Subject: Re: (ngtrans) I-D ACTION:draft-ietf-ngtrans-6to4-dns-00.txt

From: David Terrell <[email-masked]>
Date: Thu, 27 Dec 2001 14:56:54 -0800

On Mon, Nov 19, 2001 at 08:32:29AM -0500, [email-masked] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Next Generation Transition Working Group of the IETF.
> 
> 	Title		: 6to4 and DNS
> 	Author(s)	: K. Moore
> 	Filename	: draft-ietf-ngtrans-6to4-dns-00.txt
> 	Pages		: 11
> 	Date		: 16-Nov-01

The final suggestion of this draft is that local (stub and recursive)
resolvers be modified to return pseudorecords for .2.0.0.2.ip6.arpa.

Wouldn't it speed deployment of 6to4 reverse DNS to simply implement
this psuedorecord creation in the nameservers to whom 2.0.0.2.ip6.arpa
is delegated?  Consider:

10.0.0.1 / 2002:a00:1::/48
Assume 6to4 DNS anycast suffix of dddd::abc

A small DNS server is written which loads an authoritative zone for
2.0.0.2.ip6.arpa.  An axfr of 2.0.0.2.ip6.arpa would only return
this authoritative data.

Any request for a.b.c.d.e.f.g.h.2.0.0.2.ip6.arpa is looked up against
this authoritative zone.  This zone could include things like blackhole
delegations at 8.a.0.c.2.0.0.2.ip6.arpa (192.168) or more importantly 
perhaps e.2.0.0.2.ip6.arpa (224/8) to avoid sending people off into
problematic areas.  It could also include delegations requested by 
IP block owners.

If the response would be NXDOMAIN and the request is at least 8 nibbles
past 2002, then return:
h.g.f.e.d.c.b.a.2.0.0.2.ip6.arpa. 0 IN NS ns.h.g.f.e.d.c.b.a.2.0.0.2.ip6.arpa.
ns.h.g.f.e.d.c.b.a.2.0.0.2.ip6.arpa. 0 IN AAAA 2002:abcd:efgh:dddd::abc

field testing should be done to verify that if this configuration is 
used, resolvers will contact 2002:abcd:efgh:dddd::abc for authoritative
data and cache the supplied NS records for a period of time.

The other alternative is for the authoritative server for
.2.0.0.2.ip6.arpa to contact 2002:abcd:efgh:dddd::abc itself and
ask it for NS records for h.g.f.e.d.c.b.a.2.0.0.2.ip6.arpa.  This
allows reasonable delegations to external nameservers (off the
destination network), but is much more susceptible to hijacking.

-- 
David Terrell            | "Consumerism is neat."
[email-masked]             |         - Brian Swetland
http://wwn.nebcorp.com/  |

---

From: Keith Moore <[email-masked]>
Date: Fri, 28 Dec 2001 02:22:31 -0500

> is delegated?

it probably would.  one reason I didn't suggest this is that I didn't
want DNS servers to actually return pseudorecords because I thought 
they might get confused (in caches or by clients) with real resource 
records.

however I was thinking about pseudorecords returned by arbitrary
servers or caches.  for the specific case of the 2.0.0.2.ip6.arpa 
servers it might be more reasonable to do something like this,
as long as the TTLs were very short.

---

From: David Terrell <[email-masked]>
Date: Mon, 31 Dec 2001 01:10:50 -0800

> as long as the TTLs were very short.

So if these pseudorecords are created on the 2.0.0.2.ip6.arpa
authoritative side, what's an appropriate AAAA record to return and
is ns.<nibbles>.ip6.arpa. an appropriate NS to use?

-- 
David Terrell            | "If NNTP had a protocol extension for
[email-masked]             | administering a spanking (long overdue if
Nebcorp Prime Minister   | you ask me), you'd be yelping right now."
http://wwn.nebcorp.com/  |  - Miguel Cruz