Subject: RE: relevent?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 22 May 2004 07:41:36 -0700

> Consider any query for a non-existing name a.b.c.d.e.f.com in the zone
> f.com.  To prove that a.b.c.d.e.f.com doesn't exist, the server has to
> return records proving that the following names do not exist:
> 
> a.b.c.d.e.f.com
> *.b.c.d.e.f.com
> *.c.d.e.f.com
> *.d.e.f.com
> *.e.f.com
> *.f.com
> 
> This is the same for NXT, NSEC and presumably all alternatives as
> well.

Meng did some analysis in MARID on this. I think he might have the answer.

The first point that has to be understood is that wildcards are not
really a DNS protocol feature, they are exclusively the result of
server action. The only reason that wildcards exist in the original 
DNS spec at all is that it is desirable to communicate wildcards
in zone transfers and the like. 

Since wildcards are the result of server synthesis there is in fact
only one server whose wildcard synthesis is relevant, that is the
server holding the enclosing SOA record, what Meng refers to as 
the zone cut.

In other words it is critical to observe the fact that there are 
delegations:

In other words structure matters, a better example would be:

a.b.][c.d.][e.f.][com][.]

We do not, repeat DO NOT need to consider the existence of 
c.d.e.f.com in the context of wildcarding since WE WOULD NOT HAVE
GOT THERE WITHOUT PROOF THEY EXISTED.

In fact all we need to know is that:
	The zone c.d.e.f.com does not contain a wildcard
	b.c.d.e.f.com does not exist.

This statement can be proven in a single statement that is attached
to the zone node c.d.e.f.com:
	This zone does not contain a wildcard
	This zone does not contain any nodes x such that
		s < H(x) < e where s < SHA1(b), e > SHA1 (b)

Since we are at it we might as well fix wildcarding for SRV and like records
at the same time. There is no logical reason why it should be imposible to
deal with wildcards in the middle of a name, so called 'synthetic' but a
more accurate description would be 'non-transferable' and that only because
the protocol neglects to realize the need for them.

All that is necessary here is to add a wildcard NODE which can have
descendents. Let us use _* as the wildcard node. The same principle and
proof can be applied to the wildcard node descendents.

i.e. to prove that a.b.c.d.e.f.com does not exist when the zone contains
wildcard records such as x.*.c.d.e.f.com, y.*, z.* etc it is merely
necessary to list the intervals x-y, y-z, z-x.

By fixing this deficiency in DNS we also eliminate all engineering (i.e. not
layer 9) objections to use of SRV style name differentiation in the DNS as a
substitute for defining new resource records, a strategy that has as Dave
Crocker rightly points out a track record of over a decade of failure.

		Phill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>