Subject: TR : Stepping back on the DNS discovery discussion

From: "BELOEIL Luc FTRD/DMI/CAE" <[email-masked]>
Date: Wed, 16 Jul 2003 14:31:14 +0200

(sorry it seems I have encountered pb to send messages...)

Hi Alain, 

> -----Message d'origine-----
> De : Alain Durand [mailto:[email-masked]]
> Envoyé : mardi 15 juillet 2003 09:40

I agree, we should first have a clear consensus on requirements for "DNS discovery".

> A)  Rob, in his introduction, pointed at a number a functions a node
> could

I agree that point 1- is the most critical requirement for basic services. It's not clear for me how to evaluate criticity of other points.

> B) The second major element to study is the desired/required mode of
> operation.

As far as I know, 3 solutions have been documented:
- well-known site-local IPv6 addresses... IMHO, that solution depends on decision of ipv6 wg upon local addresses
- DHCPv6 (+ DHCP-lite)
- RA-based solution
Some guys had also spoken about SLPv6. But at last meeting, Bob pointed that a service discovery protocol should not be used for that (no one answered to that).

As DNS is a critical service between "applications world" and "IP layer world", we might be careful on consequences. From application point of view, we might ask in the future to extende that solution to other type of services (NTP, ...). In that way, RA-based solution might not be the good solution, because I do think that RA must not be extended to any sort of service discovery. Any idea about that?

> C) A third element in this discussion is the compatibility with the
> IPv4 model.

I agree that we need an _administrative model_ in IPv6. But I don't really understand that within that discussion. Do you have in mind O-bit et al? Anyway could you clarify?

> 	- Alain.
> 
> #-------------------------------------------------------------
> ---------
> # To unsubscribe, send a message to <[email-masked]>.
> 

#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.

---

From: Tim Chown <[email-masked]>
Date: Wed, 16 Jul 2003 18:04:20 +0100

> As DNS is a critical service between "applications world" and "IP layer world", we might be careful on consequences. From application point of view, we might ask in the future to extende that solut…

So where do you draw the boundary between "network device autoconfiguration" 
and "service discovery".   For IPv4, you (manually or via DHCP) configure
IPv4 address, netmask, gateway and DNS resolver(s) as the "basic" four 
components to be able to get up and running.   In IPv6, when using stateless 
autoconfiguration, the RA mechanism takes care of the first three (because 
the stateless mechanism implies the /64 "netmask"), but the DNS resolver 
address(es) cannot be learnt (although I believe WinXP implements the 
well-known site local discovery method).

So an interesting question is what we mean by "stateless autoconfiguration".
I think this term is causing some of the religion in the discussion :)   It 
seems that probably mean "autoconfiguration without servers (i.e. DHCPv6)",
since there would have to be state (pre-configuration) in the router (the 
prefix configuration).   The RA camp seems to want the routers to be able to
issue DNS resolver information, not a separate full-blown DHCPv6 server.

But it's not that clear cut as, for example, my home DSL router includes
a DHCP server (as well my DNS server and print server and other stuff).
The functionality is combined, all in a very cheap (<100 Euro) commodity box.

So are we really concerned as to whether we need a separate DHCPv6 server on
our network (and the overhead of that in ad-hoc networks), or that we would 
like a router to be able to provide DNS resolver information on link (such that
we can plumb networks without needing a separate DHCPv6 box)?   If the latter, 
then does it matter if the router does that via RA piggybacks or DHCPv6 Lite?
What is the real difference in implementation cost?

Of course the mode of operation is also an interesting issue, but it's possible
for DHCPv6(Lite) to have an unsolicited response mode added, if that is felt
to be important.

Something has to configure the prefix information to the router, likewise
the DNS information has to be configured.  I don't think we've discusse that
much, but distributing the DNS resolver information to multiple routers rather
than one (or a small number of) DHCPv6 servers may require more thought.  But
in my home network, it'll all be in my DSL router :)

Tim

---

From: Michael Richardson <[email-masked]>
Date: Thu, 17 Jul 2003 12:51:59 +0200

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Tim" == Tim Chown <[email-masked]> writes:
    Tim> So where do you draw the boundary between "network device
    Tim> autoconfiguration"  
    Tim> and "service discovery".   For IPv4, you (manually or via DHCP)
    Tim> configure 
    Tim> IPv4 address, netmask, gateway and DNS resolver(s) as the "basic"
    Tim> four components to be able to get up and running.   In IPv6, when
    Tim> using stateless  

  That's all you need *TODAY*.

  Given only those things, you are completely insecure. Anyone can spoof
your MAC address or IP address, anyone can feed to bad data, or spoof the
MAC of the nexthop router, etc.

  If you just want IPv6 to be IPv4-with-bigger-addresses, then fine, add
DNS info to the RA. But, NATv4 works just as well for many people.

  While some people feel that the location of the nearest print server isn't
critical information - it *is* if you run a print shop, and I arrive in
to print things. In fact, the location of the print server might be more
important than the gateway!!!! It is all in the eye of the beholder.

  If you want to be useful, then we need all of the other things that we
have been doing with DHCPv4 for years to be available reliably. This means
many other things too.

  Put the address of the DHCPv6 server in the RA, if you want to put anything
in the RA. I know that there are ways to address it otherwise as well.

]                   At IETF57 in Wien, Austria                  |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] printk("Just another Debian GNU/Linux using, kernel hacking, security guy");[

---

From: Jaehoon Jeong <[email-masked]>
Date: Thu, 17 Jul 2003 01:17:10 -0700 (PDT)

In this DNSOP meeting, RA-based DNS discovery has been
being discussed in comparison with DHCP-based DNS
discovery. As it seems that this discussion is related
to IPv6 wg, I send this issue in CC to IPv6 wg for
listening to IPv6 members' liberal opinions and
comments.

> For IPv4, you (manually or via DHCP) configure

For consistent and time-saving autoconfiguration, I
think, we need to adopt one of two alternatives in
sequence (stateless and stateful approaches). In IPv4
domain, DHCP is enough for the autoconfiguration. But,
in IPv6, we introduced stateless autoconfiguration.
Like Tim's opinion, DNS information is missing in the
current IPv6 stateless autoconfiguration. Of course,
DHCPv6 is a good solution. However, in order to get
only DNS information, it is so limited direction for
all kinds of IPv6 networks, such as home network,
HMIPv6, NEMO and MANET connected to the Internet, to
adopt only DHCPv6-based DNS discovery. 
IMHO, RA-based DNS discovery is a really really good
companion with DHCP approach, not enemy or competitor.

> I think this term is causing some of the religion in
> the discussion :)   It seems that probably
> mean "autoconfiguration without
> servers (i.e. DHCPv6)",

I think no great difference.
 
> mode added, if that is felt
 
Just in order to announce DNS information, isn't to
run  DHCPv6(Lite) overactive? RA-piggyback
announcement of DNS information with prefix
information is efficient in the respect of the amount
of announced traffic.

> the DNS information has to be configured.  I don't
> think we've discusse that much, 

Right, let's discuss further.

> but distributing the DNS resolver information
> to multiple routers rather
> than one (or a small number of) DHCPv6 servers may
> require more thought.  

In current Cisco router, we configure the addresses of
recursive DNS servers for its own name resolution.
Therefore, the DNS servers' addresses have already
been configured. We only have to use the information
so as to announce DNS information through RA message.
How about?

/Jaehoon Paul

> But
> # To unsubscribe, send a message to
<[email-masked]>.

__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com
#----------------------------------------------------------------------
# To unsubscribe, send a message to <[email-masked]>.