Subject: inverse resolution

From: "Javier Puche. CSIC RedIRIS" <[email-masked]>
Date: Wed, 17 Feb 1999 20:14:22 +0100

Hi,

 I am having a problem when activating 'deny    !nameserved', the thing
is that it seems not to work well when people coming from classless
inverse resolutions (not byte boundaries)

 I don't know to what extent is a wu-ftpd, libresolv or any other thing
problem, the client seems to have correctly set the inverse resolution.
Just to know if someone has had similar experiences or has any insight
on what could be the problem.

Thanks a lot,

Javier Puche.

PD: I run wu-2.4.2-academ[BETA-13] with some patches on Solaris 2.6,
but I do not find any mention to resolution topics in the tickets
solved for next releases.

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 17 Feb 1999 15:42:04 -0500 (EST)

On Wed, 17 Feb 1999, Javier Puche. CSIC RedIRIS wrote:

> I am having a problem when activating 'deny !nameserved', the thing is 
> that it seems not to work well when people coming from classless   
> problem, the client seems to have correctly set the inverse 
> resolution. Just to know if someone has had similar experiences or has 
> any insight on what could be the problem.
  
I'm not sure I understand your problem, but I'll make couple of a guesses.
  
I'm thinking you're talking about reverse lookups which were dynamically
inserted when a dialup user connected.  If that's the case, it sounds like
a DNS latency issue.  The whole idea of so-called 'dynamic-DNS' seems lame
to me and I dont think it'll work without taking the entire internet to
its knees.
  
The other possibility which comes to mind is the idea of using a CNAME in
the reverse lookup table.  As I read the DNS RFC, it seems to me that
practice is non-compliant.  It's used as an example in a book somewhere,
so we see a lot of people trying it (including some major ISPs).  I've not
looked but it may be discussed somewhere in a BCP.  I don't know about
BIND 8 but I can tell you BIND 4 doesn't like it a bit.
  
Neither of these isues, btw, are FTP or wu-ftpd issues.  If it's a problem
with a specific site, I'd have a talk with the hostmaster there.  If it's
a problem with a lot of sites hitting your archive, I'd think about losing
the !nameserved option.
  
--

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: "Javier Puche. CSIC RedIRIS" <[email-masked]>
Date: Thu, 18 Feb 1999 13:42:56 +0100

Hi all,

 Thanks Gregory for your quick reply and your guesses. Yes, I am
talking about reverse lookups (sorry for my bad writing), and the
scenario is your guess number 2: zones with delegated classles in-addr;
the use of CNAMES is the recomended practice for this cases according
to RFC 2317, but the same RFC warns that some software are not able to
deal with this kind of indirection in the resolution.

 My knowledge of DNS is not too deep, so I am trying to locate where
the not well working piece is: ftpd code to handle reverse lookups, the
o.s. library for resolving, ....  DNS people here tell me that DNS
configuration is ok according to the RFC. I've been told to avoid
losing !nameserved option because this is a big ftp site here in Spain
and helps forcing people to configure properly reverse resolution.

Thanks again for your help,

Javier Puche.

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 18 Feb 1999 10:03:55 -0500 (EST)

On Thu, 18 Feb 1999, Javier Puche. CSIC RedIRIS wrote:

> scenario is your guess number 2: zones with delegated classles
> in-addr; the use of CNAMES is the recomended practice for this cases
> according to RFC 2317, but the same RFC warns that some software are
> not able to deal with this kind of indirection in the resolution.

Well.  I didn't know the BCP had been upgraded to an RFC.  Actually, I
wasn't sure there was even a BCP, it was just a vague recollection.

The libraries and everything you need are in BIND 8, available from
http://www.isc.org/bind.html I still run BIND 4 and can tell you it
doesn't like CNAMES much.  It appears to resolve them, but complains
loudly in my system logs.

5.1 Recommended secondary name service

   Some older versions of name server software will make no effort to
   find and return the pointed-to name in CNAME records if the pointed-
   to name is not already known locally as cached or as authoritative
   data.  This can cause some confusion in resolvers, as only the CNAME
   record will be returned in the response.  To avoid this problem it is
   recommended that the authoritative name servers for the delegating
   zone (the zone containing all the CNAME records) all run as slave
   (secondary) name servers for the "child" zones delegated and pointed
   into via the CNAME records.

The last time I tried BIND 8 (8.0) was several months ago.  It didn't play
well with the other kids on my block, so I set it aside.  If you upgrade
to BIND 8 and relink the FTP daemon with the new resolver libraries BIND 8
provides, things should work better.

--

---

From: Jim Davis <[email-masked]>
Date: Thu, 18 Feb 1999 11:13:45 -0700 (MST)

This is on Solaris 2.6?  I think there was a resolver patch recently to
fix various bogosities with classless IP address resolution. Try
installing patch 105755 if you haven't already.