Re: [mdnsext] mDNSext features/requirements rollup

[nudge <[e-mail]>]

On Tue, Jan 29, 2013, at 07:07 PM, Alf Watt wrote:
> 
> I think Andrew's point is worth taking the time to seriously consider. We
> already have dynamic DNS update but as previously mentioned configuration
> of the DNS server and it's clients out has proven to be either too
> difficult or not of interest to various OS vendors.
> 
> It's worth mentioning that Apple has all the parts in place to pull this
> off:
> 
> - A Server OS with an embedded DNS server which they provide a UI to
> manage
> - Traditional and Mobile Clients with mDNSResolvers running on them
> - A profile distribution system which make pushing configuration options
> including keys easy
> 
> Given the will to get the features implemented Apple could solve part of
> the problem this without any changes to mdns.
> 
> There are still things that fall outside of that scope which we should
> consider, but ignoring the opportunity to uses the existing protocols
> seems like a lot of effort to reproduce work that already exists.
> 
> Best,
> Alf
> 

As someone who successfully tested and implemented WAB with TSIG
protected updates[1] in an Apple environment about a year or so ago, I
would tend to agree. It wasn't as difficult as I imagined partly because
of a lack of documentation. Of course, things have changed since and I
need to test again soon. But back then you had to front-end named with
dnsextd if you needed llq (obviously you do). If that's still true it
blocks other useful stuff such as rpz and rrl and needs fixing IMO.

[1]I also tested TSIG protected reads DNSprivate, where's that going ?