Re: [dbound] [DNSOP] Over on the dbound list: draft-dcrocker-dns-perimeter-00

[Bob Harold <[e-mail]>]

On Thu, Apr 4, 2019 at 10:54 AM Dave Crocker <[e-mail]> wrote:

> Bob,
>
> On 4/4/2019 7:17 AM, Bob Harold wrote:
> > I have two questions:
> >
> > If I want to separate these levels:
> > example.
> > a.example.
> > b.a.example.
> >
> > Then a.example is both a 'begin' and 'end' node.  Do I put in two
> > records,  one for 'begin' and one for 'end'?
>
> First, note that Perimeters are actually /between/ node names.  So the
> above would be:
>
>  > example.
>    {perimeter}
>  > a.example.
>    {perimeter}
>  > b.a.example.
>
> Some choices for marking these will depend upon the specific Schema that
> is defined.  So, for example, I could imagine a Schema that demands an
> 'end' above a 'begin' and I could imagine a Scheme that merely requires
> either one to be in place, or requires a specific one.



> So for a simple hierarchy there might a schema specification might
> merely mandate that each perimeter down a hierarchy be marked by a new
> 'begin':
>
>
>    {perimeter}
>
>  > example.
>    \
>     ._perim TXT begin <schema>
>
>    {perimeter}
>
>  > a.example.
>    \
>     ._perim TXT begin <schema>
>
>
>    {perimeter}
>
>  > b.a.example.
>    \
>     ._perim TXT begin <schema>
>
>
> Each _perim record, in the above sequence, for example., is declaring
> that there is a Perimeter above the associated DNS node name.
>
> but yes, the requirement might be for more verbosity:
>
>
>    {perimeter}
>
>  > example.
>    \
>     ._perim TXT begin <schema>
>     ._perim TXT end <schema>
>
>    {perimeter}
>
>  > a.example.
>    \
>     ._perim TXT end <schema>
>     ._perim TXT begin <schema>
>
>
>    {perimeter}
>
>  > b.a.example.
>    \
>     ._perim TXT end <schema>
>     ._perim TXT begin <schema>
>
> And my having to write this response makes me suspect there's some
> benefit in adding an end-begin shorthand to the specification, to reduce
> the verbosity and permit a single record to declares Perimeters both
> above and below the node.  It's purpose would be for Perimeter hierarchy
> have a one-name level, such as your example (and I suspect would be a
> common use.)
>
> Agreed.


>
> > Secondly, if I have:
> > a.example.
> > b.a.example.
> > c.a.example.
> > d.a.example.
> > ...
> > z.a.example.
> >
> > And I want to separate z.a.example, but not the others, and there are
> > often changes to the list.  Without having to mark every one, how can I
> > (as a.example), mark above the cut that z.a.example is separate?
>
> Cool.  Subset of branches.
>
>  > a.example.
>  > b.a.example.
>  > c.a.example.
>  > d.a.example.
>  > ...
>  > z.a.example.
>    \
>     ._perim TXT begin <schema>
>
> would clearly work.
>
> If there were a need to instead have a.example make the declaration, I
> don't see an obvious answer.
>

This is my concern.


> My first thought is for the Scheme to have a sub-notation, to indicate
> that the presence of the Perimeter is not for all branches, such as by
> having it list the children links it applies to.  But that's not feeling
> terribly satisfactory.
>

Not great, but probably required.  Could the RFC include a note about this
possible issue?


> d/
>
> --
> Dave Crocker
> Brandenburg InternetWorking
> bbiw.net
>
>