Re: [dnsext] SRV and wildcard CNAME

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Masataka Ohta writes:
> Phillip Hallam-Baker wrote:
> 
> > It does indeed. And worse, it works for
> > 
> > _null._random.example.com  SRV...
> > 
> > And other non existent protocols.
> 
> Non existent protocols are not a problem, because they just do
> not work, which is fine.
> 
> The problem is that protocols used share a port.
> 
> However, as the only protocol which may be used by *LAZY* users,
> other than http, is https, it may share the same port as http,
> if servers are implemented to distinguish them by the first
> byte of the request.

It breaks *all* protocols that use SRV.  Wildcarding a SRV record
is a bad idea.

> Maybe, some of you are thinking that SRV can't differentiate
> server names of name based virtual hosting.
> 
> But,
> 
>        *.example.com  CNAME com.example.net
> 
>        *.example.org  CNAME org.example.net
> 
> 	com.example.net SRV  0 1 P com.server.example.net
> 	org.example.net SRV  0 1 P org.server.example.net
> 	com.server.example.net CNAME shared.server.example.net
> 	org.server.example.net CNAME shared.server.example.net
> 
> should work, even though it violates SRV specification requiring
> "name MUST NOT be an alias".

The you have a client that tries to use the "foo" protocol which is
SRV aware.  The client asks for _foo._tcp.bar.example.com SRV and
sends up being sent to the http server.

Wildcards match multiple labels.
 
> > There is a way to fix the issue. Instead of resolving in a single step, a
> > two step resolution is performed. The first step being for an unprefixed
> > name. This will result in either 'not found' or a canonical name being
> > returned. The prefix is applied to the canonical name in the second phase.
> 
> Why do we have to fix a non existent issue?
> 
> 						Masataka Ohta
> _______________________________________________
> dnsext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsext
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]