Subject: [dhcwg] Fwd: [dnsext] Re: DNS Proxy Implementation Guidelines - draft-ietf-dnsext-dnsproxy-01

From: Ralph Droms <[email-masked]>
Date: Fri, 23 Jan 2009 07:54:21 -0500

of the discussion of the DNS proxy discussion.  It wouldn't hurt to  
get more dhc WG opinion on the draft - please follow up on the  
namedroppers list.

- Ralph

Begin forwarded message:

> From: Ralph Droms <[email-masked]>
> Date: January 22, 2009 11:35:48 AM EST
> To: [email-masked]
> Cc: Ralph Droms <[email-masked]>, [email-masked], Danny  
> Mayer <[email-masked]>
> Subject: Re: [dnsext] Re: DNS Proxy Implementation Guidelines -  
> draft-ietf-dnsext-dnsproxy-01
>
> (replying just to namedroppers; I asked interested dhc WG members to  
> contribute here)
>
> So, I read the draft and then traced the thread in the namedroppers  
> archive.
>
> I came up with a couple of questions when I read the draft, some of  
> which seemed to be answered in the discussion thread.
>
> * Why DNS proxies?
>
> So the DHCP server can send a consistent DNS recursive resolver  
> address to clients ... which seemed to me to be a pretty cart-before- 
> the-horse reason to go through this whole proxy exercise.  I know  
> "something" has to be done, but my intuition is that the problems  
> with proxies should encourage us to find a better solution.  This  
> line of thought lead to my next couple of questions:
>
> * How does the DNS proxy respond if there is no WAN connection?
>
> ...because once the WAN connection is in place, the BGW (broadband  
> gateway) SHOULD default to sending the DNS recursive resolver it  
> learned from the WAN DHCP server, and SHOULD allow the home network  
> admin to override that setting.  So, the only time sending the BGW  
> address as the DNS recursive resolver, employing a proxy, is when  
> the WAN connection is not yet in place, but, if the WAN connection  
> isn't in place, the DNS proxy has nowhere to proxy to, anyway.  The  
> client doesn't get any additional function out of this proxy, right?
>
> * Under what circumstances is there really a problem?
>
> How often is it the case that the BGW doesn't have the address of a  
> DNS recursive resolver to send via DHCP to hosts on the LAN?  In my  
> opinion, the BGW SHOULD use the address of the resolver associated  
> with the address it obtained through DHCP on its WAN connection.   
> Even if the WAN connection is down, the BGW SHOULD send that  
> resolver address as long as the lease on the WAN address hasn't  
> expired.
>
> And, if the lease has expired, is there harm in sending the most  
> recently obtained resolver address, anyway?  The BGW is still in the  
> state, presumably, where the WAN connection is down, so there won't  
> be any DNS resolution anyway.
>
> Conversely, what happens to hosts if the DHCP server supplies no DNS  
> resolver?
>
> * Suppose the BGW doesn't have the address of a resolver
>
> Well, as has been discussed in this thread, the problem is in the  
> transition when the BGW is finally configured with the address of a  
> resolver.  Prior to the WAN connection coming up, it doesn't much  
> matter what address the BGW hands to hosts on the LAN; DNS  
> resolution isn't going to work.  So, (and, again, I think this  
> solution is hinted at in this thread and the draft) the BGW SHOULD  
> use a short DHCP lease time until it can supply the hosts on the LAN  
> with the address of a good resolver.
>
> I recognize the impact of short DHCP leases on BGW performance.  It  
> would be interesting to test the DHCP servers in these BGW with,  
> say, 20 hosts and a lease time of 1 minute.
>
> Note that all of this discussion is aimed at solving the proxy  
> problem by avoiding proxies.  I don't know if that goal is in scope  
> of this draft.  Another solution, of course, would be to put a real  
> recursive resolver in the BGW, which might have other advantages for  
> DNSSEC.
>
> Finally, after asking all this, I wondered...
>
> * What do we want to get out of this recommendation?
>
> Are we trying to change the future behavior of BGWs in some way?  If  
> we're going to try to change the behavior of BGWs regarding DNS  
> proxies, can we take a bigger step and try to get rid of them  
> altogether?
>
> - Ralph
>
> On Jan 21, 2009, at 8:29 PM 1/21/09, Danny Mayer wrote:
>
>> [ Moderators note: Post was moderated, either because it was posted  
>> by
>>  a non-subscriber, or because it was over 20K.
>>  With the massive amount of spam, it is easy to miss and therefore
>>  delete relevant posts by non-subscribers.
>>  Please fix your subscription addresses. ]
>>
>> [email-masked] wrote:
>>>> Has anyone thought to forward this to the DHCP Working Group for  
>>>> their
>>>> input? You are ascribing a great deal to DHCP requirements, so they
>>>> should also comment on this draft.
>>>
>>> The draft itself makes no recommendations about the protocol.
>>>
>>
>> That wasn't the point. People here are making plenty of statements  
>> about
>> what DHCP needs and wants but noone seems to be asking them for what
>> their requirements really are and they can add a lot to the  
>> discussion.
>> They are an active group and are not shy about discussing issues!
>>
>>> The only recommendations are about what features the DHCP server  
>>> that's
>>> found alongside the DNS proxy in broadband gateways should support.
>>>
>>
>> For which their opinion should be sought.
>>
>>> That said, ISTR that Olafur said that he would liaise with the DHC  
>>> WG if
>>> necessary.
>>>
>>
>> Well I copied the DHCP WG on this message.
>>
>> Danny
>>> Ray
>>
>> --
>> to unsubscribe send a message to [email-masked]  
>> with
>> the word 'unsubscribe' in a single line as the message text body.
>> archive: <http://ops.ietf.org/lists/namedroppers/>
>

_______________________________________________
dhcwg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dhcwg

---

From: "Glen Zorn" <[email-masked]>
Date: Fri, 23 Jan 2009 10:06:40 -0800

> I sent the following message to the namedroppers mailing list as part

I, for one, don't really need to belong to YAML, so is there any way that we
can simply include dhc in the discussion (it seems only polite to do so ;-).

...

~gwz
---------------------------
Today in History
2002: 55 arrested at the UN for protesting the US war in Afghanistan & the
"War on Terror"

---

From: Ralph Droms <[email-masked]>
Date: Mon, 26 Jan 2009 09:19:24 -0500

I figured most everyone interested would already be subscribed to  
namedroppers.

Turns out the re wasn't much response to my post.  The entire thread  
starts here:

http://ops.ietf.org/lists/namedroppers/namedroppers.2009/msg00004.html

and my response thread starts here:

http://ops.ietf.org/lists/namedroppers/namedroppers.2009/msg00116.html

- Ralph

On Jan 23, 2009, at 1:06 PM 1/23/09, Glen Zorn wrote:

> Ralph Droms [mailto:[email-masked]] writes:
>