Subject: Re: Q20: expanding wildcards in the authority section

From: Erik Rozendaal <[email-masked]>
Date: Thu, 04 Dec 2003 13:49:17 +0100

Olaf M. Kolkman wrote:
> 
>   Q20: Expansion of wild cards in the authority section.
> 
>       Default action, based on sense of the room at IETF58, is to not
>       expand the owner names of e.g. wildcard  NSEC RRs.
>      
>       If there is no further prohibitive objections by December 8 this 
>       will be taken as consensus of the working group.

I find this rather inconsistent with the normal behavior of wildcards. 
Currently wildcard owner names are always expanded to match the SNAME.

The current NSD DNSSEC implementation expands the wildcard NSEC record. 
However, changing it to not expand the wildcard is not a big deal.  But I'd 
still prefer consistent wildcard behavior when the wildcard matches the SNAME.

So (in order of preference) I'd like:

1. The wildcard MUST always be expanded when it matches SNAME.
2. The wildcard MUST NOT be expanded for NSEC records in the authority 
section even if it matches SNAME.
3. The wildcard MAY/SHOULD/SHOULD NOT be expanded.

Option 3 has additional complications for the client/resolver and would not 
be a good idea in my opinion.

I prefer option 1 but do not mind option 2.

Erik

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Fri, 05 Dec 2003 00:41:00 +1100

> I prefer option 1 but do not mind option 2.

	Say you have

	QNAME c.example.
	QTYPE A
	
	And you get the following back:

	(expanded *)
	RCODE=NOERROR Answer count=0
	c.example. NSEC b.example. TXT NSEC RRSIG
	c.example. RRSIG ...
	b.example. NSEC d.example. A NSEC RRSIG
	b.example. RRSIG ...

	(unexpanded *)
	RCODE=NOERROR Answer count=0
	*.example. NSEC b.example. TXT NSEC RRSIG
	*.example. RRSIG ...
	b.example. NSEC d.example. A NSEC RRSIG
	b.example. RRSIG ...

	The tests the validator has to go through for NOERROR NODATA
	are:

	Does QNAME exist? ****
	Yes: Is it a empty node
	     Yes: SUCCESS
	     No: Does the type exist at the node?
		 Yes: FAIL
		 No: SUCCESS
	No: Does a wildcard exist?  ****
	    Yes: Does the type exist in the wildcard? ****
		 Yes: FAIL
	         No: SUCCESS
	     No: FAIL
	
	Which of the above two answers makes it easier to answer the
	**** questions?

	Mark

--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]