[DNSOP] Risk of using underscores for sentinel (Was: A conversational description of sentinel.

[Stephane Bortzmeyer <[e-mail]>]

On Mon, Feb 05, 2018 at 12:56:47PM +0100,
 Vladimír Čunát <[e-mail]> wrote 
 a message of 8 lines which said:

> Current Firefox 58.0.1 and old Chromium 61.0.3163.79, Linux, same
> result.  The system resolver does fetch _www.ksk-test.net. OK.  (I
> can't say I understand what happens.)

Isn't is simply because some browsers rely on the standard library's
getaddrinfo() and this routine does not accept all domain names? On Linux:

#define alphachar(c) (((c) >= 0x41 && (c) <= 0x5a) \
		   || ((c) >= 0x61 && (c) <= 0x7a))
#define digitchar(c) ((c) >= 0x30 && (c) <= 0x39)

#define borderchar(c) (alphachar(c) || digitchar(c))
#define middlechar(c) (borderchar(c) || hyphenchar(c) || underscorechar(c))
#define	domainchar(c) ((c) > 0x20 && (c) < 0x7f)

int
res_hnok(const char *dn) {
	int pch = PERIOD, ch = *dn++;

	while (ch != '\0') {
		int nch = *dn++;

		if (periodchar(ch)) {
			(void)NULL;
		} else if (periodchar(pch)) {
			if (!borderchar(ch))
				return (0);
		} else if (periodchar(nch) || nch == '\0') {
			if (!borderchar(ch))
				return (0);
		} else {
			if (!middlechar(ch))
				return (0);
		}
		pch = ch, ch = nch;
	}
	return (1);
}	

Underscores are not accepted at the beginning of a name.

% dig +short +nodnssec _www.ksk-test.net
ron.kumari.net.
204.194.23.4

% ping _www.ksk-test.net          
ping: _www.ksk-test.net: Name or service not known

If you want to check on FreeBSD, it's here:

https://svnweb.freebsd.org/base/head/lib/libc/net/gethostbydns.c?view=markup#l140