Subject: [BEHAVE] DNS64 and limiting data sharing across interfaces

From: Andrew Sullivan <[email-masked]>
Date: Thu, 29 Oct 2009 16:27:56 -0400

Dear colleagues,

The dns64-02 draft contains this text:

5.6.  DNS64 and multihoming

   Synthetic AAAA records may be constructed on the basis of the network
   context in which they were constructed.  Therefore, a synthetic AAAA
   received from one interface MUST NOT be used to resolve hosts via
   another network interface.  Because it will be hard (if not
   impossible) for a multihomed system to tell whether a given AAAA is
   synthetic, a host SHOULD treat any AAAA record received on a given
   interface as local to that interface; the alternative risks
   communication failures when the AAAA is used to communicate on
   another interface.  See the discussion in
   [I-D.savolainen-mif-dns-server-selection].

Off-list someone pointed out to me that there are cases where you have
effectively dual-stack hosts for legacy reasons: the host is connected
to the Internet via NAT64 but is talking to v4-only hosts in a local
network or something.  That reminded us that some v6-capable hosts use
v4 only to do their DNS, which means that the only way such hosts are
going to get DNS answers is on the v4-only interface. 

The above text, as written, appears to discourage such a practice.

Does anyone have a better idea?  I have been thinking about it, but I don't.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Simon Perreault <[email-masked]>
Date: Thu, 29 Oct 2009 16:51:59 -0400

> Does anyone have a better idea?  I have been thinking about it, but I don't.

Maybe we won't have a good answer until the MIF WG gives us one.

Suggestion: Write the text according to the underlying principle and let
operations decide what it means in practice. For example:

  Records synthesized by a DNS64 can only be used on a network where a NAT64
  device is available and is configured with the same Pref64::/n as the DNS64.

This principle is valid in all cases. But it doesn't tell exactly how to enforce
it. That's probably the best advice we can give right now.

Simon
-- 
DNS64 open-source   --> http://ecdysis.viagenie.ca
STUN/TURN server    --> http://numb.viagenie.ca
vCard 4.0           --> http://www.vcarddav.org

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 29 Oct 2009 17:02:50 -0400

> it. That's probably the best advice we can give right now.

I'm sort of loathe to make a requirement that can't actually be
achieved.  The problem here AFAICT is that we simply don't have a
mechanism to find any of that out, as you correctly point out.

One thing that occurs to me is to remove the normative language, and
just warn that using data from some other interface could easily cause
communication failures, sub-optimal communication paths, and maybe
even leakage of split-brain data across the network boundaries; but
that in practice, many deployed nodes in fact use DNS responses from
one interface to communicate on a different interface, and there's not
much one can do to prevent it in such cases.  This amounts to a
warning that the orderly picture one might have from reading the
document is a false one.  Would that be enough?

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Dave Thaler <[email-masked]>
Date: Thu, 29 Oct 2009 21:56:30 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Andrew Sullivan
> Sent: Thursday, October 29, 2009 1:28 PM
> To: [email-masked]
> Subject: [BEHAVE] DNS64 and limiting data sharing across interfaces
> 
> Dear colleagues,
> 

It's not clear to me whether the quoted text is talking about the
DNS64 itself being multihomed, or a client using it.

I think it would be inappropriate for the DNS64 document (which specifies
a DNS64 and hence a DNS64 implementation would claim conformance to)
to use RFC 2119 language that would apply to other entities, like
end hosts / DNS clients using the DNS64 unknowingly.

-Dave

> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 30 Oct 2009 09:12:03 -0400

> DNS64 itself being multihomed, or a client using it.

It's supposed to be for a client using it (which client could, of
course, also be doing the dns64 function, but that's irrelevant).

> end hosts / DNS clients using the DNS64 unknowingly.

Good point.  I'll see whether I can rework it along the lines I
suggested yesterday.  If so, I'll post a proposed revision.  The
window for full document updates is closed until Hiroshima, of course.

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.