[dnsext] DNAME with exceptions - work-around found

[Brian Dickson <[e-mail]>]

I've been giving more thought to the issue of DNAME vs "exceptions", and
checked both RFC 2672, and the current draft 2672-bis.

The following is *technically* allowed, and *definitely* evil.

But, at least in the current latest bind implementation I've checked (bind
9.7.1-P2), it actually works, with no modifications to the protocol or the
code.

Which means, if folks agree that this is a reasonable hack to allow use of,
it may be possible to implement all the desired features and functions for
"the same" using just a slightly-modified SHADOW.
(And suitable additional discussion in 2672-bis, for which if needed I am
willing to supply text.)

Here's the trick - on the authority server, serve up more-specific zone(s)
as needed, whose owner would have been a descendant of one of the DNAMEs
used to make things "the same".

Being "deeper" in the tree, it is found first. And not being in the same
zone, it is technically allowed, although strongly discouraged (SHOULD NOT
is the language in -bis).


So, the modifications to SHADOW would be:
Place exceptions in per-SHADOW-zone more-specific zones (generating the zone
files and conf files as needed)
Normal SHADOW zones consist of apex copies of Amber apex, plus DNAME of
Amber zone (per the previous suggestion, was it Olaf?)
(Delegations to signed SHADOW zones might not handle "exceptions" properly,
or at all, or some additional fix-ups may make them possible.)

Brian


Here's an example of it in use (apologies for the bind-specific bits):

/etc/named.conf (relevant bits anyway):

zone "foo.example.com" IN {
    type master;
    file "foo.example.zone";
    allow-update { none; };
    };

zone "bar.example.com" IN {
    type master;
    file "bar.example.zone";
    allow-update { none; };
    };

zone "bar.foo.example.com" IN {
    type master;
    file "bar.foo.example.zone";
    allow-update { none; };
    };


file bar.example.zone:

$TTL    86400
$ORIGIN bar.example.com.
@            1D IN SOA    @ root (
                    42        ; serial (d. adams)
                    3H        ; refresh
                    15M        ; retry
                    1W        ; expiry
                    1D )        ; minimum

            1D IN NS    ns1.bar.example.com.
ns1.bar.example.com.    1D IN A        127.0.0.1 ;glue record
foo            1D IN TXT    "foo.bar.example.com is what is in the zone.
Where did you find this record?"
bar            1D IN TXT    "bar.bar.example.com is what is in the zone.
Where did you find this record?"
foo.bar            1D IN TXT    "foo.bar.bar.example.com is what is in the
zone. Where did you find this record?"


file bar.foo.example.zone:

$TTL    86400
$ORIGIN bar.foo.example.com.
@                1D IN SOA    @ root (
                    42        ; serial (d. adams)
                    3H        ; refresh
                    15M        ; retry
                    1W        ; expiry
                    1D )        ; minimum

                1D IN NS    ns1.bar.foo.example.com.
ns1.bar.foo.example.com.    1D IN A        127.0.0.1 ;glue record
foo                1D IN TXT    "foo.bar.foo.example.com is what is in the
zone. Where did you find this record?"


file foo.example.zone:

$TTL    86400
$ORIGIN foo.example.com.
@            1D IN SOA    @ root (
                    42        ; serial (d. adams)
                    3H        ; refresh
                    15M        ; retry
                    1W        ; expiry
                    1D )        ; minimum

            1D IN NS    ns1.foo.example.com.
            1D IN DNAME    bar.example.com.
ns1.foo.example.com.    1D IN A        127.0.0.1 ;glue record
foo            1D IN TXT    "foo.foo.example.com is what is in the zone.
Where did you find this record?"
bar            1D IN TXT    "bar.foo.example.com is what is in the zone.
Where did you find this record?"
foo.bar            1D IN TXT    "foo.bar.foo.example.com is what is in the
zone. Where did you find this record?"
; NB - the above are, if present, occluded by the DNAME.


And the results:

bash-3.2# dig @127.0.0.1 TXT foo.foo.example.com

; <<>> DiG 9.4.3-P3 <<>> @127.0.0.1 TXT foo.foo.example.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64694
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;foo.foo.example.com.        IN    TXT

;; ANSWER SECTION:
foo.example.com.    86400    IN    DNAME    bar.example.com.
foo.foo.example.com.    0    IN    CNAME    foo.bar.example.com.
foo.bar.example.com.    86400    IN    TXT    "foo.bar.example.com is what
is in the zone. Where did you find this record?"

;; AUTHORITY SECTION:
bar.example.com.    86400    IN    NS    ns1.bar.example.com.

;; ADDITIONAL SECTION:
ns1.bar.example.com.    86400    IN    A    127.0.0.1

;; Query time: 13 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Sep 10 17:24:05 2010
;; MSG SIZE  rcvd: 206

bash-3.2# dig @127.0.0.1 TXT foo.bar.example.com

; <<>> DiG 9.4.3-P3 <<>> @127.0.0.1 TXT foo.bar.example.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38887
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;foo.bar.example.com.        IN    TXT

;; ANSWER SECTION:
foo.bar.example.com.    86400    IN    TXT    "foo.bar.example.com is what
is in the zone. Where did you find this record?"

;; AUTHORITY SECTION:
bar.example.com.    86400    IN    NS    ns1.bar.example.com.

;; ADDITIONAL SECTION:
ns1.bar.example.com.    86400    IN    A    127.0.0.1

;; Query time: 11 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Sep 10 17:24:18 2010
;; MSG SIZE  rcvd: 159

bash-3.2# dig @127.0.0.1 TXT foo.bar.foo.example.com

; <<>> DiG 9.4.3-P3 <<>> @127.0.0.1 TXT foo.bar.foo.example.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36569
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;foo.bar.foo.example.com.    IN    TXT

;; ANSWER SECTION:
foo.bar.foo.example.com. 86400    IN    TXT    "foo.bar.foo.example.com is
what is in the zone. Where did you find this record?"

;; AUTHORITY SECTION:
bar.foo.example.com.    86400    IN    NS    ns1.bar.foo.example.com.

;; ADDITIONAL SECTION:
ns1.bar.foo.example.com. 86400    IN    A    127.0.0.1

;; Query time: 7 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Sep 10 17:24:25 2010
;; MSG SIZE  rcvd: 167