Subject: Re: Draft DNSEXT @ IETF62 Minutes

From: Edward Lewis <[email-masked]>
Date: Fri, 25 Mar 2005 15:14:56 -0500

Mostly to clean up characters in the WCard 
discussion, just one rewrite for clarity.  (Put 
my suggested replacement paragraph after the 
original for cut and paste ease.)

At 12:05 +0100 3/21/05, Olaf M. Kolkman wrote:

>Minutes of the DNSEXT working group
>62nd IETF, Minneapolis, USA
>9 March 2005

>Wildcard Document
>=================
...
>(Discussion)
>
>Rob Austein: In what way couldn't DNSSEC sign it?
>
>Ed Lewis: Lets say I am going through the algorithm for answering
>“a.example” and the qtype is “NS”. What is would do in that situation
>is go through the zone and fine no a, then I’d go to star and then I’d
>match the * NS. According to wildcard normal rules, a.example NS will
>expand into the answer section. I am required to have a signature there,
>I cant put the signature in there. To make this legal I have to change
>the protocols document so that signers would have to sign this
>particular case.. if there was a signature there, the problem is the sig
>would be signed by the wrong authority.

Ed Lewis: Lets say I am going through the algorithm for QNAME
"a.example." and the QTYPE is NS.  What would be done in that situation
is go through the zone and fine no "a" label so I'd go to star("*") and
match the * NS.  According to wildcard normal rules, "a.example NS" will
expand into the answer section. I am required to have a signature there,
but there is no signature to put there.  To make this legal I have to change
the  DNSSECbis protocols document so that signers would have to sign this
particular case.  If there was a signature there, the problem is the sig
would be signed by the wrong authority.

>Rob Austein: My problem is this seems to be a special case to deal with
>garbage input. I'd rather not have special case rules to handle zones
>like these.
>
>Lars Liman:  What you’re looking at is an NS record in the parent zone,
>and you are worrying about the signature of that, but it is not going to
>be signed in the parent zone. If you ask the parent server for a deleg
>NS, are you supposed to get an answer, or a referral?
>
>Ed Lewis: If you look at the algorithm, there are three parts: (a) a
>direct match, (b) a delegation point, and (c) a closest encloser. Then I
>answer with a wildcard, no wildcard etc. When I come down I  don’t see
>the cut point, it is not on my search point, so B doesn’t work.

Ed Lewis: If you look at the algorithm, there are three parts: (a) a
direct match, (b) a delegation point, and (c) a closest encloser., where I
answer with a wildcard or no wildcard.  When I come down I don't see
the cut point, it is not on my search point, so B doesn't work.

(To rewrite this more...The reason that the "* 
NS" does not result in a referral message when 
seeking "a.example. NS" is this.  Following the 
4.3.2 algorithm, I would fall into part C, which 
is the part in which my last matching label is at 
the closest encloser, so I am in a "wildcard or 
not situation."  Referrals are in part B, but I 
didn't enter there.)

>This is written in the draft when we enter step (a), (b) or (c), we
>don't jump across.
>
>Rob Austein: You are going to have to have a case in the ordinary
>processing for the authorittive nameserver “I know what is supposed to
>be in the zone but it wasn’t there”. As far as I can tell this covers
>this mess. It is general purpose error processing. I don’t see why we
>need a special case.

Rob Austein: You are going to have to have a case in the ordinary
processing for the authoritative nameserver "I know what is supposed to
be in the zone but it wasn't there". As far as I can tell this covers
this mess. It is general purpose error processing. I don't see why we
need a special case.

>Ed Lewis: I see what you mean – in Washington we talked of the same
>thing. I made a mistake then thinking there would be a signature there.
>With no sig there we would have to let the validator know it is a weird
>case. We have to do some editing somewhere and the group on Monday felt
>this is the best place to do the edits. Text will be coming to describe it.

Ed Lewis: I see what you mean, in Washington we talked of the same
thing. I made a mistake then thinking there would be a signature there.
With no sig there we would have to let the validator know it is a weird
case. We have to do some editing somewhere and the group on Monday felt
this is the best place to do the edits. Text will be coming to describe it.

>If the type is not NS, there is no problem. Only when it is an NS or a
>DS do we get anything back and there is where there is a concern.
>
>This is how the rule would be changed in 1034. If some label has an
>impossible match, look for existence of the star label, and does not own
>an NS RRSet nor a DNAME RRSet. Treat a * NS or * DNAME as “not there”.

This is how the rule would be changed in 1034. If some label has an
impossible match, look for existence of the star label, and does not own
an NS RRSet nor a DNAME RRSet. Treat a * NS or * DNAME as name "not there".

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Achieving total enlightenment has taught me that ignorance is bliss.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Thu, 31 Mar 2005 11:34:47 +0200

On Fri, 25 Mar 2005 15:14:56 -0500

> original for cut and paste ease.)

I did the cleanup and as far as I remember your suggested rewrite
reflects what was said in the meeting.  So in its context this would
read:

 Lars Liman:  What you're looking at is an NS record in the parent zone, 
 and you are worrying about the signature of that, but it is not going to 
 be signed in the parent zone. If you ask the parent server for a deleg 
 NS, are you supposed to get an answer, or a referral?

 Ed Lewis: If you look at the algorithm, there are three parts: (a) a
 direct match, (b) a delegation point, and (c) a closest encloser.,
 where I answer with a wildcard or no wildcard.  When I come down I
 don't see the cut point, it is not on my search point, so B doesn't
 work.  The reason that the "* NS" does not result in a referral
 message when seeking "a.example. NS" is this.  Following the 4.3.2
 algorithm, I would fall into part C, which is the part in which my
 last matching label is at the closest encloser, so I am in a "wildcard
 or not situation."  Referrals are in part B, but I didn't enter
 there.

If no further modifications/objectsions I submit these minutes tomorrow.

-- Olaf

---------------------------------| Olaf M. Kolkman
---------------------------------| RIPE NCC
---------------------------------| JID: olaf at jabber.secret-wg.org