| Domain Name System Operations | Sonoda, Ed. |
| Internet-Draft | Internet Initiative Japan Inc. |
| Intended status: Informational | Feb 16, 2018 |
| Expires: August 20, 2018 |
DNS load balancing
draft-sonoda-dnsop-dnslb-01
This document defines a new DNS load balance function that is able to transfer information in zone transfer and not need online signing. DNS base load balance is popular technology. It provides weight base response and location base response. It have become an indispensable part of traffic engineering. However, DNS base load balance can't transfer load balance information in zone transfer and need online singing because it is not standardized. This document defines a new DNS resource record called "LB" and new EDNS option bit called "LS". LB RR provides the balancing information weight, location and target domain name. LS bit provides the change response mechanism in name servers.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on August 20, 2018.
Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
Legacy DNS load balancing provides traffic engineering.It use special authoritative name server. It response is one address record that is dynamic changes using network location and weight. It's used for large traffic WEB site domain name that is important domain name. Important domain name should be secure.
But legacy DNS load balancing is not secure. Because Legacy DNS load balancing can't send zone data by zone transfer. It's mean very difficult to use multi service providers. That means weak for DDoS Attack. If zone is signed, All name servers require private key for dynamic signing because response is dynamic changes. Distributing private key is not secure, It is increased risk of leakage private key.
New DNS load balancing concept is that Authoritative name server uses "LB" RR to provide load balancing and Full resolver use "LB" RR to select target name and respond with the target name.
"LB" RR defines load balancing settings that is network location and weight and target domain name. Network location is string that meaningful name of network. For example Country code (ex. JP),subdivision code(ex. US-CA) and Autonomous System Number (ex. AS65536). Full resolver use resolver configuration to select network location and refine "LB" RRs. Weight is integer value. Full resolver use weight ratio to select target name. Target name is pointer to address record. It is same "ANAME" [I-D.ietf-dnsop-aname].
1. Stub resolver sends A or AAAA query to full resolver.
2. Full Resolver sends A or AAAA query with LS bit to authoritative server.
3. Authoritative Server responses LB RRset.
4. Full Resolver selects target domain name using location and weight.
5. Full Resolver resolv target domain name.
6. Full Resolver response target domain name and LB RRSet to stub resolver.
The LB RR has mnemonic LB. LB RR define load balancing information.
LB format below.
<owner> <ttl> <class> LB <weight> <location> <target>
The format is not class-sensitive. All fields are required.
<weight> field is a 2 octets, 1 or more natural number.
<location> field is a "<character-string>" [RFC1035].
<target> field is a "<domain-name>" [RFC1035]. It has A or AAAA RR or CNAME RR or DNAME RR.
<location> ::= "*" | <continental code> | <country code> | <subdivision code> | <asn code> | <private code>
<continental code> ::= "AF" | "AN" | "AS" | "EU" | "NA" | "OC" | "SA"
<country code> ::= ISO 3166-1 alpha-2 Country code.
<subdivision code> ::= ISO 3166-2 Codes for the representation of names of countries and their subdivisions.
<asn code> ::= "AS" <asn> [ ":" <asn>]
<private code> ::= "+" <let>
<ans> ::= <nonzero digit> <digit>
<nonzero digit> ::= any one of the ten digits 1 through 9
<digit> ::= any one of the ten digits 0 through 9
<let> ::= any one of the 26 alphabetic characters A through Z in upper case or any one of the ten digits 0 through 9.
; for any region.
example.jp. 3600 IN LB 1 * www.example.com.
; for AP region.
example.jp. 3600 IN LB 1 AP ap.example.com.
; for JP region, weight 1.
example.jp. 3600 IN LB 1 JP jp1.example.jp.
; for JP region, weight 3.
example.jp. 3600 IN LB 3 JP jp2.example.jp.
; for tokyo region. (JP-13 is tokyo region ISO 3166-2:JP)
example.jp. 3600 IN LB 1 JP-13 tokyo.example.jp.
; for AS65536
example.jp. 3600 IN LB 1 AS2496 as65536.example.jp.
; for AS65536
example.jp. 3600 IN LB 1 AS2496:1 as65536.example.jp.
; private use
example.jp. 3600 IN LB 1 +BEER beer.example.jp.
Defines a new ”EDNS Header Flags” [RFC6891] call LB Support Flag(LS) using full resolver sends LB RR supported to authoritative server.
LS bit provides change response mechanism in authoritative name server. If LS bit is flagged, Authoritative name server can response LB RR for A,AAAA query.
When authoritative name server receives a query of type A or AAAA with LS bit and LB record is present at a SNAME, The authoritative server returns the LB RRSet in the answer section with LS bit.
Example zone data:
example.jp. 3600 IN SOA ( ns1.example.com.
postmaster.example.com.
1
3600
900
1814400
900 )
example.jp. 3600 IN NS ns1.example.com.
example.jp. 3600 IN NS ns2.example.com.
example.jp. 3600 IN A 198.51.100.1
example.jp. 3600 IN LB 1 * www.example.com.
example.jp. 3600 IN LB 1 JP jp1.example.com.
example.jp. 3600 IN LB 3 JP jp2.example.com.
Incoming query with LS bit:
query: qtype = example.jp. qtype=A, LS=1
Response for include LS:
query: qtype = example.jp. qtype=A
response: LS=1
answer:
example.jp. 3600 IN LB 1 * www.example.com.
example.jp. 3600 IN LB 1 JP jp1.example.com.
example.jp. 3600 IN LB 3 JP jp2.example.com.
authority:
example.jp. 3600 IN NS ns1.example.com.
example.jp. 3600 IN NS ns2.example.com.
Incoming query without LS bit (normal query):
query: qtype = example.jp. qtype=A, LS=0
Response for not include LS:
query: qtype = example.jp. qtype=A
response: LS=0
answer:
example.jp. 3600 IN A 198.51.100.1
authority:
example.jp. 3600 IN NS ns1.example.com.
example.jp. 3600 IN NS ns2.example.com.
When a full resolver sends a query of type A or AAAA with LS bit and receives a response with a LB RRset in the answer section with LS bit, Full resolver MUST re-resolv the either LB <target> of type "STYPE" [RFC1034]. <target> be selected by <location> and <weight>.
Location selection needs full resolver or stub resolver location information. Full resolver location information with priority value SHOULD gets from config file. Full resolver MUST setting '*' location with lowest priority. Full resolver select location that match either LB RR <location> and highest priority resolver location. if all LB RRs don't match all resolver locations, resolver selects a location randomly.
Full resolver selects <target> using <weight> from LB RR whose location matches.
1. Full resolver location is configured "JP-13" "JP" "AS" "*".
2. Stub resolver query coming:
query: qtype = example.jp. qtype=A
3. Full resolver send query:
query: qtype = example.jp. qtype=A, LS=1
3. If response include LB:
query: qtype = example.jp. qtype=A
response: LS=1
answer:
example.jp. 3600 IN LB 1 * www.example.com.
example.jp. 3600 IN LB 1 JP jp1.example.com.
example.jp. 3600 IN LB 3 JP jp2.example.com.
authority:
example.jp. 3600 IN NS ns1.example.com.
example.jp. 3600 IN NS ns2.example.com.
4. select LB RR that's location include resolver location
example.jp. 3600 IN LB 1 JP jp1.example.com.
example.jp. 3600 IN LB 3 JP jp2.example.com.
5. Select one LB RR using <weight>:
example.jp. 3600 IN LB 3 JP jp2.example.com.
5. Name resolution <target>:
query: qtype = jp2.example.com. qtype=A, LS=1
response:
answer:
jp2.example.com. 3600 IN A 192.0.2.2
authority:
example.com. 3600 IN NS ns1.example.com.
example.com. 3600 IN NS ns2.example.com.
6. Make response message:
query: qtype = example.jp. qtype=A, LS=1
response:
answer:
example.jp. 3600 IN LB 1 * www.example.com.
example.jp. 3600 IN LB 1 JP jp1.example.com.
example.jp. 3600 IN LB 3 JP jp2.example.com.
jp2.example.com. 3600 IN A 192.0.2.2
authority:
example.jp. 3600 IN NS ns1.example.com.
example.jp. 3600 IN NS ns2.example.com.
7. Stub resolver uses 192.0.2.2
IANA is requested to assign a DNS RR data type value for the LB RR type under the "Resource Record (RR) TYPEs" sub-registry and a EDNS Header Flag value for the LB Support Flag under the "EDNS Header Flags (16 bits)" sub-registry under the "Domain Name System (DNS) Parameters" registry.
Both authoritative server and resolvers that implement LB SHOUD carefully check for loops.
| [I-D.ietf-dnsop-aname] | Hunt, E., Dijk, P. and A. Eden, "Address-specific DNS Name Redirection (ANAME)", Internet-Draft draft-ietf-dnsop-aname-01, January 2018. |
| [RFC1034] | Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987. |
| [RFC1035] | Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, November 1987. |
| [RFC6891] | Damas, J., Graff, M. and P. Vixie, "Extension Mechanisms for DNS (EDNS(0))", STD 75, RFC 6891, DOI 10.17487/RFC6891, April 2013. |