Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4532 > unrolled thread

non-autoritative localhost, 1..12 sacle, how bad is it?

Back to article view | Back to comp.os.linux.networking

Contents

  non-autoritative localhost, 1..12 sacle, how bad is it? Eric Pozharski <whynot@pozharski.name> - 2020-05-01 00:03 +0300
    Re: non-autoritative localhost, 1..12 sacle, how bad is it? Grant Taylor <gtaylor@tnetconsulting.net> - 2020-04-30 21:54 -0600
      Re: non-autoritative localhost, 1..12 sacle, how bad is it? Eric Pozharski <whynot@pozharski.name> - 2020-05-02 20:02 +0300
        Re: non-autoritative localhost, 1..12 sacle, how bad is it? Grant Taylor <gtaylor@tnetconsulting.net> - 2020-05-03 11:35 -0600
    Re: non-autoritative localhost, 1..12 sacle, how bad is it? Johann Beretta <beretta@nun-ya-bizness.com> - 2020-05-01 10:59 -0700
      Re: non-autoritative localhost, 1..12 sacle, how bad is it? Eric Pozharski <whynot@pozharski.name> - 2020-05-02 20:33 +0300
        Re: non-autoritative localhost, 1..12 sacle, how bad is it? Johann Beretta <beretta@nun-ya-bizness.com> - 2020-05-02 22:00 -0700
          Re: non-autoritative localhost, 1..12 sacle, how bad is it? harri@kallio.tunk.org (Harri) - 2020-05-03 12:11 +0300
            Re: non-autoritative localhost, 1..12 sacle, how bad is it? Johann Beretta <beretta@nun-ya-bizness.com> - 2020-05-04 20:46 -0700
          Re: non-autoritative localhost, 1..12 sacle, how bad is it? Eric Pozharski <whynot@pozharski.name> - 2020-05-03 16:53 +0300
            Re: non-autoritative localhost, 1..12 sacle, how bad is it? Johann Beretta <beretta@nun-ya-bizness.com> - 2020-05-04 20:50 -0700
              Re: non-autoritative localhost, 1..12 sacle, how bad is it? Eric Pozharski <whynot@pozharski.name> - 2020-05-06 18:15 +0300
    Re: non-autoritative localhost, 1..12 sacle, how bad is it? "Carlos E.R." <robin_listas@es.invalid> - 2020-05-01 23:19 +0200
      Re: non-autoritative localhost, 1..12 sacle, how bad is it? Eric Pozharski <whynot@pozharski.name> - 2020-05-02 20:10 +0300
        Re: non-autoritative localhost, 1..12 sacle, how bad is it? "Carlos E.R." <robin_listas@es.invalid> - 2020-05-03 15:21 +0200
          Re: non-autoritative localhost, 1..12 sacle, how bad is it? Eric Pozharski <whynot@pozharski.name> - 2020-05-04 18:17 +0300
        Re: non-autoritative localhost, 1..12 sacle, how bad is it? "Carlos E.R." <robin_listas@es.invalid> - 2020-05-03 15:34 +0200
    Re: non-autoritative localhost, 1..12 sacle, how bad is it? Eric Pozharski <whynot@pozharski.name> - 2020-05-04 18:14 +0300

#4532 — non-autoritative localhost, 1..12 sacle, how bad is it?

Context (because should give a chance to turn this in something utterly
unralated):  slackware-current;  pdns-recursor (built from SBo, 4.1.13,
might be important, almost master seems to be 4.3.0);  for reasons
important for myself only going with zone-files.

First step:  setting up localhost.  Readings:

23:22:20 162 [0:0] dig @127.0.0.1 localhost

; <<>> DiG 9.16.1 <<>> @127.0.0.1 localhost
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44337
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;localhost.                     IN      A

;; ANSWER SECTION:
localhost.              86400   IN      A       127.0.0.1

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Apr 30 23:22:36 UTC 2020
;; MSG SIZE  rcvd: 54

As you can see, answer is non-autoritative.  (Switching 'auth-zones' off
and 'export-etc-hosts' on -- dead end, just in case;  didn't reach to a
web-interface yet;  Summary:  I have options.)

('1' is run-away-screaming and '12' is 'not-giving-slightest-fsck')
$Subject

--
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom

[toc] | [next] | [standalone]

#4533

On 4/30/20 3:03 PM, Eric Pozharski wrote:
> ('1' is run-away-screaming and '12' is 'not-giving-slightest-fsck')
> $Subject

Without a specific reason to care, I'd say 11±1.

Presuming that there is a specific reason that you didn't share, 9±1.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4537

with <r8g6j1$j4v$1@tncsrv09.home.tnetconsulting.net> Grant Taylor wrote:
> On 4/30/20 3:03 PM, Eric Pozharski wrote:
>> ('1' is run-away-screaming and '12' is 'not-giving-slightest-fsck')
>> $Subject
> Without a specific reason to care, I'd say 11±1.  Presuming that there
> is a specific reason that you didn't share, 9±1.

Well, The Ultimate Goal is to manage multiple dynamic outward interfaces
while keeping 'hosts' and 'resolv.conf' static.  I understand that
localhost (aka loopback) is neither dynamic nor multiple, and making it
authoritatively resolvable is somewhat academic.  Still, from purity and
training viewpoint such desire seems to be kinda reasonable.

-- 
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom

[toc] | [prev] | [next] | [standalone]

#4544

On 5/2/20 11:02 AM, Eric Pozharski wrote:
> Well, The Ultimate Goal is to manage multiple dynamic outward 
> interfaces while keeping 'hosts' and 'resolv.conf' static.

That should be entirely possible to do.

> I understand that localhost (aka loopback) is neither dynamic nor 
> multiple, and making it authoritatively resolvable is somewhat 
> academic.

"localhost", or more precisely, the loopback interface, is not dynamic 
in the sense of DHCP (or BOOTP).  -  I think it would be an interesting 
academic exercise to try to do that.  I suspect that there is a way to 
do it.

The "authoritative"ness is related to if the dns server in question is 
authoritative for a given zone or not.  It's trivial to add a local name 
server and make it authoritative for the zone(s) in question.

> Still, from purity and training viewpoint such desire seems to be 
> kinda reasonable.

Meh.  I don't think it's worth the effort to do so.  I do think that 
it's entirely possible to do so.  (See above.)



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4534

On 4/30/20 2:03 PM, Eric Pozharski wrote:

> 
> As you can see, answer is non-autoritative.  (Switching 'auth-zones' off
> and 'export-etc-hosts' on -- dead end, just in case;  didn't reach to a
> web-interface yet;  Summary:  I have options.)
> 

Of course it is non-authoritative. You are not the official designee for 
rDNS on the 127.0.0.0 block. You _can_ do  rDNS on your own system, but 
that is only valid locally.

I've got a class C block assigned to me via ARIN, when I do an rDNS 
lookup on that block, it is authoritative. The records, all the way 
down, end up at me.

[toc] | [prev] | [next] | [standalone]

#4538

with <r8ho17$8ki$1@dont-email.me> Johann Beretta wrote:
> On 4/30/20 2:03 PM, Eric Pozharski wrote:

>> As you can see, answer is non-autoritative.  (Switching 'auth-zones'
>> off and 'export-etc-hosts' on -- dead end, just in case;  didn't
>> reach to a web-interface yet;  Summary:  I have options.)
> Of course it is non-authoritative. You are not the official designee
> for rDNS on the 127.0.0.0 block. You _can_ do  rDNS on your own
> system, but that is only valid locally.

Yes, and it's intended behaviour.  BTW, in defense of this abomination
'whois localhost' (and 'whois localhost.' too) refuses lookup at all.
'whois 127.0.0.1' doesn't serve anything reasonable either.  So I figure
'localhost' is kindof free for grabs.

*CUT*

-- 
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom

[toc] | [prev] | [next] | [standalone]

#4539

On 5/2/20 10:33 AM, Eric Pozharski wrote:

> 
> Yes, and it's intended behaviour.  BTW, in defense of this abomination
> 'whois localhost' (and 'whois localhost.' too) refuses lookup at all.
> 'whois 127.0.0.1' doesn't serve anything reasonable either.  So I figure
> 'localhost' is kindof free for grabs.
> 
> *CUT*
> 

Yes. Per RFC 2006, there are 4 reserved top level domains and 3 reserved 
second level domains. Those 7 domains are excluded from the DNS root 
servers. They can be assigned locally to resources but they will not 
resolve across the DNS system.

.test
.example
.invalid
.localhost

are the 4 top-level and

example.com
example.net
example.org

are the three second level domains.

There may be others that were designated after RFC 2006, but that RFC 
covers localhost and that's what we're talking about at the moment.

[toc] | [prev] | [next] | [standalone]

#4540

Johann Beretta <beretta@nun-ya-bizness.com> wrote:
> Yes. Per RFC 2006, there are 4 reserved top level domains and 3 reserved 

It is actually RFC 2606.  <https://tools.ietf.org/html/rfc2606>
-- 


      Harri

[toc] | [prev] | [next] | [standalone]

#4547

On 5/3/20 2:11 AM, Harri wrote:
> Johann Beretta <beretta@nun-ya-bizness.com> wrote:
>> Yes. Per RFC 2006, there are 4 reserved top level domains and 3 reserved
> 
> It is actually RFC 2606.  <https://tools.ietf.org/html/rfc2606>
> 

You are correct. 2006 was a typo.

[toc] | [prev] | [next] | [standalone]

#4543

with <r8lj5k$ia3$1@dont-email.me> Johann Beretta wrote:
> On 5/2/20 10:33 AM, Eric Pozharski wrote:


>> Yes, and it's intended behaviour.  BTW, in defense of this
>> abomination 'whois localhost' (and 'whois localhost.' too) refuses
>> lookup at all.  'whois 127.0.0.1' doesn't serve anything reasonable
>> either.  So I figure 'localhost' is kindof free for grabs.
> Yes. Per RFC 2006,

Nope.  RFC2006 is "The Definitions of Managed Objects for IP Mobility
Support using SMIv2".

> there are 4 reserved top level domains and 3 reserved second level
> domains. Those 7 domains are excluded from the DNS root servers. They
> can be assigned locally to resources but they will not resolve across
> the DNS system.
*SKIP*

You are talking about RFC2606 "Reserved Top Level DNS Names".  No,
neither resolving nor serving across the fence was ever a point of this
endeavour.

Also, RFC6761 "Special-Use Domain Names" -- is worth reading.  Just
spotted this gem (in support of The Endeavour)

	5.  Authoritative DNS servers SHOULD recognize these names as
	special and SHOULD, by default, generate immediate negative
	responses for all such queries, unless explicitly configured by
	the administrator to give positive answers for private-address
	reverse-mapping names.

Also, doesn't mention 127.in-addr.arpa. .  Quality?

> example.com example.net example.org are the three second level
> domains.

Totally resolvable.  IP is 199.43.135.53 .

*CUT*

-- 
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom

[toc] | [prev] | [next] | [standalone]

#4548

On 5/3/20 6:53 AM, Eric Pozharski wrote:
<snip>
> 
> Nope.  RFC2006 is "The Definitions of Managed Objects for IP Mobility
> Support using SMIv2".

Yeah. It was a typo. I mean 2606


<snip>
> 
>> example.com example.net example.org are the three second level
>> domains.
> 
> Totally resolvable.  IP is 199.43.135.53 .
> 
> *CUT*
> 

Apparently not to the same IP since I get:

Name:	example.com
Address: 93.184.216.34

Same IP address for .net and .org

And as CLEARLY stated, they are not supposed to resolved across the DNS 
system.

 > there are 4 reserved top level domains and 3 reserved second level
 > domains. Those 7 domains are excluded from the DNS root servers. They
 > can be assigned locally to resources but they will not resolve across
 > the DNS system.

[toc] | [prev] | [next] | [standalone]

#4549

with <r8qnqs$ork$1@dont-email.me> Johann Beretta wrote:
> On 5/3/20 6:53 AM, Eric Pozharski wrote:

*SKIP*
>>> example.com example.net example.org are the three second level
>>> domains.
>> Totally resolvable.  IP is 199.43.135.53 .
> Apparently not to the same IP since I get:
> Name:	example.com Address: 93.184.216.34
> Same IP address for .net and .org

That's normal.

> And as CLEARLY stated, they are not supposed to resolved across the
> DNS system.
>> there are 4 reserved top level domains and 3 reserved second level
>> domains. Those 7 domains are excluded from the DNS root servers.
>> They can be assigned locally to resources but they will not resolve
>> across the DNS system.

RFC6761, section 6.5 "Domain Name Reservation Considerations for Example
Domains" disagrees.  Also, there's more than just DNS.

{8086:14} [0:0]% curl -s https://example.com | head 
<!doctype html>
<html>
<head>
    <title>Example Domain</title>

    <meta charset="utf-8" />
    <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <style type="text/css">
    body {


-- 
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom

[toc] | [prev] | [next] | [standalone]

#4535

On 30/04/2020 23.03, Eric Pozharski wrote:
> Context (because should give a chance to turn this in something utterly
> unralated):  slackware-current;  pdns-recursor (built from SBo, 4.1.13,
> might be important, almost master seems to be 4.3.0);  for reasons
> important for myself only going with zone-files.
> 
> First step:  setting up localhost.  Readings:
> 
> 23:22:20 162 [0:0] dig @127.0.0.1 localhost
> 
> ; <<>> DiG 9.16.1 <<>> @127.0.0.1 localhost
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44337
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ;; QUESTION SECTION:
> ;localhost.                     IN      A
> 
> ;; ANSWER SECTION:
> localhost.              86400   IN      A       127.0.0.1
> 
> ;; Query time: 1 msec
> ;; SERVER: 127.0.0.1#53(127.0.0.1)
> ;; WHEN: Thu Apr 30 23:22:36 UTC 2020
> ;; MSG SIZE  rcvd: 54
> 
> As you can see, answer is non-autoritative.  (Switching 'auth-zones' off
> and 'export-etc-hosts' on -- dead end, just in case;  didn't reach to a
> web-interface yet;  Summary:  I have options.)

cer@Telcontar:~> dig @127.0.0.1 localhost

; <<>> DiG 9.11.2 <<>> @127.0.0.1 localhost
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46444
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 2b8f7eb5f9a06c8d044184135eac91664fe90669143f5c9f (good)
;; QUESTION SECTION:
;localhost.			IN	A

;; ANSWER SECTION:
localhost.		86400	IN	A	127.0.0.1

;; AUTHORITY SECTION:
localhost.		86400	IN	NS	nimrodel.valinor.

;; ADDITIONAL SECTION:
nimrodel.valinor.	86400	IN	A	192.168.1.12

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri May 01 23:15:18 CEST 2020
;; MSG SIZE  rcvd: 128

cer@Telcontar:~> 


However, there is an error, it should be telcontar, not nimrodel. I just noticed.


-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#4536

with <3cgung-kfm.ln1@Telcontar.valinor> Carlos E.R. wrote:
> On 30/04/2020 23.03, Eric Pozharski wrote:
*SKIP*
> cer@Telcontar:~> dig @127.0.0.1 localhost
*SKIP*
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
*SKIP*
> localhost.		86400	IN	NS	nimrodel.valinor.
*SKIP*
> However, there is an error, it should be telcontar, not nimrodel. I
> just noticed.

Same output here (on a system I'm posting from, it's dying anyway).
Except there's no nameserver on localhost thus it's expected.  BTW, just
in case I'll need more options, what specific software is running on
nimrodel?

-- 
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom

[toc] | [prev] | [next] | [standalone]

#4541

On 02/05/2020 19.10, Eric Pozharski wrote:
> with <3cgung-kfm.ln1@Telcontar.valinor> Carlos E.R. wrote:
>> On 30/04/2020 23.03, Eric Pozharski wrote:
> *SKIP*
>> cer@Telcontar:~> dig @127.0.0.1 localhost
> *SKIP*
>> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
> *SKIP*
>> localhost.		86400	IN	NS	nimrodel.valinor.
> *SKIP*
>> However, there is an error, it should be telcontar, not nimrodel. I
>> just noticed.
> 
> Same output here (on a system I'm posting from, it's dying anyway).
> Except there's no nameserver on localhost thus it's expected.  BTW, just
> in case I'll need more options, what specific software is running on
> nimrodel?
> 

openSUSE 15.1

cer@Telcontar:~> rpm -qf /usr/sbin/named
bind-9.11.2-lp151.11.6.1.x86_64
cer@Telcontar:~>


-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#4546

with <g3t2og-rvu.ln1@Telcontar.valinor> Carlos E.R. wrote:
> On 02/05/2020 19.10, Eric Pozharski wrote:
>> with <3cgung-kfm.ln1@Telcontar.valinor> Carlos E.R. wrote:
>>> On 30/04/2020 23.03, Eric Pozharski wrote:

*SKIP*
> bind-9.11.2-lp151.11.6.1.x86_64

Well, this would be too much horse-power for me.

-- 
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom

[toc] | [prev] | [next] | [standalone]

#4542

On 02/05/2020 19.10, Eric Pozharski wrote:
> with <3cgung-kfm.ln1@Telcontar.valinor> Carlos E.R. wrote:
>> On 30/04/2020 23.03, Eric Pozharski wrote:
> *SKIP*
>> cer@Telcontar:~> dig @127.0.0.1 localhost
> *SKIP*
>> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
> *SKIP*
>> localhost.		86400	IN	NS	nimrodel.valinor.
> *SKIP*
>> However, there is an error, it should be telcontar, not nimrodel. I
>> just noticed.
> 
> Same output here (on a system I'm posting from, it's dying anyway).
> Except there's no nameserver on localhost thus it's expected.  BTW, just
> in case I'll need more options, what specific software is running on
> nimrodel?
> 

I corrected the nimrodel references (named was migrated from nimrodel to telcontar and I forgot to edit them), and now dig shows different:

Telcontar:~ # dig @127.0.0.1 localhost

; <<>> DiG 9.11.2 <<>> @127.0.0.1 localhost
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51621
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 0e3337e422b672863d85bad55eaec8497a9818a4377a95c6 (good)
;; QUESTION SECTION:
;localhost.			IN	A

;; ANSWER SECTION:
localhost.		86400	IN	A	127.0.0.1

;; AUTHORITY SECTION:
localhost.		86400	IN	NS	telcontar.valinor.

;; ADDITIONAL SECTION:
Telcontar.valinor.	86400	IN	A	192.168.1.14

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun May 03 15:34:01 CEST 2020
;; MSG SIZE  rcvd: 139

Telcontar:~ #

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#4545

with <slrnramf8r.2f1.whynot@orphan.zombinet> Eric Pozharski wrote:
*SKIP*
> As you can see, answer is non-autoritative.  (Switching 'auth-zones' off
> and 'export-etc-hosts' on -- dead end, just in case;  didn't reach to a
> web-interface yet;  Summary:  I have options.)

Well, RFC6761 "Special-Use Domain Names" with section 6.3 "Domain Name
Reservation Considerations for "localhost."" kinda settles it.

	4.  Caching DNS servers SHOULD recognize localhost names as
	special and SHOULD NOT attempt to look up NS records for them,
	or otherwise query authoritative DNS servers in an attempt to
	resolve localhost names.  Instead, caching DNS servers SHOULD,
	for all such address queries, generate an immediate positive
	response giving the IP loopback address, and for all other query
	types, generate an immediate negative response.  This is to
	avoid unnecessary load on the root name servers and other name
	servers.

IOW, caching DNS is discouraged to reply with anything but A adn/or
AAAA, while SOA is off limits.  And, because there won't be SOA, answer
can't possibly be authoritative.  So pdns-recursor is conformant, I
guess.  However, considering

	3.  Name resolution APIs and libraries SHOULD recognize
	localhost names as special and SHOULD always return the IP
	loopback address for address queries and negative responses for
	all other query types.  Name resolution APIs SHOULD NOT send
	queries for localhost names to their configured caching DNS
	server(s).

I would say not much considreration and/of clarity has been put here
anyway.

*CUT*

-- 
Torvalds' goal for Linux is very simple: World Domination
Stallman's goal for GNU is even simpler: Freedom

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web