Subject: [weirds] Questions about suffix matches in domain and nameserver searches

From: Brian Mountford <[email-masked]>
Date: Fri, 30 Oct 2015 13:40:55 -0400

RFC 7482 describes the format of search strings to be used in partial match
queries. If I understand correctly, a wildcard search string should have a
prefix, exactly one wildcard asterisk, and then zero or more complete
domain labels at the end. I am wondering if the RDAP authors had in mind an
efficient way to implement such queries on a standard database system. The
prefix and single wildcard seem to be designed for ease of lookup using a
sorted database index. But then I'm not sure how one would efficiently
implement the domain label suffixes. For instance, it appears to be legal
to search for nameservers using the pattern ns*.subdomain.example.tld. The
ns* part is easy, but the suffix is harder to figure out. I am tempted to
think that the authors figured that queries too complicated for a given
system would just get rejected as per the wiggle room in the RFC. But if
that's the case, why is only one wildcard allowed? Why not define a generic
syntax with asterisk as the wildcard, and let implementors decide where to
draw the line. I'm unclear on the thought process behind the spec.

In a tangentially related question, it looked to me like IP address lookups
of nameservers and domains did not need to support a wildcard asterisk,
because the syntax was never defined. Is that true? Or does the RDAP spec
envision wildcard IP address lookups as well? If so, what is the syntax for
that?

Thanks.

Brian

---

From: Andrew Newton <[email-masked]>
Date: Sat, 31 Oct 2015 17:29:52 -0400

On Fri, Oct 30, 2015 at 1:40 PM, Brian Mountford <[email-masked]> wrote:
> But then I'm not sure how one would efficiently
> implement the domain label suffixes.

I'm sure if I thought about it for awhile, I could figure something
out. But you are correct that standard SQL 'like' matching won't do
the trick. Perhaps somebody from a domain registry could provide some
hints.

> I am tempted to think
> that the authors figured that queries too complicated for a given system
> would just get rejected as per the wiggle room in the RFC.

That is the answer you have been looking for. :)

> But if that's the
> case, why is only one wildcard allowed? Why not define a generic syntax with
> asterisk as the wildcard, and let implementors decide where to draw the
> line. I'm unclear on the thought process behind the spec.

Two reasons:
1) The working group felt that for any given query there had to be
some expectation of what would be returned, and more than one asterisk
could lead to all sorts of interpretation and lack of agreement. If
you want to define an extension to do this, feel free.
2) It didn't appear to be a feature of today's Whois servers, nor was
there a compelling need to cover this case.

> envision wildcard IP address lookups as well? If so, what is the syntax for

I've often wondered about the use case for wildcard IP address
queries. IP address hierarchies follow a mathematical model that does
not perfectly align with the lexical notation (unless the notation is
binary). So by themselves they are problematic.

With respect to finding name servers by an IP address, the use case of
name servers by CIDR never came up. And I'm not sure it would be
useful. Do people really assign entire /24s (or whatever) to their
name servers?

-andy

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Sun, 1 Nov 2015 02:02:26 +0000

> -----Original Message-----
> From: weirds [mailto:[email-masked]] On Behalf Of Andrew
> Newton
> Sent: Saturday, October 31, 2015 5:30 PM
> To: Brian Mountford
> Cc: [email-masked]
> Subject: Re: [weirds] Questions about suffix matches in domain and
> nameserver searches
> 

Andy's right. Search functionality was a late addition to the document, and we struggled to find a reasonable compromise between minimally needed functionality and complexity.

Scott