Internet DRAFT - draft-sonoda-dnsop-dnslb

draft-sonoda-dnsop-dnslb







Domain Name System Operations                                Sonoda, Ed.
Internet-Draft                            Internet Initiative Japan Inc.
Intended status: Informational                              Jun 23, 2018
Expires: December 25, 2018


                           DNS load balancing
                      draft-sonoda-dnsop-dnslb-03

Abstract

   This document defines a new DNS load balance function that is able to
   transfer information in zone transfer and not need online signing.
   DNS base load balance is popular technology.  It provides weight base
   response and location base response.  It have become an indispensable
   part of traffic engineering.  However, DNS base load balance can't
   transfer load balance information in zone transfer and need online
   singing because it is not standardized.  This document defines a new
   DNS resource record called "LB" and new EDNS option bit called "LS".
   LB RR provides the balancing information weight, location and target
   domain name.  LS bit provides the change response mechanism in name
   servers.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on December 25, 2018.

Copyright Notice

   Copyright (c) 2018 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of



Sonoda                  Expires December 25, 2018               [Page 1]

Internet-Draft              Abbreviated Title                   Jun 2018


   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

1.  Introduction

1.1.  Legacy DNS load balancing

   Legacy DNS load balancing provides traffic engineering.It use special
   authoritative name server.  It response is one address record that is
   dynamic changes using network location and weight.  It's used for
   large traffic WEB site domain name that is important domain name.
   Important domain name should be secure.

   But legacy DNS load balancing is not secure.  Because Legacy DNS load
   balancing can't send zone data by zone transfer.  It's mean very
   difficult to use multi service providers.  That means weak for DDoS
   Attack.  If zone is signed, All name servers require private key for
   dynamic signing because response is dynamic changes.  Distributing
   private key is not secure, It is increased risk of leakage private
   key.

1.2.  New DNS load balancing

   New DNS load balancing concept is that Authoritative name server uses
   "LB" RR to provide load balancing and Full resolver use "LB" RR to
   select target name and respond with the target name.

   "LB" RR defines load balancing settings that is network location and
   weight and target domain name.  Network location is string that
   meaningful name of network.  For example Country code (ex.
   JP),subdivision code(ex.  US-CA) and Autonomous System Number (ex.
   AS65536).  Full resolver use resolver configuration to select network
   location and refine "LB" RRs.  Weight is integer value.  Full
   resolver use weight ratio to select target name.  Target name is
   pointer to address record.  It is same "ANAME"
   [I-D.ietf-dnsop-aname].

2.  Mechanism

   1.  Stub resolver sends A or AAAA query to full resolver.

   2.  Full Resolver sends A or AAAA query with LS bit to authoritative
   server.




Sonoda                  Expires December 25, 2018               [Page 2]

Internet-Draft              Abbreviated Title                   Jun 2018


   3.  Authoritative Server responses LB RRset.

   4.  Full Resolver selects target domain name using location and
   weight.

   5.  Full Resolver resolv target domain name.

   6.  Full Resolver response target domain name and LB RRSet to stub
   resolver.

3.  The LB Resource Record

   The LB RR has mnemonic LB.  LB RR define load balancing information.

   LB format below.

         <owner> <ttl> <class> LB <weight> <location> <target>

   The format is not class-sensitive.  All fields are required.

   <weight> field is a 2 octets, 1 or more natural number.

   <location> field is a "<character-string>" [RFC1035].

   <target> field is a "<domain-name>" [RFC1035].  It has A or AAAA RR
   or CNAME RR or DNAME RR.

3.1.  Define location

   <location> ::= "*" | <continental code> | <country code> |
   <subdivision code> | <asn code> | <private code>

   <region code> ::= "AF" | "NA" | "AS" | "EU" | "NA" | "OC" | "SA"

   <country code> ::= ISO 3166-1 alpha-2 Country code.

   <subdivision code> ::= ISO 3166-2 Codes for the representation of
   names of countries and their subdivisions.

   <asn code> ::= "AS" <asn> [ ":" <asn>]

   <private code> ::= "+" <let>

   <ans> ::= <nonzero digit> <digit>

   <nonzero digit> ::= any one of the ten digits 1 through 9

   <digit> ::= any one of the ten digits 0 through 9



Sonoda                  Expires December 25, 2018               [Page 3]

Internet-Draft              Abbreviated Title                   Jun 2018


   <let> ::= any one of the 26 alphabetic characters A through Z in
   upper case or any one of the ten digits 0 through 9.

3.2.  Record example

   example.jp. 3600 IN LB 1 * www.example.com. ; for any region
   example.jp. 3600 IN LB 1 AS as.example.com. ; for ASIA region
   example.jp. 3600 IN LB 1 JP jp1.example.jp. ; for JP region, weight 1
   example.jp. 3600 IN LB 3 JP jp2.example.jp. ; for JP region, weight 3
   example.jp. 3600 IN LB 1 JP-13 tokyo.example.jp. ; for tokyo region
   example.jp. 3600 IN LB 1 AS2496 as65536.example.jp.   ; for AS65536
   example.jp. 3600 IN LB 1 AS2496:1 as65536.example.jp. ; for AS65536
   example.jp. 3600 IN LB 1 +BEER beer.example.jp.       ; private use

4.  The LB Support Flag

   Defines a new "EDNS Header Flags" [RFC6891] call LB Support Flag(LS)
   using full resolver sends LB RR supported to authoritative server.

   LS bit provides change response mechanism in authoritative name
   server.  If LS bit is flagged, Authoritative name server can response
   LB RR for A,AAAA query.

5.  Authoritative name server Behavior

   When authoritative name server receives a query of type A or AAAA
   with LS bit and LB record is present at a SNAME, The authoritative
   server returns the LB RRSet in the answer section with LS bit.

5.1.  Example of authoritative name server behavior

   Example zone data:

   example.jp. 3600 IN SOA ( ns1.example.com.
                             postmaster.example.com.
                             1
                             3600
                             900
                             1814400
                             900 )
   example.jp. 3600 IN NS ns1.example.com.
   example.jp. 3600 IN NS ns2.example.com.
   example.jp. 3600 IN A 198.51.100.1
   example.jp. 3600 IN LB 1 * www.example.com.
   example.jp. 3600 IN LB 1 JP jp1.example.com.
   example.jp. 3600 IN LB 3 JP jp2.example.com.

   Incoming query with LS bit:



Sonoda                  Expires December 25, 2018               [Page 4]

Internet-Draft              Abbreviated Title                   Jun 2018


   query: qtype = example.jp. qtype=A, LS=1

   Response for include LS:

   query: qtype = example.jp. qtype=A
   response: LS=1
     answer:
       example.jp. 3600 IN LB 1 * www.example.com.
       example.jp. 3600 IN LB 1 JP jp1.example.com.
       example.jp. 3600 IN LB 3 JP jp2.example.com.
     authority:
       example.jp. 3600 IN NS ns1.example.com.
       example.jp. 3600 IN NS ns2.example.com.

   Incoming query without LS bit (normal query):

   query: qtype = example.jp. qtype=A, LS=0

   Response for not include LS:

   query: qtype = example.jp. qtype=A
   response:  LS=0
     answer:
           example.jp. 3600 IN A 198.51.100.1
     authority:
           example.jp. 3600 IN NS ns1.example.com.
           example.jp. 3600 IN NS ns2.example.com.

6.  Full Service Resolver Behavior

   When a full resolver sends a query of type A or AAAA with LS bit and
   receives a response with a LB RRset in the answer section with LS
   bit, Full resolver MUST re-resolv the either LB <target> of type
   "STYPE" [RFC1034].  <target> be selected by <location> and <weight>.

6.1.  Location selection

   Location selection needs full resolver or stub resolver location
   information.  Full resolver location information with priority value
   SHOULD gets from config file.  Full resolver MUST setting '*'
   location with lowest priority.  Full resolver select location that
   match either LB RR <location> and highest priority resolver location.
   if all LB RRs don't match all resolver locations, resolver selects a
   location randomly.







Sonoda                  Expires December 25, 2018               [Page 5]

Internet-Draft              Abbreviated Title                   Jun 2018


6.2.  Weight selection

   Full resolver selects <target> using <weight> from LB RR whose
   location matches.

6.3.  Example

   1.  Full resolver location is configured "JP-13" "JP" "AS" "*".

   2.  Stub resolver query coming:

       query: qtype = example.jp. qtype=A

   3.  Full resolver send query:

       query: qtype = example.jp. qtype=A, LS=1

   3.  If response include LB:

       query: qtype = example.jp. qtype=A
       response: LS=1
         answer:
               example.jp. 3600 IN LB 1 * www.example.com.
               example.jp. 3600 IN LB 1 JP jp1.example.com.
               example.jp. 3600 IN LB 3 JP jp2.example.com.
         authority:
               example.jp. 3600 IN NS ns1.example.com.
               example.jp. 3600 IN NS ns2.example.com.

   4. select LB RR that's location include resolver location

               example.jp. 3600 IN LB 1 JP jp1.example.com.
               example.jp. 3600 IN LB 3 JP jp2.example.com.

   5.  Select one LB RR using <weight>:

               example.jp. 3600 IN LB 3 JP jp2.example.com.

   5.  Name resolution <target>:

       query: qtype = jp2.example.com. qtype=A, LS=1
       response:
         answer:
               jp2.example.com. 3600 IN A 192.0.2.2
         authority:
               example.com. 3600 IN NS ns1.example.com.
               example.com. 3600 IN NS ns2.example.com.




Sonoda                  Expires December 25, 2018               [Page 6]

Internet-Draft              Abbreviated Title                   Jun 2018


   6.  Make response message:

       query: qtype = example.jp. qtype=A, LS=1
       response:
         answer:
               example.jp. 3600 IN LB 1 * www.example.com.
               example.jp. 3600 IN LB 1 JP jp1.example.com.
               example.jp. 3600 IN LB 3 JP jp2.example.com.
               jp2.example.com. 3600 IN A 192.0.2.2
         authority:
               example.jp. 3600 IN NS ns1.example.com.
               example.jp. 3600 IN NS ns2.example.com.

   7.  Stub resolver uses 192.0.2.2

7.  Implementation Status

7.1.  Authoritative name server

   NSD proof of concept patches can be seen at
   https://github.com/mimuret/nsd-with-ls

   KnotDNS proof of concept patches can be seen at
   https://github.com/mimuret/knotd-with-ls

7.2.  Full resolver name server

   Knot-resolver proof of concept patches can be seen at
   https://github.com/mimuret/knot-resolver-with-ls

7.3.  Stub resolver behavior

   Stub resolvers status below.

   ----------------------------------------------------------
   |Implementation|gethostbyname*|      getaddrinfo         |
   |              |              |AF_INET|AF_INET6|AF_UNSPEC|
   ----------------------------------------------------------
   |macOS(10.13)  |      X       |   X   |   X    |    X    |
   ----------------------------------------------------------
   |Windows 10    |      X       |   O   |   X    |    O    |
   ----------------------------------------------------------
   |Linux(glic)   |      X       |   X   |   X    |    O    |
   ----------------------------------------------------------
   |Solaris 11    |      X       |   X   |   X    |    X    |
   ----------------------------------------------------------





Sonoda                  Expires December 25, 2018               [Page 7]

Internet-Draft              Abbreviated Title                   Jun 2018


8.  IANA Considerations

   IANA is requested to assign a DNS RR data type value for the LB RR
   type under the "Resource Record (RR) TYPEs" sub-registry and a EDNS
   Header Flag value for the LB Support Flag under the "EDNS Header
   Flags (16 bits)" sub-registry under the "Domain Name System (DNS)
   Parameters" registry.

9.  Security Considerations

   Both authoritative server and resolvers that implement LB SHOUD
   carefully check for loops.

10.  Normative References

   [I-D.ietf-dnsop-aname]
              Hunt, E., Dijk, P., and A. Eden, "Address-specific DNS
              Name Redirection (ANAME)", draft-ietf-dnsop-aname-01 (work
              in progress), January 2018.

   [RFC1034]  Mockapetris, P., "Domain names - concepts and facilities",
              STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987,
              <https://www.rfc-editor.org/info/rfc1034>.

   [RFC1035]  Mockapetris, P., "Domain names - implementation and
              specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
              November 1987, <https://www.rfc-editor.org/info/rfc1035>.

   [RFC6891]  Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms
              for DNS (EDNS(0))", STD 75, RFC 6891,
              DOI 10.17487/RFC6891, April 2013,
              <https://www.rfc-editor.org/info/rfc6891>.

Author's Address

   Manabu Sonoda (editor)
   Internet Initiative Japan Inc.

   Email: manabu-s@iij.ad.jp












Sonoda                  Expires December 25, 2018               [Page 8]