Subject: Re: [BEHAVE] DNS64 server using its own synthesized records

From: Cameron Byrne <[email-masked]>
Date: Thu, 27 Aug 2009 22:09:12 -0700 (PDT)

> Hui Deng wrote:
> > how consequently this could happen, DNS64 have to send
> AAAA  resolver
> > to DNS6 side, and
> > send a A resolver through NAT64 meantime? is this your
> assumpation and
> > described in the draft?
> 
> When a DNS64 has only an IPv6 connection, it can only
> contact authoritative 
> name servers over IPv6. However, if it has access to the
> NAT64, it can also 
> talk to IPv4-only authoritative name servers through it. To
> do so it only has 
> to use the synthetic AAAA records it generates.

While this seems possible, as a network operator, i really cannot imagine a scenario where i would deploy something as inelegant as this.  I cannot imagine explaining to my operations teams why we did not give DNS64 a global IPv4 address and how the DNS64 is dependent on the NAT64 in this way.  

The DNS64 / NAT64 is the linchpin of inter-working the v6 and v4 realms, even in a world with limited IPv4 space, giving globally routable IPv4 addresses to the DNS64 (1 address per system, or even using NAT44 for many systems) seems like a high priority.

Cameron Byrne
Principal Engineer
T-Mobile USA

---

From: Mark Andrews <[email-masked]>
Date: Fri, 28 Aug 2009 16:10:15 +1000

In message <[email-masked]>, Cameron Byrne writes:
> While this seems possible, as a network operator, i really cannot imagine a
> scenario where i would deploy something as inelegant as this.  I cannot 
> imagine explaining to my operations teams why we did not give DNS64 a globa
> l IPv4 address and how the DNS64 is dependent on the NAT64 in this way.  

The DNS64 fate shares with the NAT64.  There is nothing inelegent
about this.  The DNS really doesn't require anything more than basic
translation offered by the NAT64.  This just lets you put the DNS64
anywhere you like rather than forcing it to be connected to the IPv4
network directly.
 
> The DNS64 / NAT64 is the linchpin of inter-working the v6 and v4 realms, ev
> en in a world with limited IPv4 space, giving globally routable IPv4 addres
> ses to the DNS64 (1 address per system, or even using NAT44 for many system
> s) seems like a high priority.
> 
> Cameron Byrne
> Principal Engineer
> T-Mobile USA
> 
> 
> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 28 Aug 2009 11:05:00 +0200

> anywhere you like rather than forcing it to be connected to the IPv4

The only way you can do iterative queries through a NAT64 cleanly  
(assuming a world where there are still a few people that don't have  
IPv6 addresses for their nameservers) is for the DNS server to realize  
it needs to talk to an IPv4 address and then add the translator prefix.

Trying to trick a DNS server that doesn't know about NAT64 into doing  
this by translating the addresses it will see IS A VERY BAD IDEA.

---

From: Xu Xiaohu <[email-masked]>
Date: Fri, 28 Aug 2009 18:02:34 +0800

> this by translating the addresses it will see IS A VERY BAD IDEA.

The network administrator can make the choice. For example, if there is a
NAT64 and there is no IPv4 path from a given DNS64 to the IPv4 Internet, the
administrator can enable the IPv6 synthesis function with which the IPv4
address in the glue address RR (associated with the NS RR) can be
synthesized into IPv6 address.

Xiaohu

---

From: Simon Perreault <[email-masked]>
Date: Fri, 28 Aug 2009 07:32:33 -0400

On Friday 28 August 2009 01:09:12 Cameron Byrne wrote:
> imagine explaining to my operations teams why we did not give DNS64 a
> global IPv4 address and how the DNS64 is dependent on the NAT64 in this
> way.

As I mentioned elsewhere in this thread, I expect it to be common that only a 
single global IPv4 address is available and is allocated to the NAT64.

Simon
-- 
DNS64 open-source   --> http://ecdysis.viagenie.ca
STUN/TURN server    --> http://numb.viagenie.ca
vCard 4.0           --> http://www.vcarddav.org

---

From: Simon Perreault <[email-masked]>
Date: Fri, 28 Aug 2009 07:38:49 -0400

> it needs to talk to an IPv4 address and then add the translator prefix.

...which is what both Bind and Unbound do naturally. They just query 
themselves for the AAAA record of a name server they're trying to reach and 
synthesize one if none is available.

> this by translating the addresses it will see IS A VERY BAD IDEA.

I don't understand what you mean. Nobody's tricking anybody, it's doing it by 
default. The point is that the administrator should be able to stop it from 
doing so. Hence my suggestion.

I also don't understand why this is being so controversial.

Simon

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 28 Aug 2009 15:39:42 +0200

> doing so. Hence my suggestion.

If you want to look up www.example.org and it turns out that the  
nameserver for that is a.iana-servers.net with address 192.0.34.43,  
then the DNS resolver behind a NAT64 should _contact_ pref64::c000222b  
but it should NOT _return_ an AAAA record with pref::c000222b in any  
result, because we haven't analyzed the bad things that can happen in  
that case.

---

From: Simon Perreault <[email-masked]>
Date: Fri, 28 Aug 2009 09:54:45 -0400

> result, because we haven't analyzed the bad things that can happen in

I'm confused. Where does your generic DNS resolver come from? I thought we 
were only talking about the DNS64.

Simon

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 28 Aug 2009 16:00:12 +0200

> were only talking about the DNS64.

Could be one box that does both. But it's the resolving that we are  
discussing so that's the name that I used, whether it does DNS64 or  
not is largely irrelevant.

---

From: Simon Perreault <[email-masked]>
Date: Fri, 28 Aug 2009 10:18:07 -0400

> >> result, because we haven't analyzed the bad things that can happen in

I still can't parse this.

If a.iana-servers.net only has an A record, why shouldn't the DNS64 (or a DNS 
resolver using the DNS64 as a forwarder, let's not always mention this case 
since as you said it's not different) synthesize *and* return a AAAA record?

The fact that a NS record points to it is irrelevant.

Simon

---

From: Cameron Byrne <[email-masked]>
Date: Fri, 28 Aug 2009 07:53:11 -0700 (PDT)

> single global IPv4 address is available and is allocated to
Simon,

Can you please explain why you assume only 1 IPv4 address is available?  My assumption is that Network Operators are the ones that will deploy NAT64 / DNS64, and we are address constrained, but not constrained to the extent that 1 more IP address is an issue ... or one more IPv4 address per POP is an issue.  Furthermore, my expectation is that the NAT64 systems will scale in the millions of sessions, so a range of IPv4 addresses will be required to create enough unique BIBs to scale in the millions of sessions, right?

That said, from the other thread, I believe Mark's point regarding the virtuous fate sharing is a good one, and DNS64 using its own synthesized records maybe a relevant deployment model, but i am not sure i would go that route myself.  For example, the virtuous fate sharing may not work perfectly as NAT64 and DNS64 scale separately in terms of transactions / sessions per second.

Cameron

---

From: Simon Perreault <[email-masked]>
Date: Fri, 28 Aug 2009 11:02:32 -0400

On Friday 28 August 2009 10:53:11 Cameron Byrne wrote:
> Can you please explain why you assume only 1 IPv4 address is available?

No. I don't assume. It's only an example. There are other cases where an 
administrator may want to have its DNS64 talk through the NAT64 instead of 
giving it an IPv4 connection.

Simon