Subject: [dnsop] two AS112 drafts

From: Joe Abley <[email-masked]>
Date: Wed, 21 Jun 2006 19:51:55 -0400

Hi all,

William Maton and I have prepared two drafts relating to the AS112  
project:

   draft-jabley-as112-ops-00
   draft-jabley-as112-being-attacked-help-help-00

Those who are unfamiliar with the AS112 project are invited to read  
the abstract of either of those for some background.

We have requested a brief slot in Montréal to gauge the opinion of  
the working group as to (a) whether the material treated in those  
documents ought to be published in the RFC series, and (b) whether,  
if so, they would benefit from collective review as dnsop working  
group documents.

Comments relating to the content of the drafts is also most welcome,  
obviously.

The problem we are trying to solve with these drafts is that the  
AS112 infrastructure is poorly documented. We think that the IETF is  
a good place for that documentation to live, since the function of  
the nameservers concerned relates directly to address blocks reserved  
by the IETF (in RFC1918).

Having been recently in the unenviable position[1] of answering phone  
calls from angry people regarding the denial-of-service attack from  
PRISONER.IANA.ORG on their firewalls (source port 53), I can also say  
with confidence that being able to point such people at a published,  
IETF document describing the project would have gone a long way  
towards pacifying some of the moderately paranoid of the callers,  
many of which were not at all convinced that this AS112 thing was on  
the up and up.

(The most paranoid callers also had sincere doubts about entities  
such as ISC, IANA, ICANN, and IETF, and many suspected they were all  
fronts for rogue foreign governments, but such people are probably  
beyond hope in so many other ways that to attempt to quench their  
suspicions is probably a lost cause).

Joe

[1] at ISC, whose NOC number is the listed telephone contact for the  
AS112 service prefix

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Dean Anderson <[email-masked]>
Date: Fri, 23 Jun 2006 15:19:34 -0400 (EDT)

>    draft-jabley-as112-ops-00

3.3.  Operating System and Host Considerations

   The use of a UNIX or UNIX-like operating system (e.g.  FreeBSD, GNU
   Linux) is recommended for the construction of AS112 nodes, primarily
   due to the cumulative experience of using such platforms for this
   purpose.  Examples in this document will assume use of such an
   operating system.
   [...]

Section 3.3 should removed. Choice of host operating system has no relevance to
DNS operations.  Use of loopback interfaces etc, is likewise irrelevant.

>    draft-jabley-as112-being-attacked-help-help-00

This draft seems to entirely miss the point, and unhelpfully belittles the fact
that AS112 servers may in fact be used (perhaps have already been used) to
conduct DOS attacks.

I have rarely seen IDS systems alarm over genuine DNS traffic to external
servers. The IDS sees the query go out, and the corresponding answer come back.  
The IDS has no idea of whether a query to, say 1.1.168.192.in-addr.arpa.  
__ought__ to go out... but would just treat it like any other query. The IDS
only alarms when it starts getting answers for queries that weren't sent.  
Receiving responses to unsent queries is an indication of a real DOS attack.

So, when you start getting calls from admins saying they are under attack from
AS112, you probably should take that more seriously, and assist them, rather
than explaining what AS112 does.  Nothing that AS112 does makes it immune from
involvement in a DOS attack.

> PRISONER.IANA.ORG on their firewalls (source port 53), 

Probably you should have responded differently to their calls: They were
probably legitimate DOS attacks involving AS112 servers.

So, I think the this draft should be dropped. Or, in its place, a draft advising
AS112 to be more helpful in the future.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 23 Jun 2006 15:47:23 -0400 (EDT)

>    draft-jabley-as112-ops-00

In section 3.1, this text should be removed:

   o  Anycast distribution of DNS services ([ISC-TN-2003-1], [I-D.ietf-
      grow-anycast]).

1)  draft-ietf-grow-anycast is based on a known scientific fraud, and is
currently under appeal to the IESG for several inappropriate acts. References to
known scientific frauds should be removed.

2)  draft-ietf-grow-anycast documents stateful anycast. Stateful isn't required
or used for AS112 operations.  AS112 is a stateless operation. Stateful queries
can be dropped. (probably all queries could be dropped) Reference to RFC1546
stateless anycast should be made instead.

		--Dean

.

---

From: Joe Abley <[email-masked]>
Date: Fri, 23 Jun 2006 16:20:38 -0400

Hi Dean!

I will note that the only question before the wg associated with this  
particular mailing list is whether or not these two drafts might  
benefit from adoption as working group documents. Comments on the  
content seems somewhat orthogonal to that goal, but since you asked  
here, I'll reply here.

> DNS operations.  Use of loopback interfaces etc, is likewise  

Thanks for the feedback.

> that AS112 servers may in fact be used (perhaps have already been  

If you can provide details to expand upon the fact you describe  
above, that would be most helpful. Without some context, I am  
struggling to understand what you are talking about.

> servers.

I have no reason to doubt you. However, having been one of the small  
group of people responsible for answering the phone when people call  
the AS112 netblock contact, I can tell you that your experience is  
not universal.

Your advice to treat reports of abuse seriously is of course valid,  
but unnecessary in this case.

> probably legitimate DOS attacks involving AS112 servers.

All the calls I responded to were investigated thoroughly. I have no  
reason to doubt that any of the other calls which were handled with  
others enjoyed any less diligence.

None of the calls I responded to related to DOS attacks involving  
AS112 servers; all of them involved replies being returned from the  
Internet towards hosts that firewall admins had not considered might  
ever send requests to the outside world.

Joe
.

---

From: Joe Abley <[email-masked]>
Date: Fri, 23 Jun 2006 16:38:30 -0400

Hi Dean!

This note has very limited application to the AS112 project, but  
since you asked it here I am happy to give you the courtesy of a  
response.

Further comments on draft-ietf-grow-anycast should properly be  
directed to the grow mailing list, where I will be happy to  
contribute if I can add value to the discussion. I won't continue  
discussing them on dnsop, however.

> known scientific frauds should be removed.

I'm not familiar with precisely what you have appealed against; for  
example, it's my impression that you sent a formal appeal to the IESG  
complaining about a decision that they had not yet made, since the  
last call was still in process, as were the Secdir and Gen-ART  
reviews. Feedback from those reviews has resulted in a -04 draft,  
which is not yet in the i-d queue. Since you haven't seen that draft,  
your confidence in being able to criticise it is puzzling.

I think the most appropriate thing for now with respect to draft- 
jabley-as112-ops is to leave the reference in place, since it's  
currently the only non-expired document in the IETF which comes close  
to explaining current practice. If it comes to pass in the future  
that the IESG decides not to proceed with draft-ietf-grow-anycast,  
then the reference can be modified or removed as appropriate.

> 2)  draft-ietf-grow-anycast documents stateful anycast.

It does describe the anycast distribution of services whose protocols  
involve keeping state. It also documents the anycast distribution of  
stateless services.

> Stateful isn't required
> or used for AS112 operations. AS112 is a stateless operation.

Since AS112 servers answer queries over TCP transport, that's not  
correct.

[octopus:~]% dig @prisoner.iana.org 10.in-addr.arpa soa +tcp +short
as112.ixnm.net. info.ixnm.net. 2003030100 3600 600 2592000 15
[octopus:~]%

> Stateful queries can be dropped. (probably all queries could be  
> dropped)

Operational indicates that such practice has a real impact on  
production services. Regardless of the fact that such services could  
feasibly be described as broken, depending as they do on public  
authority servers for private netblocks to exist and function  
correctly, any decision which causes production services to fail  
should not be taken lightly.

> Reference to RFC1546

Your opinion on this matter is noted!

Joe

.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 23 Jun 2006 18:21:38 -0400 (EDT)

> content seems somewhat orthogonal to that goal, but since you asked  

I thought they were submitted to DNSOP. How did they get in the ID-Tracker?

> > This draft seems to entirely miss the point, and unhelpfully belittles the
> > fact that AS112 servers may in fact be used (perhaps have already been used)
> > to conduct DOS attacks.
> 

You have already provided the details: That is, the fact that you didn't
consider the attacks to be actual attacks, but rather "panic attacks".

From AS112, you wouldn't be able to know if they were indeed "panic attacks",
unless you had in fact assisted in tracing the source of the packets, which you
imply wasn't done, and would be done even less if your draft were approved.

> but unnecessary in this case.

How is it that you know this?  You assert complaints were made, and that you
disregarded those complaints; that the admins "panic'ed".

> others enjoyed any less diligence.

It sounds very much like the admins making the complaints, disagreed.  Perhaps
if you send me the contact info for some of those admins, I'll follow up to see
if they were satisfied with your response.

> None of the calls I responded to related to DOS attacks involving AS112
> servers;

How could that be?   The admins making the complaints didn't seem to agree.

> all of them involved replies being returned from the Internet towards hosts
> that firewall admins had not considered might ever send requests to the
> outside world.

Please explain this, further.  So machines that weren't nameservers were sending 
DNS requests (for in-addr.arpa) to the outside world?

		--Dean

.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 23 Jun 2006 18:41:23 -0400 (EDT)

On Fri, 23 Jun 2006, Joe Abley wrote:

> Hi Dean!
> 
> This note has very limited application to the AS112 project, but since you
> asked it here I am happy to give you the courtesy of a response.

If you want to put it in the draft, and you want DNSOP to consider the draft,
then its relevant.

> Further comments on draft-ietf-grow-anycast should properly be directed to the
> grow mailing list, where I will be happy to contribute if I can add value to
> the discussion. I won't continue discussing them on dnsop, however.

You do not need to discuss the matter if you agree to remove the references.  
Otherwise, its part of the content of the draft on this working group.

> > currently under appeal to the IESG for several inappropriate acts.  
> > References to known scientific frauds should be removed.
> 
> I'm not familiar with precisely what you have appealed against; 

I think you are, or ought to be, being on the GROW WG, and author of the draft
appealed, since this was discussed on the GROW WG, and is documented on the IESG
Appeals page.

> for example, it's my impression that you sent a formal appeal to the IESG
> complaining about a decision that they had not yet made, since the last call
> was still in process, as were the Secdir and Gen-ART reviews. 

No, your impression is incorrect. But you can read that in the Appeal.

> Feedback from those reviews has resulted in a -04 draft, which is not yet in
> the i-d queue. Since you haven't seen that draft, your confidence in being
> able to criticise it is puzzling.

I have not made any criticism of the "secret" -04 draft. However, since the
notion of stateful anycast is itself a fraud, it seems impossible that you can
fix the GROW draft. I look forward to seeing the -04 draft, however, and
whatever new complaints arise from it.

> then the reference can be modified or removed as appropriate.

I strongly disagree.  The GROW document doesn't explain any current practice
whatsoever. Its entirely based on fraudulent claims and fictions.

> involve keeping state. It also documents the anycast distribution of  

The notion of stateful anycast is a fiction.

There is no documentation of stateless anycast in the document that isn't also
contained in RFC1546.

> as112.ixnm.net. info.ixnm.net. 2003030100 3600 600 2592000 15

This isn't a real test of stateful anycast, as you well know.

> Operational indicates that such practice has a real impact on production
> services. Regardless of the fact that such services could feasibly be
> described as broken, depending as they do on public authority servers for
> private netblocks to exist and function correctly, any decision which causes
> production services to fail should not be taken lightly.

The purpose of AS112 is to stop otherwise undelegated queries from loading down
in-addr.arpa, .arpa, and ultimately reaching root nameservers. They do not need
actual responses to achieve this goal. All that is necessary are delgation
records, and quickly blackholed IP addresses for the delegated nameservers.  
Nameserver software isn't even required.

> > Reference to RFC1546 stateless anycast should be made instead.
> 

Thanks.  Look for to seeing that in the document.

		--Dean

.

---

From: Joe Abley <[email-masked]>
Date: Fri, 23 Jun 2006 18:58:04 -0400

> I thought they were submitted to DNSOP. How did they get in the ID- 

They're individual submissions (the absence of "dnsop" from their  
names might have provided a clue). They were submitted according to  
the normal published procedure.

> consider the attacks to be actual attacks, but rather "panic attacks".

That's not the case, so my question remains.

> disregarded those complaints; that the admins "panic'ed".

Complaints were made, the complaints were answered, and none were  
disregarded, as I said, and as you quoted:

> It sounds very much like the admins making the complaints, disagreed.

How you can presume to know details of private phone calls is a  
little perplexing.

> Perhaps if you send me the contact info for some of those admins,  
> I'll follow up to see

If I ever feel the need to solicit volunteers to perform a customer  
satisfaction survey for anything I do, you'll be the first person I  
call :-)

> DNS requests (for in-addr.arpa) to the outside world?

Please read the draft. This is described in some detail.

Joe

.

---

From: Joe Abley <[email-masked]>
Date: Fri, 23 Jun 2006 19:09:48 -0400

On 23-Jun-2006, at 18:41, Dean Anderson wrote:

>> since you

Not really. The reference is an active document, and its content is  
relevant to this draft. If the draft referred to dies, then replacing  
it with a different reference might well make sense. However, while  
the draft referred to is alive, and the most appropriate reference, I  
don't see any reason to make a change.

If this were a working group document, then this matter would be a  
matter of consensus. Since it's an individual submission, I believe  
it's up to us as authors, and any differences of opinion you might  
have with us should properly be brought up if the documents are ever  
last-called.

It's difficult to characterise your objection as anything other than  
an oblique reaction to the anycast draft, however, of which your  
dislike is profoundly on-record. Is there really new ground to cover,  
here?

Unless anybody else here has a profound desire to see this circular  
thread continue, I think I will stop at this point.

Joe

.

---

From: Peter Koch <[email-masked]>
Date: Sat, 24 Jun 2006 10:47:38 +0200

Dean,

> appealed, since this was discussed on the GROW WG, and is documented on the IESG

the discussion of matters of the GROW WG is out of the scope of dnsop and thus
out of scope for this mailing list.

[...]

> whatsoever. Its entirely based on fraudulent claims and fictions.

The tone expressed here (``fraud'') as well as in the earlier message
<http://darkwing.uoregon.edu/~llynch/dnsop/msg03719.html>, is inacceptable.
The RFC 3683 PR ACTION as documented in
<http://www1.ietf.org/mail-archive/web/ietf-announce/current/msg01967.html>
enables maintainers of other IETF mailing lists, including this list, to
remove your posting rights.

Please consider this the final warning. You are asked to return to a civilized
mode of discussion and to not discuss out of scope issues. The WG chairs will
remove your posting rights upon your next failure to follow this request.

This message is not subject to discussion or negotiation on this list.

-Peter Koch
 DNSOP co-chair
.

---

From: Peter Koch <[email-masked]>
Date: Sat, 24 Jun 2006 11:05:26 +0200

> I thought they were submitted to DNSOP. How did they get in the ID-Tracker?

As a matter of general clarification:

The IETF I-D tracker tool <https://datatracker.ietf.org/public/pidtracker.cgi>
will give access to all I-Ds, WG documents and individual submissions.
WG documents are identified by their filename starting with "draft-ietf-dnsop-".

The DNSOP Status Pages <http://tools.ietf.org/wg/dnsop/> will list WG drafts
as well as individual submissions that contain the substring "-dnsop-".
This is just a matter of convenience and there is no formal approval process
for a draft to bear this token. Of course, it's a good idea to notify
the WG chairs of any such submission and the author's intent.

Joe chose not to include the "-dnsop-" token, but instead sent a mail to this
list. In addition, there will be an agenda item in Montreal. So, the two
"AS112" drafts are not WG drafts. The authors asked, in consultation with the
WG chairs, whether the WG would consider adoption of these drafts useful.

-Peter
.

---

From: Dean Anderson <[email-masked]>
Date: Sat, 24 Jun 2006 05:19:57 -0400 (EDT)

IESG--This is probably relevant to the Appeal on draft-ietf-grow-anycast, and
illustrates why the draft-ietf-grow-anycast document should be killed.

I note in the datatracker for draft-ietf-grow-anycast, and am told by Abley,
that they plan to take the document to another draft -04, even though there is
no chance for the document to avoid the stateful anycast subject fraud. Nor is
there any chance of achieving consensus in light of the information known about
the fraud.  Keeping the draft-ietf-grow-anycast document alive in any form gives
the perpetrators the (deception) opportunity to reference the document in new
drafts, as described by Abley below.

Working group chairs should probably also be warned to be alert for documents
that promote the fraudulent stateful anycast scheme.

There is also a note pointed out below from Joe Abley regarding my opposition to
the draft-ietf-grow-anycast which directly contradicts David Kessens statements
in the datatracker comments for draft-ietf-grow-anycast.

More inline. 

 On Fri, 23 Jun 2006, Joe Abley wrote:

> > If you want to put it in the draft, and you want DNSOP to consider the
> > draft, then its relevant.
> 
> Not really. The reference [draft-ietf-grow-anycast -ed.] is an active
> document, and its content is relevant to this draft. If the draft referred to
> dies, then replacing it with a different reference might well make sense.
> However, while the draft referred to is alive, and the most appropriate
> reference, I don't see any reason to make a change.

What the DNSOP group may not know, [but ISC, RIPE, Joe Abley, David Kessens, and
the IESG do know], is that the report claiming that stateful anycast was stable
was fabricated, and no stateful testing was performed by the DNSMON program.

The notion of a safe stateful anycast operation as asserted by Daniel Karrenberg
(http://www.nanog.org/mtg-0505/pdf/karrenberg.pdf) has now been discredited.
Karrenberg's document misled people to believe that stateful anycast was safe,
when in fact Karrenberg didn't perform any stateful testing whatsoever.

So, there is no evidence that stateful anycast is safe, and substantial evidence
that it is not safe:  Mark Kosters reports on data gathered at J root:

http://www.nanog.org/mtg-0410/pdf/kosters.pdf

    + Expected to see a saw tooth distribution .
      instead have a noisy distribution in many cases
    + Does not affect UDP
    + DO NOT RUN Anycast with Stateful Transport

http://www.rssac.org/meetings/04-08/2004WashDC.html
    Kosters repeats warning on stateful DNS Anycast, but is disputed by
Karrenberg.  It is later found (January, 2006) that Karrenberg has done no
stateful testing whatsoever, and did not reveal that his testing was only for
stateless DNS, and therefore irrelevant to Kosters data.  This discovery was
only made when Anderson examined the source code to the DNSMON program written
by Karrenberg to conduct this testing.

Now put this in context along with repeated assertions from Joe Abley and others
associated with ISC and RIPE that stateful anycast is safe and even
non-controversial.

> If this were a working group document, then this matter would be a matter of
> consensus. Since it's an individual submission, I believe it's up to us as
> authors, and any differences of opinion you might have with us should properly
> be brought up if the documents are ever last-called.

So, basically, I can't object until it is last-called?  How interesting, given
that the GROW document was improperly last-called without consensus.  So, you
want me to wait till last-call to raise these objections?  That seems like a
waste of time in the meantime.

This draft inappropriately promotes the fraudulent notion of stateful anycast.  
Your scheme here seems to me to abuse the process, in spite of on-going issues
with scientifically fraudulent stateful anycast claims in the GROW document by
you (Abley) and other conspirators named in the IESG Appeal on this subject.

> It's difficult to characterise your objection as anything other than an
> oblique reaction to the anycast draft, however, of which your dislike is
> profoundly on-record.

This strikes me as odd thing to say. Its odd because David Kessens told the IESG
in the datatracker comments on the GROW draft that I (Anderson) didn't object
strongly to the anycast draft.  How do you think he came to that conclusion
when, as you point out, its so plain that my 'dislike is so profound'?  Strange
indeed.  I suppose this and other odd behavior is why I named him as a
co-conspirator, and asked the IESG to take action against him.

However, there is a different characterization of my objection:  Active drafts
shouldn't contain scientifically fraudulent claims.  The inclusion of this
fraudulent claim to your new draft while the GROW draft is disputed for this
very reason, seems to be more evidence of mis-behavior on your part, and also
reflects on your (already named in IESG Appeal)  co-conspirators.  And perhaps
on the person who added this draft to the ID-tracker. Who was that? (you didn't
answer my first request)

> Is there really new ground to cover, here?

No, not really anything new.  So why are you bringing up discredited claims
again?

> Unless anybody else here has a profound desire to see this circular thread
> continue, I think I will stop at this point.

I do agree this is a somewhat circular thread--in the sense that we've had this
dicussion before.  But I think you should have stopped at the GROW document...Or
probably before then.

		--Dean

.