Subject: Re: thesaurus attack

From: Edward Lewis <[email-masked]>
Date: Wed, 8 Sep 2004 12:20:43 -0400

At 10:13 -0400 9/8/04, Edward Lewis wrote:
>As far as "is it doable" - a lot of text has already been floated showing how
>the matching is "supposed to" work in the face of interior "*"s.  No one
>pointed out a problem with it until the words in 1034 were raised.

In another conversation, it was pointed out that I should mention 
where this text is.  It's in a retired version of the wcard draft, 
but available here:

http://www.potaroo.net/ietf/old-ids/draft-ietf-dnsext-wcard-clarify-00.txt

Look in "Appendix A."

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Robert Elz <[email-masked]>
Date: Thu, 09 Sep 2004 08:14:32 +0700

Date:        Wed, 8 Sep 2004 10:13:39 -0400
    From:        Edward Lewis <[email-masked]>
    Message-ID:  <a06020407bd64c0ca0a9b@[192.136.136.102]>

  | I'll float this idea.  It's an idea, I think it can work, but it's up 
  | to the WG.
  | 
  | REMOVE the restriction in 1034: "<anydomain> should not contain other 
  | * labels".

I am all in favour of that, I don't think that restriction ever
made sense.

However...

  | This opens the protocol to places it's not been, so there's no danger 
  | to old code.

No.   It doesn't.   The extra '*' labels don't magically work as
wildcards, the lookup algorithm in 4.3.2 or 1034 would continue
unchanged.

The text that was in Appendix A of the wildcard draft is certainly
not needed, not that, or anything like it.   And explain the way
that wildcard lookups get done (with a liberal sprinkling of the words
from 1034 that explain how a '*' is an RR generator, and a complete
quashing of the notion that there is any kind of name pattern matching
happening - there isn't).

kre

---

From: Edward Lewis <[email-masked]>
Date: Fri, 10 Sep 2004 11:36:13 -0400

Asking for clarification...

>wildcards, the lookup algorithm in 4.3.2 or 1034 would continue

So, looking at an example I used in another message, *.example.com is 
not a wildcard (synthesis source) because there's a 
*.bar.*.example.com?

>happening - there isn't).

Do you think the text in Appendix A is wrong?

Just to make sure the text is preserved in the archives, here is Appendix A:

Appendix A: Subdomains of Wild Card Domain Names

In reading the definition of section 2 carefully, it is possible to
rationalize unusual names as legal.  In the example given, *.example.
could have subdomains of *.sub.*.example. and even the more direct
*.*.example.  (The implication here is that these domain names own
explicit resource records sets.)  Although defining these names is not
easy to justify, it is important that implementions account for the
possibility.  This section will give some further guidence on handling
these names.

The first thing to realize is that by all definitions, subdomains of
wild card domain names are legal.  In analyzing them, one realizes
that they cause no harm by their existence.  Because of this, they are
allowed to exist, i.e., there are no special case rules made to disallow
them.  The reason for not preventing these names is that the prevention
would just introduce more code paths to put into implementations.

The concept of "closest enclosing" existing names is important to keep in
mind.  It is also important to realize that a wild card domain name can
be a closest encloser of a query name.  For example, if *.*.example. is
defined in a zone, and the query name is a.*.example., then the closest
enclosing domain name is *.example.  Keep in mind that the closest
encloser is not eligible to be a source of synthesized answers, just the
subdomain of it that has the first label "*".

To illustrate this, the following chart shows some matches.  Assume that
the names *.example., *.*.example., and *.sub.*.example. are defined
in the zone.

        QNAME                Closest Encloser   Wild Card Source
        a.example.           example.           *.example.
        b.a.example.         example.           *.example.
        a.*.example.         *.example.         *.*.example.
        b.a.*.example.       *.example.         *.*.example.
        b.a.*.*.example.     *.*.example.       no wild card
        a.sub.*.example.     sub.*.example.     *.sub.*.example.
        b.a.sub.*.example.   sub.*.example.     *.sub.*.example.
        a.*.sub.*.example.   *.sub.*.example.   no wild card
        *.a.example.         example.           *.example.
        a.sub.b.example.     example.           *.example.

Recall that the closest encloser itself cannot be the wild card.  Therefore
the match for b.a.*.*.example. has no applicable wild card.

Finally, if a query name is sub.*.example., any answer available will come
from an exact name match for sub.*.example.  No wild card synthesis is
performed in this case.

---

From: Peter Koch <[email-masked]>
Date: Fri, 10 Sep 2004 20:50:40 +0200

> not a wildcard (synthesis source) because there's a 

I'd say it is as long as there are RRSets owned by *.example.com, which
was the case in your example. Now if you left out the ``TXT 1'' RR from

> *               TXT    1
> bar.*           TXT    2
> *.bar.*         TXT    3

there'd be a '*' label as an empty non-terminal. To avoid empty terminals,
this should not instantiate '*.example.com' as a wildcard. However, that
conflicts with step 3 of the algorithm in 1034.

> Appendix A: Subdomains of Wild Card Domain Names

Applying the split terminology 'asterisk label' vs. wildcard could clarify
a lot here.

>         b.a.*.*.example.     *.*.example.       no wild card

[...]

> the match for b.a.*.*.example. has no applicable wild card.

Applying the rule "it's just a star" I find this difficult to understand
and inconsistent with the idea that the wildcard covering all subtrees.
What about *.*.example. as a QNAME? That would be covered by closest
encloser *.example. and *.*.example.com as a wildcard source.

-Peter

---

From: Robert Elz <[email-masked]>
Date: Sat, 11 Sep 2004 03:08:56 +0700

Date:        Fri, 10 Sep 2004 11:36:13 -0400
    From:        Edward Lewis <[email-masked]>
    Message-ID:  <a06020409bd677918a675@[192.168.1.100]>

  | Asking for clarification...

  | So, looking at an example I used in another message, *.example.com is 
  | not a wildcard (synthesis source) because there's a 
  | *.bar.*.example.com?

No (I agree with your 3 "yes" answers).

But you can really only talk about a wildcard in the context of a
particular query, in some queries a '*' is a wildcard, in others it
is not.

  | Do you think the text in Appendix A is wrong?

Yes, some of it - but the worst is that it isn't explaining things
in the correct way.   Giving lists of domain names with '*'s in
them makes things look like patterns, and people are tempted to
do pattern matching.   That way gets very confusing, and the
answers people start assuming end up all over the place.   I don't
think any of the answers from the examples is wrong, just the way
it is explained.

  | The first thing to realize is that by all definitions, subdomains of
  | wild card domain names are legal.

This makes no sense, sub-domains of a domain which is *.xxx are legal,
but if it (*.xxx) is being used as a wildcard, it ends any query, whether
or not the '*' might have sub-domains is irrelevant.

  | The concept of "closest enclosing" existing names is important to keep in
  | mind.

Yes, though I'm not real sure I like that term - but I'm not sure what
would be a better one.

  | It is also important to realize that a wild card domain name can
  | be a closest encloser of a query name.

Not a wildcard domain, a '*' label.

  | For example, if *.*.example. is defined in a zone,

That's irrelevant here, but you do need to assume that *.example.com is
defined.

  | and the query name is a.*.example., then the closest
  | enclosing domain name is *.example.

"... which is not a wildcard, but simply a domain".

  | Keep in mind that the closest
  | encloser is not eligible to be a source of synthesized answers, just the
  | subdomain of it that has the first label "*".

That is, if there is a sibling domain (child of the same parent) for
the rightmost domain that does not explicitly exist, and that sibling
is '*', then any RRs it owns which are the same type as te QTYPE are
the answer returned for the QNAME.   If there are no RR's of the appropriate
type, NODATA is returned (shouldn't be using bindisms, but here everyone knows 
what I mean).

  | To illustrate this, the following chart shows some matches.  Assume that
  | the names *.example., *.*.example., and *.sub.*.example. are defined
  | in the zone.

... and that there are no other '*' labels in (or below) example.
(without that, some of the answers below might be wrong).   You also need
to assume that various other domains don't exist (like a.example).

  |         QNAME                Closest Encloser   Wild Card Source
  |         a.example.           example.           *.example.
  |         b.a.example.         example.           *.example.
  |         a.*.example.         *.example.         *.*.example.
  |         b.a.*.example.       *.example.         *.*.example.
  |         b.a.*.*.example.     *.*.example.       no wild card
  |         a.sub.*.example.     sub.*.example.     *.sub.*.example.
  |         b.a.sub.*.example.   sub.*.example.     *.sub.*.example.
  |         a.*.sub.*.example.   *.sub.*.example.   no wild card
  |         *.a.example.         example.           *.example.
  |         a.sub.b.example.     example.           *.example.
  | 
  | Recall that the closest encloser itself cannot be the wild card.

This is a direct contradiction of what was said earlier ...

	It is also important to realize that a wild card domain name can
	be a closest encloser of a query name.

  | Therefore
  | the match for b.a.*.*.example. has no applicable wild card.

the reason is that *.*.example. is the longest match (closest encloser),
as there is no a.*.*.example. (we're assuming, without stating it) and
there is no *.*.*.example which would be the only candidate to be the
wildcard.

  | Finally, if a query name is sub.*.example., any answer available will come
  | from an exact name match for sub.*.example.  No wild card synthesis is
  | performed in this case.

But if the lookup is algorithm is clear, none of this should be needed.
Just make it plain that it is possible for any string to be a domain
name label, including '*', and that those strings can match exactly against
the same string in the QNAME.

To be a wildcard, there's only ever one possibility - a '*' label which is a
sibling of the rightmost label in the QNAME which is not explicitly present
in the DNS tree.

kre

---

From: Edward Lewis <[email-masked]>
Date: Mon, 13 Sep 2004 16:26:40 -0400

>or not the '*' might have sub-domains is irrelevant.

I don't see a difference between what you are saying and what I had said.

>Yes, though I'm not real sure I like that term - but I'm not sure what

If you imagine the name space as a two-dimensional field (like the 
Venn diagrams I learned sets from), domains would be nested.  That's 
where the notion of "closest enclosure" comes from.  It's not so 
clear if you think of the stick and node tree diagram.

>Not a wildcard domain, a '*' label.

I think there's an obvious terminology problem.

A wild card domain has become too overloaded I think, that's why I've 
floated "source of synthesis" or "synthesis source."

The closest encloser is the smallest domain surrounding the query 
(search) name.  The source of synthesis would be the domain inside 
the closest encloser that is identified by the label '*' - no matter 
whether there are other names in the "source of synthesis'" domain.

>"... which is not a wildcard, but simply a domain".

Given a query (name, type, class), there is a closest encloser and 
there may be a source of synthesis.  The two can never be the same.

But, what is a closest encloser for one query may be the source of 
synthesis for another query.

(E.g., *.example.com could be the closest encloser for 
foo.*.example.com and it *could* be the source of synthesis for 
foo.example.com.)

>This is a direct contradiction of what was said earlier ...

I don't see that.  "the wild card" = "source of synthesis" is what I 
meant.  Perhaps if the interpretation is "wild card" means 
"*.something" yea.  That's why I think we need to update the 
terminology.

>	be a closest encloser of a query name.

I thought that was what I was saying in Appendix A.

>the same string in the QNAME.

I'm furrowing my brow now because I thought it was clear that the 
algorithm wasn't clear. ;)  Implementations have diverged, as 
evidence...

---

From: Ben Laurie <[email-masked]>
Date: Tue, 14 Sep 2004 12:00:48 +0100

> or not the '*' might have sub-domains is irrelevant.

I find this very confusing. Are you saying that if *.xxx is being used 
as a wildcard, that's because the query didn't match any of the 
subdomains, and that's why they're irrelevant?

> to assume that various other domains don't exist (like a.example).

It would probably best to present a complete zone file.

Cheers,

Ben.

-- 
ApacheCon! 13-17 November! http://www.apachecon.com/

http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff