[Docs] [txt|pdf] [Tracker] [WG] [Email] [Nits]

Versions: 00 03 RFC 2317

Network Working Group                                     Havard Eidnes
INTERNET-DRAFT                                             SINTEF RUNIT
draft-ietf-dnsind-classless-inaddr-00.txt             Geert Jan de Groot
                                                               RIPE NCC
                                                             Paul Vixie
                                           Internet Software Consortium
                                                          November 1996


                   Classless IN-ADDR.ARPA delegation



1. Status of this Memo

   This document is an Internet-Draft.  Internet-Drafts are working
   documents of the Internet Engineering Task Force (IETF), its areas,
   and its working groups.  Note that other groups may also distribute
   working documents as Internet-Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet- Drafts as reference
   material or to cite them other than as ``work in progress.''

   To learn the current status of any Internet-Draft, please check the
   ``1id-abstracts.txt'' listing contained in the Internet-Drafts Shadow
   Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe),
   munnari.oz.au (Pacific Rim), ds.internic.net (US East Coast), or
   ftp.isi.edu (US West Coast).

2. Introduction

   This document describes a way to do IN-ADDR.ARPA delegation on non-
   octet boundaries.  The proposed method should thus remove one of the
   objections to subnet on non-octet boundaries but perhaps more
   significantly, make it possible to assign IP address space in smaller
   chunks than 24-bit prefixes, without losing the ability to delegate
   authority for the corresponding IN-ADDR.ARPA mappings.  The proposed
   method is fully compatible with the original DNS lookup mechanisms
   specified in [1], i.e. there is no need to modify the lookup
   algorithm used, and there should be no need to modify any software
   which does DNS lookups either.

   The document also discusses some operational considerations to
   provide some guidance in implementing this method.





Eidnes, de Groot, Vixie      Expires 970525                     [Page 1]


INTERNET-DRAFT      Classless IN-ADDR.ARPA delegation      November 1996


3. Motivation

   With the proliferation of classless routing technology, it has become
   feasible to assign address space on non-octet boundaries.  In case of
   a Very Small Organization with only a few hosts, assigning a full
   24-bit prefix (what has traditionally been referred to as a ``class C
   network number'') often leads to inefficient address space
   utilization.

   One of the problems encountered when assigning a longer prefix (less
   address space) is that it seems impossible for such an organization
   to maintain its own reverse (``IN-ADDR.ARPA'') zone autonomously.  By
   use of the reverse delegation method described below, the most
   important objection to assignment of longer prefixes to unrelated
   organizations can be removed.

   Let us assume we have assigned the address spaces to three different
   parties as follows:

        192.0.2.0/25   to organization A
        192.0.2.128/26 to organization B
        192.0.2.192/26 to organization C

   In the classical approach, this would lead to a single zone like
   this:

   $ORIGIN 2.0.192.in-addr.arpa.
   ;
   1         PTR  host1.A.domain.
   2         PTR  host2.A.domain.
   3         PTR  host3.A.domain.
   ;
   129       PTR  host1.B.domain.
   130       PTR  host2.B.domain.
   131       PTR  host3.B.domain.
   ;
   193       PTR  host1.C.domain.
   194       PTR  host2.C.domain.
   195       PTR  host3.C.domain.

   The administration of this zone is problematic.  Authority for this
   zone can only be delegated once, and this usually translates into
   ``this zone can only be administered by one organization.''  The
   other organizations with address space that corresponds to entries in
   this zone would thus have to depend on another organization for their
   address to name translation.  With the proposed method, this
   potential problem can be avoided.




Eidnes, de Groot, Vixie      Expires 970525                     [Page 2]


INTERNET-DRAFT      Classless IN-ADDR.ARPA delegation      November 1996


4. Classless IN-ADDR.ARPA delegation

   Since a single zone can only be delegated once we need more points to
   do delegation on to solve the problem above.  These extra points of
   delegation can be introduced by extending the IN-ADDR.ARPA tree
   downwards, e.g. by using the first address or the first address and
   the network mask length (as shown below) in the corresponding address
   space to form the the first component in the name for the zones.  For
   the problem described in the motivation section, the corresponding
   four zone files would look something like this (here shown also with
   network masks and network names in the form specified in [2] as
   well):

   $ORIGIN 2.0.192.in-addr.arpa.
   @    IN   SOA  my-ns.my.domain. hostmaster.my.domain. ( ... )
   ;...
   ;  <<0-127>> /25
   0/25      NS   ns.A.domain.
   0/25      NS   some.other.name.server.
   ;
   1         CNAME     1.0/25.2.0.192.in-addr.arpa.
   2         CNAME     2.0/25.2.0.192.in-addr.arpa.
   3         CNAME     3.0/25.2.0.192.in-addr.arpa.
   ;
   ;  <<128-191>> /26
   128/26         NS   ns.B.domain.
   128/26         NS   some.other.name.server.too.
   ;
   129       CNAME     129.128/26.2.0.192.in-addr.arpa.
   130       CNAME     130.128/26.2.0.192.in-addr.arpa.
   131       CNAME     131.128/26.2.0.192.in-addr.arpa.
   ;
   ;  <<192-255>> /26
   192/26         NS   ns.C.domain.
   192/26         NS   some.other.third.name.server.
   ;
   193       CNAME     193.192/26.2.0.192.in-addr.arpa.
   194       CNAME     194.192/26.2.0.192.in-addr.arpa.
   195       CNAME     195.192/26.2.0.192.in-addr.arpa.












Eidnes, de Groot, Vixie      Expires 970525                     [Page 3]


INTERNET-DRAFT      Classless IN-ADDR.ARPA delegation      November 1996


   $ORIGIN 0/25.2.0.192.in-addr.arpa.
   @    IN   SOA  ns.A.domain. hostmaster.A.domain. ( ... )
   @         NS   ns.A.domain.
   @         NS   some.other.name.server.
   @         PTR  networkname.A.domain.
   @         A    255.255.255.128
   ;
   1         PTR  host1.A.domain.
   2         PTR  host2.A.domain.
   3         PTR  host3.A.domain.


   $ORIGIN 128/26.2.0.192.in-addr.arpa.
   @    IN   SOA  ns.B.domain. hostmaster.B.domain. ( ... )
   @         NS   ns.B.domain.
   @         NS   some.other.name.server.too.
   @         PTR  networkname.B.domain.
   @         A    255.255.255.192
   ;
   129       PTR  host1.B.domain.
   130       PTR  host2.B.domain.
   131       PTR  host3.B.domain.


   $ORIGIN 192/26.2.0.192.in-addr.arpa.
   @    IN   SOA  ns.C.domain. hostmaster.C.domain. ( ... )
   @         NS   ns.C.domain.
   @         NS   some.other.third.name.server.
   @         PTR  networkname.C.domain.
   @         A    255.255.255.192
   ;
   193       PTR  host1.C.domain.
   194       PTR  host2.C.domain.
   195       PTR  host3.C.domain.

   Note that the use of network masks and network names as specified in
   [2] is optional, but is strongly recommended.

   This approach to splitting up the responsibility for maintaining the
   IN-ADDR.ARPA mappings makes it necessary to install approximately 256
   CNAME records in the parent zone more or less permanently for each
   size-256 chunk split up this way.  Some people might view this as
   ugly; we will not argue that particular point.  It is however quite
   easy to automatically generate the CNAME resource records in the
   parent zone once and for all, if the way the address space is
   partitioned is known.





Eidnes, de Groot, Vixie      Expires 970525                     [Page 4]


INTERNET-DRAFT      Classless IN-ADDR.ARPA delegation      November 1996


   The advantage of this approach over the other proposed approaches for
   dealing with this problem is that there should be no need to modify
   any already-deployed software.  In particular, the lookup mechanism
   in the DNS does not have to be modified to accommodate this splitting
   of the responsibility for the IPv4 address to name translation on
   ``non-dot'' boundaries.  Furthermore, this technique has been in use
   for several years in at least one installation, apparently with no
   ill effects.

   As usual, a resource record like

   $ORIGIN   2.0.192.in-addr.arpa.
   129       CNAME     129.128/26.2.0.192.in-addr.arpa.

   can be convienently abbreviated to

   $ORIGIN   2.0.192.in-addr.arpa.
   129       CNAME     129.128/26.2

   Note also that it is legal to use slash ('/') in the name of the
   resource record (1.0/25.2.0.192.IN-ADDR.ARPA) because these are not
   host names; hence the restriction of [3] does not apply here.

5. Operational considerations

5.1 Recommended secondary name service

   Some older versions of name server software will make no effort to
   find and return the pointed-to name in CNAME records if the pointed-
   to name is not already known locally as cached or as authoritative
   data.  This can cause some confusion in resolvers, as only the CNAME
   record will be returned in the response.  To avoid this problem it is
   recommended that the authoritative name servers for the delegating
   zone (the zone containing all the CNAME records) all run as slave
   (secondary) name servers for the ``child'' zones delegated and
   pointed into via the CNAME records.

5.2 Alternative naming conventions

   As a result of this method, the location of the zone containing the
   actual PTR records is no longer predefined.  This gives flexibility
   and some examples will be presented here.

   An obvious alternative to using the first address or the first
   address and the network mask length in the corresponding address
   space to name the new zones is simply to use some other (non-numeric)
   name.  It is of course also possible to point to an entirely
   different part of the DNS tree (e.g. outside of the IN-ADDR.ARPA



Eidnes, de Groot, Vixie      Expires 970525                     [Page 5]


INTERNET-DRAFT      Classless IN-ADDR.ARPA delegation      November 1996


   tree).  It would be necessary to use one of these alternate methods
   if two organizations somehow shared the same physical subnet (and
   corresponding IP address space) with no "neat" alignment of the
   addresses, but still wanted to administrate their own IN-ADDR.ARPA
   mappings.

   The following short example shows how you can point out of the IN-
   ADDR.ARPA tree:

   $ORIGIN 2.0.192.in-addr.arpa.
   @    IN   SOA  my-ns.my.domain. hostmaster.my.domain. ( ... )
   ; ...
   1         CNAME     1.A.domain.
   2         CNAME     2.A.domain.
   ; ...
   129       CNAME     129.B.domain.
   130       CNAME     130.B.domain.
   ;


   $ORIGIN A.domain.
   @    IN   SOA  my-ns.A.domain. hostmaster.A.domain. ( ... )
   ; ...
   ;
   host1          A    192.0.2.1
   1         PTR  host1
   ;
   host2          A    192.0.2.2
   2         PTR  host2
   ;

   etc.

   Done this way you can actually end up with the name->address and the
   (pointed-to) address->name mapping data in the same zone file -- some
   may view this as an added bonus as no separate set of secondaries for
   the reverse zone is required.  Do however note that the traversal via
   the IN-ADDR.ARPA tree will still be done, so the CNAME records
   inserted there need to point in the right direction for this to work.

   An approach as sketched below is an alternative approach using the
   same solution:









Eidnes, de Groot, Vixie      Expires 970525                     [Page 6]


INTERNET-DRAFT      Classless IN-ADDR.ARPA delegation      November 1996


   $ORIGIN 2.0.192.in-addr.arpa.
   @         IN   SOA  my-ns.my.domain. hostmaster.my.domain. ( ... )
   ; ...
   1              CNAME     1.2.0.192.in-addr.A.domain.
   2              CNAME     2.2.0.192.in-addr.A.domain.

   $ORIGIN A.domain.
   @         IN   SOA  my-ns.A.domain. hostmaster.A.domain. ( ... )
   ; ...
   ;
   host1               A    192.0.2.1
   1.2.0.192.in-addr   PTR  host1
   host2               A    192.0.2.2
   2.2.0.192.in-addr   PTR  host2

   It is clear that many possibilities exist which can be adapted to the
   specific requirements of the situation at hand.

5.3 Other operational issues

   Note that one cannot provide CNAME referrals twice for the same
   address space, i.e. you cannot allocate a /25 prefix to one
   organisation, and run IN-ADDR.ARPA this way, and then have the
   organisation subnet the /25 into longer prefixes, and attempt to
   employ the same technique to give each subnet control of its own
   number space. This would result in a CNAME record pointing to a CNAME
   record, which may be less robust overall.

   Unfortunately, some old beta releases of the popular DNS name server
   implementation BIND 4.9.3 had a bug which caused problems if a CNAME
   record was encountered when a reverse lookup was made.  The beta
   releases involved have since been obsoleted, and this issue is
   resolved in the released code.  Some software manufacturers have
   included the defective beta code in their product. In the few cases
   we know of, patches from the manufacturers are available or planned
   to replace the obsolete beta code involved.

6. Security Considerations

   Security considerations are not discussed in this memo.

7. Conclusion

   The suggested scheme gives more flexibility in delegating authority
   in the IN-ADDR.ARPA domain, thus making it possible to assign address
   space more efficiently without losing the ability to delegate the DNS
   authority over the corresponding address to name mappings.




Eidnes, de Groot, Vixie      Expires 970525                     [Page 7]


INTERNET-DRAFT      Classless IN-ADDR.ARPA delegation      November 1996


8. Acknowledgments

   Glen A. Herrmannsfeldt described this trick on comp.protocols.tcp-
   ip.domains some time ago.  Alan Barrett and Sam Wilson provided
   valuable comments on the newsgroup.

   We would like to thank Rob Austein, Randy Bush, Matt Crawford, Glen
   A. Herrmannsfeldt, Daniel Karrenberg, David Kessens, Tony Li, Paul
   Mockapetris, Eric Wassenaar, Michael Patton, and Peter Koch for their
   review and constructive comments.

9. References

[1]  P. Mockapetris, ``Domain Names - Concepts and Facilities'',
     RFC1034, ISI, November 1987.

[2]  P. Mockapetris, ``DNS Encoding of Network Names and Other Types'',
     RFC1101, ISI, April 1989.

[3]  K. Harrenstien, M. Stahl, E. Feinler, ``DoD Internet Host Table
     Specification'', RFC952, SRI, October 1985.






























Eidnes, de Groot, Vixie      Expires 970525                     [Page 8]


INTERNET-DRAFT      Classless IN-ADDR.ARPA delegation      November 1996


   10. Author's Addresses

   Havard Eidnes
   SINTEF RUNIT
   N-7034 Trondheim
   Norway

   Phone: +47 73 59 44 68
   Fax: +47 73 59 17 00

   Email: Havard.Eidnes@runit.sintef.no


   Geert Jan de Groot
   RIPE Network Coordination Centre
   Kruislaan 409
   1098 SJ Amsterdam
   the Netherlands

   Phone: +31 20 592 5065
   Fax: +31 20 592 5090

   Email: GeertJan.deGroot@ripe.net


   Paul Vixie
   Internet Software Consortium
   Star Route Box 159A
   Woodside, CA 94062
   USA

   Phone: +1 415 747 0204

   Email: paul@vix.com

















Eidnes, de Groot, Vixie      Expires 970525                     [Page 9]


Html markup produced by rfcmarkup 1.129c, available from https://tools.ietf.org/tools/rfcmarkup/