Subject: [Mip6] [issue49] HoA validation and DNS update

From: Gerardo <[email-masked]>
Date: Mon, 03 Oct 2005 14:49:34 +0000

New submission from Gerardo <[email-masked]>:

Raised by Francis:
"
I have two concerns:
 the configuration service in IKEv2 was copied from DHCP,
 in fact, you should consider it as a lightweight DHCP service.
 - so in 5.3.2 you cannot use it to validate a HoA configured by
   the MN. BTW in the past I tried to add a validation/registration
   service for stateless autoconfed addresses in DHCPv6, it was
   rejected by the DHC WG.
 - at the contrary this service is the right one for DNS update
   (in the reverse tree: as usual the MN should update the AAAA RR
    because it has the trust over its FQDN, and the guy who allocates
    the address should update the PTR because it has the trust over
    this part of the reverse tree. PS: confirmed as the session).
"

James wrote:
"
What exactly was the issue you had with having the DNS update done via the
BU?
"

Francis wrote:
> => this is not the job of the MIPv6 code and is clearly the job of the
> tool which allocates the HoA: IKE CFG_REQUEST stuff. Here I apply
> my idea that IKE CFG_REQUEST is DHCP-like and DNS update is a classical
> service offered by DHCP. BTW the DNS update must be secured i.e. the
> tools performing it be trusted, so it is not simple...

Vijay wrote:
"
there are two issues. first, this would mean he MN is not in control of 
the DNS update. the HA does it everytime it replies with a HoA in a 
CFG_REPLY message. not sure thats a good idea. in some cases, 
the MN may not want the HoA published in the DNS. it would be 
good to get an indication from the MN before doing the DNS update.
second, we want to support HoA auto-configuration (RFC 2462, RFC 
3041, CGA). when the MN autoconfigures a HoA, we dont use 
CFG_REPLY. the HA doing the update when it sends CFG_REPLY
message supports only assigned HoA.
"

James wrote:
"
I asked Ralph whether the IKEv2 folks had consulted the DHCP WG on the
config and he said no. Perhaps there was some discussion amongst themselves
on this, but he hadn't heard of it. So it is not clear to me that the IKEv2
folks used any specific model of address configuration.
"

----------
category: Technical
draft: draft-ietf-mip6-bootstrapping-split
messages: 170
nosy: gerardo
priority: Should fix
status: Rejected
title: HoA validation and DNS update

_________________________________________________
Mip6 issue tracker <[email-masked]>
<http://www.mip4.org/issues/tracker/mip6/issue49>
_________________________________________________

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6