New IPv6 address block for Cambridge

2011-06-21 - News - Chris Thompson

You may be aware that we have been negotiating with JANET for a larger IPv6 address block. These negotiations have (eventually) been successful. We are being allocated 2001:630:210::/44, and the existing use of 2001:630:200::/48 will be phased out over (we hope) the next few months. Details of how the new space will be divided up will be available from Networks in due course.

As immediate consequences, the following changes have been made to http://jackdaw.cam.ac.uk/ipreg/nsconfig/sample.named.conf:

• The "camnets" ACL has 2001:630:210::/44 added to it.

• The reverse zone "1.2.0.0.3.6.0.1.0.0.2.ip6.arpa" is listed as available for (stealth) slaving.

Of course, the reverse zone has nothing significant in it yet! But if you are slaving the existing IPv6 reverse zone, you should probably start slaving the new one as well.

There will of course be other changes during the transition that may affect local nameserver administrators. In particular the IPv6 addresses

of the CUDN central authoritative and recursive nameservers will change at some point: this list will be informed before that happens.

A few minor issues while I have your attention:

1. The zone amtp.cam.ac.uk (old name for damtp.cam.ac.uk) is no longer delegated, and is about to vanish entirely. If you are still slaving it even after the message here on 9 March, now is the time to stop.

2. There has been another small change to the official root hints file ftp://ftp.internic.net/domain/named.cache, and the copy at http://jackdaw.cam.ac.uk/ipreg/nsconfig/db.cache has been updated accordingly. The change is the addition of an IPv6 address for d.root-servers.net, and rather appropriately it was made on "IPv6 day".

3. My description of the BIND vulnerability CVE-2011-1910 was defective in two directions:

   • It isn't necessary to have DNSSEC validation turned on to be vulnerable to it.

   • On the other hand, only moderately recent versions of BIND are vulnerable: old enough ones are not.

   The information at

   http://www.isc.org/software/bind/advisories/cve-2011-1910
   

   about which versions are affected is accurate (bearing in mind that some OS vendors make their own changes without altering the version number). If you are compiling from source, I can advise you on the code fragment to look for.