Subject: [homenet] Comments on draft-howard-isp-ip6rdns-05 about Dynamically Generate PTR When Queried

From: <[email-masked]>
Date: Thu, 6 Dec 2012 13:48:56 +0000

All,

In the document draft-howard-isp-ip6rdns-05, a proposal to manage the ip6-addr.arpa zone is to generate a PTR record on demand, and cache or prepopulate the forward (AAAA) entry for the duration of the time-to-live of the PTR.

It is possible to generate PTR responses to reverse lookups on the fly without need to keep the forward entry into cache memory.

Kazunori Fujiwara has implemented a prototype "On the Fly" DNS server which does not require caching.

  http://member.wide.ad.jp/~fujiwara/v6rev.html

The algorithm is simple. The DNS server builds the reverse host name as the concatenation of the IPv6 address (using a 32-character hexadecimal representation without :) with a fixed domain name suffix.
The generated hostname can be easily resolved by forward lookup since the generated hostname contains raw IPv6 address. The response is in the question.

Here below an example of reverse lookup matching a forward lookup.

The reverse lookup on IPv6 "2a01:c012:3456:789a:bcde:f012:3456:789a" gives the following:

# dig -x 2a01:c012:3456:789a:bcde:f012:3456:789a +short
2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr.

In the forward lookup response, we retrieve the original IPv6 address:

# dig 2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr -t aaaa +short
2a01:c012:3456:789a:bcde:f012:3456:789a

Philippe Lemordant

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
France Telecom - Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, France Telecom - Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: <[email-masked]>
Date: Thu, 6 Dec 2012 14:29:58 +0000

In the document draft-howard-isp-ip6rdns-05, a solution to manage the reverse domain is to dynamically generate PTR when queried ("On the Fly").

In the draft, we have the following:

"This method may not scale well in conjunction with DNSsec [RFC4035], because of the additional load, but since keys may be pregenerated for zones, and not for each record, the risk is moderate."

In normal conditions (i.e. with static DNS zones), signatures are pre-generated for the whole zone. However if you generate PTR records on the fly, you must also generate associated signature (RRSIG) on the fly. So IMHO the impact on performance is important.

Philippe

---

From: Mark Andrews <[email-masked]>
Date: Fri, 07 Dec 2012 10:18:07 +1100

In message <18974_13548017[email-masked]
oup>, [email-masked] writes:
> All,
> 
> In the document draft-howard-isp-ip6rdns-05, a proposal to manage the 
> ip6-addr.arpa zone is to generate a PTR record on demand, and cache or 
> prepopulate the forward (AAAA) entry for the duration of the time-to-live 
> of the PTR.
> 
> It is possible to generate PTR responses to reverse lookups on the fly 
> without need to keep the forward entry into cache memory.
> 
> 
> The algorithm is simple. The DNS server builds the reverse host name as 
> the concatenation of the IPv6 address (using a 32-character hexadecimal 
> representation without :) with a fixed domain name suffix.
> The generated hostname can be easily resolved by forward lookup since the 
> generated hostname contains raw IPv6 address. The response is in the 
> question.
> 

While it is staight forward enough to do this technically it is
still *not* a good idea to deploy it.

ISP's have leased the address to their customers and for the duration
of that lease the CUSTOMER not the ISP should be the one naming the
machine.

When ISPs started doing this with IN-ADDR.ARPA the protocols necessary
to have machines populate the zone themselves did not exist.  A lot
has changed in the intervening years.

> __________________________________________________________________________
> _______________________________________________
> 
> Ce message et ses pieces jointes peuvent contenir des informations 
> confidentielles ou privilegiees et ne doivent donc
> pas etre diffuses, exploites ou copies sans autorisation. Si vous avez 
> recu ce message par erreur, veuillez le signaler
> a l'expediteur et le detruire ainsi que les pieces jointes. Les messages 
> electroniques etant susceptibles d'alteration,
> This message and its attachments may contain confidential or privileged 
> information that may be protected by law;
> As emails may be altered, France Telecom - Orange is not liable for 
> messages that have been modified, changed or falsified.
> Thank you.
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: [email-masked]
Date: Fri, 07 Dec 2012 16:37:40 +0900 (JST)

> From: <[email-masked]>

Thanks for introducing my prototype implementation.

> From: <[email-masked]>

My code has DNSSEC on the fly signing function.
It is very slow because it is written in perl and uses Net::DNS::SEC.

You can write special DNS server in C with multi threaded.

Recent CPU can perform over 5000 signs / sec (1024bit RSA).
 (5128 signs/sec, 1024bit RSA, OpenSSL 1.0.1c, SandyBridge 3.2GHz)

We can buy 4 or more cores CPU very cheap.

Then, the server may serve over 20,000 queries/sec.
Traditional DNS server software serves about 20,000 or 100,000 queries/sec.

I think there is no performance concerns if you write new DNS server
software in C.

# new CPUs and OpenSSL 1.0.1 solved performance issues.

> From: Mark Andrews <[email-masked]>

It is not a good idea.
But the idea solves some problems.

> has changed in the intervening years.

Dynamic update or DHCP may solve, but ISPs need to check names which
the client want to register.

Hostnames generated by IPv6 addresses may be useless, but they are harmless.

--
Kazunori Fujiwara, JPRS <[email-masked]>

---

From: <[email-masked]>
Date: Fri, 7 Dec 2012 15:47:25 +0000

> While it is staight forward enough to do this technically it is still *not* a good idea to deploy it.

> ISP's have leased the address to their customers and for the duration of that lease the CUSTOMER not the ISP should be the one naming the machine.

[Philippe L.] Populating the reverse domain with "technical FQDNs' and let the customer name its machine are not incompatible. This is the way it already works in IPv4 for some major ISPs. It allows some security checks since the "technical" FQDN of the reverse domain is also provisioned in a forward zone with an A record matching the PTR record. The customer has still the possibility to define its own FQDNs.

It is also possible for the customer to delegate the reverse zone provisioning to a third party entity (like DynDNS) so that the PTR and A (or AAAA) records have the same customer's FQDN. Procedure is described at the following URL: http://dyn.com/support/reverse-dns/. 

Few customers will only need to delegate reverse DNS to this third party entity. On the ISP side, the software generating the PTR records "on the fly" should have the capacity to handle reverse zone delegation for a specific IP by use of CNAME record. If a customer requires reverse DNS delegation for a block of IPs or for a full IPv6 prefix, same principle is applicable using the DNAME records. 
By default the ISP keeps control on the provisioning of the reverse domain "ip6.arpa". On customers' request, ISP can manage exceptions to delegate this provisioning. In this case, the customer must assume the fact that some ISP's services may not be compatible any more.
  
> When ISPs started doing this with IN-ADDR.ARPA the protocols necessary to have machines populate the zone themselves did not exist.  A lot has changed in the intervening years.