Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Rick van Rein <[e-mail]>]

> The value of PTR records is
> returned verbatim by nameservers.  What's case insensitive is
> lookups derived from that name when you use it in a query string.

Below is why I believe that PTR can mangle the case of letters; both
from the specs and a practical demonstration.


Section 4.1 of RFC 4343:

No "case conversion" or "case folding" is done
during such output operations, thus "preserving" case.  However, to
optimize output, indirect labels may be used to point to names
elsewhere in the DNS answer.  In determining whether the name to be
pointed to (for example, the QNAME) is the "same" as the remainder of
the name being optimized, the case insensitive comparison specified
above is done.  Thus, such optimization may easily destroy the output
preservation of case.

Section 3.3 of RFC 1035:

The following RR definitions are expected to occur, at least
potentially, in all classes.  In particular, NS, SOA, CNAME, and PTR
will be used in all classes, and have the same format in all classes.
Because their RDATA format is known, all domain names in the RDATA
section of these RRs may be compressed.

<domain-name> is a domain name represented as a series of labels, and
terminated by a label with zero length.  <character-string> is a single
length octet followed by that number of characters.  <character-string>
is treated as binary information, and can be up to 256 characters in
length (including the length octet).

[...]

3.3.12. PTR RDATA format

    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
    /                   PTRDNAME                    /
    +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

where:

PTRDNAME        A <domain-name> which points to some location in the
                domain name space.


I've put this to the test, which turned out even more liberal; I defined
under $ORIGIN vanrein.org:

$ORIGIN vanrein.org.
_kerberos.mixedcase.ptrdemo     3600    IN      PTR    
MiXeDcAsE.VaNrEiN.OrG.
_kerberos.uppercase.ptrdemo     3600    IN      PTR    
UPPERCASE.VANREIN.ORG.
_kerberos.lowercase.ptrdemo     3600    IN      PTR    
lowercase.vanrein.org.

Passing this through ods-signer (from OpenDNSSEC) already maps the PTR
values to lowercase, probably as part of name canonicalisation in
preparation of signing.  Manually editing the ods-signer output to mixed
and uppercase again, reloaded it into the NSD name server... and again,
the PTR values are mapped to lowercase.

-Rick

P.S. If you want to query this for yourself, then note that the DNSSEC
chain isn't complete for this zone, so you won't get AD set in responses.