Re: [DNSOP] Alias mode processing in auths for draft-ietf-dnsop-svcb-https-01

[Mark Andrews <[e-mail]>]

> On 6 Aug 2020, at 02:05, Pieter Lexis <[e-mail]> wrote:
> 
> Hi folks,
> 
> Section 2.4.1 says
> 
> ```
> The primary purpose of AliasMode is to allow aliasing at the zone apex,
> where CNAME is not allowed. In AliasMode, TargetName MUST be the name of
> a domain that has SVCB, AAAA, or A records.
> ```
> 
> and section 4.1 says
> 
> ```
> When replying to a SVCB query, authoritative DNS servers SHOULD return
> A, AAAA, and SVCB records in the Additional Section for any in-bailiwick
> TargetNames.
> ```
> 
> Does this mean that the processing differs from 'regular' in-zone CNAME
> processing? Where I define this processing as "look for the Target name
> with the type from the query and use that result's status as query result".
> 
> Considering this zone (abbreviated):
> 
> ```
> svcb-alias.example.net SVCB 0 alias-target.example.net
> alias-target.example.net A 192.0.2.1
> ```
> 
> What would be the correct response to a svcb-alias.example.net|SVCB query?
> 
> ```
> ;; QUESTION SECTION:
> ;svcb-alias.example.net.		IN	SVBC
> 
> ;; ANSWER SECTION:
> svcb-alias.example.net.	3600	IN	SVBC    3600  0 alias-target.example.net
> example.net.	IN	SOA	3600	[....]
> 
> ;; ADDITIONAL SECTION:
> alias-target.example.net. 3600	IN	A	192.0.2.1
> 
> ```
> 
> or
> 
> 
> ```
> ;; QUESTION SECTION:
> ;svcb-alias.example.net.		IN	SVBC
> 
> ;; ANSWER SECTION:
> svcb-alias.example.net.	3600	IN	SVBC    3600  0 alias-target.example.net
> 
> ;; ADDITIONAL SECTION:
> alias-target.example.net. 3600	IN	A	192.0.2.1
> 
> ```

The second.

> With the former, implementers would be be able to reuse the existing
> aliasing code paths. With the latter, changes will have to be made to
> the codepath as the AliasMode is not a 'true' alias as CNAME is.

It isn’t an ALIAS.  Its a bad description that is the result of HTTP mis-using the CNAME record for the last 20 odd years.  HTTP has always needed a "server for" record like MX or SRV.  We just haven’t been able to get http developers invested in the idea until now.

> In the same vein, what happens in a zone like this (with the same
> incoming query for svcb-alias.example.net|SVCB):
> 
> ```
> svcb-alias.example.net SVCB 0 alias-target1.example.net
> alias-target1.example.net SVCB 0 alias-target2.example.net
> alias-target2.example.net SVCB 1 . ipv4hint=192.0.2.1
> 
> alias-target2.example.net A 192.0.2.1
> ```
> 
> Do *both* alias-target{1,2}.example.net|SVBC records end up in the
> ADDITIONAL section. Or are they (as is the case with an in-zone CNAME)
> considered an answer and should they go into the ANSWER section?

They go in the additional section.

> I find the alias mode semantics (on the DNS-level) unclear and
> under-specified in the draft. I look forward to guidance from the authors.
> 
> Best regards,
> 
> Pieter
> 
> -- 
> Pieter Lexis
> PowerDNS.COM BV -- https://www.powerdns.com
> 
> _______________________________________________
> DNSOP mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsop

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]              INTERNET: [e-mail]