, the wildcarded authoritative NS (and SOA) is, IMHO,
illegal, or, at least, meaningless.

The problem is that SOA and authoritative NS must appear
at the root, and nowhere else, of a zone, which makes
wildcarding, which makes the RRs appear at lower nodes
of the zone, meaningless.

On the other hand, it seems to me that referral NS, which
seems to be useful (at least for NSI, maybe), is not
considered explicitely in the draft but, IMHO, should be
legislated more explicitely.

						Masataka Ohta

---

From: David Blacka <[email-masked]>
Date: Sun, 26 Oct 2003 15:29:28 -0500

> SOA), but perhaps not on a wildcarded referal NS.

Interesting.  I came to the opposite conclusion.  The earlier paragraphs in 
the section seem to be talking about delegation NS RRsets.

If you and I can disagree on this, then it is clear that 6.2 isn't clear.

> of the zone, meaningless.

I didn't follow that.  It is perfectly valid to have a zone that only has 
records at the apex.  In fact, I imagine that is how this whole situation 
would have to work: synthesized zones with only records at the apex.

> legislated more explicitely.

My main point is that 2535bis and wcard-clarify are, IMO, in conflict, and, 
since 2535bis has a normative reference to wcard-clarify, that is definitely 
a problem.

---

From: Rob Austein <[email-masked]>
Date: Sun, 26 Oct 2003 16:01:04 -0500

At Sun, 26 Oct 2003 15:29:28 -0500, David Blacka wrote:
> ...
> My main point is that 2535bis and wcard-clarify are, IMO, in
> conflict, and, since 2535bis has a normative reference to
> wcard-clarify, that is definitely a problem.

Ignoring the rest of the conversation for the moment, thanks for
pointing this out.  This was a normative reference up through
dnssec-protocol-02, but since wcard-clarify no longer contains any
text about DNSSEC (bis or classic), the citations that made this a
normative reference will be gone in dnssec-protocol-03.

I'll make wcard-clarify an informative reference in dnssec-protocol-03
(which we'll be dropping into the I-D queue before the gate slams shut
tomorow morning).  What to do from there is, of course, up to the WG.

---

From: Rob Austein <[email-masked]>
Date: Sun, 26 Oct 2003 16:14:12 -0500

Correcting my own misstatement to save the rest of you the trouble:
wcard-clarify was incorrectly listed as an informative reference in
dnssec-protocol-02, but the reference was in fact normative.  That's
been fixed.  Sorry for the confusion.

---

From: masataka ohta <[email-masked]>
Date: Mon, 27 Oct 2003 08:24:45 +0900

David Blacka;

> records at the apex.

Yes.

> In fact, I imagine that is how this whole situation 

Yes, syhthesis is fine.

But, it is enough to have wildcard notation in zone files
internal to a name server only without having it with the
protocol. In addition, to do so, wildcarded referral NS
is just enough.

Note that wildcarded authoritative NS and SOA does not appear
on the wire even with "*" query. Or, can you show me a
conter example?

Note also that zone transfer of a zone with wildcarded SOA is
impossible.

						Masataka Ohta

---

From: Samuel Weiler <[email-masked]>
Date: Mon, 27 Oct 2003 09:16:11 -0500 (EST)

> Additionally, you might be able to see that part of the standard
> wildcard validation is missing: proof that (at least) the wildcard
> actually exists.

Put simply, the parent has no RRSIG on the NS set, and the RRSIG is an
integral part of a wildcard proof.

> issues, but would be a pretty odd special case.

Ick.  Let's just forbid it and move along.  If someone really wants to
synthesize delegations, they can sign answers on the fly.

To clarify, should a literal * delegation be allowed?  (Not a wildcard
to be synthesized, just a literal *.example NS?)

-- Sam

---

From: Miek Gieben <[email-masked]>
Date: Mon, 27 Oct 2003 15:24:04 +0100

[On 27 Oct, @15:16, Samuel wrote in "Re: Wildcard NS and DNSSEC ..."]
> Ick.  Let's just forbid it and move along.  If someone really wants to

I'm in favor of doing that also,

grtz Miek