Subject: RE: dns discovery for agenda? [Re: chairs and charter]

From: [email-masked]
Date: Wed, 19 Mar 2003 18:38:52 +0200

Erik,

> > If we have statefull address autoconfig & stateful address 
> autoconfig, I
> > think having an additional mechanism for getting DNS server 
> addresses is not
> > a  bad thing.  At the transport layer, we have UDP, 
> UDP-lite, DCCP, TCP,
> > SCTP ... to transfer packets.  Having multiple ways to do 
> something is a
> > reasonable solution.
> 
> Two issues with multiple methods to configure the same thing that
> hasn't been brought up are:
>  - potential impact on time to discover
> 	Since each router advertisement doesn't need to contain all
> 	options will a host need to listen for RAs for some time
> 	before it decides it to DHCPv6 to find the info?
>  - conflicting information
> 	A host might use DHCPv6 for other reasons/other information.
> 	What should it do if the RAs and the DHCPv6 reply contains
> 	different DNS information?
> 	What if different RAs received on the same interface contain
> 	different DNS information?

I agree that any solution needs to take these 2 issues into
account.  In summary, the problems seem to be:

1) Ordering of solutions: which to try first and when to try the 2nd.
2) How to resolve conflicting information.

Both of these, I think are solvable, but I do agree that the solution 
needs to propose them.

John	

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Wed, 19 Mar 2003 18:45:38 +0200 (EET)

> Both of these, I think are solvable, but I do agree that the solution 

Perhaps I'm naive but "implementation-specific" would be good enough for 
me.

Consider the case with IPv4.  You've manually configured a couple of DNS 
servers, then run DHCPv4 to get an address and DNS servers.

Do you have to specify how to handle the case?

The latest wins.

Specifying too exactly how to handle these cases may be a rathole, and not 
essential.  If the users are not pleased with the result, they *will* just 
disable the mechanism producing results they don't like.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 19 Mar 2003 21:41:25 +0100 (CET)

> Do you have to specify how to handle the case?

The reason this example is naive (well, you asked :-)
is when DNSSEC is used the client might have a trust relationship with
a particular DNS server (aka recursive resolver) and a secure channel
to that resolver. In that case you clearly don't want to replace
that manually configured DNS server with the ones the DHCP server tells
you to use.

But if the client itself does DNSSEC signature validation it would
presumably use the best-performing server.

   Erik

---

From: Pekka Savola <[email-masked]>
Date: Wed, 19 Mar 2003 22:58:41 +0200 (EET)

> that manually configured DNS server with the ones the DHCP server tells

As an operator and a user, this case seems trivial: if I know some 
server(s) are special, I will configure them, and *disallow* any other 
mechanism from tampering with DNS configuration.  Such toggles typically 
exist in the implementations, and if they don't, I'll switch the 
implementation.

This kind of possibility may require some minor wording ("SHOULD/MUST be
configurable") when specifying autoconfiguration mechanisms, but that
shouldn't be a problem.