[dhcwg] Re: Why draft-ietf-dhc-addr-notification-13 and not DNS update instead?

On 18. 11. 24 21:12, Michael Richardson wrote:
> Petr Menšík<[email protected]>  wrote:
>      > Hello,
>
>      > I work in Red Hat as a software engineer and one of components I work on is
>      > dnsmasq. It combines DNS and DHCP service into simple box. It made me think
>      > how to solve IPv6 and registration of machines with SLAAC.
>
> Thank you, many of us use it!
First of all, I am not its creator Simon Kelley. I am author for a few 
changes in dnsmasq, but main credit for it goes to Simon. I just know a 
bit more about it.
>      > I just today stumbled on draft draft-ietf-dhc-addr-notification-13 [1]. It
>      > seems nice, but I think DNS dynamic update (RFC 2136) might be a better
>      > solution. When I were thinking about my home network and how to pair my
>      > hostname to IPv6 address, similar way in IPv4 dnsmasq does itself
>      > automatically. Because it uses DHCP, including hostname option. But in IPv6
>      > most clients do not even try to use DHCPv6.
>
> You can do that, but in the general corporate and conference networks, few to
> zero machines have a Dynamic DNS update credential that they can use with a
> DNS server.   Having a DHCP server update the DNS works better, and with
> things like dnsmasq, that's a trivial-no-op of security.

But the thing is, do you need credential for DNS when you do not need 
any for DHCP? Where does that security came from? For example bind9 can 
use tcp-self [1] in update-policy. That allows adding a name only with 
my own address. Combined with ability to update just selected subdomain 
dynamic.example.com, it is relatively good. Fine for home or conference 
networks, where no credentials are used anyway. We do not provide 
credentials to DHCP clients anyway.

I think the only problem is to get a client make an attempt. I remember 
old samba3 being spammed by windows 2000 and XP, which attempted to 
register via DNS every machine. That were quite annoying, that is why I 
propose RA option to let them know when they should try it.

> But, IPv6 temporary
> addresses are seldom (if ever according to feedback to DHCPv6 RFC8415 we got)
> registered using DHCP(v6), so there is no obvious protocol to communicate
> their use.   dhc-addr-notification is a compromise in essense.
I am not proposing to register temporary addresses.
>
> is this use case not clear from the document itself?
> Of course, dnsmasq, speaking DHCPv6, can receive these updates, and ideally,
> yes, populate reverse DNS.
The thing is, how is DHCP authenticated better than DNS? If dnsmasq 
would accept any DNS update over TCP for a name not already registered, 
how would it be different? What makes DHCP more suitable, when it is not 
even needed for getting an address? Would it mean every client should 
support DHCPv6, but not use it for addresses?
>
>      > I thought about implementing dynamic update into dnsmasq, similar way it
>      > accepts hostnames in DHCP requests. For enterprise networks it can be
>      > improved significantly. TSIG signatures can provide shared password or krb5
>      > authentication. Good for CEO's laptop, I suppose?
>
> No, terrible for the CEO's laptop, because it doesn't know to speak kerberos
> at the IETF network.
If the IETF network RA says use just TCP update without authentication, 
everyone can become CEO. But that is exactly what dnsmasq does with 
those names anyway. It gives each name to everyone who asks, unless that 
name has a fixed address already.
> --
> Michael Richardson<[email protected]>    . o O ( IPv6 IøT consulting )
>             Sandelman Software Works Inc, Ottawa and Worldwide
>
1. 
https://bind9.readthedocs.io/en/v9.18.31/reference.html#namedconf-statement-update-policy

-- 
Petr Menšík
Senior Software Engineer, RHEL
Red Hat,http://www.redhat.com/
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB

_______________________________________________
dhcwg mailing list -- [email protected]
To unsubscribe send an email to [email protected]