Internet DRAFT - draft-mglt-front-end-naming-delegation
draft-mglt-front-end-naming-delegation
HOMENET W. Cloetens
Internet-Draft SoftAtHome
Intended status: Standards Track P. Lemordant
Expires: January 4, 2013 D. Migault (Ed)
Francetelecom - Orange
July 3, 2012
Home Network Front End Naming Delegation
draft-mglt-front-end-naming-delegation-00.txt
Abstract
This document proposes a Naming Delegation Architecture that makes
possible End Users to reach the hosts or services of their Home
Network using Names instead of IP addresses.
This document shows how the Naming Delegation between the CPE and the
ISP can be set so the CPE is not exposed on the Internet. This
document describes an Naming Architecture where ISPs provide Front
End Delegating DNS Servers whereas the CPEs constitute a Back End
Network of Delegated DNS Servers. All DNS queries for any Home
Network are addressed to the Delegating Front End Server. The
response is expected to be stored on a CPE, and the Front End
Delegating DNS Server sends a DNS Query to that CPE before answering
to the initial DNS query.
The negotiation between the CPE and the ISP is using DHCP Options.
This document provides options so Front End Delegating and the
Delegated DNS Servers configure their respective Zone files and so
that CPEs restrict access and protect themselves from unauthorized
DNS Queries.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
Cloetens, et al. Expires January 4, 2013 [Page 1]
Internet-Draft Home Network Front End Naming Delegation July 2012
This Internet-Draft will expire on January 4, 2013.
Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Cloetens, et al. Expires January 4, 2013 [Page 2]
Internet-Draft Home Network Front End Naming Delegation July 2012
Table of Contents
1. Requirements notation . . . . . . . . . . . . . . . . . . . . 4
2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5
4. Front End Naming Delegation Architecture Overview . . . . . . 5
4.1. Home Network Naming Architecture Requirements . . . . . . 5
4.2. Front End Naming Delegation Architecture Description . . . 7
4.3. Front End Naming Delegation Configuration . . . . . . . . 8
4.4. Difference between the Front End Delegating DNS Server
and traditional DNS Recursive DNS Server . . . . . . . . . 10
4.5. How the Front End Configuration impacts the CPE . . . . . 11
5. Protocol Exchange . . . . . . . . . . . . . . . . . . . . . . 11
5.1. CPE Request Creation and Transmission for the Front
End Naming Delegation Architecture . . . . . . . . . . . . 11
5.2. ISP DHCP Server Responding to the CPE Request for the
Front End Naming Delegation Architecture . . . . . . . . . 12
5.3. CPE Receiving the ISP DHCP Response for the Front End
Naming Delegation Architecture . . . . . . . . . . . . . . 12
6. DHCP Options . . . . . . . . . . . . . . . . . . . . . . . . . 13
6.1. Delegated DNS Architecture Option . . . . . . . . . . . . 13
6.2. Front End Delegating Information Option . . . . . . . . . 14
6.3. Delegating Authorized Resolvers Option . . . . . . . . . . 15
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15
8. Security Considerations . . . . . . . . . . . . . . . . . . . 15
9. Acknowledgment . . . . . . . . . . . . . . . . . . . . . . . . 16
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 16
10.1. Normative References . . . . . . . . . . . . . . . . . . . 16
10.2. Informational References . . . . . . . . . . . . . . . . . 16
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 16
Cloetens, et al. Expires January 4, 2013 [Page 3]
Internet-Draft Home Network Front End Naming Delegation July 2012
1. Requirements notation
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
2. Introduction
[I-D.mglt-naming-delegation] describes the Naming Delegation
Architecture that makes possible Services and Objects of a Home
Network to be globally reachable with Names on the Internet. For
that purpose, the Costumer Premise Equipment (CPE) hosts the
authoritative DNS Server of the Home Network. The zone associated to
the Home Network ("my-homenet") is a subzone of a zone managed by the
ISP ("example."). This zone is attached to the global DNS
Architecture. Because the ISP delegates the Naming service to the
CPE, we call the DNS server responsible for "example." the Delegating
DNS Server, and the DNS server responsible for "my-homenet.example."
the Delegated DNS Server. The Delegated DNS Server runs on the CPE,
and [I-D.mglt-naming-delegation] describes how the CPE can
automatically set the Naming Delegation between the Delegated and the
Delegating DNS Server. Necessary pieces of information to configure
the respective DNS Zones are exchanged between the DHCP client of the
CPE and the ISP DHCP Server through DHCP Options.
The resulting Naming Delegation Architecture
[I-D.mglt-naming-delegation] results in a CPE hosting a Service on
the Internet. CPEs have not been designed for heavy load, and, as a
result, the Delegating exposes the Home Network to potential Deny of
Service attacks. The Front End Naming Delegation Architecture
proposed in this document is an alternative to the Naming Delegation
Architecture [I-D.mglt-naming-delegation] where the ISP provides
Front End Delegating Servers that handles the whole DNS traffic. The
CPE remains responsible for the zone "my-homenet.example.", but only
responds to DNS queries sent by the Front End Delegating Servers.
For this reason we call the CPE Delegated DNS Server the Back End
Delegated DNS Server.
The Front End Naming Delegation Architecture can be seen as providing
a Authoritative DNS Server for all the Home Networks: the Front End
Delegating DNS Server. However this Authoritative Server distributes
the Zone between multiple nodes (the CPE). The CPE constitutes the
Back End Network. The Front End Delegating DNS Server receives DNS
query from the Internet, and to respond requires to retrieve this
information on the CPE hosting this information. In this document,
the Front End Delegating DNS Server uses the DNS protocol to retrieve
this information from the CPE. Other protocols may have been chosen.
Cloetens, et al. Expires January 4, 2013 [Page 4]
Internet-Draft Home Network Front End Naming Delegation July 2012
The Front End Naming Delegation Architecture is based on the Naming
Delegation Architecture [I-D.mglt-naming-delegation] and addresses
the same requirements. It addresses the Deny of Service Security
issue. On the other hand, it requires the ISP to provide an adapted
infrastructure, and that all DNS traffic is (partly) handled by the
ISP. The document shows how the CPE can be configured automatically
and be part of the Front End Naming Delegation Architecture.
In this document we only considered IPv6 and DHCP. As such DHCP MUST
be understood as DHCPv6. We also assume the reader has read
[I-D.mglt-naming-delegation]
3. Terminology
This document uses the terminology defined in
[I-D.mglt-naming-delegation], and introduces the following
terminology:
- Front End Delegating DNS Server or Delegating DNS Server: The DNS
Server of the ISP that handles with the DNS queries addressed
to the Home Network.
- Back End Delegated DNS Server or Delegated DNS Server: CPE are
hosting a DNS Service
- Front End Delegating Information: Information like FQDNs and IP
addresses of the Front End Delegating DNS Servers. These
pieces of information are provided from the ISP DHCP Server to
the CPE so it can properly configure its DNS zone file.
- Delegating Authorized Resolvers: The hosts that are authorized to
send DNS queries to the CPE. These Resolvers can be the Front
End Delegating DNS Servers, but we keep these functions
independent since some ISP may use dedicated Interfaces for the
Front End Delegating DNS Server and for the Delegating
Authorized Resolvers.
4. Front End Naming Delegation Architecture Overview
4.1. Home Network Naming Architecture Requirements
The Home Network Naming Requirements for the Naming Delegation listed
in [I-D.mglt-naming-delegation] are:
Cloetens, et al. Expires January 4, 2013 [Page 5]
Internet-Draft Home Network Front End Naming Delegation July 2012
- 1: Centralized Naming Configuration: The CPE is responsible to
bind Names and IP addresses for the whole Home Network.
- 2: Automatic Configuration: The CPE MUST be able to set the Naming
architecture when plugged, with minimum configuration from the
End User.
- 3: Advanced Configuration enable: The CPE enables advanced
specific configurations.
- 4: Privacy Protection By Design: The Names and the Home Network IP
address plan is administrated by the CPE and are not
communicated to the ISP. This prevents the ISP to be aware of
the hosts, Services and Objects that compose the Home Network.
- 5: Make the Home Network Naming Architecture Scalable: The Naming
Architecture MUST be scalable and designed to handle a large
increase of Objects, Services and hosts in each Home Networks.
The Naming Delegation Architecture fulfills these requirements, and
we consider this architecture as the base architecture. However,
this architecture major drawback is that the CPE hosts the Delegated
DNS Server. CPE are usually not designed to handle heavy traffic,
and thus are sensitive to DoS attacks. The Front End Naming
Delegation Architecture adds one requirement to the currently
designed Naming Delegation Architecture [I-D.mglt-naming-delegation]:
- 6: the Naming Architecture MUST be protected by the ISP
Infrastructure: The CPE MUST NOT expose the Home Network Naming
service to DoS attacks. The ISP MUST be able to provide the
necessary infrastructure that handle DoS attacks, or heavy
loads.
In order to match Requirement 6, the Front End Naming delegation
Architecture introduces Front End DNS Delegating Server that handles
with all DNS traffic. This means that all DNS queries that concern
the Home Network are addressed to the Front End DNS Delegating Server
of the ISP and are not addressed to the CPE. CPEs belong to the Back
End DNS Network.
The Front End DNS Naming Delegation Architecture fulfills all the
above Requirements. However, Requirement 4 needs to be balanced
against Requirement 6. Requirement 6 requires the ISP to handle all
DNS queries that concern the Home Network. This makes the ISP aware
of all queried Services, Objects and hosts in the Home Network. This
may, in that sense, reduces the Privacy of the Home Network compared
to the Naming Delegation Architecture. In fact with the Naming
Delegation Architecture, the DNS query is directly sent to the CPE
Cloetens, et al. Expires January 4, 2013 [Page 6]
Internet-Draft Home Network Front End Naming Delegation July 2012
when the DNS client has the IP address of the CPE in its cache. In
that case, the ISP is not aware of the existence of the queried FQDN.
However, if the DNS client does not have the IP address of the CPE,
then the DNS query is sent first to the ISP Delegating Server. In
this latter case, the Front End DNS Naming Delegation Architecture
does not provide less privacy.
4.2. Front End Naming Delegation Architecture Description
Figure 1 shows how the Resolution is performed. In [1], the Resolver
sends a DNS query to the Front End Delegated Server for the host
"hots1.my-homenet.example.". The Front End Delegated Server does not
have the response in its cache or in its zone file. The Front End
Delegating DNS Server MUST send a query to the Back End Delegated DNS
Sever. The IP address of the Back End Delegated DNS Sever MUST NOT
be revealed to the Resolver, for example by setting the NS field in
the DNS Zone File. In Figure 1, we mentioned the Delegated Server
Information Database where this IP address is stored. The Front End
Delegating Server sends the DNS(SEC) query to the Back End Delegated
Server hosting the zone "my-homenet.example.". The source IP address
used is one the Delegating Authorized Resolvers IP addresses. This
query is represented in [2]. The Back End Delegated Server responds
in [3] with the DNS(SEC) Response. Note that the "AUTHORITY" and
"ADDITIONAL SECTION" of the DNS response MUST indicate the FQDN and
the IP addresses of the Front End Delegated DNS Server. These pieces
of information have been provided by the ISP DHCP Server with the
Front End Delegating Information DHCP Option. The CPE can also be
configured to respond without these fields. Finally in [4], the
Front End Delegating Server forwards the DNS(SEC) response to the
Resolver. "AUTHORITY" and "ADDITIONAL SECTION" fields MUST be filled
in appropriately.
Cloetens, et al. Expires January 4, 2013 [Page 7]
Internet-Draft Home Network Front End Naming Delegation July 2012
+-----------------------------+ [1] DNS Query +---+
| ZONE "example.": | hots1.my-homenet.example. AAAA | R |
| Front End Delegating Servers| <------------------------------- | E |
| | [4] DNS Response: | S |
+-------------------------+ | my-homenet.example. AAAA IP6 | O |
| Delegated Server Info | | [my-homenet.example. RRSIG [...] ] | L |
| Database | | -------------------------------> | V |
+-------------------------+---+ | E |
| [2] DNS Query ^ | R |
| hots1.my-homenet.example. AAAA +---+
| | [3] DNS Response:
| | my-homenet.example. AAAA IP6
v | [my-homenet.example. RRSIG [...] ]
+-----------------------------+
| CPE |
| Back End Delegated Server |
| ZONE "my-homenet.example." |
| IP6 DELEGATED_DNS_ADDR_INFO |
+-----------------------------+
| |
+------------+ +------------+
| Host 1 | | Host n |
+------------+ +------------+
Figure 1: DNS Resolution with the Home Network Delegating Architecture
4.3. Front End Naming Delegation Configuration
Figure 2 describes the Interactions between the CPE and the ISP DHCP
Server.
Similarly to [I-D.mglt-naming-delegation], the CPE hosts a DHCP
Server (DHCP_SRV) that is used to assign IP addresses and FQDNs to
the Hosts of the Home Network. In this document we considered DHCP,
but other protocols can also be used in combination with DHCP or
instead of DHCP. The CPE also has a DHCP Client (DHCP_CLT) that is
used to exchange information with the ISP DHCP Server. This document
describes how these exchanges properly configure the Front End Naming
Delegation Architecture. The CPE also hosts a Authoritative DNS
Server (DNS_SRV) that is responsible of the subzone associated to the
Home Network. This Authoritative DNS Server is called the Back End
Delegated Server. At last the CPE also has a Firewall (FIREWALL),
that can be configured with security Policies. In this document, the
CPE is not expected to received DNS queries from any other peer but
the Front End Delegation DNS Servers, that are in the ISP Network.
In Figure 2. the CPE sends a DHCP Request for a Front End Naming
Delegation Architecture (DELEGATED_DNS_ARCHITECTURE). Similarly to
Cloetens, et al. Expires January 4, 2013 [Page 8]
Internet-Draft Home Network Front End Naming Delegation July 2012
the Naming Delegation Architecture, the CPE provides the necessary
information so the ISP can derive the IP address of the Back End
Delegated DNS Server (DELEGATED_DNS_ADDR_INFO). If the CPE wants a
DNSSEC Delegation to be set it also provides the Delegation of
Signing Information (DS). In our case, the CPE also sends a request
for a Prefix Delegation (IA_PD).
To the difference with [I-D.mglt-naming-delegation], the IP address
of the Back End Delegated DNS Server is not mentioned in the Zone
file of the Front End Delegating DNS Server. In this document, the
Back End Delegated DNS Server is not expected to receive any DNS
query from anyone but the Front End Delegating DNS Server. For DNS
Resolvers, the only Authoritative DNS Server they are aware of is the
Front End Delegating DNS Server.
Similarly to [I-D.mglt-naming-delegation], the ISP DHCP Server
provides the CPE the IP Prefix so the CPE can configure its Prefix
Delegation. To set the DNS(SEC) Naming Delegation the ISP DHCP
Server indicates the type of Naming Delegation Architecture agreed
between the CPE and the ISP DHCP Server (DELEGATED_DNS_ARCHITECTURE).
In addition, the ISP DHCP Server, provides the Delegated Domain
(DELEGATED_DOMAIN) as well as the IP addresses and FQDNs of the Front
End Delegating DNS Servers (FRONT_END_DELEGATING_INFO). These pieces
of information are necessary to configure the zone file of the Home
Network. In fact the zone file MUST be configured with the Front End
Delegating Server as the authoritative servers. In addition, the ISP
DHCP Server may also provide the IP addresses or subnet prefix of the
Delegating Authorized Resolvers (DELEGATING_AUTH_RESOLVERS). These
Resolvers are the only hosts supposed to send DNS queries to the CPE.
DNS queries from any other IP address MUST be discarded.
Upon receiving these pieces of information, the Front End Delegating
Server and the Back End Delegated Server configure their Zones. In
addition the CPE also configures its Firewall, so to discard any DNS
queries but those emitted from the Delegating Authorized Resolvers.
Cloetens, et al. Expires January 4, 2013 [Page 9]
Internet-Draft Home Network Front End Naming Delegation July 2012
<--------- Home Network ----------> <--------- ISP --------->
+--------+ +---------------------+ +-----------------------+
| Host 1 +--+ CPE | | ISP DHCP |
+--------+ +----------+----------+ +-----------------------+
. | DHCP_SRV | DHCP_CLT | | |
. | v | | | |
. | v | DHCP Request ----------------------> |
. | v | DELEGATED_DNS_ARCHITECTURE, |
. +----------| DELEGATED_DNS_ADDR_INFO, |
. | DNS_SRV | ORO(IA_PD) [DS] |
. +----------| | | |
. | ^ | <---------------------- DHCP Reply |
. | ^ | DELEGATED_DNS_ARCHITECTURE, |
. | < < < DHCP_CLT DELEGATED_DOMAIN, IA_PD, |
. | v | FRONT_END_DELEGATING_INFO, |
+--------+ +----------+ DELEGATING_AUTH_RESOLVERS, |
| Host n +--| FIREWALL | | | |
+--------+ +----------+--------- + +-----------------------+
Figure 2: Front End Naming Delegation Architecture
4.4. Difference between the Front End Delegating DNS Server and
traditional DNS Recursive DNS Server
From Figure 1, one may assimilate the Front End Delegating DNS Server
to a Recursive DNS Resolver. The main differences are:
- 1. The Front End Delegating DNS Server only proceeds to Resolution
for the FQDNs that are hosted in one of the Back End Delegated
DNS Servers.
- 2. The Back End Delegated DNS Servers are not Public DNS. More
especially, the Delegated DNS Server may have a public IP
address, but the DNS Service is not provided for any Resolver
but the authorized Resolvers.
As a result, the Front End Delegating DNS Server is a mixed mode
between Authoritative and Recursive DNS Server. As an Authoritative
Server, the Response [4] in figure 1 MUST have a Authoritative Answer
(AA) bit set, which indicates the Response is from an Authoritative
Server. Then the Resolution [2] and [3] in figure 1 MUST be
processed even if the Recursion Desired (RD) bit is not set in the
DNS query [1].
It is also recommended that the Front End Delegating DNS Server
provides the Authoritative and Additional Section of the Response in
[4], without considering the sections of [3]. In other word, it is
recommended not to forward these section from [3], and the CPE should
Cloetens, et al. Expires January 4, 2013 [Page 10]
Internet-Draft Home Network Front End Naming Delegation July 2012
be configured not to provide these sections in [3].
4.5. How the Front End Configuration impacts the CPE
Figure 2 shows that the ISP DHCP Server provides the IP addresses of
the Front End Delegating DNS Server as well as the Name of the Front
End Delegating DNS Server. These are the information the Back End
Delegated DNS Server MUST put in its Zone file. More especially in
the NS fields.
Figure 2 also shows that the ISP DHCP Server provides the CPE the IP
addresses or subnet prefix of the Authorized Delegating Resolvers.
These are the IP addresses authorized to send DNS queries that should
not be discarded on the WAN Interface. Any other DNS query on the
WAN should be discarded. These rules are set by the Firewall as
represented in Figure 2.
The Firewall rules does not prevent the CPE to be a DNS forwarder or
a DNS Resolver for the hosts of the Home Network. In fact the CPE
can still receive DNS queries from the LAN Interface. The issue is
that the CPE may provide Multiple DNS Services. In this document, we
consider the CPE provides at least a DNS Authoritative servers on its
WAN Interface for the Authorized Delegating Resolvers. For the LAN
Interface, the CPE may be configured in various ways, depending on
the ISP DNS Infrastructure. A first configuration consists in
configuring the CPE LAN DNS Service into a DNS forwarder. In that
case, the CPE DHCP server of the Home Network provides an IP address
of the CPE for the DNS Resolver. DNS queries for the Home Network
are answered by the CPE, others are forwarded to the Resolver of the
ISP. This resolver is provided via DHCP. Another alternative
consists in configuring the CPE as a Recursive DNS Server. Without
any specific configurations, DNS queries for the Home Network are
sent to the Front End Delegating DNS Server. Optimization may be
done to bypass the Front End Delegating DNS Server for the Home
Network Zone and are CPE or software implementation specific.
5. Protocol Exchange
5.1. CPE Request Creation and Transmission for the Front End Naming
Delegation Architecture
When the CPE wants to set a Front End Naming Delegation Architecture,
it requests this set up to the ISP DHCP Server. For that purpose, we
consider two new naming-delegation-action:
SET_FRONT_END_NAMING_DELEGATION_WITH_DNS when the delegation is only
performed with DNS or SET_FRONT_END_NAMING_DELEGATION_WITH_DNSSEC if
the CPE wants a DNSSEC delegation. These naming-delegation-actions
Cloetens, et al. Expires January 4, 2013 [Page 11]
Internet-Draft Home Network Front End Naming Delegation July 2012
are proposed in the Delegated DNS Architecture DHCP Option
(OPTION_DELEGATED_DNS_ARCHITECTURE). Then, the CPE proceeds as
described in [I-D.mglt-naming-delegation].
5.2. ISP DHCP Server Responding to the CPE Request for the Front End
Naming Delegation Architecture
When the DHCP Server receives a Delegated DNS Architecture DHCP
Option (OPTION_DELEGATED_DNS_ARCHITECTURE), Delegated DNS Address
Information DHCP Option (OPTION_DELEGATED_DNS_ADDR_INFO) or a
Delegation of Signing DHCP Option (OPTION_DS), the DHCP Server
proceeds as described in [I-D.mglt-naming-delegation].
In addition, when the naming-delegation-action is set to
SET_FRONT_END_NAMING_DELEGATION_WITH_DNS or
SET_FRONT_END_NAMING_DELEGATION_WITH_DNSSEC, the DHCP Server MUST
include in the Response the two additional DCHP Options. The Front
End Delegating Information DHCP Option
(OPTION_FRONT_END_DELEGATING_INFO) which indicates the FQDNs of the
Front End Delegating Servers and their associated IP addresses.
Then, it also MUST include the Delegating Authorized Resolvers DHCP
Option (OPTION_DELEGATING_AUTH_RESOLVERS) which indicates the IP
addresses or subnet prefixes of the Authorized Delegating Resolvers.
Note that Naming Delegation is set differently for the Front End
Naming Delegation Architecture and for the Naming Delegation
Architecture. More specifically, in the Front End Naming Delegation,
the ISP DHCP Server MUST NOT make the IP address of the Delegated DNS
Server public in its zone file.
5.3. CPE Receiving the ISP DHCP Response for the Front End Naming
Delegation Architecture
Similarly to [I-D.mglt-naming-delegation], if the CPE has not
received all expected DHCP Options, or cannot proceed to the
configuration of the Naming Delegation Architecture, it MUST either
clear the Naming Delegation settings or proceed to the appropriated
settings.
When the CPE receives the Delegating Authorized Resolvers DHCP Option
(OPTION_DELEGATING_AUTH_RESOLVERS), the CPE may update its Firewall
rules. The Front End Delegating Information DHCP Option
(OPTION_FRONT_END_DELEGATING_INFO) is used to configure the DNS zone
of the Home Network.
The CPE may receive the Delegating Authorized Resolvers or the Front
End Delegating Information DHCP Option from the ISP DHCP Server that
are not the response to a Delegated DNS Architecture DHCP Option.
Cloetens, et al. Expires January 4, 2013 [Page 12]
Internet-Draft Home Network Front End Naming Delegation July 2012
This may happen if the ISP DHCP Server is updating or modifying its
Front End Delegating DNS Server or the associated Delegating
Authorized Resolvers. In that case, the CPE MUST make sure the
message provides from the ISP DHCP Server and updates its Firewall
rules as well as its DNS zone file.
6. DHCP Options
The options detailed in this section are
- Delegated DNS Architecture (OPTION_DELEGATED_DNS_ARCHITECTURE): is
used by the DHCP Client on the CPE to inform how the Naming
Delegation Architecture should be configured. In return, it is
used by the ISP DHCP Server to report the Status Code.
- Front End Delegating Information DHCP Option
(OPTION_FRONT_END_DELEGATING_INFO): is used by the ISP DHCP Server
to provide the CPE the FQDN and IP addresses of the
Authoritative DNS Server of the Home Network Zone file. These
Authoritative DNS Servers are the Front End DNS Server.
- Delegating Authorized Resolvers DHCP Option
(OPTION_DELEGATING_AUTH_RESOLVERS): is used by the DHCP Server to
provide the CPE the IP addresses or subnet prefixes of the
Delegating Authorized Resolvers. These are the resolvers
authorized to send DNS(SEC) queries.
6.1. Delegated DNS Architecture Option
The Delegated DNS Architecture DHCP Option is defined in
[I-D.mglt-naming-delegation]. This document adds two new naming-
delegation-actions defined below:
- SET_FRONT_END_NAMING_DELEGATION_WITH_DNS - 2 - : Indicates that
the DHCP Server MUST set the Front End Naming Delegation
Architecture with only DNS, and MUST NOT consider DNSSEC
Delegation.
- SET_FRONT_END_NAMING_DELEGATION_WITH_DNSSEC - 3 - : Indicates that
the DHCP Server MUST set the Front End Naming Delegation
Architecture with DNSSEC.
Cloetens, et al. Expires January 4, 2013 [Page 13]
Internet-Draft Home Network Front End Naming Delegation July 2012
6.2. Front End Delegating Information Option
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPT_FRONT_END_DELEGATING_INFO | option-len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| front-end-length | front-end-fqdn-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
/ front-end-delegating-fqdn /
| |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| |
| ipv6-address |
| |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| |
| ipv6-address |
| |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- option-code: OPT_FRONT_END_DELEGATING_INFO (16 bits)
- option-len: Length (16 bits) of the Front End Delegating
Information Option in octets.
- front-end-length: Length (16 bits) of the Front End Delegating
Server.
- front-end-fqdn-length: Length (16 bits) of the Front End
Delegating Server FQDN.
- ipv6-address: IPv6 Address (128 bits).
Cloetens, et al. Expires January 4, 2013 [Page 14]
Internet-Draft Home Network Front End Naming Delegation July 2012
6.3. Delegating Authorized Resolvers Option
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|OPTION_DELEGATED_AUTH_RESOLVERS| option-len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| prefix-length | |
+-+-+-+-+-+-+-+-+ |
| |
| ipv6-prefix |
| |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | prefix-length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| |
/ ipv6-prefix /
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- option-code: OPTION_DELEGATED_AUTH_RESOLVERS (16 bits)
- option-len: Length (16 bits) of the Delegating Authorized
Resolvers Option in octets.
- prefix-length: Length (8 bits) for this prefix in bits.
- ipv6-prefix: IPv6 address or IPv6 prefix used by the authoritative
DNS server to send DNS queries to the delegated domain name.
7. IANA Considerations
This document adds two new DHCP Options:
- OPTION_FRONT_END_DELEGATING_INFO: TBD
- OPTION_DELEGATING_AUTH_RESOLVERS: TBD
8. Security Considerations
This document addresses the DoS security issue of
[I-D.mglt-naming-delegation]. Other security considerations remains
as described in [I-D.mglt-naming-delegation].
Cloetens, et al. Expires January 4, 2013 [Page 15]
Internet-Draft Home Network Front End Naming Delegation July 2012
9. Acknowledgment
The authors wish to thank Ole Troan for pointing out issues with the
IPv6 routed home concept and placing the scope of this document in a
wider picture, Mark Townsley for encouragement and injecting a
healthy debate on the merits of the idea, Ulrik de Bie for providing
alternative solutions, Paul Mockapetris for pointing out issues of
the trustworthiness of a reverse lookup, and Christian Jacquenet for
seeing the value from a Service Provider point of view.
10. References
10.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
10.2. Informational References
[I-D.mglt-naming-delegation]
Cloetens, W., Lemordant, P., and D. Migault, "IPv6 Home
Network Naming Delegation Architecture",
draft-mglt-naming-delegation-00 (work in progress),
July 2012.
Authors' Addresses
Wouter Cloetens
SoftAtHome
vaartdijk 3 701
3018 Wijgmaal
Belgium
Phone:
Email: wouter.cloetens@softathome.com
Philippe Lemordant
Francetelecom - Orange
2 avenue Pierre Marzin
22300 Lannion
France
Phone: +33 2 96 05 35 11
Email: philippe.lemordant@orange.com
Cloetens, et al. Expires January 4, 2013 [Page 16]
Internet-Draft Home Network Front End Naming Delegation July 2012
Daniel Migault
Francetelecom - Orange
38 rue du General Leclerc
92794 Issy-les-Moulineaux Cedex 9
France
Phone: +33 1 45 29 60 52
Email: mglt.ietf@gmail.com
Cloetens, et al. Expires January 4, 2013 [Page 17]
