Subject: Revised resolution Proposal for LLMNR Issue 38: DNS Proxy undefined

From: Bernard Aboba <[email-masked]>
Date: Mon, 12 May 2003 20:24:30 -0700 (PDT)

In Section 1, Change:

"Propagation of LLMNR packets on the local link is considered sufficient
to enable name resolution in small networks.  The assumption is that if
a network has a home gateway, then the network either has a DNS server
or the home gateway can function as a DNS proxy.  By implementing
Dynamic Host Configuration Service for IPv4 (DHCPv4) as well as a DNS
proxy and dynamic DNS, home gateways can provide name resolution for the
names of hosts over IPv4 on the local network.

For small IPv6 networks, equivalent functionality can be provided by a
home gateway implementing Dynamic Host Configuration Service for IPv6
(DHCPv6) for DNS configuration [DHCPv6DNS], as well as a DNS proxy
supporting AAAA RRs and dynamic DNS, providing name resolution for the
names of hosts over IPv6 on the local network.

This should be adequate as long as home gateways implementing DNS
configuration also support dynamic DNS in some form."

To:

"Propagation of LLMNR packets on the local link is considered sufficient
to enable name resolution in small networks. The assumption is that if a
network has a home gateway, then the network either has DNS and DHCPv4
servers or the home gateway provides DHCPv4 and DNS server functionality.
By providing Dynamic Host Configuration Service for IPv4 (DHCPv4), as
well as a DNS server with support for dynamic DNS, which is also
authoritative for the A RRs of local hosts, it is possible to support
resolution of local host names over IPv4.

For small IPv6 networks, equivalent functionality can be provided by
implementing Dynamic Host Configuration Service for IPv6 (DHCPv6) for DNS
configuration [DHCPv6DNS], as well providing a DNS server with support for dynamic DNS,
which is also authoritative for the AAAA RRs of local hosts, it is
possible to support the resolution of local
host names over IPv6 as well as IPv4. "

In Section 3.2, change:

"LLMNR usage MAY be configured manually or automatically on a per
interface basis. By default, LLMNR responders SHOULD be enabled on all
interfaces, at all times.

Since IPv4 and IPv6 utilize distinct configuration mechanisms, it is
possible for a dual stack host to be configured with the address of a
DNS server over IPv4, while remaining unconfigured with a DNS server
suitable for use over IPv6. In these situations, a dual stack host will
send AAAA queries to the configured DNS server over IPv4.

However, an IPv6-only host unconfigured with a DNS server suitable for
use over IPv6 will be unable to resolve names using DNS. Since
automatic IPv6 DNS configuration mechanisms (such as [DHCPv6DNS] and
[DNSDisc]) are not yet widely deployed, and not all DNS servers support
IPv6, lack of IPv6 DNS configuration may be a common problem in the
short term, and LLMNR may prove useful in enabling linklocal name
resolution over IPv6.

For example, a home gateway may implement a DNS proxy and DHCPv4, but
not DHCPv6 for DNS configuration [DHCPv6DNS]. In such a circumstance,
IPv6-only hosts will not be configured with a DNS server. Where the DNS
proxy does not support dynamic client update over IPv6 or DHCPv6-based
dynamic update of the DNS proxy, the home gateway will not be able to
dynamically register the names of IPv6 hosts. As a result, the DNS
proxy will respond to AAAA RR queries sent over IPv4 or IPv6 with an
authoritative name error (RCODE=3). This prevents hosts from resolving
the names of IPv6-only hosts on the local link. In this situation,
LLMNR over IPv6 can be used for resolution of dynamic names."

To:

"LLMNR usage MAY be configured manually or automatically on a per
interface basis. By default, LLMNR responders SHOULD be enabled
on all interfaces, at all times.

Since IPv4 and IPv6 utilize distinct configuration mechanisms, it is
possible for a dual stack host to be configured with the address of a
DNS server over IPv4, while remaining unconfigured with a DNS server
suitable for use over IPv6. In these situations, a dual stack host
will send AAAA queries to the configured DNS server over IPv4.

However, an IPv6-only host unconfigured with a DNS server suitable
for use over IPv6 will be unable to resolve names using DNS.
Since automatic IPv6 DNS configuration mechanisms (such as [DHCPv6DNS]
and [DNSDisc]) are not yet widely deployed, and not all DNS servers
support IPv6, lack of IPv6 DNS configuration may be a common problem
in the short term, and LLMNR may prove useful in enabling
linklocal name resolution over IPv6.

For example, a home network may provide a DHCPv4 server but may not
support DHCPv6 for DNS configuration [DHCPv6DNS]. In
such a circumstance, IPv6-only hosts will not be configured with a DNS
server. Where a DNS server is configured but
does not support dynamic client update
over IPv6 or DHCPv6-based dynamic update, hosts on the home network
will not be able to dynamically register or resolve the names of
local IPv6 hosts. If the configured DNS server
responds to AAAA RR queries sent over IPv4 or IPv6 with an authoritative
name error (RCODE=3), then it will not be possible to resolve the names
of IPv6-only hosts. In this situation,  LLMNR over IPv6 can be used for
local name resolution. "

-----------------------------------------------------------------
Issue 38: DNS proxy undefined
Submitter: Andreas Gustafsson
Submitter email address: [email-masked]
Date first submitted: May 9, 2003
Reference: <[email-masked]>
Document: LLMNR-18
Comment type: T
Priority: S
Section: 1, 3.2
Rationale/Explanation of issue:

draft-ietf-dnsext-mdns-18.txt makes repeated references to an entity
called a "DNS proxy". The term "DNS proxy" is not defined in the
draft, and there is no DNS standard or RFC defining the behavior of
such a device.

Requested change:

Remove all references to a "DNS proxy".
[BA] Proposed resolution is to substitute "DNS server" for "DNS proxy"
throughout.

Kevin Darcy <[email-masked]>:

I think "recursive resolver" would be more precise. "DNS server" could be
mistaken for "authoritative server". Speaking of which, I think you use
the term "DNS server" sometimes to mean an authoritative server, and at
other times, to mean a recursive resolver. You should probably audit that
usage simultaneously.

Andreas Gustafsson, [email-masked]:

The -18 draft also talked about the DNS proxy "supporting dynamic
update", which makes no sense if it was indeed referring to a
recursive resolver.

In the scenario involving a "home gateway", DHCP, and dynamic DNS,
there actually needs to be both a caching server (aka recursive
resolver) and an authoritative server (where names are registered
using DDNS), but each of these can independently be on the local wire,
integrated into the gateway, or anywhere else on the Internet
reachable through the gateway.

Since the location of these servers is entirely immaterial, any time
the draft mentions them being in a specific location or claiming that
a "proxy" is needed to reach them, it is only confusing the issue.
This is why I requested that any mention of a proxy be removed, not
changed.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked] (Andreas Gustafsson)
Date: Tue, 13 May 2003 17:20:27 -0700 (PDT)

> resolution of local host names over IPv4.

At the risk of repeating myself: there is no requirement that the DNS
server is on the local network or the DNS functionality is provided by
the home gateway.  If a network has a gateway, it can use DNS servers
anywhere on the Internet.

> host names over IPv6 as well as IPv4. "

I'm unable to parse this sentence.

> configuration also support dynamic DNS in some form."

Again, there is no need for dynamic DNS to be supported specifically
by the gateway.

I suggest replacing the three quoted paragraphs above with the
following single paragraph, which purposely omits any text implying
that home gateway is the specific entity that provides DHCPv4, DHCPv6,
recursive DNS, or dynamic authoritative DNS service:

  "Propagation of LLMNR packets on the local link is considered
  sufficient to enable name resolution in small networks. The assumption
  is that if a network has a home gateway, DHCP and DNS are also
  available, and A and/or AAAA RRs of local hosts can be registered
  using dynamic DNS."

> of IPv6-only hosts. In this situation,  LLMNR over IPv6 can be used for

The above paragraph is hopelessly confused with regards to recursive
versus authoritative servers.  When a host is "configured with a DNS
server" using DHCP, it is configured with a *recursive* server, while
the server that needs to support dynamic update is the server
authoritative for the host's domain name.  These are two completely
separate servers, but the text seems to imply that they are one and
the same. I suggest this paragraph be removed.
-- 
Andreas Gustafsson, [email-masked]

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 13 May 2003 17:08:31 -0700 (PDT)

> anywhere on the Internet.

Not sure why you've chosen to comment on the old text rather than the new
proposed text.

---

From: [email-masked] (Andreas Gustafsson)
Date: Tue, 13 May 2003 17:51:41 -0700 (PDT)

> Not sure why you've chosen to comment on the old text rather than the new

Pardon me, I didn't notice the following piece of text had been

> configuration also support dynamic DNS in some form."

The rest of the text I quoted and commented on was, as far as I can
see, the new proposed text.
-- 
Andreas Gustafsson, [email-masked]