Re: [DNSOP] [Ext] I-D Action: draft-ietf-dnsop-svcb-https-05.txt

[Pieter Lexis <[e-mail]>]

Hi Dick,

On 5/9/21 2:01 PM, Dick Franks wrote:
> Pre-processing of '\\,' into the RFC1035 standard '\,' is
> superficially attractive, but also fraught with danger.
> 
> A parser could have some fun with this one:
> 
>     $ORIGIN example.com
>     @   SVCB   1 foo
> key6="\032\001\013\184\000\000\000\000\000\000\000\000\\\\,\000"
>     ; a.k.a.   ipv6hint=2001:db8::5c5c:2c00

A zone owner/editor would never even think of typing in IP addresses
like that. And no decoder should ever write that out (and if it does,
would a zone-owner read it?). Also, when using the generic format, the
full value should be the 'wire' format so there's comma delimiter
between values. For ALPN you'd have [value1 len][value 1][value2
len][value2] and for key6 [encoded first ipv6 address bytes][encoded
second ipv6 address bytes].

> The spec only needs to say that a comma needs to be escaped  ( \, ) in
> order to be disregarded as a separator.

> BIND, NSD, Net::DNS, and PowerDNS can all do this, so there is little
> mileage in claiming that it is not possible.
> 
> The "impossible" can be made possible by doing the right things in the
> correct order.
> Selecting the right things and the correct order is left as an
> exercise for the student.
>From what I gather, this is the case? With the caveat that there is a
2-step process for parsing the values for keys defined as paramlists.

Cheers,

Pieter