From philippe.lemordant@orange.com Thu Dec 6 05:49:02 2012 Return-Path: X-Original-To: homenet@ietfa.amsl.com Delivered-To: homenet@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1863E21F8731 for ; Thu, 6 Dec 2012 05:49:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.563 X-Spam-Level: X-Spam-Status: No, score=-0.563 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, SARE_HTML_URI_LHOST31=1.666, UNPARSEABLE_RELAY=0.001, URI_HEX=0.368] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uLCOwfPfd2dU for ; Thu, 6 Dec 2012 05:49:00 -0800 (PST) Received: from relais-inet.francetelecom.com (relais-ias92.francetelecom.com [193.251.215.92]) by ietfa.amsl.com (Postfix) with ESMTP id ACF3221F858E for ; Thu, 6 Dec 2012 05:48:58 -0800 (PST) Received: from omfedm05.si.francetelecom.fr (unknown [xx.xx.xx.1]) by omfedm09.si.francetelecom.fr (ESMTP service) with ESMTP id 71D432DD144; Thu, 6 Dec 2012 14:48:57 +0100 (CET) Received: from Exchangemail-eme1.itn.ftgroup (unknown [10.114.1.183]) by omfedm05.si.francetelecom.fr (ESMTP service) with ESMTP id 4D7D935C05B; Thu, 6 Dec 2012 14:48:57 +0100 (CET) Received: from PEXCVZYM14.corporate.adroot.infra.ftgroup ([fe80::a42f:c628:bc76:d592]) by PEXCVZYH02.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.02.0318.004; Thu, 6 Dec 2012 14:48:56 +0100 From: To: "homenet@ietf.org" Thread-Topic: Comments on draft-howard-isp-ip6rdns-05 about Dynamically Generate PTR When Queried Thread-Index: Ac3TuG8xc/Gd83W4Tv6hhRJSpdw1ng== Date: Thu, 6 Dec 2012 13:48:56 +0000 Message-ID: <18974_1354801737_50C0A249_18974_12639_1_5C4880217CBF5346A0C211C7DAB9140104E827@PEXCVZYM14.corporate.adroot.infra.ftgroup> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.197.38.6] Content-Type: multipart/alternative; boundary="_000_5C4880217CBF5346A0C211C7DAB9140104E827PEXCVZYM14corpora_" MIME-Version: 1.0 X-PMX-Version: 5.6.1.2065439, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2012.12.6.124221 Cc: "fujiwara@jprs.co.jp" Subject: [homenet] Comments on draft-howard-isp-ip6rdns-05 about Dynamically Generate PTR When Queried X-BeenThere: homenet@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 13:49:02 -0000 --_000_5C4880217CBF5346A0C211C7DAB9140104E827PEXCVZYM14corpora_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable All, In the document draft-howard-isp-ip6rdns-05, a proposal to manage the ip6-a= ddr.arpa zone is to generate a PTR record on demand, and cache or prepopula= te the forward (AAAA) entry for the duration of the time-to-live of the PTR. It is possible to generate PTR responses to reverse lookups on the fly with= out need to keep the forward entry into cache memory. Kazunori Fujiwara has implemented a prototype "On the Fly" DNS server which= does not require caching. http://member.wide.ad.jp/~fujiwara/v6rev.html The algorithm is simple. The DNS server builds the reverse host name as the= concatenation of the IPv6 address (using a 32-character hexadecimal repres= entation without :) with a fixed domain name suffix. The generated hostname can be easily resolved by forward lookup since the g= enerated hostname contains raw IPv6 address. The response is in the questio= n. Here below an example of reverse lookup matching a forward lookup. The reverse lookup on IPv6 "2a01:c012:3456:789a:bcde:f012:3456:789a" gives = the following: # dig -x 2a01:c012:3456:789a:bcde:f012:3456:789a +short 2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr. In the forward lookup response, we retrieve the original IPv6 address: # dig 2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr -t aaaa +short 2a01:c012:3456:789a:bcde:f012:3456:789a Philippe Lemordant ___________________________________________________________________________= ______________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confiden= tielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu= ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el= ectroniques etant susceptibles d'alteration, France Telecom - Orange decline toute responsabilite si ce message a ete al= tere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged inf= ormation that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and dele= te this message and its attachments. As emails may be altered, France Telecom - Orange is not liable for message= s that have been modified, changed or falsified. Thank you. --_000_5C4880217CBF5346A0C211C7DAB9140104E827PEXCVZYM14corpora_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

All,

 

In the docume= nt draft-howard-isp-ip6rdns-05, a proposal to manage the ip6-addr.arpa zone= is to generate a PTR record on demand, and cache or prepopulate the forward (AAAA) entry for the duration of the time-to-live of the PTR.<= o:p>

 

It is possibl= e to generate PTR responses to reverse lookups on the fly without need to k= eep the forward entry into cache memory.

 

Kazunori Fujiwara has implemented a prototyp=
e "On the Fly" DNS server which does not require caching.
 
  http://member.w=
ide.ad.jp/~fujiwara/v6rev.html=

 

The algorithm= is simple. The DNS server builds the reverse host name as the concatenatio= n of the IPv6 address (using a 32-character hexadecimal representation without :) with a fixed domain name suffix.
The generated hostname can be easily resolved by forward lookup since the g= enerated hostname contains raw IPv6 address. The response is in the questio= n.

 

Here below an= example of reverse lookup matching a forward lookup.

 

The reverse l= ookup on IPv6 “2a01:c012:3456:789a:bcde:f012:3456:789a” gives t= he following:

 

# dig -x 2a01:c012:3456:789a:bcde:f012:3456:789a +short<= o:p>

2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr.

 

In the forward lookup response, we retrieve= the original IPv6 address:

 

# dig 2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr -t = aaaa +short

2a01:c012:3456:789a:bcde:f012:3456:789a

 

 

Philippe Lemordant

______________________________________________________________________=
___________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confiden=
tielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu=
 ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el=
ectroniques etant susceptibles d'alteration,
France Telecom - Orange decline toute responsabilite si ce message a ete al=
tere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged inf=
ormation that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and dele=
te this message and its attachments.
As emails may be altered, France Telecom - Orange is not liable for message=
s that have been modified, changed or falsified.
Thank you.
--_000_5C4880217CBF5346A0C211C7DAB9140104E827PEXCVZYM14corpora_-- From philippe.lemordant@orange.com Thu Dec 6 06:43:00 2012 Return-Path: X-Original-To: homenet@ietfa.amsl.com Delivered-To: homenet@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1109921F86C6 for ; Thu, 6 Dec 2012 06:43:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.58 X-Spam-Level: X-Spam-Status: No, score=-1.58 tagged_above=-999 required=5 tests=[AWL=1.017, BAYES_00=-2.599, HTML_MESSAGE=0.001, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0wnZhYOJK+PU for ; Thu, 6 Dec 2012 06:42:58 -0800 (PST) Received: from relais-inet.francetelecom.com (relais-ias91.francetelecom.com [193.251.215.91]) by ietfa.amsl.com (Postfix) with ESMTP id 428D821F86C3 for ; Thu, 6 Dec 2012 06:42:58 -0800 (PST) Received: from omfedm08.si.francetelecom.fr (unknown [xx.xx.xx.4]) by omfedm13.si.francetelecom.fr (ESMTP service) with ESMTP id D7DFB324F97 for ; Thu, 6 Dec 2012 15:42:56 +0100 (CET) Received: from Exchangemail-eme1.itn.ftgroup (unknown [10.114.1.183]) by omfedm08.si.francetelecom.fr (ESMTP service) with ESMTP id 7B915238048 for ; Thu, 6 Dec 2012 15:42:56 +0100 (CET) Received: from PEXCVZYM14.corporate.adroot.infra.ftgroup ([fe80::a42f:c628:bc76:d592]) by PEXCVZYH02.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.02.0318.004; Thu, 6 Dec 2012 15:29:59 +0100 From: To: "homenet@ietf.org" Thread-Topic: Comments on draft-howard-isp-ip6rdns-05 about Dynamically Generate PTR When Queried : impact of DNSSEC Thread-Index: Ac3TviqY8vaHHr19RoKQmy9e5oNNJA== Date: Thu, 6 Dec 2012 14:29:58 +0000 Message-ID: <20070_1354804976_50C0AEF0_20070_1014_2_5C4880217CBF5346A0C211C7DAB9140104E8A1@PEXCVZYM14.corporate.adroot.infra.ftgroup> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.197.38.6] Content-Type: multipart/alternative; boundary="_000_5C4880217CBF5346A0C211C7DAB9140104E8A1PEXCVZYM14corpora_" MIME-Version: 1.0 X-PMX-Version: 5.6.1.2065439, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2012.10.24.110314 Subject: [homenet] Comments on draft-howard-isp-ip6rdns-05 about Dynamically Generate PTR When Queried : impact of DNSSEC X-BeenThere: homenet@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 14:43:00 -0000 --_000_5C4880217CBF5346A0C211C7DAB9140104E8A1PEXCVZYM14corpora_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable In the document draft-howard-isp-ip6rdns-05, a solution to manage the rever= se domain is to dynamically generate PTR when queried ("On the Fly"). In the draft, we have the following: "This method may not scale well in conjunction with DNSsec [RFC4035], becau= se of the additional load, but since keys may be pregenerated for zones, an= d not for each record, the risk is moderate." In normal conditions (i.e. with static DNS zones), signatures are pre-gener= ated for the whole zone. However if you generate PTR records on the fly, yo= u must also generate associated signature (RRSIG) on the fly. So IMHO the i= mpact on performance is important. Philippe ___________________________________________________________________________= ______________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confiden= tielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu= ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el= ectroniques etant susceptibles d'alteration, France Telecom - Orange decline toute responsabilite si ce message a ete al= tere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged inf= ormation that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and dele= te this message and its attachments. As emails may be altered, France Telecom - Orange is not liable for message= s that have been modified, changed or falsified. Thank you. --_000_5C4880217CBF5346A0C211C7DAB9140104E8A1PEXCVZYM14corpora_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

In the document draft-howard-isp-ip6rdns-05= , a solution to manage the reverse domain is to dynamically generate PTR wh= en queried ("On the Fly").

 

In the draft, we have the following:

 

“This method may not scale well in co= njunction with DNSsec [RFC4035], because of the additional load, but since = keys may be pregenerated for zones, and not for each record, the risk is moderate.”

 

In normal conditions (i.e. with static DNS = zones), signatures are pre-generated for the whole zone. However if you gen= erate PTR records on the fly, you must also generate associated signature (RRSIG) on the fly. So IMHO the impact on performance is importa= nt.

 

Philippe

 

______________________________________________________________________=
___________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confiden=
tielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu=
 ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el=
ectroniques etant susceptibles d'alteration,
France Telecom - Orange decline toute responsabilite si ce message a ete al=
tere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged inf=
ormation that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and dele=
te this message and its attachments.
As emails may be altered, France Telecom - Orange is not liable for message=
s that have been modified, changed or falsified.
Thank you.
--_000_5C4880217CBF5346A0C211C7DAB9140104E8A1PEXCVZYM14corpora_-- From marka@isc.org Thu Dec 6 15:18:21 2012 Return-Path: X-Original-To: homenet@ietfa.amsl.com Delivered-To: homenet@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2B0621F85FE for ; Thu, 6 Dec 2012 15:18:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.282 X-Spam-Level: X-Spam-Status: No, score=-1.282 tagged_above=-999 required=5 tests=[AWL=-0.717, BAYES_00=-2.599, SARE_HTML_URI_LHOST31=1.666, URI_HEX=0.368] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MU+Lj7LFoZq1 for ; Thu, 6 Dec 2012 15:18:21 -0800 (PST) Received: from mx.pao1.isc.org (mx.pao1.isc.org [IPv6:2001:4f8:0:2::2b]) by ietfa.amsl.com (Postfix) with ESMTP id CF41421F8618 for ; Thu, 6 Dec 2012 15:18:20 -0800 (PST) Received: from mx.pao1.isc.org (localhost [127.0.0.1]) by mx.pao1.isc.org (Postfix) with ESMTP id 99474CA0A2; Thu, 6 Dec 2012 23:18:10 +0000 (UTC) (envelope-from marka@isc.org) Received: from bikeshed.isc.org (bikeshed.isc.org [IPv6:2001:4f8:3:d::19]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "mail.isc.org", Issuer "RapidSSL CA" (not verified)) by mx.pao1.isc.org (Postfix) with ESMTPS; Thu, 6 Dec 2012 23:18:10 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (c211-30-172-21.carlnfd1.nsw.optusnet.com.au [211.30.172.21]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by bikeshed.isc.org (Postfix) with ESMTPSA id 1ED58216C83; Thu, 6 Dec 2012 23:18:10 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (Postfix) with ESMTP id 452482CB39A7; Fri, 7 Dec 2012 10:18:07 +1100 (EST) To: philippe.lemordant@orange.com From: Mark Andrews References: <18974_1354801737_50C0A249_18974_12639_1_5C4880217CBF5346A0C211C7DAB9140104E827@PEXCVZYM14.corporate.adroot.infra.ftgroup> In-reply-to: Your message of "Thu, 06 Dec 2012 13:48:56 -0000." <18974_1354801737_50C0A249_18974_12639_1_5C4880217CBF5346A0C211C7DAB9140104E827@PEXCVZYM14.corporate.adroot.infra.ftgroup> Date: Fri, 07 Dec 2012 10:18:07 +1100 Message-Id: <20121206231807.452482CB39A7@drugs.dv.isc.org> X-DCC--Metrics: post.isc.org 1102; Body=3 Fuz1=3 Fuz2=3 Cc: "homenet@ietf.org" , "fujiwara@jprs.co.jp" Subject: Re: [homenet] Comments on draft-howard-isp-ip6rdns-05 about Dynamically Generate PTR When Queried X-BeenThere: homenet@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 23:18:22 -0000 In message <18974_1354801737_50C0A249_18974_12639_1_5C4880217CBF5346A0C211C7DAB9140104E827@PEXCVZYM14.corporate.adroot.infra.ftgr oup>, philippe.lemordant@orange.com writes: > All, > > In the document draft-howard-isp-ip6rdns-05, a proposal to manage the > ip6-addr.arpa zone is to generate a PTR record on demand, and cache or > prepopulate the forward (AAAA) entry for the duration of the time-to-live > of the PTR. > > It is possible to generate PTR responses to reverse lookups on the fly > without need to keep the forward entry into cache memory. > > > Kazunori Fujiwara has implemented a prototype "On the Fly" DNS server > which does not require caching. > > > > http://member.wide.ad.jp/~fujiwara/v6rev.html > > > The algorithm is simple. The DNS server builds the reverse host name as > the concatenation of the IPv6 address (using a 32-character hexadecimal > representation without :) with a fixed domain name suffix. > The generated hostname can be easily resolved by forward lookup since the > generated hostname contains raw IPv6 address. The response is in the > question. > > Here below an example of reverse lookup matching a forward lookup. > > The reverse lookup on IPv6 "2a01:c012:3456:789a:bcde:f012:3456:789a" > gives the following: > > # dig -x 2a01:c012:3456:789a:bcde:f012:3456:789a +short > 2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr. > > In the forward lookup response, we retrieve the original IPv6 address: > > # dig 2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr -t aaaa +short > 2a01:c012:3456:789a:bcde:f012:3456:789a > > > Philippe Lemordant While it is staight forward enough to do this technically it is still *not* a good idea to deploy it. ISP's have leased the address to their customers and for the duration of that lease the CUSTOMER not the ISP should be the one naming the machine. When ISPs started doing this with IN-ADDR.ARPA the protocols necessary to have machines populate the zone themselves did not exist. A lot has changed in the intervening years. > __________________________________________________________________________ > _______________________________________________ > > Ce message et ses pieces jointes peuvent contenir des informations > confidentielles ou privilegiees et ne doivent donc > pas etre diffuses, exploites ou copies sans autorisation. Si vous avez > recu ce message par erreur, veuillez le signaler > a l'expediteur et le detruire ainsi que les pieces jointes. Les messages > electroniques etant susceptibles d'alteration, > France Telecom - Orange decline toute responsabilite si ce message a ete > altere, deforme ou falsifie. Merci. > > This message and its attachments may contain confidential or privileged > information that may be protected by law; > they should not be distributed, used or copied without authorisation. > If you have received this email in error, please notify the sender and > delete this message and its attachments. > As emails may be altered, France Telecom - Orange is not liable for > messages that have been modified, changed or falsified. > Thank you. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From fujiwara@jprs.co.jp Thu Dec 6 23:37:42 2012 Return-Path: X-Original-To: homenet@ietfa.amsl.com Delivered-To: homenet@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E33621F8A85 for ; Thu, 6 Dec 2012 23:37:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.565 X-Spam-Level: X-Spam-Status: No, score=-0.565 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, SARE_HTML_URI_LHOST31=1.666, URI_HEX=0.368] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iczZ8kdp42E5 for ; Thu, 6 Dec 2012 23:37:41 -0800 (PST) Received: from off-send01.tyo.jprs.co.jp (off-send01.tyo.jprs.co.jp [IPv6:2001:df0:8:17::10]) by ietfa.amsl.com (Postfix) with ESMTP id 897BD21F87DC for ; Thu, 6 Dec 2012 23:37:41 -0800 (PST) Received: from off-sendsmg01.tyo.jprs.co.jp (off-sendsmg01.tyo.jprs.co.jp [172.18.8.32]) by off-send01.tyo.jprs.co.jp (8.13.8/8.13.8) with ESMTP id qB77be7l027809; Fri, 7 Dec 2012 16:37:40 +0900 X-AuditID: ac120820-b7fec6d000005acc-6c-50c19cc4a057 Received: from localhost (off-cpu04.tyo.jprs.co.jp [172.18.4.14]) by off-sendsmg01.tyo.jprs.co.jp (Symantec Messaging Gateway) with SMTP id F0.F6.23244.4CC91C05; Fri, 7 Dec 2012 16:37:40 +0900 (JST) Date: Fri, 07 Dec 2012 16:37:40 +0900 (JST) Message-Id: <20121207.163740.71123802.fujiwara@jprs.co.jp> To: philippe.lemordant@orange.com From: fujiwara@jprs.co.jp In-Reply-To: <18974_1354801737_50C0A249_18974_12639_1_5C4880217CBF5346A0C211C7DAB9140104E827@PEXCVZYM14.corporate.adroot.infra.ftgroup> <20070_1354804976_50C0AEF0_20070_1014_2_5C4880217CBF5346A0C211C7DAB9140104E8A1@PEXCVZYM14.corporate.adroot.infra.ftgroup> <20121206231807.452482CB39A7@drugs.dv.isc.org> References: <18974_1354801737_50C0A249_18974_12639_1_5C4880217CBF5346A0C211C7DAB9140104E827@PEXCVZYM14.corporate.adroot.infra.ftgroup> X-Mailer: Mew version 6.3.50 on Emacs 22.1 / Mule 5.0 (SAKAKI) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrKIsWRmVeSWpSXmKPExsWyRoiFT/fInIMBBh3zhSzeLzrEYjGrt5PR gcljyZKfTB4tz06yBTBFcdmkpOZklqUW6dslcGXseXCerWCJWMWWKb+ZGhgnCXUxcnJICJhI vHn8jx3CFpO4cG89WxcjF4eQwElGiTMve5lAEiwC2hJ3J/9lBrF5Bawkzi85CBYXEVCU2L5o B5jNLCAisfXjaTBbWCBJ4sed7WD1bAKSEps/tzKDDOUU2MIkcW7TN0aQhJBAG6NE625piM12 Eieer2DtYuQAWiAo8XeHMMRMLYmeGY/ZIWx5ie1v5zBPYOSfhVA1C0nVLCRVCxiZVzHK5Kel 6Ran5qUU56YbGOqVVObrZRUUFeslg+hNjOBQ5FDYwTjjlMEhRgEORiUeXtVrBwKEWBPLiitz DzFKcjApifIKTzsYIMSXlJ9SmZFYnBFfVJqTWnyIUYKDWUmEt6MPKMebklhZlVqUD5OS5mBR Euc9fnaHn5BAemJJanZqakFqEUxWhoNDSYK3fTZQo2BRanpqRVpmTglCmomDE2Q4D9DwNyA1 vMUFibnFmekQ+VOMklLivE9AEgIgiYzSPLjeV4ziQC8I814EyfIA0wpc1yuggUxAA6PY94MM LElESEk1MEberVvVqvSmaBLz3J1TZILS7CWDvm8o7GNUslhho5O6UmGCRKn0pw1s57JZlGRL 5i1ZynYszZyf98jSn4nxUz/WMn84Ydg9KePyh28pSSLys+YcYTpZc29JzelT/zZ7MqyNk3KY +vj9jnMLc8z0Ga+LndrQvGfep7/mb6w2NbLvyt283lRYlE2JpTgj0VCLuag4EQCP2hlH6AIA AA== Cc: homenet@ietf.org Subject: Re: [homenet] Comments on draft-howard-isp-ip6rdns-05 about Dynamically Generate PTR When Queried X-BeenThere: homenet@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 07:37:42 -0000 > From: > Kazunori Fujiwara has implemented a prototype "On the Fly" DNS server which does not require caching. > http://member.wide.ad.jp/~fujiwara/v6rev.html Thanks for introducing my prototype implementation. > From: > In the document draft-howard-isp-ip6rdns-05, a solution to manage the reverse domain is to dynamically generate PTR when queried ("On the Fly"). > > In the draft, we have the following: > > "This method may not scale well in conjunction with DNSsec [RFC4035], because of the additional load, but since keys may be pregenerated for zones, and not for each record, the risk is moderate." > > In normal conditions (i.e. with static DNS zones), signatures are pre-generated for the whole zone. However if you generate PTR records on the fly, you must also generate associated signature (RRSIG) on the fly. So IMHO the impact on performance is important. My code has DNSSEC on the fly signing function. It is very slow because it is written in perl and uses Net::DNS::SEC. You can write special DNS server in C with multi threaded. Recent CPU can perform over 5000 signs / sec (1024bit RSA). (5128 signs/sec, 1024bit RSA, OpenSSL 1.0.1c, SandyBridge 3.2GHz) We can buy 4 or more cores CPU very cheap. Then, the server may serve over 20,000 queries/sec. Traditional DNS server software serves about 20,000 or 100,000 queries/sec. I think there is no performance concerns if you write new DNS server software in C. # new CPUs and OpenSSL 1.0.1 solved performance issues. > From: Mark Andrews >> The reverse lookup on IPv6 "2a01:c012:3456:789a:bcde:f012:3456:789a" >> gives the following: >> >> # dig -x 2a01:c012:3456:789a:bcde:f012:3456:789a +short >> 2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr. >> >> In the forward lookup response, we retrieve the original IPv6 address: >> >> # dig 2a01c0123456789abcdef0123456789a.ip6.abo.orange.fr -t aaaa +short >> 2a01:c012:3456:789a:bcde:f012:3456:789a >> >> >> Philippe Lemordant > > While it is staight forward enough to do this technically it is > still *not* a good idea to deploy it. It is not a good idea. But the idea solves some problems. > ISP's have leased the address to their customers and for the duration > of that lease the CUSTOMER not the ISP should be the one naming the > machine. > > When ISPs started doing this with IN-ADDR.ARPA the protocols necessary > to have machines populate the zone themselves did not exist. A lot > has changed in the intervening years. Dynamic update or DHCP may solve, but ISPs need to check names which the client want to register. Hostnames generated by IPv6 addresses may be useless, but they are harmless. -- Kazunori Fujiwara, JPRS From philippe.lemordant@orange.com Fri Dec 7 07:52:55 2012 Return-Path: X-Original-To: homenet@ietfa.amsl.com Delivered-To: homenet@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0956D21F881E for ; Fri, 7 Dec 2012 07:52:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.089 X-Spam-Level: X-Spam-Status: No, score=-2.089 tagged_above=-999 required=5 tests=[AWL=0.509, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wRWpCvEVOCmo for ; Fri, 7 Dec 2012 07:52:54 -0800 (PST) Received: from relais-inet.francetelecom.com (relais-ias92.francetelecom.com [193.251.215.92]) by ietfa.amsl.com (Postfix) with ESMTP id 2172621F87E9 for ; Fri, 7 Dec 2012 07:52:49 -0800 (PST) Received: from omfedm08.si.francetelecom.fr (unknown [xx.xx.xx.4]) by omfedm14.si.francetelecom.fr (ESMTP service) with ESMTP id 74D9B22C603; Fri, 7 Dec 2012 16:52:48 +0100 (CET) Received: from Exchangemail-eme1.itn.ftgroup (unknown [10.114.1.183]) by omfedm08.si.francetelecom.fr (ESMTP service) with ESMTP id 2022E23806E; Fri, 7 Dec 2012 16:52:48 +0100 (CET) Received: from PEXCVZYM14.corporate.adroot.infra.ftgroup ([fe80::a42f:c628:bc76:d592]) by PEXCVZYH02.corporate.adroot.infra.ftgroup ([::1]) with mapi id 14.02.0318.004; Fri, 7 Dec 2012 16:47:26 +0100 From: To: Mark Andrews Thread-Topic: [homenet] Comments on draft-howard-isp-ip6rdns-05 about Dynamically Generate PTR When Queried Thread-Index: AQHN1Af8CHIcf9fOqEuYlYkmv5MPRJgNSZGw Date: Fri, 7 Dec 2012 15:47:25 +0000 Message-ID: <5614_1354895568_50C210D0_5614_6537_1_5C4880217CBF5346A0C211C7DAB9140104EAB9@PEXCVZYM14.corporate.adroot.infra.ftgroup> References: <18974_1354801737_50C0A249_18974_12639_1_5C4880217CBF5346A0C211C7DAB9140104E827@PEXCVZYM14.corporate.adroot.infra.ftgroup> <20121206231807.452482CB39A7@drugs.dv.isc.org> In-Reply-To: <20121206231807.452482CB39A7@drugs.dv.isc.org> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.197.38.2] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-PMX-Version: 5.6.1.2065439, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2012.12.7.151516 Cc: "homenet@ietf.org" , "fujiwara@jprs.co.jp" Subject: Re: [homenet] Comments on draft-howard-isp-ip6rdns-05 about Dynamically Generate PTR When Queried X-BeenThere: homenet@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2012 15:52:55 -0000 > While it is staight forward enough to do this technically it is still *no= t* a good idea to deploy it. > ISP's have leased the address to their customers and for the duration of = that lease the CUSTOMER not the ISP should be the one naming the machine. [Philippe L.] Populating the reverse domain with "technical FQDNs' and let = the customer name its machine are not incompatible. This is the way it alre= ady works in IPv4 for some major ISPs. It allows some security checks since= the "technical" FQDN of the reverse domain is also provisioned in a forwar= d zone with an A record matching the PTR record. The customer has still the= possibility to define its own FQDNs. It is also possible for the customer to delegate the reverse zone provision= ing to a third party entity (like DynDNS) so that the PTR and A (or AAAA) r= ecords have the same customer's FQDN. Procedure is described at the followi= ng URL: http://dyn.com/support/reverse-dns/.=20 Few customers will only need to delegate reverse DNS to this third party en= tity. On the ISP side, the software generating the PTR records "on the fly"= should have the capacity to handle reverse zone delegation for a specific = IP by use of CNAME record. If a customer requires reverse DNS delegation fo= r a block of IPs or for a full IPv6 prefix, same principle is applicable us= ing the DNAME records.=20 By default the ISP keeps control on the provisioning of the reverse domain = "ip6.arpa". On customers' request, ISP can manage exceptions to delegate th= is provisioning. In this case, the customer must assume the fact that some = ISP's services may not be compatible any more. =20=20 > When ISPs started doing this with IN-ADDR.ARPA the protocols necessary to= have machines populate the zone themselves did not exist. A lot has chang= ed in the intervening years. ___________________________________________________________________________= ______________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confiden= tielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu= ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el= ectroniques etant susceptibles d'alteration, France Telecom - Orange decline toute responsabilite si ce message a ete al= tere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged inf= ormation that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and dele= te this message and its attachments. As emails may be altered, France Telecom - Orange is not liable for message= s that have been modified, changed or falsified. Thank you.