Domain Name System Operations Sonoda, Ed. Internet-Draft Internet Initiative Japan Inc. Intended status: Informational Mar 23, 2018 Expires: September 24, 2018 DNS load balancing draft-sonoda-dnsop-dnslb-02 Abstract This document defines a new DNS load balance function that is able to transfer information in zone transfer and not need online signing. DNS base load balance is popular technology. It provides weight base response and location base response. It have become an indispensable part of traffic engineering. However, DNS base load balance can't transfer load balance information in zone transfer and need online singing because it is not standardized. This document defines a new DNS resource record called "LB" and new EDNS option bit called "LS". LB RR provides the balancing information weight, location and target domain name. LS bit provides the change response mechanism in name servers. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on September 24, 2018. Copyright Notice Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of Sonoda Expires September 24, 2018 [Page 1] Internet-Draft Abbreviated Title Mar 2018 publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. 1. Introduction 1.1. Legacy DNS load balancing Legacy DNS load balancing provides traffic engineering.It use special authoritative name server. It response is one address record that is dynamic changes using network location and weight. It's used for large traffic WEB site domain name that is important domain name. Important domain name should be secure. But legacy DNS load balancing is not secure. Because Legacy DNS load balancing can't send zone data by zone transfer. It's mean very difficult to use multi service providers. That means weak for DDoS Attack. If zone is signed, All name servers require private key for dynamic signing because response is dynamic changes. Distributing private key is not secure, It is increased risk of leakage private key. 1.2. New DNS load balancing New DNS load balancing concept is that Authoritative name server uses "LB" RR to provide load balancing and Full resolver use "LB" RR to select target name and respond with the target name. "LB" RR defines load balancing settings that is network location and weight and target domain name. Network location is string that meaningful name of network. For example Country code (ex. JP),subdivision code(ex. US-CA) and Autonomous System Number (ex. AS65536). Full resolver use resolver configuration to select network location and refine "LB" RRs. Weight is integer value. Full resolver use weight ratio to select target name. Target name is pointer to address record. It is same "ANAME" [I-D.ietf-dnsop-aname]. 2. Mechanism 1. Stub resolver sends A or AAAA query to full resolver. 2. Full Resolver sends A or AAAA query with LS bit to authoritative server. Sonoda Expires September 24, 2018 [Page 2] Internet-Draft Abbreviated Title Mar 2018 3. Authoritative Server responses LB RRset. 4. Full Resolver selects target domain name using location and weight. 5. Full Resolver resolv target domain name. 6. Full Resolver response target domain name and LB RRSet to stub resolver. 3. The LB Resource Record The LB RR has mnemonic LB. LB RR define load balancing information. LB format below. LB The format is not class-sensitive. All fields are required. field is a 2 octets, 1 or more natural number. field is a "" [RFC1035]. field is a "" [RFC1035]. It has A or AAAA RR or CNAME RR or DNAME RR. 3.1. Define location ::= "*" | | | | | ::= "AF" | "NA" | "AS" | "EU" | "NA" | "OC" | "SA" ::= ISO 3166-1 alpha-2 Country code. ::= ISO 3166-2 Codes for the representation of names of countries and their subdivisions. ::= "AS" [ ":" ] ::= "+" ::= ::= any one of the ten digits 1 through 9 ::= any one of the ten digits 0 through 9 Sonoda Expires September 24, 2018 [Page 3] Internet-Draft Abbreviated Title Mar 2018 ::= any one of the 26 alphabetic characters A through Z in upper case or any one of the ten digits 0 through 9. 3.2. Record example example.jp. 3600 IN LB 1 * www.example.com. ; for any region example.jp. 3600 IN LB 1 AS as.example.com. ; for ASIA region example.jp. 3600 IN LB 1 JP jp1.example.jp. ; for JP region, weight 1 example.jp. 3600 IN LB 3 JP jp2.example.jp. ; for JP region, weight 3 example.jp. 3600 IN LB 1 JP-13 tokyo.example.jp. ; for tokyo region example.jp. 3600 IN LB 1 AS2496 as65536.example.jp. ; for AS65536 example.jp. 3600 IN LB 1 AS2496:1 as65536.example.jp. ; for AS65536 example.jp. 3600 IN LB 1 +BEER beer.example.jp. ; private use 4. The LB Support Flag Defines a new "EDNS Header Flags" [RFC6891] call LB Support Flag(LS) using full resolver sends LB RR supported to authoritative server. LS bit provides change response mechanism in authoritative name server. If LS bit is flagged, Authoritative name server can response LB RR for A,AAAA query. 5. Authoritative name server Behavior When authoritative name server receives a query of type A or AAAA with LS bit and LB record is present at a SNAME, The authoritative server returns the LB RRSet in the answer section with LS bit. 5.1. Example of authoritative name server behavior Example zone data: example.jp. 3600 IN SOA ( ns1.example.com. postmaster.example.com. 1 3600 900 1814400 900 ) example.jp. 3600 IN NS ns1.example.com. example.jp. 3600 IN NS ns2.example.com. example.jp. 3600 IN A 198.51.100.1 example.jp. 3600 IN LB 1 * www.example.com. example.jp. 3600 IN LB 1 JP jp1.example.com. example.jp. 3600 IN LB 3 JP jp2.example.com. Incoming query with LS bit: Sonoda Expires September 24, 2018 [Page 4] Internet-Draft Abbreviated Title Mar 2018 query: qtype = example.jp. qtype=A, LS=1 Response for include LS: query: qtype = example.jp. qtype=A response: LS=1 answer: example.jp. 3600 IN LB 1 * www.example.com. example.jp. 3600 IN LB 1 JP jp1.example.com. example.jp. 3600 IN LB 3 JP jp2.example.com. authority: example.jp. 3600 IN NS ns1.example.com. example.jp. 3600 IN NS ns2.example.com. Incoming query without LS bit (normal query): query: qtype = example.jp. qtype=A, LS=0 Response for not include LS: query: qtype = example.jp. qtype=A response: LS=0 answer: example.jp. 3600 IN A 198.51.100.1 authority: example.jp. 3600 IN NS ns1.example.com. example.jp. 3600 IN NS ns2.example.com. 6. Full Service Resolver Behavior When a full resolver sends a query of type A or AAAA with LS bit and receives a response with a LB RRset in the answer section with LS bit, Full resolver MUST re-resolv the either LB of type "STYPE" [RFC1034]. be selected by and . 6.1. Location selection Location selection needs full resolver or stub resolver location information. Full resolver location information with priority value SHOULD gets from config file. Full resolver MUST setting '*' location with lowest priority. Full resolver select location that match either LB RR and highest priority resolver location. if all LB RRs don't match all resolver locations, resolver selects a location randomly. Sonoda Expires September 24, 2018 [Page 5] Internet-Draft Abbreviated Title Mar 2018 6.2. Weight selection Full resolver selects using from LB RR whose location matches. 6.3. Example 1. Full resolver location is configured "JP-13" "JP" "AS" "*". 2. Stub resolver query coming: query: qtype = example.jp. qtype=A 3. Full resolver send query: query: qtype = example.jp. qtype=A, LS=1 3. If response include LB: query: qtype = example.jp. qtype=A response: LS=1 answer: example.jp. 3600 IN LB 1 * www.example.com. example.jp. 3600 IN LB 1 JP jp1.example.com. example.jp. 3600 IN LB 3 JP jp2.example.com. authority: example.jp. 3600 IN NS ns1.example.com. example.jp. 3600 IN NS ns2.example.com. 4. select LB RR that's location include resolver location example.jp. 3600 IN LB 1 JP jp1.example.com. example.jp. 3600 IN LB 3 JP jp2.example.com. 5. Select one LB RR using : example.jp. 3600 IN LB 3 JP jp2.example.com. 5. Name resolution : query: qtype = jp2.example.com. qtype=A, LS=1 response: answer: jp2.example.com. 3600 IN A 192.0.2.2 authority: example.com. 3600 IN NS ns1.example.com. example.com. 3600 IN NS ns2.example.com. Sonoda Expires September 24, 2018 [Page 6] Internet-Draft Abbreviated Title Mar 2018 6. Make response message: query: qtype = example.jp. qtype=A, LS=1 response: answer: example.jp. 3600 IN LB 1 * www.example.com. example.jp. 3600 IN LB 1 JP jp1.example.com. example.jp. 3600 IN LB 3 JP jp2.example.com. jp2.example.com. 3600 IN A 192.0.2.2 authority: example.jp. 3600 IN NS ns1.example.com. example.jp. 3600 IN NS ns2.example.com. 7. Stub resolver uses 192.0.2.2 7. Implementation Status Proof of concept patches for NSD, KnotDNS and Drill that in github(https://github.com/mimuret/draft-sonoda-dnsop-lb-rr) 8. IANA Considerations IANA is requested to assign a DNS RR data type value for the LB RR type under the "Resource Record (RR) TYPEs" sub-registry and a EDNS Header Flag value for the LB Support Flag under the "EDNS Header Flags (16 bits)" sub-registry under the "Domain Name System (DNS) Parameters" registry. 9. Security Considerations Both authoritative server and resolvers that implement LB SHOUD carefully check for loops. 10. Normative References [I-D.ietf-dnsop-aname] Hunt, E., Dijk, P., and A. Eden, "Address-specific DNS Name Redirection (ANAME)", draft-ietf-dnsop-aname-01 (work in progress), January 2018. [RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987, . [RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, November 1987, . Sonoda Expires September 24, 2018 [Page 7] Internet-Draft Abbreviated Title Mar 2018 [RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms for DNS (EDNS(0))", STD 75, RFC 6891, DOI 10.17487/RFC6891, April 2013, . Author's Address Manabu Sonoda (editor) Internet Initiative Japan Inc. Email: manabu-s@iij.ad.jp Sonoda Expires September 24, 2018 [Page 8]