Subject: [dnsop] RFC: "AS112 work basket"

From: Peter Koch <[email-masked]>
Date: Mon, 18 Sep 2006 05:40:34 +0200

Dear working group,

an excerpt of IETF 66's minutes shows:

    Presentation by Joe Abley covers
    - draft-jabley-as112-being-attacked-help-help-00.txt
    - draft-jabley-as112-ops-00.txt

    - Related work: draft-ietf-dnsop-default-local-zones
      - Contains many more zones than AS 112
        - No current good process for adding new zones to AS 112
        - No process for new transports for AS 112, e.g. adding IPv6
    - Adoption by WG?

    Of the people in the room ~10 are involved in running AS 112 instances
    and ~40 have read the AS112 drafts.

    Subject of further discussion was what the WG was expected to do given that
    the documents seemed almost ready. The authors felt that the dnsop wg
    was the broadest forum (compared to NANOG, RIPE, ...) and also the best
    approximation of AS112 operators. Also, Joe felt suggested that AS112
    was IANA sponsored central infrastructure.

    Target status of these documents would be "Informational", including an
    IETF Last Call.

This is a request to the WG to express an opinion on adopting the
different AS112 related work items as a new "AS112 basket", pending AD
approval, i.e. adding AS112 related issues to our charter, currently
consisting of the following tasks

0) draft-ietf-dnsop-default-local-zones

   This Draft is in post-WGLC phase already

1) draft-jabley-as112-being-attacked-help-help-00.txt
   "I'm Being Attacked by PRISONER.IANA.ORG"

   This draft may serve as an Informational RFC, potentially in the FYI
   subseries (see FYI 1/RFC 1150).

2) draft-jabley-as112-ops-00.txt
   AS112 Nameserver Operations

   This draft would cover operation of name servers particpating in the AS112
   project, aiming at Informational status (likely with IETF wide Last Call)

3) [no draft available yet]
   "Updating the zones/transports covered by AS112 servers"

   This new work item would deal with defining a mechanism to control the
   set of zones covered by project AS112 servers, including new transports
   like IPv6.

If you have an opinion whether the dnsop WG should address the overall
issue of project AS112 <http://public.as112.net/> operations, please
state it on the wg mailing list with some reasoning. Please also indicate
whether you'd like to volunteer as a reviewer for one or more of the
mentioned Internet-Drafts (1-3). This is not a Last Call on drafts (1) and (2),
so I'd like to ask that a discussion of specific text portions or pros and cons
be postponed until a decision regarding the general direction has been made.

The authors have offered (1) and (2) for adoption as WG items. Draft (3)
would have to be specified and would need editors and reviewers as well.
Again, this is to be seen in the general context of rechartering the WG
and will need AD approval.

Thanks,
  Peter 
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 18 Sep 2006 11:56:06 +0200

On Mon, Sep 18, 2006 at 05:40:34AM +0200,
 Peter Koch <[email-masked]> wrote 
 a message of 73 lines which said:

> If you have an opinion whether the dnsop WG should address the
> overall issue of project AS112 <http://public.as112.net/>
> operations,

+1

* There is no other obvious *worldwide* forum,
* In practice, dnsop is a good approximation of the interested people.

And I'm volunteer for the drafts.
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Joe Abley <[email-masked]>
Date: Mon, 18 Sep 2006 11:31:23 -0400

Le 2006-09-17 à 23:40, Peter Koch a écrit :

> [...]

I would be very happy to volunteer to edit/(co-)author 3, should it  
be considered that such a draft is worth writing.

Joe

.

---

From: Paul Vixie <[email-masked]>
Date: 18 Sep 2006 15:45:16 +0000

[email-masked] (Peter Koch) writes:

> state it on the wg mailing list with some reasoning.

I think that it should, yes.  AS112 was started in response to a successful
experiment by John Brown and Bill Manning, but it has always lacked formal
structure and technical oversight.  There's nothing this WG can do about the
former, but there's nobody but dnsop in the world who can address the latter.

Additionally, I'd like to thank Joe Abley and William Maton for maintaining
the AS112 web site, and to thank Lars-Johan Liman for answering endless
questions from the public as to what the service is for and why it's nec'y
and why every use of it (20KQPS, 24x7) represents a configuration error.

(And: I'm told that a mailing list of AS112 operators will be created soon.)
-- 
ISC Training!  October 16-20, 2006, in the San Francisco Bay Area,
covering topics from DNS to DHCP.  Email [email-masked].
--
Paul Vixie
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 18 Sep 2006 12:23:31 -0400

> state it on the wg mailing list with some reasoning. 

I am of the opinion that the WG should address the issue, on the
grounds that there isn't another group with the same global reach and
relevant expertise.

> mentioned Internet-Drafts (1-3). 

I am willing to review both 1 and 2 (I can't comment on 3, since it
doesn't exist yet), but I suggest it is in the community's interest
to find some more competent reviewers than I am (I haven't ever run
any AS112 infrastructure, and have never been attacked by any
prisoners of any description).

A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
                                        +1 416 646 3304 x4110

.

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Mon, 18 Sep 2006 18:40:00 +0200

> consisting of the following tasks

As for the motivation. I agree with "the authors" that dnsop is most  
probably the most global forum to deal with this issue and that AS112  
operators and those that "suffer" from their answers are probably  
best found in dnsop.

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: Dean Anderson <[email-masked]>
Date: Mon, 18 Sep 2006 15:39:28 -0400 (EDT)

I don't think the WG should address this as proposed, because AS112 is
unnecessary:  A delegation of "local" address space to IP Address
127.0.0.1 makes all problems go away.  So, there is no need to have
AS112.  Second, AS112 Approach does not offer any pro-active correction
to the problem of misconfiguration, which is the source of the traffic
AS112 hopes to "sink".

There is a better approach.

The better approach is for the WG to recommend to the in-addr.arpa
maintainer to put in delegations for 168.192.in-addr.arpa et al to be
delegated to 127.0.0.1. These delegation records should have the maximum
TTL.

This approach has two beneficial effects that AS112 doesn't 
offer: 

1) The nameserver operator with the misconfigured nameserver will begin
getting "recursion to self" errors, which will prompt corrective action.

2) The delegation records will be cached on the local nameserver,
reducing unnecessary traffic from the misconfigured nameserver.  

Dean Anderson
Av8 Internet, Inc

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

.

---

From: Mohsen Souissi <[email-masked]>
Date: Fri, 29 Sep 2006 10:26:57 +0200

On 18 Sep, Peter Koch wrote:
[...]

 | This is a request to the WG to express an opinion on adopting the
 | different AS112 related work items as a new "AS112 basket", pending AD
 | approval, i.e. adding AS112 related issues to our charter, currently
 | consisting of the following tasks
 | 
 | 0) draft-ietf-dnsop-default-local-zones
 | 
 |    This Draft is in post-WGLC phase already
 | 
 | 1) draft-jabley-as112-being-attacked-help-help-00.txt
 |    "I'm Being Attacked by PRISONER.IANA.ORG"
 | 
 |    This draft may serve as an Informational RFC, potentially in the FYI
 |    subseries (see FYI 1/RFC 1150).
 | 
 | 2) draft-jabley-as112-ops-00.txt
 |    AS112 Nameserver Operations
 | 
 |    This draft would cover operation of name servers particpating in the AS112
 |    project, aiming at Informational status (likely with IETF wide Last Call)
 | 
 | 3) [no draft available yet]
 |    "Updating the zones/transports covered by AS112 servers"
 | 
 |    This new work item would deal with defining a mechanism to control the
 |    set of zones covered by project AS112 servers, including new transports
 |    like IPv6.
 | 
 | If you have an opinion whether the dnsop WG should address the overall
 | issue of project AS112 <http://public.as112.net/> operations, please
 | state it on the wg mailing list with some reasoning. Please also indicate
 | whether you'd like to volunteer as a reviewer for one or more of the
 | mentioned Internet-Drafts (1-3). This is not a Last Call on drafts (1) and (2),
 | so I'd like to ask that a discussion of specific text portions or pros and cons
 | be postponed until a decision regarding the general direction has been made.

==> I support the whole basket above being adopted by dnsop wg, as the
closest IETF wg dealing with connected matters. It would be the
occasion to formalize and also to make the Internet community know,
via an "official" channel, *what* really happens and *how* it happens.

I volunteer to review 1, 2 and 3 (once it is edited).

Mohsen.
.

---

From: Dean Anderson <[email-masked]>
Date: Fri, 29 Sep 2006 16:54:14 -0400 (EDT)

> via an "official" channel, *what* really happens and *how* it happens.

What really happens is that system administrators misconfigure DNS 
servers so that they forward queries for local address space to global 
servers (frequently the roots). This traffic can't properly be answered 
by the roots or by in-addr.arpa zone.

The remedy to this problem is twofold: 
1) relieve this traffic from the root servers 
2) get system administrators to properly configure their nameservers.

One solution proposed has been AS112. The question is whether this is a 
good solution.  There is another solution, and I think better 

Lets think about what the best solution is, before we jump into one
particular, and complicated, solution.

Could you address why it is you think the simpler and approach below
should not be recommended by the working group?

Thanks,

		--Dean

----------

.

---

From: Mark Andrews <[email-masked]>
Date: Sat, 30 Sep 2006 09:24:47 +1000

> should not be recommended by the working group?

	Because it also breaks responses to queries from nameservers that
	are NOT using these addresses.
 
> reducing unnecessary traffic from the misconfigured nameserver.  

	Because it only works when you get responses *back*.  A
	large amout of this traffic is non-repliable by the roots.
 
--
ISC Training!  October 16-20, 2006, in the San Francisco Bay Area,
covering topics from DNS to DHCP.  Email [email-masked].
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html