RFC 7393
Using the Port Control Protocol (PCP) to Update Dynamic DNS
RFC 7393: Using the Port Control Protocol (PCP) to Update Dynamic DNS 🎀
- Stream: Independent Submission 💅
- Category: Informational 🧚
- Date: November 2014 🌸
- ISSN: 2070-1721 ✨
- Authors: X. Deng, M. Boucadair, Q. Zhao, J. Huang, C. Zhou 💜
- Affiliations listed: France Telecom, Beijing University of Posts and Telecommunications, Huawei Technologies 🦋
- Obsoletes / Updates: the header doesn't list any RFCs it obsoletes or updates 🙈
Abstract 🌈
okay so this doc is all about the problems you run into when you use dynamic DNS in address-sharing setups, like Dual-Stack Lite (DS-Lite) and Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers (NAT64), while the internet is moving over to IPv6 🚀 It lays out the issues AND some possible fixes, all in one memo, which is so iconic of it 💖
Status of This Memo 📝
this one is not an Internet Standards Track spec. It's published just for info 🧚
It's a contribution to the RFC Series that's independent of any other RFC stream. The RFC Editor picked to publish it at their discretion, and they make zero claims about whether it's good to implement or deploy 🤷♀️ Docs the RFC Editor approves for publication can't be a candidate for any level of Internet Standard, see Section 2 of RFC 5741 💅
Info about this doc's current status, any errata, and how to give feedback lives at http://www.rfc-editor.org/info/rfc7393 🔗
Copyright Notice 🎀
Copyright (c) 2014 IETF Trust and the people listed as the document authors. All rights reserved ✨
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Please read those carefully, because they spell out your rights and restrictions for this doc 📜
Table of Contents 📚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Problem Statement . . . . . . . . . . . . . . . . . . . . 3
1.2. Scope and Goals . . . . . . . . . . . . . . . . . . . . . 4
2. Solution Space . . . . . . . . . . . . . . . . . . . . . . . 5
2.1. Locate a Service Port . . . . . . . . . . . . . . . . . . 5
2.2. Create Explicit Mappings for Incoming Connections . . . . 5
2.3. Detect Changes . . . . . . . . . . . . . . . . . . . . . 5
3. Some Deployment Solutions . . . . . . . . . . . . . . . . . . 7
3.1. Reference Topology . . . . . . . . . . . . . . . . . . . 7
3.2. For Web Service . . . . . . . . . . . . . . . . . . . . . 8
3.3. For Non-web Service . . . . . . . . . . . . . . . . . . . 9
4. Security Considerations . . . . . . . . . . . . . . . . . . . 11
5. References . . . . . . . . . . . . . . . . . . . . . . . . . 12
5.1. Normative References . . . . . . . . . . . . . . . . . . 12
5.2. Informative References . . . . . . . . . . . . . . . . . 12
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 13
Contributors . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 141. Introduction ✨
1.1. Problem Statement 💭
okay so Dynamic DNS (DDNS) is a super widely used service for hosting servers at people's homes, like a webcam, an HTTP server, an FTP server, and so on 🎥 A bunch of providers offer DDNS in a client-and-server setup, and it's mostly done through web forms 🌸 The DDNS client usually lives in the user's router or computer. Once a change is detected in its assigned IP address, it automatically sends an update message to the DDNS server 💌 The way the client and server talk to each other isn't standardized, so it's different for every provider, even though a few standard web-based ways of updating have shown up over time 🫶
In address-sharing setups, well-known port numbers (like port 80) won't be available for every user [RFC6269] 😭 So the DDNS client has to register the IP address and/or the external port(s) the service is listening on. It also has to report any change to that IP address and/or external port(s). On top of that, it needs to be able to configure the matching port forwarding on the Carrier-Grade NAT (CGN) [RFC6888] device, so incoming traffic from the Internet can get routed to the right server behind the CGN 🍓
Issues in address sharing are documented in [RFC6269]. This doc focuses on the problems you hit when using dynamic DNS in address-sharing contexts (like DS-Lite [RFC6333] and NAT64 [RFC6146]). The main challenges are:
- Announce and discover an alternate service port: the DDNS service must be able to keep track of an alternative port number instead of the default one 🎯
- Allow for incoming connections: there have to be proper ways to set up port mappings in the address-sharing device 🚪
- Detect changes and trigger DDNS updates: the DDNS client must get triggered by a change in the external IP address and the port number. Concretely, whenever the external IP address (and/or external port number) changes, the DDNS client must refresh the DNS records. Otherwise, the server won't be reachable from outside 😱 This gets even worse in the DS-Lite context, because no public IPv4 address is assigned to the Customer Premises Equipment (CPE) 💀
1.2. Scope and Goals 🌷
This doc describes some candidate solutions for these issues, with a special focus on DS-Lite. These solutions may also be valid for other address-sharing schemes ✨
It also sketches deployment considerations based on the Port Control Protocol (PCP) [RFC6887]. Fun fact: DDNS may be considered an implementation of the rendezvous service mentioned in [RFC6887] 🧚
Here's the thing. After you create an explicit mapping for incoming connections using PCP, you still have to tell remote hosts the IP address, protocol, and port number they need to reach the services hosted behind a DS-Lite CGN. This is usually done in an application-specific way 🎮 For example, a machine hosting a game server might use a rendezvous server that's specific to that game (or that game's developer), a SIP phone would use a SIP proxy, and a client using DNS-Based Service Discovery [RFC6763] would use DNS Update [RFC2136][RFC3007], and so on. PCP does not provide this rendezvous function, so that part is on the app 🙃
The rendezvous function may support IPv4, IPv6, or both. Depending on that and on whether the application supports IPv4 or IPv6, the PCP client may need an IPv4 mapping, an IPv6 mapping, or both 🦋 An example of how the DDNS server may implement this kind of service notification, if necessary, is in Section 3.
This doc doesn't specify any protocol extension. Instead, it digs into the problem space and shows how existing tools can be reused to solve the problem in some deployment contexts 💜 Specifically, this doc requires no changes to PCP or to dynamic updates in the standard domain name system [RFC2136]. It's an operational doc meant to make the current DDNS providers aware of the impacts and issues that IPv6 transition and IPv4 address sharing will bring them, and it offers solutions for those upcoming issues 📚 Right now, DDNS providers usually use a web-based form to handle DDNS registration and updates 🖥️
Generic deployment considerations for DS-Lite, including Basic Bridging BroadBand (B4) remote management and IPv4 connectivity check, are in [RFC6908]. This doc adds deployment considerations on top of that, related to rendezvous service maintenance 🫧 More PCP-related deployment considerations are at [PCP-DEPLOYMENT] 🌈
Solutions that rely on DNS-Based Service Discovery [RFC6763] or Apple's Back to My Mac (BTMM) Service [RFC6281] aren't considered here. Also, this doc doesn't assume that the DDNS service relies on [RFC2136] 🙈
The IPv4 addresses used in the examples come from the IPv4 block reserved for documentation in [RFC6890]. DNS name examples follow [RFC2606] 🍬
2. Solution Space 🧩
2.1. Locate a Service Port 🔍
There are at least two solutions you can use to link a port number to a service:
- Use service URIs (like FTP, SIP, or HTTP) that embed an explicit port number. The Uniform Resource Identifier (URI) defined in [RFC3986] lets the port number ride along in the syntax, like
mydomain.example:15687🎀 - Use SRV records [RFC2782]. Unfortunately, most browsers don't support this record type 😭
The DDNS client and DDNS server need updating so that an alternate port number gets signaled and stored by the DDNS server 💾 After that, remote hosts that ask for the server get told the IP address and port number they need to reach it 📣
2.2. Create Explicit Mappings for Incoming Connections 🚪
PCP is used to install the right mapping(s) in the CGN, so incoming packets can get delivered to the correct server 🎯
🧚 this is part 1 of 3! Section 2.3 (Detect Changes) and everything after it are coming in the next parts, so stay tuned 💖
2.3. Detect Changes ✨
okay bestie, picture this 🎀 in a network like Figure 1, a DDNS client or PCP client can be living on either the CPE or the host that's actually running the services itself 💅 there are a couple of ways to deal with the problems from Section 1.1 (the "why did my external IP change on me" drama 😭):
- okay so the DDNS client is switched on, and the host keeps checking in every now and then (like every 60 minutes 🕐) by sending PCP MAP requests (think messages 1 and 2 in Figure 1) with short lifetimes (like 30s ⏱️). the goal is to ask what external IP address you have and to set things up. if the goal is to catch any change to the external port too, the host must issue a PCP mapping to install for the internal server 🫶. when the external IP address changes, the DDNS client updates the records (that's message 3 in Figure 1) 🦋
- this one is giving checking the mapping table 📋 if the DDNS client is enabled, it looks at the local mapping table kept by the PCP client, and it keeps doing that on a schedule (every 5 minutes, 30 minutes, or 60 minutes 🌸). if the PCP client hasn't made any PCP mapping, the DDNS client sends a PCP MAP request (messages 1 and 2 in Figure 1) to ask for the external IP address and to set up port forwarding mappings for incoming connections ✨. when the external IP address changes, the DDNS client updates the records on the DDNS server, which is message 3 in Figure 1 💜
+-----------------+
| DDNS Server |
+-----------------+
^
|
|3. DDNS updates
| (if any)
|
+---------------+ +-----------------+
|DDNS Client |1. PCP MAP request | CGN/PCP Server |
|PCP Client/IWF |------------------->| (PCP mapping for|80:8080+------+
|on CPE or |2. PCP MAP response | port forwarding)|<------|Client|
|the host itself|<-------------------| | +------+
| |3. DDNS updates | |
| | (if any) | |
| |------------------->| |
+---------------+ +-----------------+
IWF = Internetworking Function
Figure 1: Flow Chart3. Some Deployment Solutions 🧚
3.1. Reference Topology
Figure 2 shows the setup used for the deployment solutions we're about to break down in the next subsections 🍓
+--------------+ +--------+ +---------+ +--------+ +-------+
| Service | | DDNS | | CGN/ | | PCP | |Servers|
| User |---| Server|----| PCP |---| Client |---| |
| | | | | Server | | /DDNS | | |
| | | | | | | Client | | |
+--------------+ +--------+ +---------+ +--------+ +-------+
A user DDNS Server AFTR B4(CPE) A host
from Internet behind B4
Figure 2: Implementation TopologyFigure 2 has the following cast of characters 👑
- Servers: these are the servers sitting in the DS-Lite network, or more generally in any IP address-sharing environment 🖥️ they're usually running on a host that's been given a private IPv4 address. once a proper mapping has been created via PCP in the Address Family Transition Router (AFTR), these services become reachable by Internet users 🌈 they can offer web, FTP, SIP, and other services, though in the IP address-sharing context those may no longer be seen from the outside using a well-known port 🙈
- B4(CPE): this is the endpoint of an IPv4-in-IPv6 tunnel [RFC6333] 🫶 a PCP client and a DDNS client both run on it. after the PCP client sets up a mapping on the AFTR, an end user can register their domain name and their external IPv4 address plus port number with their DDNS service provider (the DDNS server), either by hand or automatically through a DDNS client. later on, end users can likewise announce IP address and/or port changes to the DDNS server manually, or let the DDNS client announce them automatically ✨
- AFTR: this one keeps track of the mappings between an IPv6 address, the internal IPv4 address plus internal port, and the external IPv4 address plus port [RFC6333] 🧠
- DDNS server: this one keeps a table that links a registered domain name to a registered host's external IPv4 address/port number pair 📒 when it gets told about IP address and port number changes from a DDNS client, it passes the updates along to DNS servers on the end user's behalf. [RFC2136] and [RFC3007] may be used by DDNS servers to send those updates to DNS servers. in lots of current setups, a DDNS service provider announces its own IP address as the registered domain names of its end users 🤭 and when HTTP requests reach the DDNS server, it may use URL Forwarding or HTTP 301 redirection to send the request to the right registered end user by looking it up in the maintained link table 🦋
- Service users: these are the people who want to reach services behind an IP address-sharing network 🙋 they send standard DNS requests to find the services. if the requested services have been registered with a DDNS service provider, those requests lead them to a DDNS server. the DDNS server then handles the rest the same way as described above 💅
3.2. For Web Service
okay real talk, lots of current DDNS server implementations assume the end servers are hosting web servers on the default 80 port 😬 but in the DS-Lite context, they have to account for the fact that the external ports assigned by the AFTR may be any number other than 80, so the mapping between domain names and the external IP plus port stays correct 🎯 if a proper mapping is being maintained, the HTTP request gets redirected to the AFTR, which serves the specific end host running the servers 💖
Figure 3 shows how the messages get handled so they reach the right server 🦋
Web Visitor DDNS Server AFTR B4(CPE) Web Server
behind B4
| HTTP GET* | | | |
|---------------------->| | | |
| ip_DDNS_server |------------->| | |
| | HTTP 301 | | |
| |<-------------| | |
| HTTP GET* ip_aftr:8001 | | |
|------------------------------------->| |
| | HTTP GET* ip_websrv:8000 |
| |------------------------->|
| | |
| HTTP response | HTTP response |
|<-------------------------------------|--------------------------|
| | |
Figure 3: HTTP Service Messagesso here's the flow 💅 when a web user sends an HTTP GET message to the DDNS server after a standard DNS query, the DDNS server redirects the request to a registered web server by replying with an HTTP 301 message 🌸 then the HTTP GET message goes out to the AFTR, which finds the proper host behind it 🧚 to keep things simple, the messages among the AFTR, the B4, and the web server behind the B4 aren't shown in full here, so for communication among those nodes, check out [RFC6333] 📚
3.3. For Non-web Service ✨
okay so for non-web services, like I said back in Section 2, we need some other way to tell users what services are out there 🦋 bestie this part is actually so good
[RFC6763] has an example of a DNS-based solution where an app running on the end user's device can grab service info through DNS SRV/TXT records and show a list of available services 💅 but if that kind of app isn't an option, here's another move a third party (like a DDNS service provider) can make to share services with internet users 🫶
A web portal can list the available services 🌸 A DDNS server keeps a web portal for each user's Fully Qualified Domain Name (FQDN), and the portal hands out service links to visitors 🧚 Figure 4 assumes "websrv.example.com" is a user's FQDN from a DDNS service provider, and it's giving full main character energy
+-------------+ +-------------+ +----------+ Internet +-------+
|DDNS Client /| |DDNS Server /| |DNS Server| |Visitor|
| Web Server | | Web Portal | | | | |
+-------------+ +-------------+ +----------+ +-------+
| register | | |
|<------------------>| | |
| websrv.example.com | update DNS | |
| 192.0.2.1:2000 | <-------------> | |
| |websrv.example.com| |
| | portal's IP | |
| +-------------+ | |
| |update portal| | |
| +-------------+ | DNS resolve for |
| | | <----------------> |
| | | websrv.example.com |
| | | get portal's IP |
| | | |
| | visit portal of websrv.example.com |
| | <-----------------------------------> |
| | | |
| visit http://192.0.2.1:2000 |
| <--------------------------------------------------------->|
| | | |
Figure 4: Update Web PortalThe DDNS client registers the server's info with the DDNS server 💖 that includes the public IP address and port it got via PCP, the user's FQDN, and any other necessary stuff. The DDNS server also acts as a portal server, so it registers its own IP address, port number, and the user's FQDN with the DNS system so visitors can reach the web portal 🎀
A DDNS server also keeps a web portal for each user's FQDN and updates it based on what the DDNS client registered 🔥 When a visitor goes to "websrv.example.com", a DNS query resolves the portal server's address and port number, and boom, the visitor sees the portal and the available services 👑
+-------------------------------------------------------------+
| |
| Portal: websrv.example.com |
| |
| Service1: web server |
| Link: http://192.0.2.1:2000 |
| |
| Service2: video |
| Link: rtsp://192.0.2.1:8080/test.sdp |
| |
| ...... |
| |
+-------------------------------------------------------------+
Figure 5: An Example of a Web PortalAs Figure 5 shows, the web portal displays the service URLs that can be accessed 🌈 Multiple services can be reached through one user's FQDN, which is so iconic 😭
Some non-HTTP apps can be delivered this way too 🦋 When a user clicks a link, the app registered in the client OS gets invoked to handle it. How that gets done is out of the scope of this document 💅
4. Security Considerations 💀
This document does not introduce a new protocol, nor does it specify protocol extensions 🙈 Security-related considerations for PCP [RFC6887] and DS-Lite [RFC6333] should be taken into account, bestie, don't skip them 🔥
The protocol between the DDNS client and DDNS server is proprietary in most cases 😬 Some extensions may be necessary, and that's up to the DDNS operators. These operators should enforce security-related policies so illegitimate users can't alter records installed by legitimate users, or install fake records that would attract illegitimate traffic 🚨 Means to protect the DDNS server against Denial of Service (DoS) should be enabled 🛡️ Note that these considerations aren't specific to address-sharing contexts, they're valid for DDNS services in general, so no excuses 💅
5. References 📚
5.1. Normative References 💜
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
Resource Identifier (URI): Generic Syntax", STD 66, RFC
3986, January 2005,
<http://www.rfc-editor.org/info/rfc3986>.
[RFC6333] Durand, A., Droms, R., Woodyatt, J., and Y. Lee, "Dual-
Stack Lite Broadband Deployments Following IPv4
Exhaustion", RFC 6333, August 2011,
<http://www.rfc-editor.org/info/rfc6333>.
[RFC6887] Wing, D., Cheshire, S., Boucadair, M., Penno, R., and P.
Selkirk, "Port Control Protocol (PCP)", RFC 6887, April
2013, <http://www.rfc-editor.org/info/rfc6887>.5.2. Informative References 🌸
[PCP-DEPLOYMENT]
Boucadair, M., "Port Control Protocol (PCP) Deployment
Models", Work in Progress, draft-boucadair-pcp-deployment-
cases-03, July 2014.
[RFC2136] Vixie, P., Thomson, S., Rekhter, Y., and J. Bound,
"Dynamic Updates in the Domain Name System (DNS UPDATE)",
RFC 2136, April 1997,
<http://www.rfc-editor.org/info/rfc2136>.
[RFC2606] Eastlake, D. and A. Panitz, "Reserved Top Level DNS
Names", BCP 32, RFC 2606, June 1999,
<http://www.rfc-editor.org/info/rfc2606>.
[RFC2782] Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for
specifying the location of services (DNS SRV)", RFC 2782,
February 2000, <http://www.rfc-editor.org/info/rfc2782>.
[RFC3007] Wellington, B., "Secure Domain Name System (DNS) Dynamic
Update", RFC 3007, November 2000,
<http://www.rfc-editor.org/info/rfc3007>.
[RFC6146] Bagnulo, M., Matthews, P., and I. van Beijnum, "Stateful
NAT64: Network Address and Protocol Translation from IPv6
Clients to IPv4 Servers", RFC 6146, April 2011,
<http://www.rfc-editor.org/info/rfc6146>.
[RFC6269] Ford, M., Boucadair, M., Durand, A., Levis, P., and P.
Roberts, "Issues with IP Address Sharing", RFC 6269, June
2011, <http://www.rfc-editor.org/info/rfc6269>.
[RFC6281] Cheshire, S., Zhu, Z., Wakikawa, R., and L. Zhang,
"Understanding Apple's Back to My Mac (BTMM) Service", RFC
6281, June 2011, <http://www.rfc-editor.org/info/rfc6281>.
[RFC6763] Cheshire, S. and M. Krochmal, "DNS-Based Service
Discovery", RFC 6763, February 2013,
<http://www.rfc-editor.org/info/rfc6763>.
[RFC6888] Perreault, S., Yamagata, I., Miyakawa, S., Nakagawa, A.,
and H. Ashida, "Common Requirements for Carrier-Grade NATs
(CGNs)", BCP 127, RFC 6888, April 2013,
<http://www.rfc-editor.org/info/rfc6888>.
[RFC6890] Cotton, M., Vegoda, L., Bonica, R., and B. Haberman,
"Special-Purpose IP Address Registries", BCP 153, RFC
6890, April 2013,
<http://www.rfc-editor.org/info/rfc6890>.
[RFC6908] Lee, Y., Maglione, R., Williams, C., Jacquenet, C., and M.
Boucadair, "Deployment Considerations for Dual-Stack
Lite", RFC 6908, March 2013,
<http://www.rfc-editor.org/info/rfc6908>.Acknowledgements 🫶
Thanks to Stuart Cheshire for bringing up DNS-Based Service Discovery (SD) and [RFC6281], which covers a DNS-based SD scenario and gives an example of how the application is a means for a solution to address dynamic DNS updates; in this case, Apple's BTMM can be achieved 🍓
Many thanks to D. Wing, D. Thaler, and J. Abley for their comments 💖
Contributors 🌟
The following individuals contributed text to the document:
Xiaohong Huang
Beijing University of Posts and Telecommunications, China
EMail: huangxh@bupt.edu.cn
Yan Ma
Beijing University of Posts and Telecommunications, China
EMail: mayan@bupt.edu.cnAuthors' Addresses 🦋
Xiaohong Deng
EMail: dxhbupt@gmail.com
Mohamed Boucadair
France Telecom
Rennes 35000
France
EMail: mohamed.boucadair@orange.com
Qin Zhao
Beijing University of Posts and Telecommunications
China
EMail: zhaoqin.bupt@gmail.com
James Huang
Huawei Technologies
China
EMail: james.huang@huawei.com
Cathy Zhou
Huawei Technologies
China
EMail: cathy.zhou@huawei.com📦 where this page comes from
- ietf: rfc7393 2014-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms