Re: Faux wildcards

[Pekka Savola <[e-mail]>]

On Sun, 15 Jan 2005, John R Levine wrote:
> I've been working on CSV, a simple scheme for HELO/EHLO authentication
> with Dave Crocker and some other people.  By far the knottiest question
> we've been wresting with is if and how to do wildcard-like things.
>
> For CSV we're using repurposed SRV records.  They have the fields we need,
> they're widely supported by DNS software, including software written in
> the Seattle suburbs, and the name prefixes that all SRV records have avoid
> collisions.
[...]

If you want to do wildcard-like thing, maybe wildcards is the answer, 
but not necessarily in the place you were thinking of using them..

I don't think this answers your actual question, but people have 
deployed a mechanism where information is stored in the reverse DNS; 
you'd create explicit records for the valid IP addresses of mail 
servers, and use wildcards to cover the rest with "don't accept mail 
from here" records.

And if the record for mail servers was actually specified to be a 
pointer to the forward DNS, that could also provide a means to give 
information what the EHLO string should be, e.g.,

*.3.4.in-addr.arpa. MAIL-EHLO [some encoding to say "nope."] 
1.2.3.4.in-addr.arpa. MAIL-EHLO good.example.com.

then if you wanted to "verify" (though I'm not sure what this would 
actually verify..), you could do a second lookup for:

_client._smtp.good.example.com. which would have to point at 4.3.2.1

This avoids having to walk down or up the tree. Take a look at: 
draft-durand-naptr-service-discovery-00.txt

I don't quite understand why you'd want to look up EHLO string, 
instead of getting the information from the IP address; an attacker 
can make EHLO arbitrary and make all kinds of attacks, but IP address 
has a fixed format is hopefully (in this kind of TCP session) 
difficult to spoof.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>