IETF Logo Mail Archive

Re: Last Call: RFC 6346 successful: moving to Proposed Standard

Mark Andrews <marka@isc.org> Fri, 05 December 2014 05:01 UTC

Return-Path: <marka@isc.org>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 195731AC3FD; Thu, 4 Dec 2014 21:01:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.911
X-Spam-Level:
X-Spam-Status: No, score=-6.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OiJ-PKvzARY1; Thu, 4 Dec 2014 21:01:02 -0800 (PST)
Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.64.53]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0801C1AC3F9; Thu, 4 Dec 2014 21:01:02 -0800 (PST)
Received: from zmx1.isc.org (zmx1.isc.org [149.20.0.20]) by mx.pao1.isc.org (Postfix) with ESMTP id 429FE3493B8; Fri, 5 Dec 2014 05:01:00 +0000 (UTC)
Received: from zmx1.isc.org (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTP id 2E6FF160057; Fri, 5 Dec 2014 05:05:04 +0000 (UTC)
Received: from rock.dv.isc.org (c211-30-183-50.carlnfd1.nsw.optusnet.com.au [211.30.183.50]) by zmx1.isc.org (Postfix) with ESMTPSA id F0CB316004A; Fri, 5 Dec 2014 05:05:03 +0000 (UTC)
Received: from rock.dv.isc.org (localhost [IPv6:::1]) by rock.dv.isc.org (Postfix) with ESMTP id 820E624EE8E8; Fri, 5 Dec 2014 16:00:57 +1100 (EST)
To: Ted Lemon <Ted.Lemon@nominum.com>
From: Mark Andrews <marka@isc.org>
References: <20141201223832.20448.34524.idtracker@ietfa.amsl.com> <A4CFF3FB-A9C5-47EA-A1CA-B900CDBF776E@gmail.com> <547F451C.3010507@dcrocker.net> <89433C24-5E69-463B-804B-62F73E0DFB12@istaff.org> <CAMm+Lwhf4jxbWb9j-RMJJk7KiWdbRddbhPkyzwBntNTVQ_jHJw@mail.gmail.com> <CAKr6gn1e+Cq6v_eoPMFOpGmffX5jMeTzym3Q0DSD37zL649yhA@mail.gmail.com> <74DF5B53-055C-4235-A8FA-E8B38E007F45@nominum.com>
Subject: Re: Last Call: RFC 6346 successful: moving to Proposed Standard
In-reply-to: Your message of "Thu, 04 Dec 2014 23:07:00 -0500." <74DF5B53-055C-4235-A8FA-E8B38E007F45@nominum.com>
Date: Fri, 05 Dec 2014 16:00:57 +1100
Message-Id: <20141205050057.820E624EE8E8@rock.dv.isc.org>
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf/IaVpQOc-9KcxBpIbLfNX8suKesY
Cc: Phillip Hallam-Baker <phill@hallambaker.com>, IETF Discussion Mailing List <ietf@ietf.org>, Bob Hinden <bob.hinden@gmail.com>, IESG <iesg@ietf.org>, Dave Crocker <dcrocker@bbiw.net>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf/>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 05 Dec 2014 05:01:03 -0000

In message <74DF5B53-055C-4235-A8FA-E8B38E007F45@nominum.com>, Ted Lemon writes
:
> On Dec 4, 2014, at 10:02 PM, George Michaelson <ggm@algebras.org> wrote:
> > Hang on.. the deployment of DNSSEC backed applications is a bit iffy if
> we depend on deployment of DNS based tricks to cover for V4/V6
> interoperation surely?
>
> DNS64 can be done by the client, in which case DNSSEC validation can be
> performed _before_ translating the IPv4 address from the A record into an
> IPv6 address in the NAT64 prefix.

Which requires every DNSSEC aware client to also be DNS64 aware.
I though we were trying to remove NAT kludges requires that they
be kept forever.

RFC 6147 also get DNSSEC signalling completely wrong.  There is NO
combination of bits that indicates validation will / will not occur.

Additionally the discover mechanism for the DNS64 parameters is to
say the least baroque.  It would have been much simpler to add a
EDNS option so the nameserver could actually return them or the
addresses it would have otherwise returned if DO=1 is set.  These
could be cached along with the NODATA response by intermediate
nameservers.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org

v2.23.0 | Report a Bug | By Email