From wmaton at ottix.net  Fri May 13 13:02:18 2011
From: wmaton at ottix.net (William F. Maton)
Date: Fri, 13 May 2011 09:02:18 -0400 (EDT)
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
Message-ID: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>


All,
 	Since there seems to be as of late an appetite to consider all 
things AS112, I wanted to float this draft here with fellow operators 
before popping this at the IETF submission queue.  Most of it is lifted 
directly from draft-michaelson-as112-ipv6 given that it serves as a nice 
template.  It still needs polishing, so forgive the grammar and style, but 
I wanted to have some as112-ops peer review first.  Comments appreciated.

 	BTW, I'm thinking about RFC 2606, but perhaps I'm pushing my luck.

wfms

PS If the attachment doesn't make it I'll re-post as a message.
-------------- next part --------------



Individual Submission                                           W. Maton
Internet-Draft                                                  NRC-CNRC
Intended status: BCP                                        May 13, 2011
Expires: November 14, 2011


                 Additional IPv4 Delegations for AS112
                     draft-maton-as112-ipv4-cull-00

Abstract

   This is a direction to IANA concerning the delegation of certain
   additional IPv4 zones to the AS112 project.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on November 14, 2011.

Copyright Notice

   Copyright (c) 2011 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.






Maton                   Expires November 14, 2011               [Page 1]

Internet-Draft    Additional IPv4 Delegations for AS112         May 2011


Table of Contents

   1.  Reverse DNS Delegation, Local-Use and Test Addresses  . . . . . 3
   2.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 3
   3.  Security Considerations . . . . . . . . . . . . . . . . . . . . 4
   4.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 4
   5.  References  . . . . . . . . . . . . . . . . . . . . . . . . . . 4
     5.1.  Normative References  . . . . . . . . . . . . . . . . . . . 4
     5.2.  Informative References  . . . . . . . . . . . . . . . . . . 4
   Appendix A.  Change History . . . . . . . . . . . . . . . . . . . . 5
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . . . 6








































Maton                   Expires November 14, 2011               [Page 2]

Internet-Draft    Additional IPv4 Delegations for AS112         May 2011


1.  Reverse DNS Delegation, Local-Use and Test Addresses

   This is a direction to IANA concerning the delegation of certain
   additional IPv4 zones to the AS112 project which operates in an
   anycast cloud [RFC4786].

   When the AS112 Project was first formally proposed in a pair of
   drafts back in 2006, the impact of the load created when executing
   queries involving other IPv4 reverse zones designated as local-use or
   special use was starting to become apparent.  Since that time work
   documenting special use addresses [RFC3330], and its successor
   [RFC5735] appeared containing good candidates for inclusion with the
   exising delegations to the AS112 Project.  These local and special
   use addresses have now been captured and identified for Domain Name
   System (DNS [RFC1034] and [RFC1035]) zone adminstrators to curtail
   leaking queries in [I-D.ietf-dnsop-default-local-zones].

   Additionally, [RFC5737] identifies a short listing of IPv4 address
   blocks for use in documentation.  These too should be considered for
   dlegation to the AS112 Project.

   Thus the purpose of this draft is to effectively signal to the AS112
   Project that it should reflect the efforts of
   [I-D.ietf-dnsop-default-local-zones] and follow directives and
   delegations subsequently issued as described in section 6.

   It is interesting to note that while the focus has largely been on
   the use of [RFC1918] addresses, some addresses (such as those first
   enumerated within [RFC1912]) have as of late also been the subject of
   [I-D.ietf-dnsop-default-local-zones] .


2.  IANA Considerations

   As per the provisions of [RFC3152], this document recommends the IAB
   to direct IANA to delegate the following IN-ADDR.ARPA reverse DNS
   zones to the AS112 project [I-D.ietf-dnsop-as112-ops]:

                 0.in-addr.arpa (IPv4 "This" Network)
               127.in-addr.arpa (IPv4 Loop-Back Network)
           2.0.192.in-addr.arpa (IPv4 Test Net 1)
        100.51.198.in-addr.arpa (IPv4 Test Net 2)
         113.0.203.in-addr.arpa (IPv4 Test Net 3)
   255.255.255.255.in-addr.arpa (IPv4 Broadcast)

   AS112 project servers should add these zones to their configuration,
   and terminate queries efficiently inside their service
   infrastructure.



Maton                   Expires November 14, 2011               [Page 3]

Internet-Draft    Additional IPv4 Delegations for AS112         May 2011


   This delegation instruction is subject to further direction in the
   future from the IAB to IANA, as per the provisions of [RFC3152].


3.  Security Considerations

   The Security Considerations described in [I-D.ietf-dnsop-as112-ops]
   also apply to local-use IPv4 addresses, and should be considered in
   the context of the use of these addresses.

   Security administrators as well as general support personnel who are
   involved in the operations of networked devices may also find the
   information found in the companion document
   [I-D.ietf-dnsop-as112-under-attack-help-help] quite helpful.

   DNS queries may well identify the location of deployment of IPv4
   enabled equipment in private contexts, particularly when the reverse
   queries relate to local-use IPv4 addresses.  While operators of the
   DNS reverse servers should respect the privacy of data relating to
   individual queries made to these reverse address servers, the
   unintentional leakage of information beyond its intended scope of use
   and circulation represents a potential threat to the security of a
   local private network.  This direction to delegate these local-use
   IPv4 reverse address sub-domains does not substantially change the
   security risks of information leakage from private environments.


4.  Acknowledgments

   The author would like to acknowledge the efforts of Mark P. Andrews
   for preparing the work related to serving DNS zones locally and
   George Michaelson and Geoff Huston for their work
   [I-D.michaelson-as112-ipv6] in setting the example for a template to
   be used by the AS112 Project as a direction for the IANA.


5.  References

5.1.  Normative References

   [RFC1034]  Mockapetris, P., "Domain names - concepts and facilities",
              STD 13, RFC 1034, November 1987.

5.2.  Informative References

   [I-D.ietf-dnsop-as112-ops]
              Abley, J. and W. Maton, "AS112 Nameserver Operations",
              draft-ietf-dnsop-as112-ops-09 (work in progress),



Maton                   Expires November 14, 2011               [Page 4]

Internet-Draft    Additional IPv4 Delegations for AS112         May 2011


              May 2011.

   [I-D.ietf-dnsop-as112-under-attack-help-help]
              Abley, J. and W. Maton, "I'm Being Attacked by
              PRISONER.IANA.ORG!",
              draft-ietf-dnsop-as112-under-attack-help-help-06 (work in
              progress), April 2011.

   [I-D.ietf-dnsop-default-local-zones]
              Andrews, M., "Locally-served DNS Zones",
              draft-ietf-dnsop-default-local-zones-15 (work in
              progress), March 2011.

   [I-D.michaelson-as112-ipv6]
              Michaelson, G. and G. Huston, "AS112 Nameserver
              Delegations for IPv6", draft-michaelson-as112-ipv6-00
              (work in progress), March 2011.

   [RFC1035]  Mockapetris, P., "Domain names - implementation and
              specification", STD 13, RFC 1035, November 1987.

   [RFC1912]  Barr, D., "Common DNS Operational and Configuration
              Errors", RFC 1912, February 1996.

   [RFC1918]  Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G., and
              E. Lear, "Address Allocation for Private Internets",
              BCP 5, RFC 1918, February 1996.

   [RFC3152]  Bush, R., "Delegation of IP6.ARPA", BCP 49, RFC 3152,
              August 2001.

   [RFC3330]  IANA, "Special-Use IPv4 Addresses", RFC 3330,
              September 2002.

   [RFC4786]  Abley, J. and K. Lindqvist, "Operation of Anycast
              Services", BCP 126, RFC 4786, December 2006.

   [RFC5735]  Cotton, M. and L. Vegoda, "Special Use IPv4 Addresses",
              BCP 153, RFC 5735, January 2010.

   [RFC5737]  Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks
              Reserved for Documentation", RFC 5737, January 2010.


Appendix A.  Change History

   This section to be removed prior to publication.




Maton                   Expires November 14, 2011               [Page 5]

Internet-Draft    Additional IPv4 Delegations for AS112         May 2011


   00 Initial draft, circulated as draft-maton-as112-ipv4-cull-00.


Author's Address

   William F. Maton Sotomayor
   National Research Council of Canada
   1200 Montreal Road
   Ottawa, ON  K1A 0R6
   Canada

   Phone: +1 613 993 0880
   Email: wmaton at ryouko.imsb.nrc.ca






































Maton                   Expires November 14, 2011               [Page 6]


From nick at inex.ie  Fri May 13 13:46:42 2011
From: nick at inex.ie (Nick Hilliard)
Date: Fri, 13 May 2011 14:46:42 +0100
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
In-Reply-To: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
References: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
Message-ID: <4DCD3642.6000305@inex.ie>

On 13/05/2011 14:02, William F. Maton wrote:
> Since there seems to be as of late an appetite to consider all things
> AS112, I wanted to float this draft here with fellow operators before
> popping this at the IETF submission queue. Most of it is lifted directly
> from draft-michaelson-as112-ipv6 given that it serves as a nice template.
> It still needs polishing, so forgive the grammar and style, but I wanted to
> have some as112-ops peer review first. Comments appreciated.

I think this is a great idea and am all for it, but it may need some 
explicit analysis in the ID of what's going to happen on AS112 nodes which 
are out of date and which don't serve these domains.  e.g. that the 
NXDOMAIN returned (if it actually is returned) may be non-authoritative and 
ignored by the client.

Nick

From vixie at isc.org  Fri May 13 13:55:30 2011
From: vixie at isc.org (Paul Vixie)
Date: Fri, 13 May 2011 13:55:30 +0000
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
In-Reply-To: Your message of "Fri, 13 May 2011 09:02:18 -0400."
	<Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
References: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
Message-ID: <474.1305294930@nsa.vix.com>

i love this.

From vixie at isc.org  Fri May 13 14:06:47 2011
From: vixie at isc.org (Paul Vixie)
Date: Fri, 13 May 2011 14:06:47 +0000
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
In-Reply-To: Your message of "Fri, 13 May 2011 14:46:42 +0100."
	<4DCD3642.6000305@inex.ie>
References: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
	<4DCD3642.6000305@inex.ie>
Message-ID: <1231.1305295607@nsa.vix.com>

> Date: Fri, 13 May 2011 14:46:42 +0100
> From: Nick Hilliard <nick at inex.ie>
> 
> I think this is a great idea and am all for it, but it may need some
> explicit analysis in the ID of what's going to happen on AS112 nodes
> which are out of date and which don't serve these domains.  e.g. that
> the NXDOMAIN returned (if it actually is returned) may be
> non-authoritative and ignored by the client.

true.

apropos of authoritativeness, i think it's time to start planning for
dnssec signing of AS112 zones.  this would mean using a signing key for
which the "usually secret" part was published.

From md at Linux.IT  Fri May 13 14:05:57 2011
From: md at Linux.IT (Marco d'Itri)
Date: Fri, 13 May 2011 16:05:57 +0200
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
In-Reply-To: <4DCD3642.6000305@inex.ie>
References: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
	<4DCD3642.6000305@inex.ie>
Message-ID: <20110513140557.GA9580@bongo.bofh.it>

On May 13, Nick Hilliard <nick at inex.ie> wrote:

> I think this is a great idea and am all for it, but it may need some
> explicit analysis in the ID of what's going to happen on AS112 nodes
> which are out of date and which don't serve these domains.  e.g.
> that the NXDOMAIN returned (if it actually is returned) may be
> non-authoritative and ignored by the client.
They will get more traffic, but this is OK as long as the traffic does
not hit the root servers.

-- 
ciao,
Marco
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://lists.dns-oarc.net/pipermail/as112-ops/attachments/20110513/07e79e6a/attachment.pgp>

From leo.vegoda at icann.org  Fri May 13 15:25:41 2011
From: leo.vegoda at icann.org (Leo Vegoda)
Date: Fri, 13 May 2011 08:25:41 -0700
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
In-Reply-To: <20110513140557.GA9580@bongo.bofh.it>
References: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
	<4DCD3642.6000305@inex.ie> <20110513140557.GA9580@bongo.bofh.it>
Message-ID: <05B243F724B2284986522B6ACD0504D7E5D6A23606@EXVPMBX100-1.exc.icann.org>

Marco wrote:

> > I think this is a great idea and am all for it, but it may need some 
> > explicit analysis in the ID of what's going to happen on AS112 nodes 
> > which are out of date and which don't serve these domains.  e.g.
> > that the NXDOMAIN returned (if it actually is returned) may be 
> > non-authoritative and ignored by the client.
> They will get more traffic, but this is OK as long as the traffic does not hit the root servers.

Wouldn't that traffic go to the servers in in-addr-servers.arpa, rather than the root servers, as they are authoritative for in-addr.arpa?

Regards,

Leo

From jabley at hopcount.ca  Fri May 13 15:32:38 2011
From: jabley at hopcount.ca (Joe Abley)
Date: Fri, 13 May 2011 11:32:38 -0400
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
In-Reply-To: <1231.1305295607@nsa.vix.com>
References: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
	<4DCD3642.6000305@inex.ie> <1231.1305295607@nsa.vix.com>
Message-ID: <DAE16870-C9E6-4856-B32C-F647E3A540C6@hopcount.ca>


On 2011-05-13, at 10:06, Paul Vixie wrote:

> apropos of authoritativeness, i think it's time to start planning for
> dnssec signing of AS112 zones.  this would mean using a signing key for
> which the "usually secret" part was published.

What is the value in signing with a public private key?


Joe


From md at Linux.IT  Fri May 13 16:06:50 2011
From: md at Linux.IT (Marco d'Itri)
Date: Fri, 13 May 2011 18:06:50 +0200
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
In-Reply-To: <05B243F724B2284986522B6ACD0504D7E5D6A23606@EXVPMBX100-1.exc.icann.org>
References: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
	<4DCD3642.6000305@inex.ie> <20110513140557.GA9580@bongo.bofh.it>
	<05B243F724B2284986522B6ACD0504D7E5D6A23606@EXVPMBX100-1.exc.icann.org>
Message-ID: <20110513160650.GA20483@bongo.bofh.it>

On May 13, Leo Vegoda <leo.vegoda at icann.org> wrote:

> > They will get more traffic, but this is OK as long as the traffic does not hit the root servers.
> Wouldn't that traffic go to the servers in in-addr-servers.arpa, rather than the root servers, as they are authoritative for in-addr.arpa?
Yes, I forgot that the root servers are not authoritative anymore for
in-addr.arpa.

-- 
ciao,
Marco

From wmaton at ottix.net  Fri May 13 17:22:00 2011
From: wmaton at ottix.net (William F. Maton)
Date: Fri, 13 May 2011 13:22:00 -0400 (EDT)
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
In-Reply-To: <4DCD3642.6000305@inex.ie>
References: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
	<4DCD3642.6000305@inex.ie>
Message-ID: <Pine.LNX.4.64.1105131320260.16420@iskra.ottix.net>

On Fri, 13 May 2011, Nick Hilliard wrote:

> On 13/05/2011 14:02, William F. Maton wrote:
>> Since there seems to be as of late an appetite to consider all things
>> AS112, I wanted to float this draft here with fellow operators before
>> popping this at the IETF submission queue. Most of it is lifted directly
>> from draft-michaelson-as112-ipv6 given that it serves as a nice template.
>> It still needs polishing, so forgive the grammar and style, but I wanted to
>> have some as112-ops peer review first. Comments appreciated.
>
> I think this is a great idea and am all for it, but it may need some explicit 
> analysis in the ID of what's going to happen on AS112 nodes which are out of 
> date and which don't serve these domains.  e.g. that the NXDOMAIN returned 
> (if it actually is returned) may be non-authoritative and ignored by the 
> client.

Thanks for the feedback Nick.  I'm working through the language for that a 
little bit, although I sense that the AS112 IPv6 draft would need a 
similar blurb.

I've also taken the liberty of feeding it through idnits, looks like the 
RFC3152 has been obsoleted among other things...

wfms

From vixie at isc.org  Fri May 13 18:41:45 2011
From: vixie at isc.org (Paul Vixie)
Date: Fri, 13 May 2011 18:41:45 +0000
Subject: [as112-ops] draft to include more IPv4 reverse zone delegations
In-Reply-To: Your message of "Fri, 13 May 2011 11:32:38 -0400."
	<DAE16870-C9E6-4856-B32C-F647E3A540C6@hopcount.ca>
References: <Pine.LNX.4.64.1105130857170.16420@iskra.ottix.net>
	<4DCD3642.6000305@inex.ie> <1231.1305295607@nsa.vix.com>
	<DAE16870-C9E6-4856-B32C-F647E3A540C6@hopcount.ca>
Message-ID: <16755.1305312105@nsa.vix.com>

> From: Joe Abley <jabley at hopcount.ca>
> Date: Fri, 13 May 2011 11:32:38 -0400
> 
> > apropos of authoritativeness, i think it's time to start planning for
> > dnssec signing of AS112 zones.  this would mean using a signing key for
> > which the "usually secret" part was published.
> 
> What is the value in signing with a public private key?

that depends.  if in-addr.arpa and ip6.arpa will always be signed with NSEC3
and opt-out then there's no benefit.  if we want the option of using NSEC or
using NSEC3 without opt-out then we'd need this.

there's also a subtle difference between proving authenticity and preventing
unintended leaks/pollution.  a public signing key can help with the latter in
many cases that a completely unsigned zone will not help at all.

it's also a precedent setting cool hack, like AS112.  just as unowned anycast
was proved viable, so public signing can be.

