Subject: Re: [v6ops] Making RDNSS a MUST?

From: Enno Rey <[email-masked]>
Date: Mon, 3 Apr 2017 11:47:43 +0200

Hi,

On Mon, Apr 03, 2017 at 09:20:01AM +0200, Mikael Abrahamsson wrote:
> On Fri, 31 Mar 2017, Fred Baker wrote:
> 
> > Something that would help me, in this discussion, would be a simple and 
> > incontrovertible statement of what breaks, or in which circumstances 
> > RDNSS would be inappropriate. That would help me distinguish between 
> > "SHOULD" and "MUST". Failing either, it sounds to me like "MAY".
> 
> What I would like to see (this is not breakage though, only potential 
> breakage and cause of confusion) is what a host should do if it gets RDNSS 
> information and potentially DNS resolver information via DHCP.

This is somewhat covered in

RFC 4862, 5.6 Configuration Consistency
“If the same configuration information is provided by multiple sources, the value of this information should be consistent.”
“In any case, if there is no security difference, the most recently obtained values SHOULD have precedence over information learned earlier.”

and

RFC 6106

“1.2 Coexistence of RA Options and DHCP Options for DNS Configuration
	
Two protocols exist to configure the DNS information on a host, the Router Advertisement options described in this document and the DHCPv6 options described in [RFC3646]. They can be used together.
The rules governing the decision to use stateful configuration mechanisms are specified in [RFC4861].  Hosts conforming to this specification MUST extract DNS information from Router Advertisement messages, unless static DNS configuration has been specified by the user. 
If there is DNS information available from multiple Router Advertisements and/or from DHCP, the host MUST maintain an ordered list of this information as specified in Section 5.3.1.

RFC 6106, sect. 5.3.1:

In the case where the DNS options of RDNSS and DNSSL can be obtained from multiple sources, such as RA and DHCP, the IPv6 host SHOULD keep some DNS options from all sources. Unless explicitly specified for the discovery mechanism, the exact number of addresses and domain names to keep is a matter of local policy and implementation choice.However, the ability to store at least three RDNSS addresses (or DNSSL domain names) from at least two different sources is RECOMMENDED.The DNS options from Router Advertisements and DHCP SHOULD be stored into the DNS Repository and Resolver Repository so that information from DHCP appears there first and therefore takes precedence.Thus, the DNS information from DHCP takes precedence over that from RA for DNS queries.

===

cheers

Enno

-- 
Enno Rey

ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de
Tel. +49 6221 480390 - Fax 6221 419008 - Cell +49 173 6745902 

Handelsregister Mannheim: HRB 337135
Geschaeftsfuehrer: Enno Rey

=======================================================
Blog: www.insinuator.net || Conference: www.troopers.de
Twitter: @Enno_Insinuator
=======================================================

---

From: "Mr. Jaehoon Paul Jeong" <[email-masked]>
Date: Mon, 3 Apr 2017 07:32:40 -0500

Hi Rey,
Though the main idea is almost the same in your mentioned text in Section
1.2 and Section 5.3.1,
RFC 8106 replaces RFC 6106 as follows:T
https://tools.ietf.org/html/rfc8106

---------------------------------------------------------
1.2.  Coexistence of RA Options and DHCP Options for DNS Configuration

   Two protocols exist to configure the DNS information on a host: the
   RA options specified in this document and the DHCPv6 options
   specified in [RFC3646].  They can be used together.  The rules
   governing the decision to use stateful configuration mechanisms are
   specified in [RFC4861].  Hosts conforming to this specification MUST
   extract DNS information from RA messages, unless static DNS
   configuration has been specified by the user.  If there is DNS
   information available from multiple RAs and/or from DHCP, the host
   MUST maintain an ordered list of this information as specified in
   Section 5.3.1.

5.3.1.  Procedure in IPv6 Hosts
   ...
   In the case where the DNS information of RDNSS and DNSSL can be
   obtained from multiple sources, such as RAs and DHCP, the IPv6 host
   SHOULD keep some DNS options from all sources.  Unless explicitly
   specified for the discovery mechanism, the exact number of addresses
   and domain names to keep is a matter of local policy and
   implementation choice as a local configuration option.  However, in
   the case of multiple sources, the ability to store a total of at
   least three RDNSS addresses (or DNSSL domain names) from the multiple
   sources is RECOMMENDED.  The DNS options from RAs and DHCP SHOULD be
   stored in the DNS Repository and Resolver Repository so that
   information from DHCP appears there first and therefore takes
   precedence.  Thus, the DNS information from DHCP takes precedence
   over that from RAs for DNS queries.  On the other hand, for DNS
   options announced by RAs, if some RAs use the Secure Neighbor
   Discovery (SEND) protocol [RFC3971] for RA security, they MUST be
   preferred over those that do not use SEND.  Also, DNS options
   announced by RAs via SEND MUST be preferred over those announced by
   unauthenticated DHCP [RFC3118].  Refer to Section 7 for a detailed
   discussion of SEND for DNS RA options.
---------------------------------------------------------

Thanks.

Paul

On Mon, Apr 3, 2017 at 4:47 AM, Enno Rey <[email-masked]> wrote:

> “If the same configuration information is provided by multiple sources,
> the value of this information should be consistent.”
> “In any case, if there is no security difference, the most recently
> obtained values SHOULD have precedence over information learned earlier.”
>
> and
>
> RFC 6106
>
> Two protocols exist to configure the DNS information on a host, the Router
> Advertisement options described in this document and the DHCPv6 options
> described in [RFC3646]. They can be used together.
> The rules governing the decision to use stateful configuration mechanisms
> are specified in [RFC4861].  Hosts conforming to this specification MUST
> extract DNS information from Router Advertisement messages, unless static
> DNS configuration has been specified by the user.
> If there is DNS information available from multiple Router Advertisements
> and/or from DHCP, the host MUST maintain an ordered list of this
> information as specified in Section 5.3.1.
>
> RFC 6106, sect. 5.3.1:
>
> In the case where the DNS options of RDNSS and DNSSL can be obtained from
> multiple sources, such as RA and DHCP, the IPv6 host SHOULD keep some DNS
> options from all sources.   Unless explicitly specified for the discovery
> mechanism, the exact number of addresses and domain names to keep is a
> matter of local policy and implementation choice.  However, the ability to
> store at least three RDNSS addresses (or DNSSL domain names) from at least
> two different sources is RECOMMENDED.  The DNS options from Router
> Advertisements and DHCP SHOULD be stored into the DNS Repository and
> Resolver Repository so that information from DHCP appears there first and
> therefore takes precedence.  Thus, the DNS information from DHCP takes
> precedence over that from RA for DNS queries.
>
> ===
>
> cheers
>
> Enno
>
>
>
>
> --
> Enno Rey
>
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>
>

-- 
===========================
Mr. Jaehoon (Paul) Jeong, Ph.D.
Assistant Professor
Department of Software
Sungkyunkwan University
Office: +82-31-299-4957
Email: [email-masked], [email-masked]
Personal Homepage: http://iotlab.skku.edu/people-jaehoon-jeong.php
<http://cpslab.skku.edu/people-jaehoon-jeong.php>