[v6ops] Re: SIIT-DC node requirements (single-stack)

["Soni \"It/Its\" L." <[e-mail]>]

The IANA stuff is a good point. However, the main advantages of SIIT-DC 
are to do with routing and packet processing. DNS is an 
application-level concept, and rDNS/getnameinfo (usually) isn't even 
part of the kernel, so this probably should be addressed at an 
application (read: libc) level.

(And we are still completely against DNS64, even for reverse records. 
We'll make an exception for ipv4only.arpa tho, as it was designed and 
specified as a DNS-based discovery protocol instead of a hack to make 
IPv4-only domains resolve on an IPv6-only network.)

On 2024-09-04 19:35, Mark Andrews wrote:
> Well in BIND you would configure this by setting the dns64 clients to
> the ’none;’ acl.
>
>      dns64 64:ff9b::/96 { clients { none; }; };
>
> alternatively just configure the reverse zone using the reverse database
> implementation directly.
>
>      zone “0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.B.9.F.F.4.6.0.0.IP6.ARPA” {
> 	type primary; database “_dns64 dns64 . .”;
>      };
>
> That said IANA should have been directed to create an insecure delegation
> for 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.B.9.F.F.4.6.0.0.IP6.ARPA so that it
> CAN ACTUALLY BE USED by DNSSEC validating clients.  Alternatively IANA
> should have been directed to provide a reverse mapping servers.   At the
> moment the specification is incomplete.
>
> % dig 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.B.9.F.F.4.6.0.0.IP6.ARPA ns +dnssec
> ;; BADCOOKIE, retrying.
>
> ; <<>> DiG 9.21.0-dev <<>> 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.B.9.F.F.4.6.0.0.IP6.ARPA ns +dnssec
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 18718
> ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags: do; udp: 1232
> ; COOKIE: 868e3d961cd944870100000066d8e0370ef8f51ed8e0b258 (good)
> ;; QUESTION SECTION:
> ;0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.B.9.F.F.4.6.0.0.IP6.ARPA. IN NS
>
> ;; AUTHORITY SECTION:
> ip6.arpa. 752 IN SOA b.ip6-servers.arpa. nstld.iana.org. 2022093211 1800 900 604800 3600
> ip6.arpa. 752 IN RRSIG SOA 8 2 3600 20240925172238 20240904203346 16801 ip6.arpa. d+mwFkGSUCBSWTIhwXbhOHDP0ipcsMDSY3siOF4YoxH6FCVoVJjb968I Wr9c079tOcTYt/bsiG50jg74LsRvxAMSUyFc4wUcF2HELoZmnxHqRN0a ow/yd7g3FWg9i1277zTbdAAWRmXzpol6u2jVbc09hwd3ybc4Tzrm+qzM VzU=
> ip6.arpa. 752 IN NSEC 2.0.1.0.0.2.ip6.arpa. NS SOA RRSIG NSEC DNSKEY
> ip6.arpa. 752 IN RRSIG NSEC 8 2 3600 20240912101727 20240822081034 16801 ip6.arpa. A9LGpqSVszkgkxNtvq4CAGl4frQsql8WEtM075ON3VBplxlzcafH8mqX PBYVgefSgDF/0RzPS+q6yvDjFg+jrBUpNL983xOqa1YyPeWtAXhHoecZ 5fqN1wHD2f8wAbIfchq5SkBAy/oVG2V171RdlSLCyaUHaVEGONH7WdR5 mIc=
>
> ;; Query time: 1 msec
> ;; SERVER: ::1#53(::1) (UDP)
> ;; WHEN: Thu Sep 05 08:33:27 AEST 2024
> ;; MSG SIZE  rcvd: 564
>
> %
>
> Mark
>
> > On 5 Sep 2024, at 05:55, Soni It/Its L. <[e-mail]> wrote:
> > 
> > Hello!
> > 
> > Sooo we've noticed using DNS64 with SIIT-DC is optional (thankfully), however... it raises a really big issue with certain applications. We noticed this while setting up IRC: traditionally, IRC daemons will look up the reverse DNS (hostname) of the connecting client, and that doesn't really work in SIIT-DC deployments... (We mean yeah the hostname is generally unimportant for IRC network operation, so it isn't a huge loss, but it's still rather unfortunate.)
> > 
> > We'd like to suggest recommending the use of PREF64 even for a single-stack server, so that getnameinfo can return the appropriate name by querying for the IPv4 reverse DNS - *without* using DNS64, and independently of a SIIT-DC ER.
> > 
> > Thoughts?
> > 
> > (This is also relevant for our "IPv6-only OS" project. That project is still ongoing, tho it increasingly looks like "CLAT-in-libc" is not really viable (mostly due to signals and socket address type-confusion issues). Anyway.)
> > 
> > -- 
> > plural system (tend to say 'we'), it/she/they, it instead of you
> > 
> > _______________________________________________
> > v6ops mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>

-- 
plural system (tend to say 'we'), it/she/they, it instead of you