Re: [v4v6interim] Single namespace

On Oct 1, 2008, at 2:09 PM, bmanning@vacation.karoshi.com wrote:
> that said, DNS64 is asserted to provide a different answer depending  
> on
> where the question originates.  Some folks do this today w/ a bind  
> construct
> called "views".  if  DNS64 "constructs" synthetic addresses on the fly
> (algorithmically generated addressess) as proposed,  is this based  
> on the
> DNS64 application intercepting a DNS reply - (here is the A rr) and  
> fabricating
> a lie (here is the AAAA rr) to pass to the querier? where the AAAA  
> is the address
> of the translation device?

It doesn't intercept anything.

It gets a AAAA request from some host, sends a request for an A record  
(perhaps o itself), gets the A record response, generates a AAAA  
record from it, and sends that as a reply to the original request.

> If this is a plausable explaination, then I would posit that the  
> creation of
> DNS64 is injecting a MITM vector that is unreasonable.

Any form of translation is a MITM vector. If you find translation  
unreasonable, then yes you will find that vector unreasonable. If you  
find translation necessary, I don't think you can avoid the  
possibility that the translator is a MITM vector.

> depending on the deployment model, i think that properly placed DNS  
> caches, running
> dual stack, would work just fine.

several problems there. First, what if a name exists and is  
translatable but doesn't happen to be in the cache at the moment? Do  
you populate the cache? Second, what if the cache is poisoned?

Your complaining about MITM attacks?

> back to the oatwillie.example.com case...
> presume the node has a single NIC  ::   2001:478:6::cafe
> and and IVI box with               ::   2001:478:6::254
> 	                           ::   198.32.6.251
>
> with a dual-stack DNS server       ::   2001:478:6::11
>                                   ::   198.32.6.11
>
> inside the DNS server, I might make the following mapping for  
> oatwillie:
>
> oatwillie	in aaaa 2001:478:6::cafe
> 		in a    198.32.6.251
>
>
> would that work for you?

Maybe. If the server directly knows the translation already, it's  
great. I don't think it is a very general solution, though, as there  
is no way to populate the cache in the first place.

_______________________________________________
v4v6interim mailing list
v4v6interim@ietf.org
https://www.ietf.org/mailman/listinfo/v4v6interim