Subject: [renum] DNS aspects of renumbering

From: RJ Atkinson <[email-masked]>
Date: Fri, 3 Dec 2010 10:08:17 -0500

A) Secure Dynamic DNS Update

My understanding is that "Secure Dynamic DNS Update" is already
widely implemented (Linux/UNIX/BSD, MS Windows, MacOS X) in
both DNS clients and DNS servers.  I've been told that nsd(8)
omits support for this, but otherwise products seem to support
the capability.

According to Cricket Liu [1], many sites have deployed this
unknowingly because some versions of Microsoft Windows Server
silently enable it if DHCP server, DNS server, and Active Directory
have been enabled by the site.

Otherwise, my perception is that there is somewhat limited
deployment of "Secure Dynamic DNS Update".  As near as I can 
tell, part of the issue is lack of user/site awareness of
this feature and part of the issue is confusion/difficulty
in how to enable that feature.

It seems to me that "Secure Dynamic DNS Update" is a very
powerful and useful tool, but it also seems to me that 
better information ("How To") on this needs to be made
available where folks easily can locate/read it. 

I'm not sure how to make any of that happen, and it is at
least partly a user education topic, but moving to 
FQDN-oriented configuration (as some already are undertaking) 
can't be fully successful unless roaming devices can keep 
their DNS information updates as they roam.

B) SRV, MX, KX records

Similarly, the use of SRV records in the DNS seems 
limited today, except for use with mDNS/DNS-SD within
the local subnet, although the technology is widely 
available/supported across a wide range of platforms.

KX records pre-date SRV records but can be quite useful in
enabling site-to-site VPNs to remain up even in the face
of a site renumbering event.  Conceptually, a KX record
is most similar to an MX record.

MX records are already widely used, so don't need to be
discussed further.

C) mDNS/DNS-SD

These are being standardised by the IETF, hopefully very
soon, and can really help with locating on-subnet printers
or other appliances/services.

At least some of my clients recall the old AppleTalk deployments,
where similar technology existed that worked across multiple
subnets within a site or organisation.  So there is at least
some end user interest in defining what a router-based mDNS 
proxy/cache might look like.  This would be worth undertaking,
but is subtle work as one would want to avoid the issues
that SLP reportedly created. (SLP advertisements were broadcast
in a not-entirely-thoughtful way that ended up consuming 
lots of bandwidth/packets within the enterprise.)  Ideally,
someone with experience in how the AppleTalk routers dealt
with this would draft something here.  I'm certainly willing
to help with this item, as several clients are interested in
this capability.

Yours,

Ran

---

From: Teco Boot <[email-masked]>
Date: Fri, 3 Dec 2010 18:10:46 +0100

Op 3 dec 2010, om 16:08 heeft RJ Atkinson het volgende geschreven:

> subnets within a site or organisation.

In MANETs, same need for a solution. Autoconf draft charter part 2 
addresses also multi-hop service discovery. So there is a home for 
this work. Although Autoconf can use a better record producing stuff.

Draft Autoconf charter:
> 2. Analysis of Problem Space for distributed address configuration and
> service discovery. This analysis is necessary in order to understand
> what type of distributed solution(s) can be standardized. There is
> already quite a lot of material about possible solutions in the
> literature.

Is this related to renumbering?

Teco.

---

From: RJ Atkinson <[email-masked]>
Date: Fri, 3 Dec 2010 13:23:27 -0500

> Is this related to renumbering?

I would say so.  

The big problem isn't actually renumbering the end systems -- 
DHCP, Neighbour Discovery handle that pretty well at this point,
and both are widely deployed now.

The big problem, IMHO, and where RFC-5887 has most of its text,
is on the large number of different places where IP addresses 
have been configured manually (e.g. Access Control Lists,
Printers).  

For that last example, mDNS/DNS-SD is great for locating 
on-subnet devices & services, but extending it to cover 
within-the-building or on-campus devices, in some scoped
and scalable manner similar to AppleTalk long ago, 
would be very helpful IMHO.

My guess is that since MANETs tend to be highly dynamic,
hence are likely to have IP addressing changes more often,
MANET needs and generalised site renumbering needs overlap
greatly.  I'm not sure it matters where the work happens,
so long as it is done.  (In any event, the IESG usually
sorts out which work belongs where.)

Cheers,

Ran

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 6 Dec 2010 11:39:10 +0100

On Fri, Dec 03, 2010 at 10:08:17AM -0500,
 RJ Atkinson <[email-masked]> wrote 
 a message of 79 lines which said:

> widely implemented (Linux/UNIX/BSD, MS Windows, MacOS X) in both DNS
> clients and DNS servers.

You mean RFC 3007 ? It includes at least two very different things,
authentifying the dynamic update request (today, typically via TSIG)
and signing automatically the updated zone. T

> I've been told that nsd(8) omits support for this,

It has no support for dynamic update at all, secure or not, for
anti-bloat reasons.

> Similarly, the use of SRV records in the DNS seems limited today,

Unfortunately, yes. For instance, on .FR name servers, they make
0.25 % of the requests, less than TXT and even less than A6!

> C) mDNS
> 
> These are being standardised by the IETF, hopefully very soon,

I hope not. I do not see why Apple's technology should be approved
blindly. There is already a RFC on a similar technology, RFC 4795 and,
IMHO, mDNS (which is not DNS at all) should follow the same way.

---

From: RJ Atkinson <[email-masked]>
Date: Mon, 6 Dec 2010 06:24:04 -0500

On 06  Dec 2010, at 05:39 , Stephane Bortzmeyer wrote:
> On Fri, Dec 03, 2010 at 10:08:17AM -0500, RJ Atkinson <[email-masked]> wrote 
> and signing automatically the updated zone. 

RFC-3007 is reportedly [Liu] widely implemented, widely available,
and widely interoperable today (and for several years now).  It is not,
as near as I can tell, widely deployed today.  It is relevant here
because it could help greatly with renumbering.

> It has no support for dynamic update at all, secure or not, for

Thank you for the confirmation.

> 0.25 % of the requests, less than TXT and even less than A6!

Thanks for the data.  Increased use of SRV records could help
with renumbering also.

Cheers,

Ran