On Mar 9, 3:47 am, ma...@ntp.org (Danny Mayer) wrote: > Dave Hart wrote: > > That's a bit misleading. At the protocol level the queries are often > > distinct, asking for A or AAAA records. type=any will return both but > > is not typically used in apps. At the app level, if the app looks up > > a name indicating both IPv4 and IPv6 addresses are desired, platform > > and site policies come into play > > getaddrinfo() which is used by all newer apps returns both IPv4 and IPv6 > unless you specify a particular type. It has nothing to do with site > policy and they do not come into play. The query is controlled solely by > the app. The app may have additional controls on whether or not it wants > to query for IPv4, IPv6 or both.
You might want to spend a little time curling up with RFC 3484, "Default Address Selection for IPv6" http://www.rfc-editor.org/rfc/rfc3484.txt With RFC 3484 support, getaddrinfo sorts its results so that applications processinig the results in order follow the selected policy. Given that the RFC came out of Microsoft Research, it should be no surprise that a certain widely-used platform respects RFC 3484. Take particular note of the policy tables described in RFC 3484 and how they allow site policies to come into play. > > It sounds like you use a disconnected IPv6 network alongside a > > connected RFC1918 v4 network internally. I wonder if you could get by > > using only link-local addresses for your internal IPv6 network? I > > believe that would solve the problem because your stack would know it > > can't connect to a global v6 address from a machine with only link- > > local v6 addresses. > > The stack has no knowledge of whether it can connect to a global IPv6 > address. Only the routers will be able to do that. Since link-local addresses by definition are not routable, routers do not come into play. Any IPv6 stack understands the difference between link-local and global addresses, and will not attempt to connect to a global remote address using a link-local local address. Hence the results Martin saw that only machines with IPv6 global addresses were having trouble with names returning AAAA as well as A. > > This may indeed be the best option for your configuration. I wouldn't > > call it a good solution, though. Your machines should be able to > > handle seeing AAAA records via IPv4-accessible DNS even if they can't > > use them. I'd dig into configuring the machines to use IPv6 as a last > > resort before considering DNS server-based AAAA filtering. > > It cannot be done by the DNS. This reads as a non-sequiter. I have no idea what "It" is that cannot be done. Cheers, Dave Hart _______________________________________________ questions mailing list questions@lists.ntp.org https://lists.ntp.org/mailman/listinfo/questions
