Subject: question regarding wildcards and 2672

From: Edward Lewis <[email-masked]>
Date: Mon, 16 Jun 2003 23:06:43 -0400

With a light bulb supplied by Mark Andrews, in the never ending 
effort to clarify wild cards...

In RFC 2672, section 4.1:

#     c. If at some label, a match is impossible (i.e., the
#        corresponding label does not exist), look to see whether the
#        last label matched has a DNAME record.
#
#        If a DNAME record exists at that point, ... SHOULD synthesize a
#        CNAME record ...  Go back to step 1.
#
          ...
#
#        If the "*" label does exist, match RRs at that node against
#        QTYPE.  If any match, copy them into the answer section, but
#        set the owner of the RR to be QNAME, and not the node with the
#        "*" label.  Go to step 6.

There's a problem with this.

Let's say an authoritative server has '*.example. DNAME example.org.' 
in a zone.

ACT I:

Cache issues a query for '1.2.example. DNAME IN' and gets the 
synthesized answer.  Cache is then asked for '0.1.2.example. A IN'

ACT II:

Cache issues a query for '2.example. DNAME IN' and gets the 
synthesized answer.  Cache is then asked for '0.1.2.example. A IN' 
(same query as in ACT I).

In ACT I, the response will include:

              0.1.2.example. CNAME 0.example.org.

In ACT II, the response to the SAME query will include:

              0.1.2.example. CNAME 0.1.example.org.

Note that the first query changes what the second query gets.  (And 
unlike the ANY situation, the two answers are incoherent.)

One reason for the problem is that a wild card is allowed to own a 
DNAME record.
Another reason for the problem is that there is no restriction on how 
many labels a wild card domain matches.

How do people feel about barring DNAME records at wild cards?
How do people feel about limiting the DNAME to matching just one label?
(I.e., In ACT I, the reply to '1.2.example. DNAME IN' would be:
                       2.example.   DNAME example.org.
                       1.2.example. CNAME 1.example.org)

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

...as graceful as a blindfolded bull in a china shop...

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Tue, 17 Jun 2003 11:52:19 -0400

At 7:03 -0700 6/17/03, Bill Manning wrote:
>% What's intended are paragraphs on what are apparently the three
>% resource records (known to date) that have an impact on wild cards.
>% The three are NS, CNAME, and DNAME.
>
>	what!  no SOA?

No - the SOA is already restricted to the apex, so far as I know. 
So, unless you do something stooopid like have a zone that starts 
with a "*." name -

Umm, wait, perhaps there ought to be text covering that.

I ain't naming names.

---

From: Edward Lewis <[email-masked]>
Date: Tue, 17 Jun 2003 13:13:56 -0400

At 0:20 +1000 6/18/03, [email-masked] wrote:
>Network Working Group                                        M. Crawford
>Request for Comments: 2672                                      Fermilab
>Category: Standards Track                                    August 1999
>
>	Please cite the RFC that moves DNAME to experimental.  Note
>	it is *not* RFC 3363.

I missed that.  I thought DNAME was experimental.  So DNAME is 
another standards document that is falling through the cracks.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer