Subject: Re: [mdnsext] mDNSext features/requirements rollup

From: Alf Watt <[email-masked]>
Date: Tue, 29 Jan 2013 18:07:57 +0000

I think Andrew's point is worth taking the time to seriously consider. We already have dynamic DNS update but as previously mentioned configuration of the DNS server and it's clients out has proven to be either too difficult or not of interest to various OS vendors.

It's worth mentioning that Apple has all the parts in place to pull this off:

- A Server OS with an embedded DNS server which they provide a UI to manage
- Traditional and Mobile Clients with mDNSResolvers running on them
- A profile distribution system which make pushing configuration options including keys easy

Given the will to get the features implemented Apple could solve part of the problem this without any changes to mdns.

There are still things that fall outside of that scope which we should consider, but ignoring the opportunity to uses the existing protocols seems like a lot of effort to reproduce work that already exists.

Best,
Alf

On Jan 28, 2013, at 12:03 PM, [email-masked]<mailto:[email-masked]> wrote:

From: Andrew Sullivan <[email-masked]<mailto:[email-masked]>>
Subject: Re: [mdnsext] mDNSext features/requirements rollup
Date: January 28, 2013 9:34:00 AM PST
To: <[email-masked]<mailto:[email-masked]>>

On Mon, Jan 28, 2013 at 11:51:02AM -0500, RJ Atkinson wrote:

Some of us would like to see mDNS support multiple IP subnets
(e.g. multiple buildings, multiple groups, multiple (V)LANs)
within a single administrative domain (e.g. university campus,
corporate campus).

 This implies having a straight-forward way to configure
 networking devices (e.g. firewalls, routers) at the edge
 of one's administrative domain to exclude certain interfaces
 (e.g. exterior uplink interfaces) from all mDNS traffic
 of the administrative domain using mDNS.

I still do not understand why this sort of thing isn't better handled
by vastly improved tools for real DNS management.  It seems to me that
people are asking for a single, unifed namespace outside the
link-local context, and we invented a mechanism for that many years
ago.  The problem is that the support tools for that mechanism sort of
suck.  Instead of inventing a new protocol which, by definition, is
going to run into conflicts with the existing protocols in this space,
why wouldn't it be better to take that energy and expend it on the
missing tools?

A

--
Andrew Sullivan
[email-masked]<mailto:[email-masked]>

---

From: nudge <[email-masked]>
Date: Tue, 29 Jan 2013 19:39:12 +0100

On Tue, Jan 29, 2013, at 07:07 PM, Alf Watt wrote:
> 
> I think Andrew's point is worth taking the time to seriously consider. We
> already have dynamic DNS update but as previously mentioned configuration
> of the DNS server and it's clients out has proven to be either too
> difficult or not of interest to various OS vendors.
> 
> Given the will to get the features implemented Apple could solve part of
> the problem this without any changes to mdns.
> 
> There are still things that fall outside of that scope which we should
> consider, but ignoring the opportunity to uses the existing protocols
> seems like a lot of effort to reproduce work that already exists.
> 
> Best,
> Alf
> 

As someone who successfully tested and implemented WAB with TSIG
protected updates[1] in an Apple environment about a year or so ago, I
would tend to agree. It wasn't as difficult as I imagined partly because
of a lack of documentation. Of course, things have changed since and I
need to test again soon. But back then you had to front-end named with
dnsextd if you needed llq (obviously you do). If that's still true it
blocks other useful stuff such as rpz and rrl and needs fixing IMO.

[1]I also tested TSIG protected reads DNSprivate, where's that going ?

---

From: vortex <[email-masked]>
Date: Tue, 29 Jan 2013 19:33:56 +0000

The problem has been that the POSIX and non-apple WAB component for
read/write DNS-SD under the bonjour stack has been broken and ignored
for years.

Integrating mDNS & WAB has been close on impossible because of this
(reference all the frustrations on the bonjour-dev mailing list without
resolution, again, it's been years!).

Alternate stacks such as avahi (non-cross platform) have waited for
"vital" security implementations for DNSSEC before implementing write
enabled DNS-SD (a big mistake IMHO!), and because DNSSEC is so hairy
this has not happened either (on their roadmap unimplemented/delayed for
years).

WAB & m~DNS has had the potential to be an exciting cross platform
Internet-wide resource publishing and discovery mechanism, but their
seems little interest in the past to make this happen,

Regards to all,

.v

On 29/01/2013 18:39, nudge wrote:
> _______________________________________________
> mdnsext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mdnsext
>

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 29 Jan 2013 15:04:49 -0500

> this has not happened either (on their roadmap unimplemented/delayed for

This is probably a clue-stick that should be applied off-list, but
what does DNSSEC have to do with writing records into the DNS?
(Unless by "DNSSEC" you mean SIG(0) or TSIG or something like that.)

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: vortex <[email-masked]>
Date: Wed, 30 Jan 2013 07:11:24 +0000

> (Unless by "DNSSEC" you mean SIG(0) or TSIG or something like that.)

AFAIK, close to nothing. But in avahi's case the two issues were bound
together by one or more developers considering them intimately bound,
resulting in Wide Area updates never being implemented, see

http://avahi.org/roadmap

and

http://avahi.org/wiki/GoogleSummerOfCode

Best,

.v

---

From: Olivier Levon <[email-masked]>
Date: Wed, 30 Jan 2013 15:39:28 +0100

Hi,

Some people did various patches to suport WAB in POSIX, like
http://www.roguelazer.com/tips/2010/02/dynamic-dns-part-two/ or
https://github.com/gkaindl/Community-mdnsResponder.
They were published on the bonjour-dev mailing list.

For my own use, I'm currently running my own patched version of POSIX
mdnsresponder on two Ubuntu boxes (one client with mdnsresponder and one
DNS server with dnsextd/bind).

Best,

Olivier