Subject: AW: [Enum] Fwd: [Sipping] I-D ACTION:draft-ietf-sipping-e164-03.t xt

From: "Martin Streller" <[email-masked]>
Date: Mon, 7 Jul 2003 10:42:45 +0200

Hello Patrik,

>The wildcard in DNS 
>have many side effects -- most of them today felt being negative.

you may admit such a statement is a bit vague and nebulous.

Given an example like Marian's or mine - what are the definite 
side effects that you feel negative about ?

Martin

-----Ursprüngliche Nachricht-----
Von: Patrik Fältström [mailto:[email-masked]]
Gesendet: Sonntag, 6. Juli 2003 18:32
An: Marian Durkovic
Cc: [email-masked]; [email-masked]
Betreff: Re: [Enum] Fwd: [Sipping] I-D
ACTION:draft-ietf-sipping-e164-03.t xt

On söndag, jul 6, 2003, at 18:10 Europe/Stockholm, Marian Durkovic 
wrote:

> On Sun, Jul 06, 2003 at 03:01:42PM +0200, Patrik Fältström wrote:
>> Can we please keep the discussions about the wildcard in DNS separate
>> from the regular expression in NAPTR as separate as possible?
>
> I don't think this is fully possible. If you want to use wildcard in 
> DNS,
> you must use non-greedy regular expression with a subpattern ( ) to 
> extract
> and reuse the digits matched by the wildcard:
>
> $ORIGIN 5.5.5.5.5.1.2.4.e164.arpa.
> * IN  NAPTR   100 10 "u" "E2U+sip"  
> "!^\\+42155555(.*)$!sip:1\\[email-masked]!" .

Yes, you are absolutely correct. And one can say dependencies exists in 
the other direction as well.

BUT, today I still see a large number of arguments (especially when 
looking at DNSSEC) from a pure DNS perspective to _not_ use wildcards 
in DNS.

My point is that that is not enough as an argument for removing the 
regular expression in the NAPTR for ENUM. It is needed anyway, and I 
gave an example.

You say you don't want a million NAPTR records in your DNS server, and 
I can understand that given the most common provisioning mechanisms 
which exists.

The IETF do though concentrate on what goes on the wire between hosts, 
and not so much of how things are inside the host itself.

I.e. you might have some DNS software that you can configure given some 
kind of wildcard, BUT, it will not be a wildcard from a DNS 
perspective. That is a very very big difference. The wildcard in DNS 
have many side effects -- most of them today felt being negative.

     paf

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Patrik Fältström <[email-masked]>
Date: Mon, 7 Jul 2003 11:35:09 +0200

On måndag, jul 7, 2003, at 10:42 Europe/Stockholm, Martin Streller 

> side effects that you feel negative about ?

(1) If you have an owner which have a CNAME, you can not have any other 
RR with the same owner. Many many people fail on this (for example, 
they add an MX record).
(2) The implications with DNSSEC is not known in enough detail. 
Especially when looking at negative caching. Yes, compared to some 6-12 
months ago, there are ideas on how it might work, but the proposal is 
still to run wildcards in either a delegated zone which is not secure, 
or you synthesize your records, which in turn means you need to have 
the private key online.
(3) It is easy to forget the wildcard when you later need to delegate 
something, and understand the implications (together with (1) above).

But, the largest problems are with (1) and (2).

As DNSSEC is important for ENUM, I rather stay away from wildcards. The 
wildcards _can_ be simulated by either generating many records, or by 
having a DNS server which synthesizes the records.

Another problem when you do ENUM is that there will be responses if 
someone query for for example:

  NAN.1.2.3.4.6.4.e164.arpa. + IN + NAPTR

and in the DNS I have

  *.1.2.3.4.6.4.e164.arpa. IN NAPTR ....

I don't like that. You might want to store other RR types with similar 
names in the same hierarchy, for example SRV records (which Microsoft 
Active Directory uses heavily) or whatever.

     paf

---

From: Marian Durkovic <[email-masked]>
Date: Mon, 7 Jul 2003 14:51:13 +0200

OK, but all this still translates to me as "use with care" and not as 
"don't use at all". Sure the DNS admins should be aware of the issues
described in RFC1912. Regarding the DNSSEC, ENUM could perhaps apply the 
attitude described in draft-ietf-dnsext-dns-threats-03.txt:

     ...since the alternative of giving up wildcards entirely is not 
     practical due to widespread use, we are going to have to live with 
     wildcards, and the question just becomes one of whether or not the 
     proposed optimizations would make DNSSEC's wildcard proof mechanisms 
     more or less fragile.

Anyway, the original topic was, that we all should always use a greedy
regexpr which is (not only but also) due to possible use in wildcards
and/or in synthesizing DNS servers certainly not a good idea.

	With kind regards,

		M.

---

From: Jim Reid <[email-masked]>
Date: Mon, 07 Jul 2003 07:20:06 -0700

>>>>> "Marian" == Marian Durkovic <[email-masked]> writes:

    Marian> OK, but all this still translates to me as "use with care"
    Marian> and not as "don't use at all". Sure the DNS admins should
    Marian> be aware of the issues described in RFC!912. Regarding the
    Marian> DNSSEC, ENUM could perhaps apply the attitude described in
    Marian> draft-ietf-dnsext-dns-threats-03.txt:

I strongly disagree with you. DNS wildcards are at best a last
resort. They should only be considered when it is proven there is no
other viable alternative. That's my take on what Patrik has said. Most
clueful DNS people share that perspective. [Or, like me, they take a
more extreme position and say wildcard RRs are evil and to be avoided
at all costs.] So far, it's not been demonstrated why this proposed
wildcard RR is essential or why there are no other viable options.

The issues surrounding DNSSEC are just one part of the wildcarding
problem. Until these are fully understood, it would be prudent not to
advocate or deploy ENUM solutions/specifications that depended on
wildcard RRs. We know DNSSEC *is* going to figure in ENUM one day.
Having to cope with the signing (or non-signing) of wildcards is too
much of a leap into the dark. This needs to be worked out and
documented.

It also looks to me like the wildcard NAPTR RR has been proposed here
to kludge around name server provisioning issues. If that's the case,
wouldn't it be better to solve the underlying problem?

---

From: Bill Manning <[email-masked]>
Date: Mon, 7 Jul 2003 09:26:00 -0700 (PDT)

draft-lewis-dns-wildcard-clarify-00.txt

is worth a read, for those who have expectations on the use of wildcards.
Ed would appreciate feedback.

--bill
Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).