Subject: clarity on wildcards

From: Ketil Froyn <[email-masked]>
Date: Fri, 28 Feb 2003 12:24:05 +0100 (CET)

Hi.

I recently found out that there are some discrepancies in how different
implementations handle wildcards. Let's say the DNS server authoritative
for the zone "c." contains these records:
*.c. A 192.168.1.1
a.b.c. A 192.168.1.2

BIND8.3.4 gives these results:
z.a.b.c. NXDOMAIN
b.c. NODATA
b.b.c. NXDOMAIN
d.c. A 192.168.1.1

BIND9.2.2rc1 gives these results:
z.a.b.c. NXDOMAIN
b.c. A 192.168.1.1
b.b.c A 192.168.1.1
d.c. A 192.168.1.1

tinydns gives these results:
z.a.b.c. A 192.168.1.1
b.c. A 192.168.1.1
b.b.c. A 192.168.1.1
d.c. A 192.168.1.1

Mark Andrews has said[1] that BIND9.3 does this:
b.c. NODATA or NXDOMAIN (does not match *.c)
which implies
b.b.c. NXDOMAIN

Edward Lewis has said[2] (as I understood it, please correct me if I 
am wrong, this discussion includes elements I am not familiar with) that 
this is the correct response:
b.b.c. 192.168.1.1 (matches *.c)
which implies
b.c 192.168.1.1 (matches *.c)

By my own understanding of RFC1034, BIND9.2.2rc1 is the only one listed
that gets all cases right. In my opinion, b.c should match the wildcard, 
because RFC1034 says:
---
Wildcard RRs do not apply:

   - When the query is in another zone.  That is, delegation cancels
     the wildcard defaults.
---
which implies that other RRs do not cancel the wildcard. I say this 
because, if a zone includes this delegation:
d.e.c.	NS	some.name.server.
or in fact any label attached to d.e.c., then by BIND8/BIND9.3 logic, 
anything on the form *.e.c is already cancelled, and only specifying that 
*.d.e.c is cancelled is pointless, especially when it additionally limits 
this to delegations.

Also, the reverse case is detailed, where a subdomain of the query name 
exists between the query name and the wildcard:
---
Wildcard RRs do not apply:
[snip]
   - When the query name or a name between the wildcard domain and
     the query name is know to exist.  For example, if a wildcard
     RR has an owner name of "*.X", and the zone also contains RRs
     attached to B.X, the wildcards would apply to queries for name
     Z.X (presuming there is no explicit information for Z.X), but
     not to B.X, A.B.X, or X.
---
but if a.b.c were to cancel b.c from matching *.c, that would surely be
worthy of mention? In addition, this definition implies that existence of
a name is existence of an RR attached to that name, not the existence of
an RR where the label has the name at the end.

So, which one _is_ right? Please support your arguments thoroughly, I am
clearly not the only one who needs to be convinced.

[1] http://marc.theaimsgroup.com/?l=bind-users&m=104634519523021&w=2
[2] http://marc.theaimsgroup.com/?l=namedroppers&m=103549359131894&w=2

Ketil Froyn
[email-masked]
http://ketil.froyn.name/

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>