Subject: [DNSOP] IVIPTR: New RR for DNS

From: Tariq Saraj <[email-masked]>
Date: Sat, 25 Nov 2017 22:41:13 +0500

Dear all,
Please provide your valuable feedback on the newly uploaded draft.
draft-tariq-dnsop-iviptr-00
<https://datatracker.ietf.org/doc/draft-tariq-dnsop-iviptr/>
*IVIPTR: Resource Record for DNS*

-- 
Regards
Tariq Saraj
Riphah Institute of Systems Engineering, Islamabad

---

From: bert hubert <[email-masked]>
Date: Sat, 25 Nov 2017 19:51:41 +0100

> *IVIPTR: Resource Record for DNS*

Hello Tariq,

I have read through this draft and it left me pretty confused, both in terms
of the motivation and the practicalities.

If understand it correctly, the idea is to find the 'corresponding' IPv4
address to an IPv6 address?  And that this could then be applied to
transposing access control list rules from one protocol to the other?

In other words, I could have something like 'allow from 192.0.2.1', and
through an IVIPTR lookup, this could be mirrored to 'allow from
2001::db8::2:1'? Can you confirm that this is the intended goal?

In terms of practicalities, I implement both resolving and authoritative
nameservers, and your section 3 and 4 leave me confused if I have to do
anything or not, except support the record format. The wording is very hard
to follow and could do with a lot more whitespace and perhaps enumerated
steps.

If it turns out that resolvers or authoritative servers need to do something
special, your draft should definitely talk about how to cope with servers
that do not perform such special processing.

Good luck!

	Bert

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Alejandro Acosta <[email-masked]>
Date: Sat, 25 Nov 2017 23:57:36 -0400

Hello there,

> of the motivation and the practicalities.

  The draft is very interesting but I do have exactly this very same
question: motivation. 
  I think the authors have faced an issue that we don't know.

Thanks,

---

From: Tariq Saraj <[email-masked]>
Date: Sun, 26 Nov 2017 13:03:41 +0500

Hello Bert,
Thank you very much, yes you are 100% right about the intended goal of the
IVIPTR RR.
About Section 3 and 4, I totally agreed, and will explain it with more
clarity specially the query processing. I am currently working on POC and
in the next version of draft before uploading it I will resolve all the
concerns on the mailing list.
Once again thank you very much for your valuable time and response.

---

From: Tony Finch <[email-masked]>
Date: Mon, 27 Nov 2017 13:38:08 +0000

bert hubert <[email-masked]> wrote:
> address to an IPv6 address?

Why not

57.57.111.131.in-addr.arpa. 3406 IN PTR grey.csi.cam.ac.uk.
57.57.111.131.in-addr.arpa. 3600 IN AAAA 2001:630:212:110::d:7a7
7.a.7.0.d.0.0.0.0.0.0.0.0.0.0.0.0.1.1.0.2.1.2.0.0.3.6.0.1.0.0.2.ip6.arpa. 3600 IN PTR grey.csi.cam.ac.uk.
7.a.7.0.d.0.0.0.0.0.0.0.0.0.0.0.0.1.1.0.2.1.2.0.0.3.6.0.1.0.0.2.ip6.arpa. 3600 IN A 131.111.57.57

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/  -  I xn--zr8h punycode
Viking, North Utsire, South Utsire: Cyclonic becoming northerly 5 to 7,
occasionally gale 8 except in South Utsire. Moderate or rough, occasionally
very rough later except in South Utsire. Rain then squally showers. Moderate
or good.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 27 Nov 2017 15:27:39 +0100

On Mon, Nov 27, 2017 at 01:38:08PM +0000,
 Tony Finch <[email-masked]> wrote 

> Why not

Section 1 of the draft explains "why not" but I disagree with their
assessment. I think the PTR way is indeed the right one.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 27 Nov 2017 15:45:15 +0100

On Sat, Nov 25, 2017 at 10:41:13PM +0500,
 Tariq Saraj <[email-masked]> wrote 

> *IVIPTR: Resource Record for DNS*

The only use case you describe (firewall configuration) is
questionable. Most firewall configuration interfaces allow you to use
domain names instead of IP addresses. So, if I want to allow port 443
to www.example.com (which has IPv4 and IP v6 addresses), I can. Note
that many firewall administrators don't use this because, rightly or
wrongly, they don't trust the DNS. They'll have the same issue with
your proposal.

By the way, that's why you _need_ to write something in the Security
Considerations, probably mentioning DNSSEC.

Otherwise, I'm not convinced by your argument against using PTR. If
people don't configure PTRs to get the effect you want, it may be because:

* they don't want to (so they don't need your proposal)
* they're lazy or incompetent (so they'll ignore your proposal)