Subject: Unique local & DNS (was: AD Evaluation of draft-ietf-ipv6-unique-local-addr-03.txt+

From: "Christian Huitema" <[email-masked]>
Date: Sun, 14 Mar 2004 20:41:26 -0800

In her review of "draft-ietf-ipv6-unique-local-addr-03.txt", Margaret
raises an excellent point:
 
> (1) This draft doesn't mention the reverse DNS tree.  Is it expected
that
>      whatever registry assigns these values will also populate the
reverse
>      DNS tree?  Or not?

The registration process could conceivably populate the reverse DNS
tree, but that would only be a partial solution: the draft also defines
random prefixes that don't need to be registered. Also, there is no
requirement that the networks numbered with these unique local addresses
be accessible to DNS resolvers on the Internet.

We may however want some kind of "theory of operation". When a network
is numbered using unique local addresses, hosts in that network will
want to resolve addresses to names. There are 2 possible solutions:

1) Add specific knowledge of this reverse tree to the DNS servers in the
unique-local-addressed site,

2) Perform reverse name resolution by asking the host itself, sending
either a host information query or an LLMNR PTR request to the IPv6
address being resolved.

The first solution is similar to the "dual face DNS" deployments common
in organization networks, and should probably be the normal case. It
does not require registration in the ip6.arpa tree. It does however
require some coordination between DNS servers of unique-local-addressed
sites when these sites establish a back-door connection. This
coordination could be facilitated if we used a conventional host
identifier for "the DNS server within a uniquely addressed site".

We generally shied away from the second solution, and generally from
using the host identification query to provide reverse mappings. Using
LLMNR does make sense when LLMNR is also used as the primary name
resolution service within the unique-local-addressed site.

-- Christian Huitema

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Mon, 15 Mar 2004 08:21:15 +0200 (EET)

> resolution service within the unique-local-addressed site.

Using LLMNR makes no sense in the generic case; at least the name says
"link-local" and the case where the site using local addresses would
be restricted to single link is not generic enough.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Fred Templin <[email-masked]>
Date: Mon, 15 Mar 2004 07:19:41 -0800 (PST)

Christian,
 
Christian Huitema <[email-masked]> wrote:We generally shied away from the second solution, and generally from
using the host identification query to provide reverse mappings.
 
Is "host identification query" == "Node Information Queries" here?
 
Also, what about other non-DNS naming services that can be deployed
within a site/organization? E.g., the Sun Yellow Pages (I guess it's called
NIS now?) and the naming service developed by Project Athena at MIT
back in the 1980's (not sure on the name of this one, but "Hessiod" rings
a bell) still widely used by site administrators? (Feeling a bit like Rip Van
Winkle waking up from a 15-yr slumber wrt this technology space...)
 
Fred
[email-masked]

---

From: Ignatios Souvatzis <[email-masked]>
Date: Wed, 17 Mar 2004 09:27:46 +0100

Hi Fred,

> NIS now?)

We don't confess it in public, and we block all RPC requests at our border
routers, but some of us do.

> and the naming service developed by Project Athena at MIT
> a bell)

I'm not from Athens, but AFAIK, 
HESIOD uses DNS ... it packs more information than host information into DNS.

> still widely used by site administrators? (Feeling a bit like Rip Van

hehe.
	-is

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 17 Mar 2004 09:59:34 -0600

Thus spake "Christian Huitema" <[email-masked]>
> >       that whatever registry assigns these values will also populate the
> >       reverse DNS tree?  Or not?
>

At a minimum, being present in the global DNS should be at the option of the
allocatee.  Until a viable solution is found for non-registered prefixes,
this might be given as an advantage of using a registered prefix.

While I don't think it's particularly elegant, it might work to designate a
"well known" anycast DNS server address within each local prefix.  This
wouldn't require any registration in the global DNS for any type of local
prefix.

> unique-local-addressed site,

While this should be sufficient for isolated sites, this doesn't scale when
multiple sites interconnect (privately) using local addresses.  Presence in
the global DNS (if desired) or a well-known anycast removes the need for
special local configuration.

> either a host information query or an LLMNR PTR request to the IPv6

I don't know anything about LLMNR and so can't comment if this is workable.

S

Stephen Sprunk        "Stupid people surround themselves with smart
CCIE #3723           people.  Smart people surround themselves with
K5SSS         smart people who disagree with them."  --Aaron Sorkin

---

From: Mark Andrews <[email-masked]>
Date: Thu, 18 Mar 2004 07:32:32 +1100

> this might be given as an advantage of using a registered prefix.

	Well non-registered addresses are not guarenteed to be
	unique.  We should be recommending that *every* recursive
	nameserver, not just where locals addresses are in use, be
	configured with a empty zone (SOA and NS only) for the /8.
	This will prevent the root and ip6.arpa servers having to
	deal with all the requests that would otherwise come to them.

	If a non-unique local addresses are in use it can have delegations
	in this zone.
 
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 17 Mar 2004 16:19:09 -0600

Thus spake "Mark Andrews" <[email-masked]>
> > At a minimum, being present in the global DNS should be at the option
> > of the allocatee.  Until a viable solution is found for non-registered
> > prefixes, this might be given as an advantage of using a registered
prefix.
>
> Well non-registered addresses are not guarenteed to be unique.

"Until" should probably be "unless".

> We should be recommending that *every* recursive nameserver, not
> just where locals addresses are in use, be configured with a empty zone
> (SOA and NS only) for the /8.  This will prevent the root and ip6.arpa
> servers having to deal with all the requests that would otherwise come to
> them.

While undoubtedly ideal, I don't trust a million local DNS admins around the
world to all get this right.  For example, this should be done for RFC1918
addresses as well, yet the volume of bogus reverse queries hitting the roots
was still substantial enough IANA resorted to lamely delegating the zones.
It'll probably end up happening to FD00::/8 as well.

> If a non-unique local addresses are in use it can have delegations

Of course.

S