Subject: [dnsext] [Technical Errata Reported] RFC4343 (6361)

From: RFC Errata System <[email-masked]>
Date: Tue, 22 Dec 2020 03:29:11 -0800 (PST)

The following errata report has been submitted for RFC4343,
"Domain Name System (DNS) Case Insensitivity Clarification".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6361

--------------------------------------
Type: Technical
Reported by: Kaspar Etter <[email-masked]>

Section: 4.1

Original Text
-------------
No "case conversion" or "case folding" is done during such output operations, thus "preserving" case.

Corrected Text
--------------
?

Notes
-----
Whose case is preserved? The case of the label in the DNS query or the case of the label in the DNS database? In other words, if there is a DNS record for ietf.org and I query IETF.org, should the DNS response say ietf.org or IETF.org? I would expect it's the former so that the DNS administrator can inform the DNS requester about the preferred capitalization but I can't figure this out on the basis of the RFC. Does output case preservation refer to something else? All I observe is that tools like dig return the latter when I run 'dig IETF.org'. Maybe an errata is not the right place to ask for clarification but given the name of the RFC, I would expect to find a clear answer to this question in the RFC.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC4343 (draft-ietf-dnsext-insensitive-06)
--------------------------------------
Title               : Domain Name System (DNS) Case Insensitivity Clarification
Publication Date    : January 2006
Author(s)           : D. Eastlake 3rd
Category            : PROPOSED STANDARD
Source              : DNS Extensions
Area                : Internet
Stream              : IETF
Verifying Party     : IESG

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 22 Dec 2020 23:14:48 -0500

Hi,

I am the author of RFC 4343. See below.

> Whose case is preserved? The case of the label in the DNS query or
> the case of the label in the DNS database?

The earlier text in Section 4.1 is intended to indicate it is the
"database".

> In other words, if there is a DNS record for ietf.org and I query
> IETF.org, should the DNS response say ietf.org or IETF.org? I would
> expect it's the former so that the DNS administrator can inform the
> DNS requester about the preferred capitalization but I can't figure
> this out on the basis of the RFC.

Well, you seem to have figured out how it works, although I have no
idea what why the reference to "DNS administrator" rather than DNS
resolver or DNS server.

> Does output case preservation refer to something else? All I observe
> is that tools like dig return the latter when I run 'dig IETF.org'.

Right. The deployed DNS generally conforms to this RFC.

> Maybe an errata is not the right place to ask for clarification but
> given the name of the RFC, I would expect to find a clear answer to
> this question in the RFC.

Well, I have no problem with the theory that any successor document to
this RFC should be clearer on this point.

> Instructions:

I'm not sure about the details of "errata" status but I think this
should end up in the "hold for future documentation" or whatever the
usual formula is. The RFC isn't wrong but is arguably unclear for some
readers.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 2386 Panoramic Circle, Apopka, FL 33896 USA
 [email-masked]

---

From: Kaspar Etter <[email-masked]>
Date: Wed, 23 Dec 2020 09:51:25 +0100

Dear Mr. Eastlake,

Thanks a lot for the quick reply. Just to make sure that there’s no misunderstanding: If I figured it out (i.e. I should receive the capitalization of the label as it is in the server’s database in DNS responses), then the deployed DNS DOESN’T conform to this RFC.

Examples:
dig IETF.org <http://ietf.org/> => IETF.org <http://ietf.org/> in the answer section of the DNS response
dig ietf.org <http://ietf.org/> => ietf.org <http://ietf.org/> in the answer section of the DNS response

Since this could be due to one of the DNS servers rather than dig, here’s an API that is independent of my local configuration:
https://dns.google/resolve?name=IETF.org&type=A <https://dns.google/resolve?name=IETF.org&type=A> => IETF.org <http://ietf.org/> in response
https://dns.google/resolve?name=ietf.org&type=A <https://dns.google/resolve?name=ietf.org&type=A> => ietf.org <http://ietf.org/> in response

And here is another public DNS API:
curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=IETF.org&type=A <https://cloudflare-dns.com/dns-query?name=IETF.org&type=A%E2%80%99>' => IETF.org <http://ietf.org/> in response
curl -H 'accept: application/dns-json' 'https://cloudflare-dns.com/dns-query?name=ietf.org&type=A <https://cloudflare-dns.com/dns-query?name=ietf.org&type=A>' => ietf.org <http://ietf.org/> in response

The problem with the earlier text in Section 4.1 of RFC 4343 is that, given "taking the label on the node whose name is to be output”, one could argue that my DNS query also specifies a node whose name you might want to output.

In a way, it has to be the capitalization of the label in the database. Otherwise, what’s the point of case preservation on input if there’s no way for anyone other than the DNS administrator, who can look at the zone file, to get the preserved case on output? But why is everyone getting it wrong then?

Can you confirm one more time that the above assessment is correct? Thank you.

And in any case, the status "Held for Document Update” is fine for me.

Best regards,
Kaspar

> On 23 Dec 2020, at 05:14, Donald Eastlake <[email-masked]> wrote:
> 
> Hi,
>

---

From: Evan Hunt <[email-masked]>
Date: Mon, 28 Dec 2020 18:42:05 +0000

On Wed, Dec 23, 2020 at 09:51:25AM +0100, Kaspar Etter wrote:
> Thanks a lot for the quick reply. Just to make sure that there’s no
> misunderstanding: If I figured it out (i.e. I should receive the
> capitalization of the label as it is in the server’s database in DNS
> responses), then the deployed DNS DOESN’T conform to this RFC.
> Examples:

This has been ambiguous for a long time.  If you check the authoritative
servers for ietf.org, the answer section is capitalized as specified in
the zone database, not matching the question:

   $ dig +noall +answer @ns1.ams1.afilias-nst.info. IETF.org
   ietf.org.		1800	IN	A	4.31.198.44

However, some servers use case-insensitive name compression in their
responses. Differently-capitalized versions of the same name are treated as
duplicates, so if IETF.org appears in the question section, the answer
section will refer back to that.  In my view, this behavior is incorrect,
but it's commonplace.

I'm not sure whether this helps with the issue at hand, I just thought
the additional context might be useful.

-- 
Evan Hunt -- [email-masked]
Internet Systems Consortium, Inc.

---

From: Donald Eastlake <[email-masked]>
Date: Mon, 28 Dec 2020 16:17:22 -0500

Hi,

Thanks for the recent replies. See below.

> section will refer back to that.  In my view, this behavior is incorrect,

Right. "correctness" is in the eye of the beholder but all this pointed out
in RFC 4343 in the Section 4.1 which is the target of this errata:

   ...   No "case conversion" or "case folding" is done
   during such output operations, thus "preserving" case.  However, to
   optimize output, indirect labels may be used to point to names
   elsewhere in the DNS answer.  In determining whether the name to be
   pointed to (for example, the QNAME) is the "same" as the remainder of
   the name being optimized, the case insensitive comparison specified
   above is done.  Thus,
*such optimization may easily destroy the output   preservation of case*.
This type of optimization is commonly called
   "name compression".
(bold face added)

> the additional context might be useful.

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 2386 Panoramic Circle, Apopka, FL 32703 USA
 [email-masked]