Re: [v6ops] PI [ULA draft revision #2 Regarding isolated networks]

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Philip Homburg writes:
> In your letter dated Sun, 01 Jun 2014 07:49:08 +1000 you wrote:
> >You have UPDATE + TSIG or SIG(0).  This is basically what Microsoft
> >do with Active Directory except they use GSS-TSIG for about 15 years
> >now.  UPDATE and DNSSEC just work and have for over a decade now.
> >Happy Eyeballs has proved that you don't need change the DNS for
> >link state changes.  IPv4 vs IPv6 is no different to PA1 vs PA2.
> >HE is all about the client working around a dead link.
> 
> My router is going to update DNS using UPDATE + TSIG? How does my router know
> then names of my servers (or the actual addresses)?
> 
> Are servers going update themselves?

Why not?  They know their own addresses.  They know their name.  If
you have a UNIX/Linux based box that shipped in the last 15 years
you have the tools to do this.  Having this done when the addresses
change is a matter of writing a small daemon or integrating it into
the DHCP client.

% nsupdate -k keyfile
update delete <servername> AAAA
update add <servername> 3600 AAAA <address1>
update add <servername> 3600 AAAA <address2>
update add <servername> 3600 AAAA <address3>
send
%

This deletes all the AAAA records and then adds in all the current
addresses.  This is a atomic transaction.  The nameserver adds
DNSSEC signatures if they are appropriate for the zone.

Similar for A records.

keyfile could contain a TSIG key or a KEY for SIG(0)

You can also do split horizon updates if you want to using multiple
TSIG keys to select the zone instance to be updated.

> Is any of that spelled out?
> 
> I have no idea what software you are using, but only a tiny fraction of
> the software I'm using actually uses happy eyeballs. 
> 
> You suggest that every possible piece of software should implement HE?

Yes.  RFC 1123 told every developer for the last 2 decades to support
multi-homed servers.

http://users.isc.org/~marka/ has simple example code for how to do
this for TCP clients.  UDP clients are slightly more complicated
as you have to it higher up the stack.  The client side of DNS
servers has been doing this sort of stuff for multiple decades now
but instead of trying to do a single connection they are dealing
with thousands of connections.

The code is slightly more complicated than that published in the
getaddrinfo man page but not much more.

> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]