L-Root IPv6 address renumbering

[W.C.A. Wijngaards]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi Robert,

On 15/03/16 18:45, Robert Edmonds via Unbound-users wrote:
> W.C.A. Wijngaards via Unbound-users wrote:
>> I have updated the default root hints that ship inside the source
>> code of Unbound (in the code repository, for future releases).
>> Thank you for the notification.
>> 
>> Users can upgrade the root hints right now by editing the
>> named.root (or named.cache, or root.hints file) and using the
>> root-hints: "filename" directive in unbound.conf.  Or they can
>> wait for a source code upgrade if they are using defaults.
> 
> Hi, Wouter:
> 
> I wonder a few things. Probably there will be future root server 
> re-numberings. We have to patch and rebuild binary packages for
> several recursive DNS servers each time this happens.
> 
> On Debian, we ship the root hints file in
> /usr/share/dns/root.hints (in package dns-root-data). It would be
> nice if Unbound and other recursive DNS servers could use the
> freshest hints available on the system, either in the system's
> root.hints file, or in the compiled in root hints. This would avoid
> the need to update packages in released versions of Debian and the
> need to backport hint updates from trunk to the latest release.
> 
> That is, the two policies available currently are "use hints from
> an external file" and "use compiled in hints". Both of these
> policies can easily fail, e.g. the "use external file" policy with
> an out-of-date hints file and up-to-date binary, or "use compiled
> in hints" policy with an out-of-date binary and up-to-date hints
> file.
> 
> What if there were a "use latest hints from either external file
> or compiled in hints" policy? Unbound would need to compile in a
> timestamp corresponding to the time that the hints were last
> updated, and compare this to the mtime on the root hints file. The
> distros can then enable this policy by default and point the
> parameter to a file in /usr whose mtime will be no later than the
> time that the hint file was actually updated (and not the time the
> package was built or the file was downloaded, etc.). Since the file
> would not be a configuration file it would never be modified by the
> sysadmin and the mtime should always

The sysadmin edits the root.hints file?  The unbound.conf file is just
pointing to the root.hints file.  I don't really see sysadmins editing
the root.hints file.  Only very sporadic, perhaps, updating it
themselves.  But then they have to keep doing it?

But that seems to be the only use case for the mtime comparison.  And
it is very unusual?

I do not like mixing the internal compiled root hints with the
external file.  I would like the internal compiled root hints to shut
off completely, when the root-hints config is given in unbound.conf.
This to make sure that the user's choice of root servers is used, and
the code does not (accidentally) use the wrong root servers.

But, having a second root-hints file, root-hints-backup or so?  And
then mtime comparing it with the first root hints file, and using the
newest of the two files?

Also, would you want to have a configure-time default for the
root-hints value, i.e. never use the compiled-in defaults and always
read from a specific file (at default location)?  (that would be,
unless overridden in unbound.conf).

Best regards, Wouter

> accurately reflect its age.
> 
> Maybe this is not that big a deal if one or two hint addresses are
> out of date out of 20+ addresses, because the root priming
> algorithm will update it at process startup, but at least the
> distros do feel some pressure to keep the compiled in hints
> current, across all the recursive DNS servers in the distro that
> build in hints and across all the supported distro releases. If I
> wrote a patch implementing this policy would it be something
> suitable for merging into the mainline?
> 
> The other thing I wonder is, if the root-servers.net zone were ever
> to be signed with DNSSEC, could we just let the server securely
> store a persistent copy of updated root hints into /var, like 
> auto-trust-anchor-file does for the root trust anchor? :-)
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJW6Q02AAoJEJ9vHC1+BF+NqKAP/2wCbObXjyIiH9WKZwgv0Cq3
VoPZk/24jzHQWT4hxJmqW8VrdMUn7fTLqnkYKsiQ9MnScnYqIZ69PUQBWjc7NjPR
o9SfCD68IiHbt24ofApwOhfY/tna0ANdRYSLvOqfIuiKk4JIFPFiI/I6ayam4GAX
koqihk9X3Q3cIuetwgIgCT/FgmVpVT4fuuHDmvopuKQzbRAcrAaI/O3KAGJ9X6vN
HRkCq6Iqk3YvL/eLsXNkpjyEjIvj4Fmle1T1pX8oyeBPQZW02m19ah/xja1tDL9w
NfbDRTULRjF/6tk0/Co/SeGv4IXAsSkIBKw1am+24p9B940Cd1OfXUaRvhlsgBu1
sn7YkIA1cB53UIF27Ht/AfFryCtL5VGfxspywX1lAmkkReoIO8AsvwfQhX/SSICI
UibSPhVrr9tyJ0uP+KZcJ0pj9GjnoqtDOdlsG29x2voxVjgUl4K9LAOD/dcn6uie
WDvlNMHZ8qwOl5HskYg0hL/8c6hDJ304sNeYdFMkUuCoTSXXBG4V6CE5Z2ccyF34
aG9eYeAZY47g4K2/8TVMVVnnyMJ3RsHqXTWJ80bGO+P26uyYGLT7dGMbkifOnNtQ
RTrzpzpnr8xft3BKvrIZ14tjqYWYSnuV6OxetNAcLgy0pV+7mQ41dajzfMwHoapr
Uz6Lh7gl3iBp+v27yPmn
=RVQb
-----END PGP SIGNATURE-----