Subject: Any decision on wildcard CNAME ?

From: Robert Elz <[email-masked]>
Date: Sun, 12 Oct 2003 03:13:03 +0700

I'm trying to work out what the WG decision is on wildcard CNAME
so a new draft can get submitted sometime soon...

As best I can tell, Masatake Ohta and Mark Andrews favour simply
defining it to work (in the full and naturally expected way).

Rob Austein and Olaf Kolkman seemed to prefer simply defining it to
be illegal (or undefined, or something essentially equivalent).

I, and I think some others (but I don't remember the names) want the
thing fixed, but I don't care which of the above ways.

Randy Bush and Paul Vixie seemed to want to leave the DNS with inconsistent
results possible.   Or did the last time they wrote.

Large numbers of other people who I know read this list haven't
expressed an opinion at all.   Please do - without more input, there
isn't going to be any way to come to any kind of conclusion on this.

kre

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked] (Ted Lindgreen)
Date: Sun, 12 Oct 2003 12:13:25 +0200

[Quoting Robert Elz, on Oct 12, 10:55, in "Any decision on wild ..."]

> isn't going to be any way to come to any kind of conclusion on this.

We (developers of NSD) are (strongly) in favor of defining it
to be illegal.

Second best is make it work, provided that does not further
complicate DNSSEC.  Leaving it inconsistent will make
implementing DNSSEC very difficult if not impossible.

-- ted

---

From: masataka ohta <[email-masked]>
Date: Sun, 12 Oct 2003 22:03:48 +0900

Ted;

> implementing DNSSEC very difficult if not impossible.

My understanding is that the issue is orthogonal to DNSSEC complexity.

							Masataka Ohta

---

From: [email-masked] (Ted Lindgreen)
Date: Sun, 12 Oct 2003 19:21:23 +0200

[Quoting masataka ohta, on Oct 12, 15:12, in "Re: Any decision on  ..."]

> My understanding is that the issue is orthogonal to DNSSEC complexity.

Then I am probably missing something. Please enlighten us on what
algoritme to use to prove correctness or non-existence of an RR
derived from expansion of a wildcard CNAME with its current definition?
We have great problems with this now, and want to get on with our work.

-- ted

---

From: "Christian Huitema" <[email-masked]>
Date: Sun, 12 Oct 2003 12:05:57 -0700

> derived from expansion of a wildcard CNAME with its current
definition?

Yup. How is that different from a load balancing DNS making up records
on the fly? Or a server programmed to synthesize PTR records? If you
cannot see the problem on the wire, then you cannot rule out the
behavior.

Now, there are two ways were you might see the behavior "on the wire":
in a zone transfer, and in a DNSSEC computation. Whatever rule is
written can only be written in one of these two contexts.

-- Christian Huitema

---

From: [email-masked]
Date: Mon, 13 Oct 2003 08:29:20 +1000

> We have great problems with this now, and want to get on with our work.
 
	You prove wildcard CNAMEs exactly the same way that you prove
	wildcard A records.

	Verify the name does not exist. (NSEC)
	Verify that expanded owner name matches the signature. (RRSIG).

	Banning records actually introduces MORE work for DNSSEC.  You
	then have to check that you are not receiving a banned record.
	
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: [email-masked]
Date: Mon, 13 Oct 2003 09:35:13 +0100

I'm with Masatake Ohta and Mark Andrews - define it to work.

Regards,
Tony Milton

Internet
[email-masked]@ops.ietf.org - 11/10/2003 21:13

Sent by:    [email-masked]

To:    namedroppers

cc:

Subject:    Any decision on wildcard CNAME ?

kre

This message and any attachments (the "message") is
intended solely for the addressees and is confidential. 
If you receive this message in error, please delete it and 
immediately notify the sender. Any use not in accord with 
its purpose, any dissemination or disclosure, either whole 
or partial, is prohibited except formal approval. The internet
can not guarantee the integrity of this message. 
BNP PARIBAS (and its subsidiaries) shall (will) not 
therefore be liable for the message if modified. 

                ---------------------------------------------

Ce message et toutes les pieces jointes (ci-apres le 
"message") sont etablis a l'intention exclusive de ses 
destinataires et sont confidentiels. Si vous recevez ce 
message par erreur, merci de le detruire et d'en avertir 
immediatement l'expediteur. Toute utilisation de ce 
message non conforme a sa destination, toute diffusion 
ou toute publication, totale ou partielle, est interdite, sauf 
autorisation expresse. L'internet ne permettant pas 
d'assurer l'integrite de ce message, BNP PARIBAS (et ses
filiales) decline(nt) toute responsabilite au titre de ce 
message, dans l'hypothese ou il aurait ete modifie.

---

From: Robert Elz <[email-masked]>
Date: Mon, 13 Oct 2003 19:52:14 +0700

Date:        Mon, 13 Oct 2003 08:29:20 +1000
    From:        [email-masked]
    Message-ID:  <[email-masked]>

  | 	Banning records actually introduces MORE work for DNSSEC.  You
  | 	then have to check that you are not receiving a banned record.

I have heard a similar sentiment (expressed in a different way) in
private mail (which I would prefer not to receive - everyone send opinions
to the list - unless you have an editorial not in the document)
though, which suggests that perhaps a clarification of the option
might be in order.

I'm not certain this is what Olaf had in mind when he suggested
this, but my impression of what "banning" the records would do
isn't quite like that.

That is, I don't think it is reasonable (or probably even possible)
to outlaw the transmission of a CNAME record that was constructed from
a wildcard, nor to force servers to barf on such things - as they might on
an RR like

	name IN A 1.2.3.4.5

but that making it illegal would be specified something like is currently
done when specifying that having the RDATA in an NS record be a CNAME
is illegal.

That is, if you do that, the server, caches, resolvers, may do anything
that like with your data, treat the record as if it doesn't exist, treat
it as if it does, with almost any meaning they like ... so just "don't
do that".

That is, provided we make it clear that a wildcard CNAME record isn't
something that should be expected to exist, and is not intended to be
handled (in any way at all), what implementations actually do should
one be found, is entirely their business - including "let's try and
make it work", "BARF loading the zone file and refuse to accept it",
"do according to what appears to be the strict interpretation of the
algorithm in 3.4.2 of 1034", or almost anything else (dumping core is
not included though...)

What effect that might have on the DNSSEC algorithms, especially wrt
non-existence, I have no idea.

kre

---

From: [email-masked]
Date: Tue, 14 Oct 2003 00:06:08 +1000

> > results possible.
> no, results consistent with 1034.  if qtype=cname then return it.
> if not, don't.
> 
> randy

	Which leaves caches returning inconsistant result dependent
	on query history.

	So you want mail to go through from a MTA that make explict
	CNAME queries and not to go through from a MTA that makes
	implict CNAME queries (e.g. MX/A/AAAA)?

	Mark