Subject: Re: [BEHAVE] using IPv4-mapped DNS/DNS64 resolversfordual-stack/IPv6-only hosts

From: [email-masked]
Date: Fri, 12 Mar 2010 19:22:47 +0800

Mark,

My proposed main idea is to distinguish the received type A answer. If the answer is for a type A query the DNS64 server generates, DNS64 server should sythesize a type AAAA answer. Otherwise, DNS64 server should not.

DNS64 server can use a specific range of transaction IDs for the type A queries it generates for the type AAAA queries. This way is stateless.

Another way, DNS64 server uses a STATUS to indicate the source of a type A query it makes. This STATUS field needs to be adopted in DNS64 implementation. BIND, for example, is easy to do this.

Regards,
Zhenqiang

> Hi, Dan,
> 
> Not that difficult.DNS64 server only needs to record the transaction ID of th
> e A query it generates for AAAA query, and does not record the transaction ID
> of the A query it forwards.

A DNS server needs to record *every* transaction id of *every* query it makes.

> When DNS64 server receives the response of a A q
> uery, DNS64 server looks for the transaction ID in the records. If satisfied,
> DNS64 server synthesizs AAAA answer for it. Otherwise, DNS64 server just for
> wards the A answer to the relevant host, then the host will send traffic usin
> g IPv4.
> 
> In short, if a host explicitly wants a type A answer, DNS64 server should not
> touch the answer it receives, just forwards it to the host.

What made you think a DNS64 server didn't answer A queries with A
records?  DNS64 servers are standard DNS servers for EVERYTHING
other than AAAA and PTR queries.  That includes A queries.  They
just do additional processing on A and PTR queries than a standard
server doesn't do.

> As for HBT, that is not my intent.
> In addition, a picture is good to illustrate the environment you want to addr
> ess.
> 
> Best Regards,
> Zhenqiang

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mark Andrews <[email-masked]>
Date: Fri, 12 Mar 2010 22:41:39 +1100

In message <[email-masked]
ile>, [email-masked] writes:
> Mark,
> 
> My proposed main idea is to distinguish the received type A answer. If the =
> answer is for a type A query the DNS64 server generates, DNS64 server shoul=
> d sythesize a type AAAA answer. Otherwise, DNS64 server should not.
> 
> DNS64 server can use a specific range of transaction IDs for the type A que=
> ries it generates for the type AAAA queries. This way is stateless.

No recursive nameserver is stateless.  You can't write a reliable
stateless recursive server.  No even a stateless DNS proxy.  You
have multiple id spaces to contend with.
 
> Another way, DNS64 server uses a STATUS to indicate the source of a type A =
> query it makes. This STATUS field needs to be adopted in DNS64 implementati=
> on. BIND, for example, is easy to do this.

I've had code to do this for BIND for years.  Did it as a exercise
one afternoon.  For BIND 9 you only need to touch bin/named/query.c
if you are willing to hard code the prefix which I was for this
exercise. :-)

Remember early versions of BIND 9 synthesised AAAA from A6 records
if there were no AAAA records present.

Mark

---

From: Mark Andrews <[email-masked]>
Date: Fri, 12 Mar 2010 23:20:03 +1100

I think what Zhenqiang is thinking of is a DNS64 proxy trying to
operate by just manipulating the DNS packets that are flowing through
it and also not wanting to maintain state. It would be sitting
between the client and the recursive DNS server.

The AAAA query would be passed through to the recursive server and
if there were AAAA records in the answer it would just be passed
back.  It there was a error it would just be passed back.  If it
was a NOERROR response the response packet would be turned into a
AAAA query and sent back to the recursive server.  The response
would be translated to AAAA records and the type in the question
adjusted.

If you only have IPv6 only clients that *never* make A queries then
this would almost work.

However, in the real world, IPv6 only clients will also make A and
other DNS queries in addition to AAAA queries, the same as IPv4
only clients make AAAA queries from time to time, so the basic
assumptions are wrong.

Mark

---

From: Mark Andrews <[email-masked]>
Date: Fri, 12 Mar 2010 23:41:26 +1100

> would be translated to AAAA records and the type in the question

Or to put it more clearly.  The proxy was trying to operate by only
looking at the reply traffic.  NODATA responses to AAAA queries are
turned into A queries and all A responses are translates to AAAA
responses.
 
> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave