Subject: RE: IPv6 Scoped Addresses and Routing Protocols

From: "Dave Thaler" <[email-masked]>
Date: Tue, 11 Jun 2002 10:43:13 -0700

> -----Original Message-----
> From: Pekka Savola [mailto:[email-masked]]
[...] 
> On Mon, 10 Jun 2002, Alain Durand wrote:
> > Today, with IPv4+NAT on my home network, I simply point my
> > stub-resolvers to my ISP DNS resolver. It's simple, and works
> > fine, at least until I try to do reverse DNS lookup for my internal
> > addresses.
> 
> You could run your own authorative DNS server in your
> router/firewall/whatever.  That's what I do.  That isn't really a
recipe
> for the masses, but if that's all it takes, I guess router vendors
might
> implement something like that.
> 
> > Then it just fails. Some applications that I run on
> > my local LAN don't work well or wait forever for timeouts,
> > because they can not resolve 1.1.168 .192.in-addr.arpa.
> > If I had enough IPv4 address space, I could get my ISP
> > to populate the DNS reverse maps, and my problem would
> > be solved.

Personally I think DNS reverse lookups should go away, not
site-locals.  In my opinion, using ICMP name lookups to the 
node itself is a much better solution to making reverse 
lookups work, and they would work fine for scoped addresses.  
(Yes it would only work when the node is reachable, but I 
don't consider that a problem, whereas DNS has bigger problems.)

-Dave

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Tue, 11 Jun 2002 14:15:40 -0400

> Personally I think DNS reverse lookups should go away, not site-locals

you mean you'd take away functionality that's actually *useful* 
in order to save a hack of dubious value?

> In my opinion, using ICMP name lookups to the

the node's opinion of its name isn't the same piece of information as 
the network administrator's opinion of a node's name.  

you might be able to trust the network admin, but you certainly can't
trust the node.

Keith

---

From: Randy Bush <[email-masked]>
Date: Tue, 11 Jun 2002 11:34:05 -0700

>> In my opinion, using ICMP name lookups to the node itself is a much
>> better solution to making reverse lookups work, and they would work fine
>> for scoped addresses.

cool knowing the intent of the icmp draft, isn't it?

> the network administrator's opinion of a node's name.  
                             ^ cryptogtaphically signed

can you say "name spoofing"

randy

---

From: Keith Moore <[email-masked]>
Date: Tue, 11 Jun 2002 14:42:15 -0400

> can you say "name spoofing"

either piece of information can be signed, but the two are still
different pieces of information.

Keith

---

From: Alain Durand <[email-masked]>
Date: Tue, 11 Jun 2002 12:07:23 -0700

On Tuesday, June 11, 2002, at 11:34 AM, Randy Bush wrote:
> l knowing the intent of the icmp draft, isn't it?
>

The ICMP name lookup tells you who a node pretends to be,
not what its globally unique assigned name has been cryptographically 
verified
You may or may not trust this information.
For local debuging purpose, it is valuable information, but it would 
certainly
raises major concerns if it were to be applied on the Internet.

	- Alain.

---

From: Derek Fawcus <[email-masked]>
Date: Tue, 11 Jun 2002 21:38:05 +0100

On Tue, Jun 11, 2002 at 12:07:23PM -0700, Alain Durand wrote:
> certainly raises major concerns if it were to be applied on the Internet.

But surely you simply use the name retrned to do a forward lookup and
verify that the original address is one of those returned?

DF

---

From: Alain Durand <[email-masked]>
Date: Tue, 11 Jun 2002 16:39:37 -0700

> verify that the original address is one of those returned?

.. assuming the name returned is in the global name space.

	- Alain.

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Wed, 12 Jun 2002 21:51:42 +0900

>>>>> On Tue, 11 Jun 2002 10:43:13 -0700, 
>>>>> "Dave Thaler" <[email-masked]> said:

> don't consider that a problem, whereas DNS has bigger problems.)

Personally I agree with you, and the issue of DNS reverse lookup vs
ICMP name lookup (or whatever possible) is important.  However, I'm
afraid this can make the site-local discussion too complicated.  Also,
the reverse lookup issue is not only related to site-locals but to
link-locals or temporary addresses, so we should discuss this at a
separate, generic thread.

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------