Subject: RE: [Hipsec] Fwd: Cross Area Review: draft-ietf-hip-dns-01

From: "Henderson, Thomas R" <[email-masked]>
Date: Fri, 8 Jul 2005 11:27:28 -0700

Julien, I had a question on the below suggested change:

> * I'd replace the following paragraph 
>    Then, when some other node wants to initiate a HIP 
> exchange with such
>    a responder, it retrieves the RVS IP address by looking up a HIPRVS
>    RR at the FQDN of the responder, and sends an I1 to this 
> IP address.
>    The I1 will then be relayed by the RVS to the responder, which will
>    then complete the HIP exchange, either directly or via the 
> RVS [13].
> 
> * by [and I hope I have correcty understood this]:
> *    When an some HIP node wants to initiate a HIP exchange with a
> *    responder it will perform a number of DNS lookups. 
> *    First the initiator will need to query for an A or AAAA record at
> *    the responders FQDN.
> *    
> *    If the query for the A and/or AAAA was responded to with a DNS
> *    answer with RCOCE=3 (Name Error) than the responder's information
> *    is not present in the DNS and further queries SHOULD not be made.
> *
> *    In case the query for the address records returned a a DNS answer
> *    with RCODE=0 (No Error) the initiator sends out two queries. One
> *    for the HIPHI and one for the HIPRSV type at the responders FQDN.
> * 
> *    Depending on the combinations of answer the situations 
> described in 
> *    3.1, 3.2 and 3.3 can occur. 

I think you were proposing to fetch A, HIPHI, and HIPRSV all at the same
time (or else leaving the fetching order ambiguous), while Olaf suggests
that you fetch them all individually, and further, that you fetch the A
record first, then only if that succeeds, then you fetch the HIPRSV
record.  But what if there is no A record and only HIPHI and HIPRSV?
Also, do we want to specify when (in what order) records should be
fetched?

Tom

_______________________________________________
Hipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/hipsec

---

From: Julien Laganier <[email-masked]>
Date: Mon, 11 Jul 2005 09:40:22 +0200

> Julien, I had a question on the below suggested change:

(...)

> > When an some HIP node wants to initiate a HIP exchange with a
> > responder it will perform a number of DNS lookups. First the
> > initiator will need to query for an A or AAAA record at the
> > responders FQDN. 
> >
> > If the query for the A and/or AAAA was responded to with a DNS
> > answer with RCOCE=3 (Name Error) than the responder's information 
> > is not present in the DNS and further queries SHOULD not be made.
> >
> > In case the query for the address records returned a a DNS answer
> > with RCODE=0 (No Error) the initiator sends out two queries. One
> > for the HIPHI and one for the HIPRSV type at the responders FQDN.
> > 
> > Depending on the combinations of answer the situations described
> > in 3.1, 3.2 and 3.3 can occur.
>
> I think you were proposing to fetch A, HIPHI, and HIPRSV all at the
> same time (or else leaving the fetching order ambiguous), 

I was proposing to fetch A, AAAA, HIPHI, and HIPRVS in parallel, 
without specifying a particular order. 

You cannot fetch all of them in the same query with QTYPE=*, because 
then authoritative answers are not available [RFC1035]. 

So you have to make individuals requests with A, AAAA, HIPHI, and 
HIPRVS. 

My present understanding is that's still leaves us with the choice of 
doing them in parallel or sequentially, or a mix of both... the 
choice seems to be left to the resolver implementor, but I am still 
waiting for a clarification from Olaf on that specific point.

The problem with parallel queries is that if the domain name does not 
exist, 4 queries would be issued for nothing. But see below...

> Olaf suggests that you fetch them all individually, and further,
> that you fetch the A record first, then only if that succeeds, then
> you fetch the HIPRSV record.  But what if there is no A record and
> only HIPHI and HIPRSV? Also, do we want to specify when (in what
> order) records should be fetched?

What Olaf wrote is that if RCODE=3 (Name Error) occurs, that means 
that the domain name referenced in the query does not exist 
[RFC1035]. So if there is no A record but HIPHI and HIPRVS, when 
queried for QTYPE=A, the DNS server would answer with RCODE=0 and no 
A RR. Then the resolver knows the domain exist and can issue further 
HIPRVS queries.

I am not sure that we want to specify an order. From what I observed 
with the related A vs AAAA query, the resolver on BSD (I guess it's 
based on ISC's BIND) always query A, then AAAA, sequentially, i.e. 
the AAAA query is not issued before the A query answer is received. 
This makes sense because if the domain name does not exist two 
queries would be issued from nothing.

So back to Olaf's proposed: It's a mix of sequential and parallel 
queries. First you only issue a query for one of the RRs (A in his 
example), and if the domain name exists, then you issue parallel 
queries with the remaining RRs (AAAA, HIPHI, and HIPRVS). It is the 
most efficient way of querying multiple RRs, without wasting 
resources in case the domain name is non-existent.

Concerning Olaf's suggested change, when I get more information from 
him, perhaps it would alsoo be good to explain the rationale for 
querying for an A RR, then the remaining RRs.
-- 
julien

---

From: Pekka Nikander <[email-masked]>
Date: Thu, 28 Jul 2005 12:18:58 +0200

> [...] that if RCODE=3 (Name Error) occurs, that means

Sounds good but I would suggest first querying for HIPHI and
then the rest in parallel.  If you get a HIPHI, you can return
the HIT/LSI to the app then while the rest of the info is still
being received.  If you don't get a HIPHI, depending on the API
you perpaps can indicate that no HI exists for the given DN and
ask whether the app wants to establish an insecure connection.

--Pekka