Subject: Re: [Enum] Fwd: [Sipping] I-D ACTION:draft-ietf-sipping-e164-03.t xt

From: Marian Durkovic <[email-masked]>
Date: Sun, 6 Jul 2003 10:42:40 +0200

> Major problem: 5.3
>    "Authors of
>    records intended to be used for SIP applications SHOULD always use a
>    greedy regexp; no use-cases have been identified today in which a
>    different antecedent is necessary."
> 
> I strongly object this.
> First, the use of regular expessions is a feature in ENUM and DDDS,
> second, there are use cases (e.g. in wildcards) and
> third, if there is no-use cases, why is are regular 
> expression there in
> the first place?

Hi all,

   we're heavily using the wildcards in Slovak ENUM trial for pointing all the
numbers behind a PBX to the VoIP gateway attached to this PBX. Here is the
example:

   the PBX prefix +421-55555-xxx  (number not real) 

The DNS:

$ORIGIN 5.5.5.5.5.1.2.4.e164.arpa.
* IN  NAPTR   100 10 "u" "E2U+sip" "!^\\+42155555(.*)$!sip:1\\[email-masked]!" .

Thus when one calls +421-55555-777 the above rule replaces it with
sip:[email-masked]

  I really refuse to put 1000 NAPTR records into DNS just to get the same
functionality. If someone wants to arrange things in a different way,
the exact NAPTR record can still be put into DNS and it overrides the
wildcard one.

  I've seen similar examples in Swedish ENUM trial, so I fully support the 
objection against the requirement for greedy regexpr.

	With kind regards,

		M.

--------------------------------------------------------------------------
----                                                                  ----
----   Marian Durkovic                       network  manager         ----
----                                                                  ----
----   Slovak Technical University           Tel: +421 2 524 51 301   ----
----   Computer Centre, Nam. Slobody 17      Fax: +421 2 524 94 351   ----
----   812 43 Bratislava, Slovak Republic    E-mail: [email-masked]        ----
----                                                                  ----
--------------------------------------------------------------------------

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Patrik Fältström <[email-masked]>
Date: Sun, 6 Jul 2003 15:01:42 +0200

Can we please keep the discussions about the wildcard in DNS separate  
from the regular expression in NAPTR as separate as possible?

     paf

On söndag, jul 6, 2003, at 10:42 Europe/Stockholm, Marian Durkovic  
wrote:

> ----                                                                   
> ----
> ----                                                                   
> ----
> ----                                                                   
> ----

---

From: Marian Durkovic <[email-masked]>
Date: Sun, 6 Jul 2003 18:10:04 +0200

> from the regular expression in NAPTR as separate as possible?

I don't think this is fully possible. If you want to use wildcard in DNS,
you must use non-greedy regular expression with a subpattern ( ) to extract
and reuse the digits matched by the wildcard:

    With kind regards,

         M.

---

From: Patrik Fältström <[email-masked]>
Date: Sun, 6 Jul 2003 18:31:48 +0200

On söndag, jul 6, 2003, at 18:10 Europe/Stockholm, Marian Durkovic 

> "!^\\+42155555(.*)$!sip:1\\[email-masked]!" .

Yes, you are absolutely correct. And one can say dependencies exists in 
the other direction as well.

BUT, today I still see a large number of arguments (especially when 
looking at DNSSEC) from a pure DNS perspective to _not_ use wildcards 
in DNS.

My point is that that is not enough as an argument for removing the 
regular expression in the NAPTR for ENUM. It is needed anyway, and I 
gave an example.

You say you don't want a million NAPTR records in your DNS server, and 
I can understand that given the most common provisioning mechanisms 
which exists.

The IETF do though concentrate on what goes on the wire between hosts, 
and not so much of how things are inside the host itself.

I.e. you might have some DNS software that you can configure given some 
kind of wildcard, BUT, it will not be a wildcard from a DNS 
perspective. That is a very very big difference. The wildcard in DNS 
have many side effects -- most of them today felt being negative.

     paf

---

From: "Conroy, Lawrence (SMTP)" <[email-masked]>
Date: Sun, 6 Jul 2003 23:16:20 +0100

At 6:31 pm +0200 6/7/03, Patrik Fältström wrote:
>On söndag, jul 6, 2003, at 18:10 Europe/Stockholm, Marian Durkovic wrote:
>
>Yes, you are absolutely correct. And one can say dependencies exists 
>in the other direction as well.
>
>looking at DNSSEC) from a pure DNS perspective to _not_ use 
>wildcards in DNS.
>
>You say you don't want a million NAPTR records in your DNS server, 
>and I can understand that given the most common provisioning 
>mechanisms which exists.
>
>The IETF do though concentrate on what goes on the wire between 
>hosts, and not so much of how things are inside the host itself.
>
>I.e. you might have some DNS software that you can configure given 
>some kind of wildcard, BUT, it will not be a wildcard from a DNS 

Hi Patrik, Marian, folks,
   I'll have one more try.
I *did* reset the thread name. Folk must have missed the "Use of 
Wildcards in ENUM";
this topic is not specific to using ENUM in sip, but...Hey ho.

Re. DNS Wildcards - these can exist and can be used, albeit they are dangerous.
What goes over the wire should be a standard DNS response message *as if the
DNS request* had matched the query domain as requested, with several 
big gotchas
to make life interesting.

Using a DNS Wildcard is NOT the same as provisioning a whole raft of similar
entries into the DNS server using some sensible software, IMHO; the effect may
be the same, or may not, depending on other entries - that's one reason why DNS
wildcards are risky.

Listing the caveats in DNS wildcard use for ENUM seems like a good idea to me,
as, at first, they look like they are very useful. This means that there WILL
be these in ENUM DNS server configurations, so at least a "here's some hints
on detecting and debugging problems with these" would be useful.

Yes, it's a standard DNS issue and should be in the FAQ, but they look like
a natural for ENUM with number ranges being reflected as sub-domains, so I
suspect they WILL be an issue that ENUM folk will hit more than most.

BTW, I will have a range that directs to an attendant, and so could be done
with a DNS wildcard *without* a non-greedy regexp - these ARE separable issues.

all the best,
   Lawrence
-- 
-----------------------------------------------------------------------
Roke Manor Research    : This information is provided "as is" and is not
<mailto:[email-masked]>: intended to create any contractual or legal
<tel:+441794833666>    : relationship.

---

From: "Conroy, Lawrence (SMTP)" <[email-masked]>
Date: Sun, 6 Jul 2003 23:26:13 +0100

>with a DNS wildcard *without* a non-greedy regexp - these ARE 

What I actually meant to say was:
  BTW, I will have a range that directs to an attendant, and so could be done
with a DNS wildcard *without* a greedy regexp - these ARE separable issues.

Time for bed.

all the best,
   Lawrence

---

From: Michael Haberler <[email-masked]>
Date: Mon, 07 Jul 2003 16:38:46 +0200

At 18:31 06.07.2003 +0200, Patrik Fältström wrote:

The IETF do though concentrate on what goes on the wire between hosts, and 
not so much of how things are inside the host itself.

>kind of wildcard, BUT, it will not be a wildcard from a DNS perspective. 
>That is a very very big difference. The wildcard in DNS have many side 
>effects -- most of them today felt being negative.

that is quite an elegant idea - if I get you right you propose to PROVISION 
it as a wildcard, have special code interpret it and give specific  answers 
if the wildcard would match in the status ante scenario

however - do i get this right that this will break zone transfer as we know 
it? and I'm fuzzy what the DNSsec implications are - I would assume you 
cant sign a record which isnt in the zone

Or do you propose to have a wildcard in the zone, and have the server 
interpret it differently - i.e giving a matching non-wildcard response?

those with working ENUM trials;) have a strong interest in a good solution 
of this problem (enumeration of number space != good)

if we can reach consensus as to how to provision this and what the 
semantics are, we might have a non-problem afterall and we instead could go 
home and build the damn thing

maybe we should just cook up a syntax for a bind9 config file and a semantics

-Michael

---

From: Jim Reid <[email-masked]>
Date: Mon, 07 Jul 2003 07:54:18 -0700

>>>>> "Michael" == Michael Haberler <[email-masked]> writes:

    Michael> maybe we should just cook up a syntax for a bind9 config
    Michael> file and a= semantics

Please don't confuse the DNS protocol with an implementation of that
protocol. In all probability a "solution" based around BIND9 is not
likely to be practical in the long run. If/when ENUM takes off, the
datasets are going to be 1-2 orders of magnitude bigger than what's in
the DNS today, maybe more. [Compare the number of registrations or
domain names under .at with the number of phones in Austria for
example.] Managing and provisioning these sorts of datasets with BIND9
text files will be very, very painful. They may even be unworkable.

---

From: Michael Haberler <[email-masked]>
Date: Mon, 07 Jul 2003 17:02:57 +0200

did that math - that's why we are not running bind9 for 3.4.e164.arpa; we 
run a server straight off a database

I really dont care about the vehicle, I just assumed a bind9 config option 
would serve well as an operational specification and guideline for the rest 
of us

So what would you propose instead?

-Michael

---

From: Patrik Fältström <[email-masked]>
Date: Mon, 7 Jul 2003 17:24:34 +0200

On måndag, jul 7, 2003, at 16:38 Europe/Stockholm, Michael Haberler 
wrote:

> however - do i get this right that this will break zone transfer as we 
> know it? and I'm fuzzy what the DNSsec implications are - I would 
> assume you cant sign a record which isnt in the zone

The proposal I saw talked about using a wildcard in DNS, which is a 
very very special thing in the DNS specification. What I saw the 
proposal talked about was a "simple" way of specifying what to do with 
not all possible labels in a zone (which DNS wildcard help with) but 
instead what happens with the labels which matches the syntax of an 
ENUM NAPTR. (Just digits, one digit in each label.

Those are two very different things.

And, what you talk about above are some of the issues with Wildcards.

What I said was not that wildcards in dns should not be used, but, as 
Jim says, it should be as the absolute last resort, and the one 
choosing to use wildcards must know about the implications.

    paf