Subject: * NS

From: Edward Lewis <[email-masked]>
Date: Mon, 20 Sep 2004 15:34:35 +0100

Since midday yesterday a couple of RIPE attendees have talked about 
the "* NS" issue.

A couple of things seem clearer now (at least to me), but still we 
have a conundrum.

The current thinking is that there should be no restriction on a zone 
with a "* NS" because a domain name beginning with a "*" isn't always 
being used as a source of synthetic records.

E.g.,

         example.com.     SOA   (SOA rdata)
                          NS    (NS rdata)
                          NS    (NS rdata)
         *.foo            TXT   (TXT rdata)
         www              A     (A rdata)
         *                NS    (NS rdata)
                          NS    (NS rdata)

I'm going to use a convention for the purpose of this message of:

    Q(*, NS) is the same as (QNAME=*; QCLASS=IN; QTYPE=NS)
    ANSWER(#): Answer section and answer count
    AUTHORITY(#): Authority section w/count

Query: Q(*.example.com, NS) returns:

    ANSWER(2): *.example.com. IN NS (x2)

    This is a case of (RFC 1034, 4.3.2) Step 3.a (exact name match) being
    invoked.

Query: Q(*.example.com, A) returns:

    This depends.  If the server has loaded a zone named *.example.com. then
    we wouldn't be looking at this zone.

    Assuming there is no loaded zone for *.example.com., then the answer comes
    from Step 3.b (cut point it hit).  The answer would be:

    AUTHORITY(2): *.example.com. IN NS (x2)

QUERY Q(www.example.com, TXT) returns:

    ANSWER(0)

    This is from 3.a - exact name match, but no matching RR set.

QUERY Q(www.*.foo.example.com, A) returns:

    Name Error

    This is from 3.c.  A match failed at the label * of *.foo.example.com.
    There is no * label below this (*.*.foo.example.com) - setting aside the
    "anydomain should not contain *" text - so there is no name match, hence
    the name error return.

QUERY Q(smtp.example.com, A) returns:

     Seeing no match for smtp.example.com as Step 3.a, the response will
     have to be from 3.b or 3.c.  It looks like 3.b is not the right Step
     either as *.example.com is not in the path to smtp.example.com.  So
     it looks like 3.c.

     Looking into 3.c, we are now trying to match types, or "chase" a CNAME
     (as the other part of the draft proposes).  There are no A records, so
     it looks like the answer is either:

     ANSWER(0)

     or:

     AUTHORITY(2): smtp.example.com IN NS (x2)

     It comes down to the meaning of the word "match" in the last paragraph
     of 3.c.  If we are deciding between 3.a or 3.b, meaning that the query
     name is a cut point, the presence of the NS occludes the A.  Does that
     constitute a "match?"

     I've also been given a third choice - not bother to answer the question.
     IOW - leave it unspecified.  I'm assuming that this isn't a generally
     held position, but I ought to check.

     Oh, and there's another problem, the "conundrum." Is the synthesis of
     the (smtp.example.com IN NS) set legal?  To separate the issue, I'll use
     another query.

QUERY Q(smtp.example.com, NS) returns:

     In this case, we are in Step 3.c, with the NS matching exactly.

     The problem is:

     Assuming the child (and not the parent) is authoritative for the NS set,
     is it legal for the parent to synthesize the child NS set?

     The irony here is, by following established rules in generating the NS
     set for the answer (here it is the answer and not the referral because
     we've fallen into step c) the parent has delegated away the authority
     for the name.  The parent is no longer allowed to answer for this. In
     hindsight, the answer ought to have come from 3.b - but we didn't know
     to go there until we stepped halfway through 3.c.

(Is it the jet lag, or is this stuff really muddy?)
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>