No subject
root at unspecified-domain
root at unspecified-domain
Mon May 11 08:43:22 UTC 1998
Network Working Group Havard Eidnes
INTERNET-DRAFT SINTEF RUNIT
draft-ietf-cidrd-classless-inaddr-01.txt Geert Jan de Groot
RIPE NCC
May 1996
Classless in-addr.arpa delegation
1. Status of this Memo
This document is an Internet-Draft. Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas,
and its working groups. Note that other groups may also distribute
working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet- Drafts as reference
material or to cite them other than as ``work in progress.''
To learn the current status of any Internet-Draft, please check the
``1id-abstracts.txt'' listing contained in the Internet-Drafts Shadow
Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe),
munnari.oz.au (Pacific Rim), ds.internic.net (US East Coast), or
ftp.isi.edu (US West Coast).
2. Introduction
This document describes a way to do in-addr.arpa delegation on non-
octet boundaries. The proposed method should thus remove one of the
objections to subnet on non-octet boundaries but perhaps more
significantly, make it possible to assign IP address space in smaller
chunks than 24-bit prefixes, without losing the ability to delegate
authority for the corresponding in-addr.arpa mappings. The proposed
method is fully compatible with the original DNS lookup mechanisms
specified in [1], i.e. there is no need to modify the lookup
algorithm used, and there should be no need to modify any software
which does DNS lookups either.
The document also discusses some operational considerations to
provide some guidance in implementing this method.
Eidnes, de Groot Expires 961115 [Page 1]
INTERNET-DRAFT Classless in-addr.arpa delegation May 1996
3. Motivation
With the proliferation of classless routing technology, it has become
feasible to assign address space on non-octet boundaries. In case of
a Very Small Organization with only a few hosts, assigning a full
24-bit prefix (what has traditionally been referred to as a ``class C
network number'') often leads to inefficient address space
utilization.
One of the problems encountered when assigning a longer prefix (less
address space) is that it seems impossible for such an organization
to maintain its own reverse (``in-addr.arpa'') zone autonomously. By
use of the reverse delegation method described below, the most
important objection to assignment of longer prefixes to unrelated
organizations can be removed.
Let us assume we have assigned the address spaces to three different
parties as follows:
192.0.2.0/25 to organization A
192.0.2.128/26 to organization B
192.0.2.192/26 to organization C
In the classical approach, this would lead to a single zone like
this:
$ORIGIN 2.0.192.in-addr.arpa.
;
1 PTR host1.A.domain.
2 PTR host2.A.domain.
3 PTR host3.A.domain.
;
129 PTR host1.B.domain.
130 PTR host2.B.domain.
131 PTR host3.B.domain.
;
193 PTR host1.C.domain.
194 PTR host2.C.domain.
195 PTR host3.C.domain.
The administration of this zone is problematic. Authority for this
zone can only be delegated once, and this usually translates into
``this zone can only be administered by one organization.'' The
other organizations with address space which corresponds to entries
in this zone would thus have to depend on another organization for
their address to name translation. With the proposed method, this
potential problem can be avoided.
Eidnes, de Groot Expires 961115 [Page 2]
INTERNET-DRAFT Classless in-addr.arpa delegation May 1996
4. Classless in-addr.arpa delegation
Since a single zone can only be delegated once we need more points to
do delegation on to solve the problem above. These extra points of
delegation can be introduced by extending the in-addr.arpa tree
downwards, e.g. by using the first address in the corresponding
address space as the first component in the name for the zones. For
the problem described in the motivation section, the corresponding 4
zone files would look something like this (here shown with network
masks and network names in the form specified in [2] as well):
$ORIGIN 2.0.192.in-addr.arpa.
@ IN SOA my-ns.my.domain. hostmaster.my.domain. ( ... )
;...
0 NS ns.A.domain.
0 NS some.other.name.server.
;
128 NS ns.B.domain.
128 NS some.other.name.server.too.
;
192 NS ns.C.domain.
192 NS some.other.third.name.server.
;
1 CNAME 1.0.2.0.192.in-addr.arpa.
2 CNAME 2.0.2.0.192.in-addr.arpa.
3 CNAME 3.0.2.0.192.in-addr.arpa.
;
129 CNAME 129.128.2.0.192.in-addr.arpa.
130 CNAME 130.128.2.0.192.in-addr.arpa.
131 CNAME 131.128.2.0.192.in-addr.arpa.
;
193 CNAME 193.192.2.0.192.in-addr.arpa.
194 CNAME 194.192.2.0.192.in-addr.arpa.
195 CNAME 195.192.2.0.192.in-addr.arpa.
$ORIGIN 0.2.0.192.in-addr.arpa.
@ IN SOA ns.A.domain. hostmaster.A.domain. ( ... )
@ NS ns.A.domain.
@ NS some.other.name.server.
@ PTR networkname.A.domain.
@ A 255.255.255.128
;
1 PTR host1.A.domain.
2 PTR host2.A.domain.
3 PTR host3.A.domain.
Eidnes, de Groot Expires 961115 [Page 3]
INTERNET-DRAFT Classless in-addr.arpa delegation May 1996
$ORIGIN 128.2.0.192.in-addr.arpa.
@ IN SOA ns.B.domain. hostmaster.B.domain. ( ... )
@ NS ns.B.domain.
@ NS some.other.name.server.too.
@ PTR networkname.B.domain.
@ A 255.255.255.192
;
129 PTR host1.B.domain.
130 PTR host2.B.domain.
131 PTR host3.B.domain.
$ORIGIN 192.2.0.192.in-addr.arpa.
@ IN SOA ns.C.domain. hostmaster.C.domain. ( ... )
@ NS ns.C.domain.
@ NS some.other.third.name.server.
@ PTR networkname.C.domain.
@ A 255.255.255.192
;
193 PTR host1.C.domain.
194 PTR host2.C.domain.
195 PTR host3.C.domain.
Note that the use of network masks and network names as specified in
[2] is optional, and that it is just shown here as an illustration.
This approach to splitting up the responsibility for maintaining the
in-addr.arpa mappings makes it necessary to install approximately 256
CNAME records in the parent zone more or less permanently for each
size-256 chunk split up this way. Some people might view this as
ugly; we will not argue that particular point. It is however quite
easy to automatically generate the CNAME resource records in the
parent zone once and for all, if the way the address space is
partitioned is known.
The advantage of this approach over the other proposed approaches for
dealing with this problem is that there should be no need to modify
any already-deployed software. In particular, the lookup mechanism
in the DNS does not have to be modified to accommodate this splitting
of the responsibility for the IPv4 address to name translation on
``non-dot'' boundaries. Furthermore, this technique has been in use
for several years in at least one installation, apparently with no
ill effects.
Eidnes, de Groot Expires 961115 [Page 4]
INTERNET-DRAFT Classless in-addr.arpa delegation May 1996
5. Operational considerations
As a result of this method, the location of the zone containing the
actual PTR records is no longer predefined. This gives flexibility
and some examples will be presented here.
An obvious alternative to using the first address in the
corresponding address space to name the new zones is simply to use
some other (non-numeric) name. It is of course also possible to
point to an entirely different part of the DNS tree (e.g. outside of
the in-addr.arpa tree). It would be necessary to use one of these
alternate methods if two organizations somehow shared the same
physical subnet (and corresponding IP address space) but still wanted
to administrate their own in-addr.arpa mappings.
The following short example shows how you can point out of the in-
addr.arpa tree:
$ORIGIN 2.0.192.in-addr.arpa.
@ IN SOA my-ns.my.domain. hostmaster.my.domain. ( ... )
; ...
1 CNAME 1.A.domain.
2 CNAME 2.A.domain.
; ...
129 CNAME 129.B.domain.
130 CNAME 130.B.domain.
;
$ORIGIN A.domain.
@ IN SOA my-ns.A.domain. hostmaster.A.domain. ( ... )
; ...
;
host1 A 192.0.2.1
1 PTR host1
;
host2 A 192.0.2.2
2 PTR host2
;
etc.
Done this way you can actually end up with the name->address and the
(pointed-to) address->name mapping data in the same zone file -- some
may view this as an added bonus as no separate set of secondaries for
the reverse zone is required. Do however note that the traversal via
the in-addr.arpa tree will still be done, so the CNAME records
inserted there need to point in the right direction for this to work.
Eidnes, de Groot Expires 961115 [Page 5]
INTERNET-DRAFT Classless in-addr.arpa delegation May 1996
An approach as sketched below is an alternative approach using the
same solution:
$ORIGIN 2.0.192.in-addr.arpa.
@ IN SOA my-ns.my.domain. hostmaster.my.domain. ( ... )
; ...
1 CNAME 1.2.0.192.in-addr.A.domain.
2 CNAME 2.2.0.192.in-addr.A.domain.
$ORIGIN A.domain.
@ IN SOA my-ns.A.domain. hostmaster.A.domain. ( ... )
; ...
;
host1 A 192.0.2.1
1.2.0.192.in-addr PTR host1
host2 A 192.0.2.2
2.2.0.192.in-addr PTR host2
It is clear that many possibilities exist which can be adapted to the
specific requirements of the situation at hand.
Note that one cannot provide CNAME referrals twice for the same
address space, i.e. an ISP can't allocate a /25 prefix to one
organisation, and run in-addr.arpa this way, and then have the
organisation subnet the /25 into longer prefixes, and attempt to
employ the same technique to give each subnet control of its own
number space. This would result in a CNAME record pointing to a CNAME
record, which is generally considered bad practice.
Unfortunately, some old beta releases of the popular DNS name server
implementation BIND 4.9.3 had a bug which caused problems if a CNAME
record was encountered when a reverse lookup was made. The beta
releases involved have since been obsoleted, and this issue is
resolved in the released code. Some software manufacturers have
included the defective beta code in their product. In the few cases
we know of, patches from the manufacturers are available or planned
to replace the obsolete beta code involved.
6. References
[1] P. Mockapetris, ``Domain Names - Concepts and Facilities'',
RFC1034, ISI, November 1987.
[2] P. Mockapetris, ``DNS Encoding of Network Names and Other Types'',
RFC1101, ISI, April 1989.
Eidnes, de Groot Expires 961115 [Page 6]
INTERNET-DRAFT Classless in-addr.arpa delegation May 1996
7. Security Considerations
Security considerations are not discussed in this memo.
8. Conclusion
The suggested scheme gives more flexibility in delegating authority
in the in-addr.arpa domain, thus making it possible to assign address
space more efficiently without losing the ability to delegate the DNS
authority over the corresponding address to name mappings.
9. Acknowledgments
Glen A. Herrmannsfeldt described this trick on comp.protocols.tcp-
ip.domains some time ago. Alan Barrett, Sam Wilson, and Paul Vixie
provided valuable comments on the newsgroup.
We would like to thank Rob Austein, Randy Bush, Matt Crawford, Glen
A. Herrmannsfeldt, Daniel Karrenberg, David Kessens, Tony Li, Paul
Mockapetris, Paul Vixie, Eric Wassenaar, Michael Patton, and Peter
Koch for their review and constructive comments.
10. Author's Addresses
Havard Eidnes
SINTEF RUNIT
N-7034 Trondheim
Norway
Phone: +47 73 59 44 68
Fax: +47 73 59 17 00
Email: Havard.Eidnes at runit.sintef.no
Geert Jan de Groot
RIPE Network Coordination Centre
Kruislaan 409
1098 SJ Amsterdam, the Netherlands
Phone: +31 20 592 5065
Fax: +31 20 592 5090
Email: GeertJan.deGroot at ripe.net
Eidnes, de Groot Expires 961115 [Page 7]
More information about the bind-users
mailing list