Subject: Re: thesaurus attack

From: Edward Lewis <[email-masked]>
Date: Fri, 10 Sep 2004 15:06:17 -0400

At 20:50 +0200 9/10/04, Peter Koch wrote:

>there'd be a '*' label as an empty non-terminal. To avoid empty terminals,
>this should not instantiate '*.example.com' as a wildcard. However, that
>conflicts with step 3 of the algorithm in 1034.

Ahh, yeah, what about empty non-terminal '*' nodes in the tree and 
the role they might play as a source of synthetic records.  Sigh.

I suppose if you read the very last paragraph of step 3, you would 
take this to mean that any name matching an empty non-terminal '*' 
node would result in a no error, no data return (neglecting the CNAME 
rules).

>What about *.*.example. as a QNAME? That would be covered by closest
>encloser *.example. and *.*.example.com as a wildcard source.

I don't think that's right.

If you have *.example.com and *.*.example.com in the zone and the 
query is for *.*.example.com, then you'd get a direct hit on the 
latter zone member.

If the query was for *.*.*.example.com, you'd match the 
*.*.example.com "source of synthesis" - not the *.example.com.

Does that make sense?
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Robert Elz <[email-masked]>
Date: Sat, 11 Sep 2004 04:02:47 +0700

Date:        Fri, 10 Sep 2004 20:50:40 +0200
    From:        Peter Koch <[email-masked]>
    Message-ID:  <[email-masked]>

  | To avoid empty terminals,

There's no reason to do that.    We don't have them in the normal name
tree, but the reason for that is that there's no way to represent them.

Here, the "empty terminal" only appears in the answer to a query, where it
cannot be detected as being terminal, so there's no need to do anything
special to avoid this case, just leave it.

kre

---

From: Peter Koch <[email-masked]>
Date: Fri, 10 Sep 2004 23:42:08 +0200

> node would result in a no error, no data return (neglecting the CNAME 

yes.

> query is for *.*.example.com, then you'd get a direct hit on the 

agreed.

> *.*.example.com "source of synthesis" - not the *.example.com.

Probably not, sorry for the confusion. It's easy if we don't translate '*'
to "all names":

Given a zone example.com

@	SOA ...
	NS  ...
*	TXT " ... "

A QNAME something.example.com is matched by the wildcard. A QNAME *.example.com
is NOT matched by the wildcard but gives a direct match. This does not change
the result, but is important for the next step. A QNAME of a.*.example.com
results in NXDOMAIN. That's because the wildcard matches all names except
those which "exist". "*.example.com" does exist, so the tree is pruned here.
Now that's consistent with Appendix A claiming that b.a.*.*.example is not
covered bey either *.example or *.*.example.
The common assumption that in an otherwise empty zone (see above) the '*'
covers *all* names is just wrong. To really catch all you'd have to add

*.*	TXT " ... "
*.*.*	TXT " ... "
[...]

up to the maximum domain name length (whatever that really is).
All that's already said in terms of closest encloser etc in the draft, but
I guess an example like this with some prose in the appendix won't hurt.
The joke helped.

-Peter

---

From: Ben Laurie <[email-masked]>
Date: Tue, 14 Sep 2004 12:15:04 +0100

Edward Lewis wrote:
> Ahh, yeah, what about empty non-terminal '*' nodes in the tree and the 
> role they might play as a source of synthetic records.  Sigh.
> 
> I suppose if you read the very last paragraph of step 3, you would take 
> this to mean that any name matching an empty non-terminal '*' node would 
> result in a no error, no data return (neglecting the CNAME rules).

Wouldn't this mean (since all nonexistent names match the '*') that 
there's a synthesized (or real) closest encloser for all names at that 
level.

In other words, if a.*.example exists, then a query for x.y.example 
would cause y.example to be synthesized as the closest encloser? So, if 
the zone looked like:

a.*.example 	TXT "1"
*.example	TXT "2"

Then a query for x.y.example would yield NXDOMAIN (since y.example is an 
ENT). If a.*.example was not present, the result would be "2".

Cheers,

Ben.

-- 
ApacheCon! 13-17 November! http://www.apachecon.com/

http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Edward Lewis <[email-masked]>
Date: Tue, 14 Sep 2004 09:19:42 -0400

At 12:15 +0100 9/14/04, Ben Laurie wrote:

>
>In other words, if a.*.example exists, then a query for x.y.example would
>cause y.example to be synthesized as the closest encloser? So, if the zone
>looked like:
>
>a.*.example 	TXT "1"
>*.example	TXT "2"
>
>Then a query for x.y.example would yield NXDOMAIN (since y.example 
>is an ENT). If a.*.example was not present, the result would be "2".

The closest encloser is never synthesized - it's the closest domain 
in the tree to the name that is sought.

Recall that synthesis only happens when you've found that an exact 
match fails.  The last point of "success" is the closest encloser.

For x.y.example, the closest encloser would be example.com.  As there 
is a *.<closest encloser> (= *.example), that is the source of the 
synthetic records.

The result you have is right, but y.example.com is not the closest 
encloser.  Recall that when performing match rules to find the source 
of synthesis, multiple labels can match a '*'.  (Not true when 
'matching down the tree, label by label.)
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

---

From: Ben Laurie <[email-masked]>
Date: Thu, 23 Sep 2004 09:14:32 +0100

Edward Lewis wrote:
>> Then a query for x.y.example would yield NXDOMAIN (since y.example is 
>> an ENT). If a.*.example was not present, the result would be "2".
> 
> 
> The closest encloser is never synthesized - it's the closest domain in 
> the tree to the name that is sought.
> 
> Recall that synthesis only happens when you've found that an exact match 
> fails.  The last point of "success" is the closest encloser.
> 
> For x.y.example, the closest encloser would be example.com.  As there is 
> a *.<closest encloser> (= *.example), that is the source of the 
> synthetic records.
> 
> encloser.  Recall that when performing match rules to find the source of 
> synthesis, multiple labels can match a '*'.  (Not true when 'matching 
> down the tree, label by label.)

It was more a question than a result, but now I'm puzzled. If the 
closest encloser is not synthesized (which is fine by me, I just thought 
that you were implying it could be), then surely the result is "2" in 
both cases and never NXDOMAIN?

Cheers,

Ben.

---

From: Edward Lewis <[email-masked]>
Date: Thu, 23 Sep 2004 09:38:05 +0100

At 9:14 +0100 9/23/04, Ben Laurie wrote:

>It was more a question than a result, but now I'm puzzled. If the closest
>encloser is not synthesized (which is fine by me, I just thought that you were
>implying it could be), then surely the result is "2" in both cases and never
>NXDOMAIN?

By definition, the closest encloser is never synthesized.  (You don't 
synthesize names, you synthesize records.)  It's like this:

                              .
                            / | \
                          uk com edu
                              |
                           example
                           /  |  \
                         abc def ghi
                             /|\
                            x y z
                             /|
                            * w
                              |
                              *

If the sought name is foo.bar.w.y.def.example.com., then I match down 
the tree (label by label) until I see that at w.y.def.example.com. is 
as far as I can match.

Using Venn diagram notation:

         +--------------------------------------------+
         |  .                                         |
         |  +-------+ +--------------------+ +------+ |
         |  | uk    | | com                | | edu  | |
         |  +-------+ |                    | +------+ |
         |  +---------+                    +--------+ |
         |  | +-----------------------------------+ | |
         |  | | example                           | | |
         |  | | +-----+ +---------------+ +-----+ | | |
         |  | | | abc | | def           | | ghi | | | |
         |  | | +-----+ |               | +-----+ | | |
         |  | |       +-+               +-+       | | |
         |  | |       | +---+ +---+ +---+ |       | | |
         |  | |       | | x | | y | | z | |       | | |
         |  | |       | +---+ |   | +---+ |       | | |
         |  | |       | +-----+   +-----+ |       | | |
         |  | |       | |               | |       | | |
         |  | |       | |  +---+ +---+  | |       | | |
         |  | |       | |  | * | | w |  | |       | | |
         |  | |       | |  +---+ |   |  | |       | | |
         |  | |       | |  +-----+   |  | |       | | |
         |  | |       | |  |         |  | |       | | |
         |  | |       | |  |  +---+  |  | |       | | |
         |  | |       | |  |  | * |  |  | |       | | |
         |  | |       | |  |  +---+  |  | |       | | |
         |  | |       | |  +---------+  | |       | | |
         |  | |       | +---------------+ |       | | |
         |  | |       +-------------------+       | | |
         |  | +-----------------------------------+ | |
         |  +---------------------------------------+ |
         +--------------------------------------------+

(Note this is a domain diagram, not a zone diagram.)

If you look to see what smallest box covers the sought name, you'll 
see it's the box labeled w inside the box(y) inside the box(def) 
inside the box(example) inside the box(com) inside the box(.) (=the 
universe).

That's a better representation of "closest encloser" its the existing 
domain that encloses the sought name "most closely."  I suppose that 
I got the workd closest from drawing lines to the tree, enclosing 
from the idea of the domain Venn diagram.