Subject: [dnssd] Hybrid Proxy configuration & deployment draft

From: Tom Pusateri <[email-masked]>
Date: Wed, 1 Apr 2015 13:16:28 -0400

As promised in the working group meeting, I put together a draft of configuration parameters and some deployment advice for the Hybrid Proxy.

http://tools.ietf.org/html/draft-pusateri-hybridproxy-impl-00

I'd love to get some feedback on this. If you're working on an implementation and have come across other necessary or optional parameters, let me know.

Thanks,
Tom

---

From: "Albrecht, Harald" <[email-masked]>
Date: Thu, 2 Apr 2015 10:48:34 +0000

Helllo Tom,

in section 3.1, list item #2 you mention:

"As an example, this could be foo.example.com where example.com is
the domain name distributed through DHCP or SLAAC and foo is the
assigned subdomain."

While I'm aware of the FQDN options in DHCPv4 and DHCPv6, I'm not aware of SLAAC being able to distribute a FQDN or domain name in general. Or am I missing something possibly obvious here?

To my limited knowledge I'm aware of the DNS configuration options for ICMPv6 Router Advertisements (RAs). One such option is for DNSSL(?), the DNS search lists. Do you have some idea in mind how to make use of this existing DNSSL option which isn't yet spelled out in the draft? Or do you intend to define a new RA option that would carry a domain name for completing local device names, such as the mDNS device (host) names?

With best regards,
Harald

Siemens AG
Digital Factory Division
Factory Automation
DF FA TIP DH NBG
Gleiwitzer Str. 555
90475 Nuernberg, Germany 

Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Gerhard Cromme; Managing Board: Joe Kaeser, Chairman, President and Chief Executive Officer; Roland Busch, Lisa Davis, Klaus Helmrich, Janina Kugel, Siegfried Russwurm, Ralf P. Thomas; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322

-----Ursprüngliche Nachricht-----
Von: dnssd [mailto:[email-masked]] Im Auftrag von Tom Pusateri
Gesendet: Mittwoch, 1. April 2015 19:16
An: [email-masked]
Betreff: [dnssd] Hybrid Proxy configuration & deployment draft

Thanks,
Tom

---

From: Tom Pusateri <[email-masked]>
Date: Thu, 2 Apr 2015 08:42:14 -0400

Harald,
	You are correct. I was thinking of the ICMPv6 Router Advertisement Options (RFC 6106) and iterating over the search list but mistakenly thought that was classified as a part of SLAAC. I will fix this.

Thanks,
Tom

> On Apr 2, 2015, at 6:48 AM, Albrecht, Harald <[email-masked]> wrote:
> 
> Helllo Tom,
> 
> _______________________________________________
> dnssd mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnssd

---

From: Markus Stenberg <[email-masked]>
Date: Wed, 8 Apr 2015 11:49:08 +0300

On 1.4.2015, at 20.16, Tom Pusateri <[email-masked]> wrote:
> I'd love to get some feedback on this. If you’re working on an implementation and have come across other necessary or optional parameters, let me know.

In section 2, I would also like to see legacy browse ptr option (not necessarily for all domains); early on in our hybrid proxy implementation experience, we noted that many clients require that to be functional (and expecting them all to be fixed is wistful thinking I think). Whether that would be option under 2.2, or separate 2.3, I do not know.

I think 3.1 #2 was somewhat controversial? At least I vaguely remember that from Dallas. Perhaps mentioning something about that would be useful.

In section 3.1, how about the new ‘host subdomain’ <> ’service subdomain’ that showed up in some later version of hybrid draft? (disclaimer: we do not implement the separation.) I believe the idea was there to have a zone that had ASCII hostname-ish names for A/AAAs, and have the SRV records in potentially UTF-8 zone pointing there or something.

BTW, 3.1 #3 is cool idea ;) And in IPv6 case, you can be actually more clever if you know the site-wide prefix in use; just use the bits that distinguish the local prefix from the delegated prefix the whole site has. (I guess same could be done in IPv4 too, given configuration about what the local prefix is.)

Section 3.4, #2/#3: Are those actually officially required? (I am not sure we do this currently) So not sure they are ‘minimum’ requirements at least.

Section 3.5, UDP port - can that be actually be expressedin a NS record? If not, then not really relevant unless colocated or somehow transmitted outside DNS (we do this in colocated case to keep our hybrid proxy implementation from ever being connected remotely and use local dns forwarder to forward requests to it, but it is implementation choice and therefore not sure it applies here _in general_)

Section 4.1: Not sure this is relevant. If it is, then we should also mention that DNS server address(es) has to be provided to client too (using DHCP, DHCPv6 or ICMPv6).

Cheers,

-Markus

---

From: Tom Pusateri <[email-masked]>
Date: Fri, 10 Apr 2015 21:53:55 -0400

> On Apr 8, 2015, at 4:49 AM, Markus Stenberg <[email-masked]> wrote:
> 

Can you recall which clients need this? The hybrid proxy spec recommends only a single legacy browse domain PTR record for the parent domain. I’ll add this and a single default browse domain.

> I think 3.1 #2 was somewhat controversial? At least I vaguely remember that from Dallas. Perhaps mentioning something about that would be useful.

Yes, Andrew Sullivan mentioned at the microphone that reverse records have fallen out of favor. From the context, I gathered he was referring to PTR records for hostnames (the inverse of A and AAAA records). This is certainly true for AAAA. But I’m not sure this applies to specialized PTR records for infrastructure such as the hybrid proxy. This is specified in section 11 of RFC 6763 and is simply a way to configure things for a campus all in one place and I don’t think the same negative connotation of PTR records applies in all cases. Maybe Andrew could chime in and expand?

> In section 3.1, how about the new ‘host subdomain’ <> ’service subdomain’ that showed up in some later version of hybrid draft? (disclaimer: we do not implement the separation.) I believe the idea…

Yes, I forgot about section 3.2 of the hybrid proxy draft. I will add this.

> BTW, 3.1 #3 is cool idea ;) And in IPv6 case, you can be actually more clever if you know the site-wide prefix in use; just use the bits that distinguish the local prefix from the delegated prefix…

There is also the possibility of needing separate subdomain names for IPv4 and IPv6 if IPv4-only or IPv6-only hosts exist. I need to add this.

> Section 3.4, #2/#3: Are those actually officially required? (I am not sure we do this currently) So not sure they are ‘minimum’ requirements at least.

I thought they were but after re-reading section 11 of RFC 6763, I’m not sure. I’ll have to experiment some more.

> Section 3.5, UDP port - can that be actually be expressedin a NS record? If not, then not really relevant unless colocated or somehow transmitted outside DNS (we do this in colocated case to keep o…

Yes, you are correct. For a delegated subdomain, UDP and TCP must listen on port 53. But I should add optional TLS and DTLS ports. The TLS port will probably be the same as the tcp_push_port but DNS Push may not be implemented so a direct TLS port without STARTTLS could be specified.

> Section 4.1: Not sure this is relevant. If it is, then we should also mention that DNS server address(es) has to be provided to client too (using DHCP, DHCPv6 or ICMPv6).

You are right again. I think I can remove the client configuration info.

Thanks,
Tom

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 15 Apr 2015 16:38:26 -0400

> Yes, Andrew Sullivan mentioned at the microphone that reverse records have fallen out of favor. From the context, I gathered he was referring to PTR records for hostnames (the inverse of A and AAAA…

I think you're right.  My dim memory (and I'm sorry, by Dallas was a
bit of a whirlwind) tells me that the discussion left me thinking you
were going to be able to do forward-reverse matching in order to get
some kind of assurance of something.  The only point that I was trying
to make is that the reverse tree is not that reliable.  PTR records in
general work just fine, and certainly if you're setting up SD you can
use them and the'll work.

A

-- 
Andrew Sullivan
[email-masked]