Re: [dnsext] Re: I-D ACTION:draft-vandergaast-edns-client-ip-00.txt

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Joe Abley writes:
> 
> On 2010-01-28, at 12:56, Wilmer van der Gaast wrote:
> 
> > To summarize the I-D: It specifies an EDNS0 option that carries IP
> > address information (by default only the first 24 bits to preserve
> > privacy) of the user that triggered a DNS resolution.
> 
> My initial reading of the proposal suggests that the client that =
> originates the DNS request is the one that MAY populate a client-address =
> option, and that any other resolver or proxy in the chain between the =
> client and a server (cache or authority) which supplies an answer MAY =
> NOT change the client-address option data.
> 
> Suppose most clients are numbered using RFC 1918 addresses behind a NAT, =
> and have no trivial way of discovering a non-RFC1918 address that the =
> world might see them as. In that case isn't the address information that =
> ultimately arrives at cache or authority nameservers useless for any =
> purpose other than identifying that RFC 1918 addresses are in use?
> 
> I have some suggestions that relate specifically to the text, but the =
> general utility of the proposal seems limited to me: I have doubts that =
> there are significant client populations in 2010 which have useful =
> address information to send.

The presumption is that recursive resolvers would not set the option
if they receive the query from a RFC 1918 (or otherwise deemed
private) address.  The first recursive resolver which received a
query from a non private address would add the option to any upstream
queries made on behalf of the client.

Note you don't need to know your address to make this decision as
it is based entirely on the source address from which you receive
the query.  All the nameservers involved could be on machines using
private address and provided they are not behind a NAT that collapses
the world down to a single address this will just work.  The outbound
NAT sets the source address to a public address and the inbound NAT
preserves it.

This is not a option which would be normally be sent stub resolvers.
This is not a option that works when there are multiple exit points
from the private net and the internal nameserver uses a different
exit point to the actual client.  The presumption is that there is
a single exit point.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]