Subject: Forgery Resilience consensus call: Qname case sensitivity

From: Ólafur Guðmundsson /DNSEXT chair <[email-masked]>
Date: Mon, 17 Mar 2008 11:23:23 -0400

To focus the discussion a little bit, the current draft says:
>Given the above, a resolver implementation MUST match answers to the
>    following attributes of the question:
>
>    o  Remote address
>
>    o  Local address
>
>    o  Query port
>
>    o  Query ID
>
>    o  Question (name and type)
>
>    before applying DNS trustworthiness rules.

Does this mean that:
A.      name issued in query matches exactly to name in Query section of answer
B.      the names match after case folding

Please state your reason why you think it should be A or B.

Based on this we can then assert what/if FR draft should tell responders to
do if they want their answer believed.

         Olafur

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Brian Dickson <[email-masked]>
Date: Mon, 17 Mar 2008 12:38:15 -0400

> B.      the names match after case folding

IMHO, the correct answer is (A).

> Please state your reason why you think it should be A or B.

The basic problem is a zero-information, first-order problem.

There are any number of ways case folding *could* be done:
- to lower
- to upper
- to match the query (folding the answer)
- to match the answer (folding the query)
- to match any element of the delegation chain or other kinds of sources 
of data, e.g. parent label vs RR label(s)

And, in order to validate anything that isn't an exact match, would 
require doing a query on one of the above.
But, there is no authoritative/definitive source of non-case-folded data 
among those, to ascertain which way case folding might have been done.

Which means, there is no way to know if case folding should have been 
expected, versus untrusted injected data.

The fact that case folding (for comparisons) is permitted, does not 
define which way case folding results should be expected (e.g. to-lower 
*only*).
It creates a circular dependency when trying to validate case-folded data.

> do if they want their answer believed.
I believe Paul Vixie's currently demonstrated method - test all 
authority servers known, if case-folded answers are seen - is what 
askers should do.
If responders want their answer believed, they have to copy bit-for-bit 
the original query into the question section of the response.

Brian Dickson

---

From: Yue Luo <[email-masked]>
Date: Mon, 17 Mar 2008 10:22:26 -0700

I completely agree with Paul.

Thanks.
Yue

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul Vixie
Sent: Monday, March 17, 2008 9:50 AM
To: Ólafur Guðmundsson /DNSEXT chair
Cc: [email-masked]
Subject: Re: Forgery Resilience consensus call: Qname case sensitivity

> Please state your reason why you think it should be A or B.

i think it has to mean B until dns-0x20 is contemplated and standardized.

> do if they want their answer believed.

given that dns-0x20 has become controversial, i withdraw my previous
suggestion that forgery-resilience contain a reference to it.

---

From: Edward Lewis <[email-masked]>
Date: Mon, 17 Mar 2008 13:49:33 -0400

>B.      the names match after case folding

DNS has always defined name matching as B.

>Please state your reason why you think it should be A or B.

Frankly, when I read this the first time my 
reaction was "how are A and B different?"  An 
exact match of labels in DNS parlance has meant 
post-case folding (as opposed to an in-exact 
match of a wild card).

In AXFR "clarify" we are running into the issue 
that "matching" for the purpose of generating a 
response is not the same as "matching" for the 
purpose of message compression.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Never confuse activity with progress.  Activity pays more.

---

From: bert hubert <[email-masked]>
Date: Mon, 17 Mar 2008 20:20:14 +0100

> i think it has to mean B until dns-0x20 is contemplated and standardized.

Agreed ('case-folding comparisons').

> suggestion that forgery-resilience contain a reference to it.

In the mean time, after doing my own measurements and experiments, I will be
implementing dns-0x20 for real including the advanced 'bit stripper'
countermeasures suggested by Paul.

My wish is to ship forgery resilience in uncontroversial form, after which
we'll have time to hash out dns-0x20.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

---

From: Paul Vixie <[email-masked]>
Date: Mon, 17 Mar 2008 20:41:01 +0000

> we'll have time to hash out dns-0x20.

in that case, you should remove the must-copy-question logic from your i-d,
since it doesn't relate to the rest of what you're saying.

---

From: Patrik Fältström <[email-masked]>
Date: Wed, 19 Mar 2008 10:02:10 +0100

> B.      the names match after case folding

Note that B should be "the names match after case folding in ASCII  
when octet values are within the range 0x41-0x7A" or something similar.

    Patrik