Subject: AW: [Enum] Fwd: [Sipping] I-D ACTION:draft-ietf-sipping-e164-03.t xt

From: "Martin Streller" <[email-masked]>
Date: Mon, 7 Jul 2003 10:42:45 +0200

Hello Patrik,

>The wildcard in DNS 
>have many side effects -- most of them today felt being negative.

you may admit such a statement is a bit vague and nebulous.

Given an example like Marian's or mine - what are the definite 
side effects that you feel negative about ?

Martin

-----Ursprüngliche Nachricht-----
Von: Patrik Fältström [mailto:[email-masked]]
Gesendet: Sonntag, 6. Juli 2003 18:32
An: Marian Durkovic
Cc: [email-masked]; [email-masked]
Betreff: Re: [Enum] Fwd: [Sipping] I-D
ACTION:draft-ietf-sipping-e164-03.t xt

On söndag, jul 6, 2003, at 18:10 Europe/Stockholm, Marian Durkovic 
wrote:

> On Sun, Jul 06, 2003 at 03:01:42PM +0200, Patrik Fältström wrote:
>> Can we please keep the discussions about the wildcard in DNS separate
>> from the regular expression in NAPTR as separate as possible?
>
> I don't think this is fully possible. If you want to use wildcard in 
> DNS,
> you must use non-greedy regular expression with a subpattern ( ) to 
> extract
> and reuse the digits matched by the wildcard:
>
> $ORIGIN 5.5.5.5.5.1.2.4.e164.arpa.
> * IN  NAPTR   100 10 "u" "E2U+sip"  
> "!^\\+42155555(.*)$!sip:1\\[email-masked]!" .

Yes, you are absolutely correct. And one can say dependencies exists in 
the other direction as well.

BUT, today I still see a large number of arguments (especially when 
looking at DNSSEC) from a pure DNS perspective to _not_ use wildcards 
in DNS.

My point is that that is not enough as an argument for removing the 
regular expression in the NAPTR for ENUM. It is needed anyway, and I 
gave an example.

You say you don't want a million NAPTR records in your DNS server, and 
I can understand that given the most common provisioning mechanisms 
which exists.

The IETF do though concentrate on what goes on the wire between hosts, 
and not so much of how things are inside the host itself.

I.e. you might have some DNS software that you can configure given some 
kind of wildcard, BUT, it will not be a wildcard from a DNS 
perspective. That is a very very big difference. The wildcard in DNS 
have many side effects -- most of them today felt being negative.

     paf

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Patrik Fältström <[email-masked]>
Date: Mon, 7 Jul 2003 11:35:09 +0200

On måndag, jul 7, 2003, at 10:42 Europe/Stockholm, Martin Streller 

> side effects that you feel negative about ?

(1) If you have an owner which have a CNAME, you can not have any other 
RR with the same owner. Many many people fail on this (for example, 
they add an MX record).
(2) The implications with DNSSEC is not known in enough detail. 
Especially when looking at negative caching. Yes, compared to some 6-12 
months ago, there are ideas on how it might work, but the proposal is 
still to run wildcards in either a delegated zone which is not secure, 
or you synthesize your records, which in turn means you need to have 
the private key online.
(3) It is easy to forget the wildcard when you later need to delegate 
something, and understand the implications (together with (1) above).

But, the largest problems are with (1) and (2).

As DNSSEC is important for ENUM, I rather stay away from wildcards. The 
wildcards _can_ be simulated by either generating many records, or by 
having a DNS server which synthesizes the records.

Another problem when you do ENUM is that there will be responses if 
someone query for for example:

  NAN.1.2.3.4.6.4.e164.arpa. + IN + NAPTR

and in the DNS I have

  *.1.2.3.4.6.4.e164.arpa. IN NAPTR ....

I don't like that. You might want to store other RR types with similar 
names in the same hierarchy, for example SRV records (which Microsoft 
Active Directory uses heavily) or whatever.

     paf