<div dir="ltr">Hi Manu, <div><br></div><div>Is it still the case? I will try to outreach the people of AS4134 and AS138457.</div><div><br></div><div>Best regards,</div><div>Davey</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 6 Nov 2021 at 12:18, Manu Bretelle <<a href="mailto:chantr4@gmail.com">chantr4@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi all,<br><br>Based on <a href="https://root-servers.org/" target="_blank">https://root-servers.org/</a>, there are a few root servers operated from Mainland China.<br><br>How do we ensure that those are not advertised outside of China so DNS answers are not poisoned by the GFW?<br><br>Are there any contracts that root in CN are supposed to follow to prevent this? Is the onus put on both the CN ASNs and their respective non-CN ASNs peers to not advertise/not accept the root range on those specific peering links? If so, how is it ensured that every operator knows about those rules?<br>Is there any monitoring performed by root operators to ensure that leaks are being detected and possibly addressed?<br><br>I don't believe this specific leak I am seeing is malicious, but rather is just a misconfiguration and I really wonder how this could be prevented/addressed early on.<br>I have ran some probes in other regions and do not have proof that this is happening more widely than a specific AS, but this was not exhaustive and I could have very likely missed something.<br><br>As for this specific problem, we have reached out to both the AS that is accepting the leak and RIPE NCC as we identified the issue, provided the ISP possible workaround in the meantime.<br><br><div>Both DNSSEC and Qname minimization would have helped the resolver detecting bogus answers, or just getting to com. in the first place, while this would have helped, there is still an ongoing leak.<br><br><br>Longer story for the ones that want to dig more into it....<br><br>I am asking because we (FB/Meta) got reports from an ISP in MX which users were not able to access <a href="http://whatsapp.net" target="_blank">whatsapp.net</a>. For instance, answer would be 199.59.149.244.... which is not quite the right answer....<br><br>Some initial debugging from the ISP seemed to point to k-root acting up. e.g something alike:<br><br>```<br># dig +trace <a href="http://d.ns.facebook.com" target="_blank">d.ns.facebook.com</a> <br><br>; <<>> DiG 9.11.13 <<>> +trace <a href="http://d.ns.facebook.com" target="_blank">d.ns.facebook.com</a><br>;; global options: +cmd<br>. 518379 IN NS <a href="http://m.root-servers.net" target="_blank">m.root-servers.net</a>.<br>. 518379 IN NS <a href="http://e.root-servers.net" target="_blank">e.root-servers.net</a>.<br>. 518379 IN NS <a href="http://g.root-servers.net" target="_blank">g.root-servers.net</a>.<br>. 518379 IN NS <a href="http://j.root-servers.net" target="_blank">j.root-servers.net</a>.<br>. 518379 IN NS <a href="http://k.root-servers.net" target="_blank">k.root-servers.net</a>.<br>. 518379 IN NS <a href="http://b.root-servers.net" target="_blank">b.root-servers.net</a>.<br>. 518379 IN NS <a href="http://l.root-servers.net" target="_blank">l.root-servers.net</a>.<br>. 518379 IN NS <a href="http://a.root-servers.net" target="_blank">a.root-servers.net</a>.<br>. 518379 IN NS <a href="http://i.root-servers.net" target="_blank">i.root-servers.net</a>.<br>. 518379 IN NS <a href="http://d.root-servers.net" target="_blank">d.root-servers.net</a>.<br>. 518379 IN NS <a href="http://f.root-servers.net" target="_blank">f.root-servers.net</a>.<br>. 518379 IN NS <a href="http://h.root-servers.net" target="_blank">h.root-servers.net</a>.<br>. 518379 IN NS <a href="http://c.root-servers.net" target="_blank">c.root-servers.net</a>.<br>. 518379 IN RRSIG NS 8 0 518400 20211117170000 20211104160000 14748 . inFOlh92Cxaf58/AdV/M4SZ37+MCm6PMOn6RNHDtE1MR6yvD0sfSPui9 YR3o9Yix/55zuodOWkCh7A0mMosbC5v2gMeiR9iw5jWko5dU7tPPSMnL MZNgsRvIjuR80RWOJnvEVZyz45BXtFWd6UcCIG3BahAUSOXAWhqhkNP4 gF6YeDsZHElhjvhWAzBA/44aFCJPT2nySKuzH4cGRulhO0remY6CHD4o 59fQooYT8lopP6SWdHOmDYhdb6/UBGDELd35QwGG0MDAMSie6jZGGkeb DhAuTFRWzboxlbqQw3nyYlH0Ot8lSatzhx0Cl0rNIBTboFQiWIUMgtVi PeRj0Q==<br>;; Received 1125 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms<br><br>;; expected opt record in response<br><a href="http://d.ns.facebook.com" target="_blank">d.ns.facebook.com</a>. 65 IN A 31.13.67.19<br>;; Received 51 bytes from 193.0.14.129#53(<a href="http://k.root-servers.net" target="_blank">k.root-servers.net</a>) in 231 ms<br>```<br><br>Looking a bit more into it:<br><br>Querying <a href="http://d.ns.facebook.com/A" target="_blank">d.ns.facebook.com/A</a> against k-root directly from MX probes:<br> <a href="https://atlas.ripe.net/measurements/33184386/" target="_blank">https://atlas.ripe.net/measurements/33184386/</a><br>```<br>$ blaeu-resolve -m 33184386 -q A <a href="http://d.ns.facebook.com" target="_blank">d.ns.facebook.com</a><br>[] : 13 occurrences<br>[202.160.128.195] : 1 occurrences<br>[199.59.148.97] : 1 occurrences<br>[185.89.219.12] : 2 occurrences<br>[31.13.96.193] : 1 occurrences<br>[208.77.47.172] : 1 occurrences<br>Test #33184386 done at 2021-11-05T20:36:59Z<br>```<br><br>Getting an answer in the first place is kind of unexpected but I will not focus on the ones returning the correct answer (e.g 185.89.219.12).<br><br>Checking the probes that return those results:<br>```<br>ripe-atlas report --renderer dns_compact 33184386<br>...<br>...<br>Probe #27558: 2021-11-05 13:36:59 NOERROR qr ra rd <a href="http://d.ns.facebook.com" target="_blank">d.ns.facebook.com</a>. 98 A 202.160.128.195<br>Probe #31355: 2021-11-05 13:37:01 NOERROR qr ra rd <a href="http://d.ns.facebook.com" target="_blank">d.ns.facebook.com</a>. 146 A 199.59.148.97<br>Probe #52013: 2021-11-05 13:37:01 NOERROR qr ra rd <a href="http://d.ns.facebook.com" target="_blank">d.ns.facebook.com</a>. 179 A 31.13.96.193<br>Probe #52660: 2021-11-05 13:37:00 NOERROR qr ra rd <a href="http://d.ns.facebook.com" target="_blank">d.ns.facebook.com</a>. 150 A 208.77.47.172<br>...<br>```<br><br>Those probes will fail to reach 193.0.14.129 (k-root) over TCP.<br><br>Checking which id.server is returned by the k-roots reached by those probes:<br><br>```<br>ripe-atlas measure dns --query-argument id.server --query-type TXT --query-class CHAOS --from-country MX --target 193.0.14.129<br><a href="https://atlas.ripe.net/measurements/33184807/" target="_blank">https://atlas.ripe.net/measurements/33184807/</a><br>```<br><br>where the interesting snippet is:<br>```<br>$ ripe-atlas report --renderer dns_compact 33184807<br>...<br>Probe #27558: 2021-11-05 14:08:54 NOERROR qr rd id.server. 0 TXT <a href="http://ns1.cn-ggz.k.ripe.net" target="_blank">ns1.cn-ggz.k.ripe.net</a><br>Probe #31355: 2021-11-05 14:08:55 NOERROR qr rd id.server. 0 TXT <a href="http://ns1.cn-ggz.k.ripe.net" target="_blank">ns1.cn-ggz.k.ripe.net</a><br>Probe #52013: 2021-11-05 14:08:55 NOERROR qr rd id.server. 0 TXT <a href="http://ns1.cn-ggz.k.ripe.net" target="_blank">ns1.cn-ggz.k.ripe.net</a><br>Probe #52660: 2021-11-05 14:08:55 NOERROR qr rd id.server. 0 TXT <a href="http://ns1.cn-ggz.k.ripe.net" target="_blank">ns1.cn-ggz.k.ripe.net</a><br>...<br>```<br><br>Traceroute from those probes to k-root:<br><a href="https://atlas.ripe.net/measurements/33184963/" target="_blank">https://atlas.ripe.net/measurements/33184963/</a><br><br><br>Looking at the traceroutes<br>ripe-atlas report --renderer traceroute --traceroute-show-asns 33184963 <br><br>shows that the last AS before reaching a CN AS and also the first transiting AS from the probe is AS32098<br><br>which when checking their looking glass: <a href="https://lg.transtelco.net/" target="_blank">https://lg.transtelco.net/</a> uses path:<br><br>Transtelco Inc. (AS PATH: 32098)<br>-><br>Asia Pacific Network Information Centre (AS PATH: 4134)<br>-><br>Not found (AS PATH: 58466)<br>-><br>China Academy of Information and Communications Technology (AS PATH: 138457)<br>-><br>Reseaux IP Europeens Network Coordination Centre (RIPE NCC) (AS PATH: 25152)<br><br>Thanks,<br><br>Manu</div></div>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div>