Subject: RE: IPv6 and Dynamic DNS

From: "Cutler, James R" <[email-masked]>
Date: Tue, 10 Aug 1999 13:47:45 -0400

DIFFERENT WORKING ASSUMPTION REGARDING DDNS:

My working assumption is that the initial decision is made by the provider
of the network to which you attach.  Forward and reverse DNS entries will be
established (or not established) by provider policy. Then, forward lookup
using your home domain may be established to your current address, if there
is need for it.

This, of course, ignores mobile IP and all its interesting differences
between the apparent address and the local delivery address.

SECURITY IMPLICATIONS:

The security implications should be expressed simply in terms of physical
access. If you are allowed to plug your system into (granted physical access
to) a network, your system has the implicit right to use an address on that
network. 

In most cases, forward and reverse references involving that address have NO
connection with the user of the attached system. Thus, they should be
un-involved in authentication and authorization. 

REPRISE:

So I will reiterate my position:

	DDNS is at the pleasure of the service provider, not
	the technology.

	Security (authentication and authorization) first
	is an issue for the end user and the application.

Regards.

	JimC

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, August 10, 1999 7:05 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: IPv6 and Dynamic DNS

> I have a really dumb question about all this.
> 
> Consider this situation:
> 
> My laptop is tomslaptop.mycompany.com.
> 
> I visit SomeoneElse, Inc. and plug my laptop into their network and use
> autoconf or DHCPv6 to get an address.
> 
> What should I expect as my FQDN?  Is it tomslaptop.someoneelse.com or
> should I expect the right DNS updates to maintain my name as
> tomslaptop.mycompany.com.
> 
> Note: I'm not asking about reverse lookups.  Depending on the answer to
> the question above I have different questions about reverse lookups.
> 
> Thanks,
> 
> -tal

	My working assumption is that you keep your FQDN and
	only the address mapping changes.

-- 
--bill

---

From: Paul A Vixie <[email-masked]>
Date: Tue, 10 Aug 1999 14:05:10 -0700

It seems to me that DNS (dynamic or not) can't address what seems to be a
basic flaw in the basic model of stateless address autoconfiguration.  We,
in the person of Yakov and Susan, designed DNS UPDATE with an eye toward
DHCP (v4 and v6).  Our assumptions were all based on there being an agent
on the LAN (meaning the DHCP server) who had permission to update that LAN's
inverse DNS entries (meaning IN-ADDR.ARPA and IP6.INT).  If stateless auto-
configuration doesn't work the same way (meaning there's no agent on the LAN
who has permission to update the inverse DNS entries for that LAN and who
knows about new address assignments) then stateless autoconfiguration needs
some work.  Is namedroppers really the place where this work should occur?

---

From: Jim Bound <[email-masked]>
Date: Tue, 10 Aug 1999 21:04:59 -0400

Hmmm.  You missed my name on that but thats OK.

On the contrary when Yakov and I first talked about this with Donald
Eastlake and I think Charlie Kaufmann we intended that in ddns.  We
never assumed in any discussions or when you entered the picture that
there would be any agent.  We assumed a client could update either
record or ask the server.  Hence, no assumption was made and when you
came on to help fix things so it was more implementable we continued to
make no assumption in the spec.  In my mind and in Yakovs mind (which we
did discuss) it was a non-issue for DDNS.

So I don't agree as one of the co-authors that this was our assumption
and I will let Sue and Yakov speak for themselves.

In fact when we first met really officially about this via Randy Bush at
Stanford Univ we had the discussions about "agents" as I recall.
Again this was before you entered the picture I think?  But if you were
at the Stanford meeting this in fact was discussed.

/jim

---

From: Jim Bound <[email-masked]>
Date: Tue, 10 Aug 1999 22:56:38 -0400

Also I missed Peter Ford was in the initial discussions and present too.
Sorry Peter.....Its to busy in the IETF I guess ...:--).

/jim

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 11 Aug 99 17:24:11 JST

Paul;

> basic flaw in the basic model of stateless address autoconfiguration.

Right.

> We,
> some work.

Needs some work?

Being an excellent implementer, you tend to specify and implement
anything.

However, if stateless autoconfiguration needs to be modified to
be stateful autoconfiguration, the reasonable approach is to
abandon it and just use DHCP.

Remember that IPng was expected to be simple IP.

> Is namedroppers really the place where this work should occur?

Histrically in IPng WG, the fundamental flaw of stateless
autoconfiguration has survived using other protocols/proposals
as scape goats.

So, namedroppers should be the place to sentence death penalty
to stateless autoconfiguration, unless you want dynamic DNS
be yet another scape goat.

							Masataka Ohta