From owner-dnsop@cafax.se Wed Feb 12 17:36:36 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA17978 for ; Wed, 12 Feb 2003 17:36:35 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1CMARoE011792 for ; Wed, 12 Feb 2003 23:10:27 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1CMARgb011791 for dnsop-outgoing; Wed, 12 Feb 2003 23:10:27 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from naptop.autonomica.net (as5-4-6.spa.s.bonet.se [217.215.75.155]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1CMAQoE011786 for ; Wed, 12 Feb 2003 23:10:26 +0100 (MET) Received: from naptop.autonomica.net (localhost [127.0.0.1]) by naptop.autonomica.net (8.12.7.Beta0/8.12.7.Beta0) with ESMTP id h1CMB8pi025040 for ; Wed, 12 Feb 2003 23:11:09 +0100 (MET) To: dnsop@cafax.se Subject: Meeting in SF? From: Lars-Johan Liman Date: 12 Feb 2003 23:11:08 +0100 Message-ID: <22wuk5b14z.fsf@naptop.autonomica.net> Lines: 11 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.2 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-dnsop@cafax.se Precedence: bulk Folks, I guess you want to meet in San Francisco. For that we need an agenda. What do _you_ want to see on the agenda? (Look at it this way: if you raise your voices, you get to talk about the things you would like to talk about; if not, I will decide what we're going to talk about, and you will like that less. :-) Cheers, /Liman #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Wed Feb 12 20:52:53 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA21180 for ; Wed, 12 Feb 2003 20:52:52 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1D1eEoE013528 for ; Thu, 13 Feb 2003 02:40:14 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1D1eEwm013527 for dnsop-outgoing; Thu, 13 Feb 2003 02:40:14 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from rip.psg.com (rip.psg.com [147.28.0.39]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1D1eDoE013518; Thu, 13 Feb 2003 02:40:13 +0100 (MET) Received: from localhost ([127.0.0.1] helo=rip.psg.com) by rip.psg.com with esmtp (Exim 4.12) id 18j8MF-000AEx-00; Wed, 12 Feb 2003 17:40:11 -0800 From: Randy Bush MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Wed, 12 Feb 2003 17:40:10 -0800 To: Lars-Johan Liman Cc: dnsop@cafax.se Subject: Re: Meeting in SF? References: <22wuk5b14z.fsf@naptop.autonomica.net> Message-Id: Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit > I guess you want to meet in San Francisco. For that we need an agenda. > What do _you_ want to see on the agenda? ipv6 data and dual-stack server coexistence #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 13 19:05:53 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA22501 for ; Thu, 13 Feb 2003 19:05:52 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1DNgkoE025531 for ; Fri, 14 Feb 2003 00:42:46 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1DNgk0i025530 for dnsop-outgoing; Fri, 14 Feb 2003 00:42:46 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from rip.psg.com (rip.psg.com [147.28.0.39]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1DNgjoE025525 for ; Fri, 14 Feb 2003 00:42:45 +0100 (MET) Received: from localhost ([127.0.0.1] helo=rip.psg.com) by rip.psg.com with esmtp (Exim 4.12) id 18jT07-0007pt-00; Thu, 13 Feb 2003 15:42:43 -0800 From: Randy Bush MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Thu, 13 Feb 2003 15:42:43 -0800 To: Christian Kuhtz Cc: dns op wg Subject: Re: Meeting in SF? References: <20030213234152.GA210@ns1.arch.bellsouth.net> Message-Id: Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit >>> I guess you want to meet in San Francisco. For that we need an agenda. >>> What do _you_ want to see on the agenda? >> ipv6 data and dual-stack server coexistence > Perhaps you can elaborate this time. Thanks.. dnsop needs to do major work to defind the operational mechanisms and practices for v4/v6 coexistence. the charter was to be changed to reflect this many moons ago. this needs to be done now. and then the meeting should focus on this. randy #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 13 20:36:36 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA25426 for ; Thu, 13 Feb 2003 20:36:34 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1E1G6oE026350 for ; Fri, 14 Feb 2003 02:16:06 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1E1G6RJ026349 for dnsop-outgoing; Fri, 14 Feb 2003 02:16:06 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from patan.sun.com (patan.Sun.COM [192.18.98.43]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1E1G4oE026344 for ; Fri, 14 Feb 2003 02:16:04 +0100 (MET) Received: from esunmail ([129.147.58.120]) by patan.sun.com (8.9.3+Sun/8.9.3) with ESMTP id SAA24410 for ; Thu, 13 Feb 2003 18:16:03 -0700 (MST) Received: from xpa-fe2 (esunmail [129.147.58.120]) by edgemail1.Central.Sun.COM (iPlanet Messaging Server 5.2 HotFix 1.08 (built Dec 6 2002)) with ESMTP id <0HA900AQAY6QDV@edgemail1.Central.Sun.COM> for dnsop@cafax.se; Thu, 13 Feb 2003 18:16:03 -0700 (MST) Received: from sun.com ([66.93.78.11]) by mail.sun.net (iPlanet Messaging Server 5.2 HotFix 1.08 (built Dec 6 2002)) with ESMTPSA id <0HA900J92Y6P3G@mail.sun.net> for dnsop@cafax.se; Thu, 13 Feb 2003 18:16:02 -0700 (MST) Date: Thu, 13 Feb 2003 17:17:10 -0800 From: Alain Durand Subject: Re: Meeting in SF? In-reply-to: To: Randy Bush , dns op wg Message-id: <0A6763F7-3FBA-11D7-8C8C-00039376A6AA@sun.com> MIME-version: 1.0 X-Mailer: Apple Mail (2.551) Content-type: text/plain; charset=US-ASCII; format=flowed Content-transfer-encoding: 7BIT Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7BIT For the sake of discussion, here is what I sent to Liman on Wednesday: Liman, I would like to have more discussions about IPv6 DNS focussed on reverse path DNS. I think it is important to understand what people want to do about this. I will update my draft and write a new one presenting the RFC1101-based idea that was discussed in the mailing list before Atlanta. - Alain. On Thursday, February 13, 2003, at 03:42 PM, Randy Bush wrote: >>>> I guess you want to meet in San Francisco. For that we need an >>>> agenda. >>>> What do _you_ want to see on the agenda? >>> ipv6 data and dual-stack server coexistence >> Perhaps you can elaborate this time. Thanks.. > > dnsop needs to do major work to defind the operational mechanisms and > practices for v4/v6 coexistence. the charter was to be changed to > reflect this many moons ago. this needs to be done now. and then the > meeting should focus on this. > > randy > > #---------------------------------------------------------------------- > # To unsubscribe, send a message to . #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 13 21:05:19 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26229 for ; Thu, 13 Feb 2003 21:05:17 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1E1guoE026561 for ; Fri, 14 Feb 2003 02:42:56 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1E1guSS026560 for dnsop-outgoing; Fri, 14 Feb 2003 02:42:56 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from garlic.apnic.net (garlic.apnic.net [202.12.29.224]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1E1groE026555 for ; Fri, 14 Feb 2003 02:42:54 +0100 (MET) Received: (from ggm@localhost) by garlic.apnic.net (8.11.6/8.11.6) id h1E1fmi00739; Fri, 14 Feb 2003 11:41:48 +1000 (EST) Date: Fri, 14 Feb 2003 11:41:48 +1000 From: George Michaelson To: Alain Durand Cc: randy@psg.com, dnsop@cafax.se Subject: Re: Meeting in SF? Message-Id: <20030214114148.7d28bca2.ggm@apnic.net> In-Reply-To: <0A6763F7-3FBA-11D7-8C8C-00039376A6AA@sun.com> References: <0A6763F7-3FBA-11D7-8C8C-00039376A6AA@sun.com> Organization: APNIC Pty Ltd X-Mailer: Sylpheed version 0.8.8claws (GTK+ 1.2.10; i386--netbsdelf) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit Alain, I was asked by the RIR engineering coordination group to look into writing a draft on how the RIR would support 6to4 and delegation under 2.0.0.2.ip6.arpa. Due to other work, I haven't yet put pen to paper. I think your comments about scalability are true, as is the observation that cooperation from upstream ISPs will be required. This implicitly demands that the RIR have a mechanism in place to support ISPs who need to register reverse DNS for these instances. Putting the scaling issue to one side, the RIR believe that a current procedure being used for transfer of early registration IPv4 records will scale well to cover shared management of IPv6 spaces, and IPv4 spaces ongoing. This mechanism essentially permits the ISPs and address holders to use existing mechanisms for lodgement of reverse-DNS records via the RIR they normally work with, and a shared zone management procedure for us to integrate these discrete records into the zonefile which we then co-assert. Late last year Randy Bush also asked if we could investigate a process to expedite support of 6to4 delegation. Now that we are close to having the shared zone management process bedded in, Its realistic to proceed. So if I can get a brief draft written up in time, could we discuss this in SF? cheers -George #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 11:17:16 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA19866 for ; Thu, 20 Feb 2003 11:17:15 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KFdhoE005229 for ; Thu, 20 Feb 2003 16:39:43 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1KFdhLu005228 for dnsop-outgoing; Thu, 20 Feb 2003 16:39:43 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from wentzl.cdg.chalmers.se (wentzl.cdg.chalmers.se [129.16.12.9]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KFdJoE005222 for ; Thu, 20 Feb 2003 16:39:23 +0100 (MET) Received: from wilfer1.cdg.chalmers.se (AG7Rbvq5Cd56IxJciIKxkSbC3XZNFQZq@wilfer1.cdg.chalmers.se [129.16.12.11]) by wentzl.cdg.chalmers.se (8.8.8/8.8.8) with ESMTP id QAA20932; Thu, 20 Feb 2003 16:39:02 +0100 (MET) From: Gunnar Lindberg Received: (from lindberg@localhost) by wilfer1.cdg.chalmers.se (8.8.8/8.8.8) id QAA14337; Thu, 20 Feb 2003 16:39:02 +0100 (MET) Date: Thu, 20 Feb 2003 16:39:02 +0100 (MET) Message-Id: <200302201539.QAA14337@wilfer1.cdg.chalmers.se> To: dnsop@cafax.se Subject: timeout of glue A record X-Mailer: UCB Mail 5.3.26 2003-02-19 (MIME) Sender: owner-dnsop@cafax.se Precedence: bulk Is this a bug or a flaw in the DNS design? Some days ago we saw: % dig @our-ns1 foo.bar ns ;; ANSWER SECTION: foo.bar. 23h19m44s IN NS b.ns.foo.bar. foo.bar. 23h19m44s IN NS a.ns.foo.bar. ;; ADDITIONAL SECTION: ;; None - NB <----------------- % dig @our-ns2 foo.bar ns ;; ANSWER SECTION: foo.bar. 2m51s IN NS a.ns.foo.bar. foo.bar. 2m51s IN NS b.ns.foo.bar. ;; ADDITIONAL SECTION: a.ns.foo.bar. 2m51s IN A 192.n.m.1 b.ns.foo.bar. 2m51s IN A 192.n.m.2 So, our-ns1 had a reference to their NSs (the names to be specific) but the corresponding glue A records were missing. What happened before to get us into this state is beyond my knowledge, but since our-ns2 was counting down the glue A's ttl I take it they reached 0 and were simply discarded. After 2m51s our-ns2 was able to refresh both set of records, while our-ns1 stayed out of sync for another 23h19m44s. It would seem reasonable to me that the DNS should not keep NS records unless it has at least some A records to support them. Is this a bug or design flaw? Gunnar Lindberg #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 11:49:29 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20976 for ; Thu, 20 Feb 2003 11:49:29 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KGVHoE005781 for ; Thu, 20 Feb 2003 17:31:17 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1KGVHFF005780 for dnsop-outgoing; Thu, 20 Feb 2003 17:31:17 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from outpost.ds9a.nl (outpost.ds9a.nl [213.244.168.210]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KGVFoE005775 for ; Thu, 20 Feb 2003 17:31:16 +0100 (MET) Received: by outpost.ds9a.nl (Postfix, from userid 1000) id 7DDF24072; Thu, 20 Feb 2003 17:31:15 +0100 (CET) Date: Thu, 20 Feb 2003 17:31:15 +0100 From: bert hubert To: Gunnar Lindberg Cc: dnsop@cafax.se Subject: Re: timeout of glue A record Message-ID: <20030220163115.GC521@outpost.ds9a.nl> Mail-Followup-To: bert hubert , Gunnar Lindberg , dnsop@cafax.se References: <200302201539.QAA14337@wilfer1.cdg.chalmers.se> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200302201539.QAA14337@wilfer1.cdg.chalmers.se> User-Agent: Mutt/1.3.28i Sender: owner-dnsop@cafax.se Precedence: bulk On Thu, Feb 20, 2003 at 04:39:02PM +0100, Gunnar Lindberg wrote: > Is this a bug or a flaw in the DNS design? Some days ago we saw: This is something a recursor has to deal with. Check out the 'syncres.cc' file in the PowerDNS tar.gz (http://www.powerdns.com/downloads) for one way to deal with this problem. It is not really a bug in DNS design, it is a resolver challenge. Different implementations solve it in different ways. One of the hardest problems is to make sure that you don't end up in a loop but break out high enough so you get records back. DJB has some notes on this somewhere on http://cr.yp.to/djbdns/notes.html which describe how his software and BIND solve this problem. Regards, bert -- http://www.PowerDNS.com Open source, database driven DNS Software http://lartc.org Linux Advanced Routing & Traffic Control HOWTO http://netherlabs.nl Consulting #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 12:12:31 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21680 for ; Thu, 20 Feb 2003 12:12:30 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KGqgoE006119 for ; Thu, 20 Feb 2003 17:52:42 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1KGqgpM006118 for dnsop-outgoing; Thu, 20 Feb 2003 17:52:42 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from thrintun.hactrn.net (dsl092-066-067.bos1.dsl.speakeasy.net [66.92.66.67]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KGqeoE006113 for ; Thu, 20 Feb 2003 17:52:41 +0100 (MET) Received: from thrintun.hactrn.net (localhost [::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 9A0FE18F2 for ; Thu, 20 Feb 2003 11:52:39 -0500 (EST) Date: Thu, 20 Feb 2003 11:52:39 -0500 From: Rob Austein To: dnsop@cafax.se Subject: Re: timeout of glue A record In-Reply-To: <200302201539.QAA14337@wilfer1.cdg.chalmers.se> References: <200302201539.QAA14337@wilfer1.cdg.chalmers.se> User-Agent: Wanderlust/2.8.1 (Something) Emacs/20.7 Mule/4.0 (HANANOEN) MIME-Version: 1.0 (generated by SEMI 1.14.4 - "Hosorogi") Content-Type: text/plain; charset=US-ASCII Message-Id: <20030220165239.9A0FE18F2@thrintun.hactrn.net> Sender: owner-dnsop@cafax.se Precedence: bulk At Thu, 20 Feb 2003 16:39:02 +0100 (MET), Gunnar Lindberg wrote: > > So, our-ns1 had a reference to their NSs (the names to be specific) > but the corresponding glue A records were missing. What happened > before to get us into this state is beyond my knowledge, but since > our-ns2 was counting down the glue A's ttl I take it they reached 0 > and were simply discarded. > > After 2m51s our-ns2 was able to refresh both set of records, while > our-ns1 stayed out of sync for another 23h19m44s. > > It would seem reasonable to me that the DNS should not keep NS > records unless it has at least some A records to support them. The resolver has to detect and recover from this situation. One way or another, the recovery involves lowering the NS TTLs (either explicitly, or just by realizing that it has gotten into this trap and issuing a query for the NS RRset even though there's an unexpired NS RRset in the resolver's cache). #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 14:16:39 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26091 for ; Thu, 20 Feb 2003 14:16:38 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KJ3XoE007508 for ; Thu, 20 Feb 2003 20:03:33 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1KJ3XXG007507 for dnsop-outgoing; Thu, 20 Feb 2003 20:03:33 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from igor.alcpress.com (igor.alcpress.com [208.151.249.202]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KJ3VoE007502 for ; Thu, 20 Feb 2003 20:03:32 +0100 (MET) Received: from db.panug.org (db.panug.org [208.151.249.203]) by igor.alcpress.com (Postfix) with ESMTP id AA0485585E for ; Thu, 20 Feb 2003 11:03:22 -0800 (PST) Subject: Why one port? From: Ed Sawicki To: dnsop@cafax.se Content-Type: text/plain Organization: ALC Message-Id: <1045767795.1155.135.camel@red> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.1 Date: 20 Feb 2003 11:03:15 -0800 Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit I'm wondering why there is only one UDP port assigned to the DNS protocol? It prevents us from using both an iterative name server and a recursive name server/cache on the same computer when only one IP address is available. -- Ed Sawicki ALC #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 16:29:42 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA00230 for ; Thu, 20 Feb 2003 16:29:41 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KLE1oE009037 for ; Thu, 20 Feb 2003 22:14:01 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1KLE1Qt009036 for dnsop-outgoing; Thu, 20 Feb 2003 22:14:01 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from outpost.ds9a.nl (outpost.ds9a.nl [213.244.168.210]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KLE0oE009031 for ; Thu, 20 Feb 2003 22:14:00 +0100 (MET) Received: by outpost.ds9a.nl (Postfix, from userid 1000) id 3906D4515; Thu, 20 Feb 2003 22:14:00 +0100 (CET) Date: Thu, 20 Feb 2003 22:14:00 +0100 From: bert hubert To: Ed Sawicki Cc: dnsop@cafax.se Subject: Re: Why one port? Message-ID: <20030220211400.GA14720@outpost.ds9a.nl> Mail-Followup-To: bert hubert , Ed Sawicki , dnsop@cafax.se References: <1045767795.1155.135.camel@red> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1045767795.1155.135.camel@red> User-Agent: Mutt/1.3.28i Sender: owner-dnsop@cafax.se Precedence: bulk On Thu, Feb 20, 2003 at 11:03:15AM -0800, Ed Sawicki wrote: > I'm wondering why there is only one UDP port assigned to the DNS > protocol? It prevents us from using both an iterative name > server and a recursive name server/cache on the same computer > when only one IP address is available. Well, that is partly due to the wording of 1034 and 1035 which pretty much mention 'local cache' and 'local database' in one breath. And indeed, this is a big mistake. Right now, you can't even differentiate based on the RD bit. Compare it to running Squid and Apache both on port 80. Regards, bert -- http://www.PowerDNS.com Open source, database driven DNS Software http://lartc.org Linux Advanced Routing & Traffic Control HOWTO http://netherlabs.nl Consulting #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 17:10:04 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA01501 for ; Thu, 20 Feb 2003 17:10:04 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KLuOoE009595 for ; Thu, 20 Feb 2003 22:56:24 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1KLuOht009594 for dnsop-outgoing; Thu, 20 Feb 2003 22:56:24 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from igor.alcpress.com (igor.alcpress.com [208.151.249.202]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KLuMoE009589 for ; Thu, 20 Feb 2003 22:56:23 +0100 (MET) Received: from db.panug.org (db.panug.org [208.151.249.203]) by igor.alcpress.com (Postfix) with ESMTP id E22575585E; Thu, 20 Feb 2003 13:56:20 -0800 (PST) Subject: Re: Why one port? From: Ed Sawicki To: bert hubert Cc: dnsop@cafax.se In-Reply-To: <20030220211400.GA14720@outpost.ds9a.nl> References: <1045767795.1155.135.camel@red> <20030220211400.GA14720@outpost.ds9a.nl> Content-Type: text/plain Organization: ALC Message-Id: <1045778179.1153.159.camel@red> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.1 Date: 20 Feb 2003 13:56:19 -0800 Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit On Thu, 2003-02-20 at 13:14, bert hubert wrote: > On Thu, Feb 20, 2003 at 11:03:15AM -0800, Ed Sawicki wrote: > > I'm wondering why there is only one UDP port assigned to the DNS > > protocol? It prevents us from using both an iterative name > > server and a recursive name server/cache on the same computer > > when only one IP address is available. > > Well, that is partly due to the wording of 1034 and 1035 which pretty much > mention 'local cache' and 'local database' in one breath. > > And indeed, this is a big mistake. Right now, you can't even differentiate > based on the RD bit. Compare it to running Squid and Apache both on port 80. > > Regards, > > bert Shouldn't we try to fix it? -- Ed Sawicki ALC #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 17:29:19 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA02098 for ; Thu, 20 Feb 2003 17:29:19 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KMALoE009741 for ; Thu, 20 Feb 2003 23:10:21 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1KMALNm009740 for dnsop-outgoing; Thu, 20 Feb 2003 23:10:21 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from outpost.ds9a.nl (outpost.ds9a.nl [213.244.168.210]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KMAKoE009735 for ; Thu, 20 Feb 2003 23:10:20 +0100 (MET) Received: by outpost.ds9a.nl (Postfix, from userid 1000) id 519E24515; Thu, 20 Feb 2003 23:10:20 +0100 (CET) Date: Thu, 20 Feb 2003 23:10:20 +0100 From: bert hubert To: dnsop@cafax.se Subject: Re: Why one port? Message-ID: <20030220221020.GD14720@outpost.ds9a.nl> Mail-Followup-To: bert hubert , dnsop@cafax.se References: <1045767795.1155.135.camel@red> <20030220211400.GA14720@outpost.ds9a.nl> <1045778179.1153.159.camel@red> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1045778179.1153.159.camel@red> User-Agent: Mutt/1.3.28i Sender: owner-dnsop@cafax.se Precedence: bulk On Thu, Feb 20, 2003 at 01:56:19PM -0800, Ed Sawicki wrote: > > And indeed, this is a big mistake. Right now, you can't even differentiate > > based on the RD bit. Compare it to running Squid and Apache both on port 80. > > Shouldn't we try to fix it? Way, way too late - changing a lot about DNS right now is next to impossible, I'm afraid. Regards, bert -- http://www.PowerDNS.com Open source, database driven DNS Software http://lartc.org Linux Advanced Routing & Traffic Control HOWTO http://netherlabs.nl Consulting #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 18:30:39 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA03395 for ; Thu, 20 Feb 2003 18:30:39 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KNJDoE010355 for ; Fri, 21 Feb 2003 00:19:13 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1KNJDSv010354 for dnsop-outgoing; Fri, 21 Feb 2003 00:19:13 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from birch.ripe.net (birch.ripe.net [193.0.1.96]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KNJCoE010349 for ; Fri, 21 Feb 2003 00:19:12 +0100 (MET) Received: from x22.ripe.net (x22.ripe.net [193.0.1.22]) by birch.ripe.net (8.12.5/8.11.6) with ESMTP id h1KNJCAr014604 for ; Fri, 21 Feb 2003 00:19:12 +0100 Date: Fri, 21 Feb 2003 00:19:12 +0100 (CET) From: Bruce Campbell X-X-Sender: bc@x22.ripe.net To: dnsop@cafax.se Subject: Re: Why one port? In-Reply-To: <1045767795.1155.135.camel@red> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-dnsop@cafax.se Precedence: bulk On 20 Feb 2003, Ed Sawicki wrote: > I'm wondering why there is only one UDP port assigned to the DNS > protocol? It prevents us from using both an iterative name > server and a recursive name server/cache on the same computer > when only one IP address is available. It does not prevent you from doing so. Most decent DNS servers allow you to be authoritative to one set of IP addresses, and recursive to another set of IP addresses. ( Whether information from the recursive side leaks into the authoritative side is another issue ) --==-- Bruce. #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 19:26:56 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA03396 for ; Thu, 20 Feb 2003 18:30:39 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KNK9oE010369 for ; Fri, 21 Feb 2003 00:20:09 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1KNK9Ld010368 for dnsop-outgoing; Fri, 21 Feb 2003 00:20:09 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from garlic.amaranth.net (garlic.amaranth.net [208.254.46.17]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1KNK7oE010363 for ; Fri, 21 Feb 2003 00:20:08 +0100 (MET) Received: from Willow.senie.com (amaranth.ne.client2.attbi.com [24.91.81.100]) (authenticated (0 bits)) by garlic.amaranth.net (8.11.6/8.11.6) with ESMTP id h1KNK6l03378 (using TLSv1/SSLv3 with cipher DES-CBC3-SHA (168 bits) verified NO) for ; Thu, 20 Feb 2003 18:20:06 -0500 Message-Id: <5.2.0.9.2.20030220181252.01a067f0@mail.amaranth.net> X-Sender: dts@mail.amaranth.net X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Thu, 20 Feb 2003 18:15:57 -0500 To: dnsop@cafax.se From: Daniel Senie Subject: Re: Why one port? In-Reply-To: <20030220221020.GD14720@outpost.ds9a.nl> References: <1045778179.1153.159.camel@red> <1045767795.1155.135.camel@red> <20030220211400.GA14720@outpost.ds9a.nl> <1045778179.1153.159.camel@red> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-dnsop@cafax.se Precedence: bulk At 05:10 PM 2/20/2003, bert hubert wrote: >On Thu, Feb 20, 2003 at 01:56:19PM -0800, Ed Sawicki wrote: > > > And indeed, this is a big mistake. Right now, you can't even > differentiate > > > based on the RD bit. Compare it to running Squid and Apache both on > port 80. > > > > Shouldn't we try to fix it? > >Way, way too late - changing a lot about DNS right now is next to >impossible, I'm afraid. Though that was my immediate reaction as well, I'll note the slow progression with SMTP servers to implement SUBMISSION protocol. That separation was done for much the same reason. Any change would take close to forever to complete, and existing servers would have to deal with users making requests on port 53 pretty much forever, but I it is a process that could be started. The question is whether it's worth the effort in this case. Given the price of hardware, and the availability of virtual machine OS environments, is it really worth going down this road? #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 20:05:16 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05373 for ; Thu, 20 Feb 2003 20:05:14 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L0sWoE011215 for ; Fri, 21 Feb 2003 01:54:32 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1L0sW6U011214 for dnsop-outgoing; Fri, 21 Feb 2003 01:54:32 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from vador.skynet.be (vador.skynet.be [195.238.3.236]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L0sVoE011209 for ; Fri, 21 Feb 2003 01:54:31 +0100 (MET) Received: from [10.0.1.4] (ip-26.shub-internet.org [194.78.144.26] (may be forged)) by vador.skynet.be (8.12.7/8.12.7/Skynet-OUT-2.21) with ESMTP id h1L0rr0f017023; Fri, 21 Feb 2003 01:54:17 +0100 (MET) (envelope-from ) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <20030220211400.GA14720@outpost.ds9a.nl> References: <1045767795.1155.135.camel@red> <20030220211400.GA14720@outpost.ds9a.nl> Date: Fri, 21 Feb 2003 01:27:46 +0100 To: bert hubert From: Brad Knowles Subject: Re: Why one port? Cc: Ed Sawicki , dnsop@cafax.se Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 10:14 PM +0100 2003/02/20, bert hubert wrote: > And indeed, this is a big mistake. Right now, you can't even differentiate > based on the RD bit. Compare it to running Squid and Apache both on port 80. You distinguish based on source address of the query. I see no other option. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 20:56:57 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05374 for ; Thu, 20 Feb 2003 20:05:14 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L0sXoE011223 for ; Fri, 21 Feb 2003 01:54:33 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1L0sXSI011222 for dnsop-outgoing; Fri, 21 Feb 2003 01:54:33 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from vador.skynet.be (vador.skynet.be [195.238.3.236]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L0sWoE011217 for ; Fri, 21 Feb 2003 01:54:33 +0100 (MET) Received: from [10.0.1.4] (ip-26.shub-internet.org [194.78.144.26] (may be forged)) by vador.skynet.be (8.12.7/8.12.7/Skynet-OUT-2.21) with ESMTP id h1L0rr0h017023; Fri, 21 Feb 2003 01:54:22 +0100 (MET) (envelope-from ) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <1045778179.1153.159.camel@red> References: <1045767795.1155.135.camel@red> <20030220211400.GA14720@outpost.ds9a.nl> <1045778179.1153.159.camel@red> Date: Fri, 21 Feb 2003 01:29:13 +0100 To: Ed Sawicki From: Brad Knowles Subject: Re: Why one port? Cc: bert hubert , dnsop@cafax.se Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 1:56 PM -0800 2003/02/20, Ed Sawicki wrote: > Shouldn't we try to fix it? How do you propose that we do that? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 20 20:56:58 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA05375 for ; Thu, 20 Feb 2003 20:05:14 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L0sVoE011207 for ; Fri, 21 Feb 2003 01:54:31 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1L0sVLP011206 for dnsop-outgoing; Fri, 21 Feb 2003 01:54:31 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from vador.skynet.be (vador.skynet.be [195.238.3.236]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L0sUoE011201 for ; Fri, 21 Feb 2003 01:54:30 +0100 (MET) Received: from [10.0.1.4] (ip-26.shub-internet.org [194.78.144.26] (may be forged)) by vador.skynet.be (8.12.7/8.12.7/Skynet-OUT-2.21) with ESMTP id h1L0rr0d017023; Fri, 21 Feb 2003 01:54:13 +0100 (MET) (envelope-from ) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <1045767795.1155.135.camel@red> References: <1045767795.1155.135.camel@red> Date: Fri, 21 Feb 2003 01:25:33 +0100 To: Ed Sawicki From: Brad Knowles Subject: Re: Why one port? Cc: dnsop@cafax.se Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 11:03 AM -0800 2003/02/20, Ed Sawicki wrote: > I'm wondering why there is only one UDP port assigned to the DNS > protocol? That's the way the standard was originally written. > It prevents us from using both an iterative name > server and a recursive name server/cache on the same computer > when only one IP address is available. Yup. That's a big problem for programs that can't handle both functions in one codebase. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 03:54:55 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA23502 for ; Fri, 21 Feb 2003 03:54:55 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L8i9oE015105 for ; Fri, 21 Feb 2003 09:44:09 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1L8i9FO015104 for dnsop-outgoing; Fri, 21 Feb 2003 09:44:09 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from igor.alcpress.com (igor.alcpress.com [208.151.249.202]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L8i8oE015099 for ; Fri, 21 Feb 2003 09:44:08 +0100 (MET) Received: from db.panug.org (db.panug.org [208.151.249.203]) by igor.alcpress.com (Postfix) with ESMTP id CD4865585E; Fri, 21 Feb 2003 00:44:04 -0800 (PST) Subject: Re: Why one port? From: Ed Sawicki To: Brad Knowles Cc: dnsop@cafax.se In-Reply-To: References: <1045767795.1155.135.camel@red> Content-Type: text/plain Organization: ALC Message-Id: <1045817043.1154.173.camel@red> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.1 Date: 21 Feb 2003 00:44:03 -0800 Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit On Thu, 2003-02-20 at 16:25, Brad Knowles wrote: > At 11:03 AM -0800 2003/02/20, Ed Sawicki wrote: > > > I'm wondering why there is only one UDP port assigned to the DNS > > protocol? > > That's the way the standard was originally written. > > > It prevents us from using both an iterative name > > server and a recursive name server/cache on the same computer > > when only one IP address is available. > > Yup. That's a big problem for programs that can't handle both > functions in one codebase. I want my systems to be as secure from attack as possible. To me, this means never allowing both functions to be provided by the same codebase. -- Ed Sawicki ALC #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 03:56:35 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA23534 for ; Fri, 21 Feb 2003 03:56:35 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L8oQoE015188 for ; Fri, 21 Feb 2003 09:50:26 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1L8oQwY015187 for dnsop-outgoing; Fri, 21 Feb 2003 09:50:26 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from igor.alcpress.com (igor.alcpress.com [208.151.249.202]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L8oPoE015180 for ; Fri, 21 Feb 2003 09:50:25 +0100 (MET) Received: from db.panug.org (db.panug.org [208.151.249.203]) by igor.alcpress.com (Postfix) with ESMTP id 83D0E5585E; Fri, 21 Feb 2003 00:50:21 -0800 (PST) Subject: Re: Why one port? From: Ed Sawicki To: Brad Knowles Cc: dnsop@cafax.se In-Reply-To: References: <1045767795.1155.135.camel@red> <20030220211400.GA14720@outpost.ds9a.nl> <1045778179.1153.159.camel@red> Content-Type: text/plain Organization: ALC Message-Id: <1045817420.1859.179.camel@red> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.1 Date: 21 Feb 2003 00:50:21 -0800 Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit On Thu, 2003-02-20 at 16:29, Brad Knowles wrote: > At 1:56 PM -0800 2003/02/20, Ed Sawicki wrote: > > > Shouldn't we try to fix it? > > How do you propose that we do that? I don't know. Allocate another port and rewrite resolvers, libraries, and recursive name servers/caches? -- Ed Sawicki ALC #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 04:52:05 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA24502 for ; Fri, 21 Feb 2003 04:52:04 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L9fCoE015619 for ; Fri, 21 Feb 2003 10:41:12 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1L9fCso015618 for dnsop-outgoing; Fri, 21 Feb 2003 10:41:12 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from shell.nominum.com (shell.nominum.com [128.177.192.160]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L9fBoE015613 for ; Fri, 21 Feb 2003 10:41:11 +0100 (MET) Received: from shell.nominum.com (localhost [127.0.0.1]) by shell.nominum.com (Postfix) with ESMTP id 2006F137F06; Fri, 21 Feb 2003 01:41:10 -0800 (PST) To: Ed Sawicki Cc: Brad Knowles , dnsop@cafax.se Subject: Re: Why one port? In-Reply-To: Message from Ed Sawicki of "21 Feb 2003 00:50:21 PST." <1045817420.1859.179.camel@red> Date: Fri, 21 Feb 2003 01:41:10 -0800 Message-ID: <86510.1045820470@shell.nominum.com> From: Jim Reid Sender: owner-dnsop@cafax.se Precedence: bulk >>>>> "Ed" == Ed Sawicki writes: >> How do you propose that we do that? Ed> I don't know. Allocate another port and rewrite resolvers, Ed> libraries, and recursive name servers/caches? This is a troll, right? If such a scheme was going to be deployed, we might as well fix everything else in the DNS that needs fixing. Since there would be the mother of all flag days, we might as well ensure that every device on the net got upgraded to the as-yet-undesigned DNSv2. Oh and IANA would likely take a dim view of assigning >1 port number for the same protocol. #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 05:02:50 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA24758 for ; Fri, 21 Feb 2003 05:02:49 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L9l1oE015741 for ; Fri, 21 Feb 2003 10:47:01 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1L9l13H015740 for dnsop-outgoing; Fri, 21 Feb 2003 10:47:01 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from shell.nominum.com (shell.nominum.com [128.177.192.160]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1L9l0oE015735 for ; Fri, 21 Feb 2003 10:47:00 +0100 (MET) Received: from shell.nominum.com (localhost [127.0.0.1]) by shell.nominum.com (Postfix) with ESMTP id AAD8B137F06; Fri, 21 Feb 2003 01:46:59 -0800 (PST) To: Ed Sawicki Cc: Brad Knowles , dnsop@cafax.se Subject: Re: Why one port? In-Reply-To: Message from Ed Sawicki of "21 Feb 2003 00:44:03 PST." <1045817043.1154.173.camel@red> Date: Fri, 21 Feb 2003 01:46:59 -0800 Message-ID: <86549.1045820819@shell.nominum.com> From: Jim Reid Sender: owner-dnsop@cafax.se Precedence: bulk >>>>> "Ed" == Ed Sawicki writes: Ed> I want my systems to be as secure from attack as possible. To Ed> me, this means never allowing both functions to be provided by Ed> the same codebase. Fine. But by the same reasoning, you wouldn't want to provide both functions on the same box. So have discrete hardware and software for the authoritative and resolving servers and we're done. Beats changing the whole internet, no? #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 08:07:35 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA28471 for ; Fri, 21 Feb 2003 08:07:33 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LCrtoE017295 for ; Fri, 21 Feb 2003 13:53:55 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LCrtYh017294 for dnsop-outgoing; Fri, 21 Feb 2003 13:53:55 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from pollux.asml.nl (ns.asml.nl [195.109.200.66]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LCrroE017283 for ; Fri, 21 Feb 2003 13:53:53 +0100 (MET) Received: from nlvdhv01.asml.nl (nlvdhv01 [195.109.200.68]) by pollux.asml.nl (8.8.8+Sun/8.8.8) with SMTP id NAA21132; Fri, 21 Feb 2003 13:53:45 +0100 (MET) Received: from unknown(146.106.1.223) by nlvdhv01.asml.nl via csmap id 4194; Fri, 21 Feb 2003 13:52:16 +0100 (CET) Received: from titan.asml.nl (titan [146.106.1.9]) by creon.asml.nl (8.11.6+Sun/8.11.6) with ESMTP id h1LCrjq25847; Fri, 21 Feb 2003 13:53:45 +0100 (MET) Received: from [10.0.1.4] (frobozz.asml.nl [146.106.12.76]) by titan.asml.nl (8.9.3+Sun/8.9.3) with ESMTP id NAA03956; Fri, 21 Feb 2003 13:53:44 +0100 (MET) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <1045817420.1859.179.camel@red> References: <1045767795.1155.135.camel@red> <20030220211400.GA14720@outpost.ds9a.nl> <1045778179.1153.159.camel@red> <1045817420.1859.179.camel@red> Date: Fri, 21 Feb 2003 13:47:22 +0100 To: Ed Sawicki From: Brad Knowles Subject: Re: Why one port? Cc: Brad Knowles , dnsop@cafax.se Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 12:50 AM -0800 2003/02/21, Ed Sawicki wrote: > I don't know. Allocate another port and rewrite > resolvers, libraries, and recursive name servers/caches? Riiiiiiiight. You're going to fix all machines on the entire Internet? I don't think so. We might theoretically add another port for non-recursive server-to-server communications, at at some point in the far distant future, we might be able to switch port 53 to be recursive only. But all current nameserver software would have to be fixed, and we'd have to monitor how many queries are coming in to what machines on what ports and only make the cutover once we got past some milestone threshold -- e.g., less than 10% of all queries are coming in to port 53. Frankly, without a predefined Flag Day, I don't think you could make this work. And I don't think you'd want to try to define a Flag Day until this sort of thing was relatively widely adopted already. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 08:07:51 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA28490 for ; Fri, 21 Feb 2003 08:07:51 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LCrtoE017293 for ; Fri, 21 Feb 2003 13:53:55 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LCrt6E017292 for dnsop-outgoing; Fri, 21 Feb 2003 13:53:55 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from pollux.asml.nl (ns.asml.nl [195.109.200.66]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LCrroE017282 for ; Fri, 21 Feb 2003 13:53:53 +0100 (MET) Received: from nlvdhv01.asml.nl (nlvdhv01 [195.109.200.68]) by pollux.asml.nl (8.8.8+Sun/8.8.8) with SMTP id NAA21124; Fri, 21 Feb 2003 13:53:43 +0100 (MET) Received: from unknown(146.106.1.223) by nlvdhv01.asml.nl via csmap id 3276; Fri, 21 Feb 2003 13:52:14 +0100 (CET) Received: from titan.asml.nl (titan [146.106.1.9]) by creon.asml.nl (8.11.6+Sun/8.11.6) with ESMTP id h1LCrgq25811; Fri, 21 Feb 2003 13:53:42 +0100 (MET) Received: from [10.0.1.4] (frobozz.asml.nl [146.106.12.76]) by titan.asml.nl (8.9.3+Sun/8.9.3) with ESMTP id NAA03911; Fri, 21 Feb 2003 13:53:35 +0100 (MET) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <1045817043.1154.173.camel@red> References: <1045767795.1155.135.camel@red> <1045817043.1154.173.camel@red> Date: Fri, 21 Feb 2003 13:43:13 +0100 To: Ed Sawicki From: Brad Knowles Subject: Re: Why one port? Cc: Brad Knowles , dnsop@cafax.se Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 12:44 AM -0800 2003/02/21, Ed Sawicki wrote: > I want my systems to be as secure from attack as possible. To me, > this means never allowing both functions to be provided by the > same codebase. Your only other option is to use forwarding, like PowerDNS. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 12:06:30 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA07133 for ; Fri, 21 Feb 2003 12:06:29 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LGr3oE020058 for ; Fri, 21 Feb 2003 17:53:03 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LGr3OX020057 for dnsop-outgoing; Fri, 21 Feb 2003 17:53:03 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from igor.alcpress.com (igor.alcpress.com [208.151.249.202]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LGr2oE020052 for ; Fri, 21 Feb 2003 17:53:03 +0100 (MET) Received: from db.panug.org (db.panug.org [208.151.249.203]) by igor.alcpress.com (Postfix) with ESMTP id AFF755585E; Fri, 21 Feb 2003 08:52:56 -0800 (PST) Subject: Re: Why one port? From: Ed Sawicki To: Jim Reid Cc: Brad Knowles , dnsop@cafax.se In-Reply-To: <86549.1045820819@shell.nominum.com> References: <86549.1045820819@shell.nominum.com> Content-Type: text/plain Organization: ALC Message-Id: <1045846375.1153.209.camel@red> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.1 Date: 21 Feb 2003 08:52:56 -0800 Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit On Fri, 2003-02-21 at 01:46, Jim Reid wrote: > >>>>> "Ed" == Ed Sawicki writes: > > Ed> I want my systems to be as secure from attack as possible. To > Ed> me, this means never allowing both functions to be provided by > Ed> the same codebase. > > Fine. But by the same reasoning, you wouldn't want to provide both > functions on the same box. I can run both processes in the same computer safely because each is running as a different non-root user and each is chrooted to a different place in the file system. If I'm really paranoid, I can run each in its own Linux virtual machine (UML) - all the while using only one IP address. > Beats changing the whole internet, no? I suspect my response to this comment would be unpopular here. -- Ed Sawicki ALC #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 12:17:07 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA07382 for ; Fri, 21 Feb 2003 12:17:06 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LH8ZoE020288 for ; Fri, 21 Feb 2003 18:08:35 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LH8ZE9020287 for dnsop-outgoing; Fri, 21 Feb 2003 18:08:35 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from outpost.ds9a.nl (outpost.ds9a.nl [213.244.168.210]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LH8YoE020282 for ; Fri, 21 Feb 2003 18:08:34 +0100 (MET) Received: by outpost.ds9a.nl (Postfix, from userid 1000) id C067D4071; Fri, 21 Feb 2003 18:08:33 +0100 (CET) Date: Fri, 21 Feb 2003 18:08:33 +0100 From: bert hubert To: Ed Sawicki Cc: Jim Reid , Brad Knowles , dnsop@cafax.se Subject: Re: Why one port? Message-ID: <20030221170833.GA14879@outpost.ds9a.nl> Mail-Followup-To: bert hubert , Ed Sawicki , Jim Reid , Brad Knowles , dnsop@cafax.se References: <86549.1045820819@shell.nominum.com> <1045846375.1153.209.camel@red> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1045846375.1153.209.camel@red> User-Agent: Mutt/1.3.28i Sender: owner-dnsop@cafax.se Precedence: bulk On Fri, Feb 21, 2003 at 08:52:56AM -0800, Ed Sawicki wrote: > > Beats changing the whole internet, no? > > I suspect my response to this comment would be unpopular here. For what it's worth - if DNS continues to (d)evolve at the current rate, I expect it soon to be usurped by other directory protocols that perhaps only use DNS to find their .NET or whatever NameResolverService. Grabbing the namespace is way too juicy a target for many to let it die and degrade without trying to take over. Why is it dying? The current issues with DNSSEC, AXFR interoperability, the arbitrary creation of some top level domains and not others and the UTF-8 plugin & takeover by VRSN. So I'd be all in favour of looking with an open mind towards 'DNS2'. Regards, bert -- http://www.PowerDNS.com Open source, database driven DNS Software http://lartc.org Linux Advanced Routing & Traffic Control HOWTO http://netherlabs.nl Consulting #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 12:25:31 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA07776 for ; Fri, 21 Feb 2003 12:25:31 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LHFqoE020354 for ; Fri, 21 Feb 2003 18:15:52 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LHFqeG020353 for dnsop-outgoing; Fri, 21 Feb 2003 18:15:52 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from shell.nominum.com (shell.nominum.com [128.177.192.160]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LHFpoE020347 for ; Fri, 21 Feb 2003 18:15:51 +0100 (MET) Received: from shell.nominum.com (localhost [127.0.0.1]) by shell.nominum.com (Postfix) with ESMTP id 5F9D7137F06; Fri, 21 Feb 2003 09:15:50 -0800 (PST) To: Ed Sawicki Cc: Brad Knowles , dnsop@cafax.se Subject: Re: Why one port? In-Reply-To: Message from Ed Sawicki of "21 Feb 2003 08:52:56 PST." <1045846375.1153.209.camel@red> Date: Fri, 21 Feb 2003 09:15:50 -0800 Message-ID: <91006.1045847750@shell.nominum.com> From: Jim Reid Sender: owner-dnsop@cafax.se Precedence: bulk >>>>> "Ed" == Ed Sawicki writes: Ed> I want my systems to be as secure from attack as possible. To Ed> me, this means never allowing both functions to be provided by Ed> the same codebase. >> Fine. But by the same reasoning, you wouldn't want to provide >> both functions on the same box. Ed> I can run both processes in the same computer safely because Ed> each is running as a different non-root user and each is Ed> chrooted to a different place in the file system. If I'm Ed> really paranoid, I can run each in its own Linux virtual Ed> machine (UML) - all the while using only one IP address. So what? The stuff is still on just one box. You've still got all your eggs in one basket. Albeit a basket with fancy padded compartments. All this software ring-fencing isn't going to help if the CPU catches fire or someone trips over the power cable and disconnects it, etc, etc. #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 14:24:50 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA11993 for ; Fri, 21 Feb 2003 14:24:49 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJ9LoE021850 for ; Fri, 21 Feb 2003 20:09:22 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LJ9L6Z021849 for dnsop-outgoing; Fri, 21 Feb 2003 20:09:21 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from igor.alcpress.com (igor.alcpress.com [208.151.249.202]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJ9KoE021844 for ; Fri, 21 Feb 2003 20:09:21 +0100 (MET) Received: from db.panug.org (db.panug.org [208.151.249.203]) by igor.alcpress.com (Postfix) with ESMTP id 01BD65585E; Fri, 21 Feb 2003 11:09:16 -0800 (PST) Subject: Re: Why one port? From: Ed Sawicki To: Jim Reid Cc: dnsop@cafax.se In-Reply-To: <91006.1045847750@shell.nominum.com> References: <91006.1045847750@shell.nominum.com> Content-Type: text/plain Organization: ALC Message-Id: <1045854555.1153.230.camel@red> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.1 Date: 21 Feb 2003 11:09:15 -0800 Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit On Fri, 2003-02-21 at 09:15, Jim Reid wrote: > >>>>> "Ed" == Ed Sawicki writes: > > Ed> I want my systems to be as secure from attack as possible. To > Ed> me, this means never allowing both functions to be provided by > Ed> the same codebase. > >> Fine. But by the same reasoning, you wouldn't want to provide > >> both functions on the same box. > > Ed> I can run both processes in the same computer safely because > Ed> each is running as a different non-root user and each is > Ed> chrooted to a different place in the file system. If I'm > Ed> really paranoid, I can run each in its own Linux virtual > Ed> machine (UML) - all the while using only one IP address. > > So what? The stuff is still on just one box. You've still got all your > eggs in one basket. Albeit a basket with fancy padded compartments. All > this software ring-fencing isn't going to help if the CPU catches fire > or someone trips over the power cable and disconnects it, etc, etc. It sounds like you agree that "ring-fencing" is an effective means of securing the processes. I've never had a CPU catch fire and my power cables are not exposed to foot traffic so I rate that risk as low for my network. > > Ed Sawicki > ALC #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 14:24:51 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA11992 for ; Fri, 21 Feb 2003 14:24:49 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJD1oE021883 for ; Fri, 21 Feb 2003 20:13:01 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LJD0Qt021882 for dnsop-outgoing; Fri, 21 Feb 2003 20:13:00 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from four.songbird.com (four.songbird.com [206.14.4.5]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJCwoE021877 for ; Fri, 21 Feb 2003 20:12:59 +0100 (MET) Received: (from kent@localhost) by four.songbird.com (8.11.6/8.11.6) id h1LIMd519470 for dnsop@cafax.se; Fri, 21 Feb 2003 10:22:39 -0800 Date: Fri, 21 Feb 2003 10:22:39 -0800 From: kent@songbird.com To: dnsop@cafax.se Subject: Re: Why one port? Message-ID: <20030221102239.A19158@songbird.com> Mail-Followup-To: dnsop@cafax.se References: <91006.1045847750@shell.nominum.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <91006.1045847750@shell.nominum.com>; from Jim.Reid@nominum.com on Fri, Feb 21, 2003 at 09:15:50AM -0800 Sender: owner-dnsop@cafax.se Precedence: bulk On Fri, Feb 21, 2003 at 09:15:50AM -0800, Jim Reid wrote: > >>>>> "Ed" == Ed Sawicki writes: > > Ed> I want my systems to be as secure from attack as possible. To > Ed> me, this means never allowing both functions to be provided by > Ed> the same codebase. > >> Fine. But by the same reasoning, you wouldn't want to provide > >> both functions on the same box. > > Ed> I can run both processes in the same computer safely because > Ed> each is running as a different non-root user and each is > Ed> chrooted to a different place in the file system. If I'm > Ed> really paranoid, I can run each in its own Linux virtual > Ed> machine (UML) - all the while using only one IP address. > > So what? The stuff is still on just one box. You've still got all your > eggs in one basket. Albeit a basket with fancy padded compartments. All > this software ring-fencing isn't going to help if the CPU catches fire > or someone trips over the power cable and disconnects it, etc, etc. Sure, there is a large set of problems that the "padded compartments" won't address. Doesn't invalidate the idea, since there is also a real value to having small highly separable components that are individually easier to validate and secure. There are numerous failure modes, and numerous tradeoffs. In some environments IP addresses are scarce, and one develops the habit of being very conservative in their use. Kent #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 14:39:17 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12474 for ; Fri, 21 Feb 2003 14:39:15 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJOXoE022006 for ; Fri, 21 Feb 2003 20:24:33 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LJOXLY022005 for dnsop-outgoing; Fri, 21 Feb 2003 20:24:33 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from igor.alcpress.com (igor.alcpress.com [208.151.249.202]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJOWoE022000 for ; Fri, 21 Feb 2003 20:24:33 +0100 (MET) Received: from db.panug.org (db.panug.org [208.151.249.203]) by igor.alcpress.com (Postfix) with ESMTP id 140665585E; Fri, 21 Feb 2003 11:24:29 -0800 (PST) Subject: Re: Why one port? From: Ed Sawicki To: Kandra =?ISO-8859-1?Q?Nyg=E5rds?= Cc: dnsop@cafax.se In-Reply-To: <05cd01c2d9d7$b681a160$0ef2a8c0@amalthea> References: <1045767795.1155.135.camel@red> <05cd01c2d9d7$b681a160$0ef2a8c0@amalthea> Content-Type: text/plain; charset=ISO-8859-1 Organization: ALC Message-Id: <1045855468.1155.247.camel@red> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.1 Date: 21 Feb 2003 11:24:28 -0800 Content-Transfer-Encoding: 8bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 8bit On Fri, 2003-02-21 at 10:33, Kandra Nygårds wrote: > From: "Ed Sawicki" > > > I'm wondering why there is only one UDP port assigned to the DNS > > protocol? It prevents us from using both an iterative name > > server and a recursive name server/cache on the same computer > > when only one IP address is available. > > Presumably so that clients would not have to guess what port to use. I'm not sure if you intended this as humor. If you didn't, why was FTP assigned two ports without clients getting confused? > It does make some sense in allowing a user-configurable port, but it makes > (IMHO) a lot more sense in sticking to a single DNS-port. I never suggested that we need a user-configurable port. We need a fixed UDP port for our recursive name servers/caches. > > I have to wonder, why are you only able to use a single IP-address? Is it a > provider limitation? Get a real provider. OS limitation? Application > limitation? In either case, I'd recommend running the resolver on a separate > machine. If security is your concern, it makes even more sense, Many people are using /28 and /29 nets and some have only a single IP address assigned to them by, in some cases, the only ISP in town. Yet, they want to take control of their DNS _and_ not be prone to attacks such as cache poisoning. Why should they be forced to use up two precious or non-existent IP addresses when the limitation is really artificial? >and you don't have to rewrite the Internet to do it. This seems to be a popular theme here. I see it as an exaggeration. > - Kandra > > > > #---------------------------------------------------------------------- > # To unsubscribe, send a message to . -- Ed Sawicki ALC #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 14:47:17 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12625 for ; Fri, 21 Feb 2003 14:47:16 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LIXpoE021413 for ; Fri, 21 Feb 2003 19:33:51 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LIXpe0021412 for dnsop-outgoing; Fri, 21 Feb 2003 19:33:51 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from poledra (as7-2-2.bn.g.bonet.se [217.215.21.151]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LIXooE021407 for ; Fri, 21 Feb 2003 19:33:51 +0100 (MET) Received: from amalthea.8in.net ([192.168.242.14] helo=amalthea) by poledra with asmtp (Exim 3.35 #1 (Debian)) id 18mHza-0003Lp-00 for ; Fri, 21 Feb 2003 19:33:50 +0100 Message-ID: <05cd01c2d9d7$b681a160$0ef2a8c0@amalthea> From: =?iso-8859-1?Q?Kandra_Nyg=E5rds?= To: References: <1045767795.1155.135.camel@red> Subject: Re: Why one port? Date: Fri, 21 Feb 2003 19:33:01 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2720.3000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit From: "Ed Sawicki" > I'm wondering why there is only one UDP port assigned to the DNS > protocol? It prevents us from using both an iterative name > server and a recursive name server/cache on the same computer > when only one IP address is available. Presumably so that clients would not have to guess what port to use. It does make some sense in allowing a user-configurable port, but it makes (IMHO) a lot more sense in sticking to a single DNS-port. I have to wonder, why are you only able to use a single IP-address? Is it a provider limitation? Get a real provider. OS limitation? Application limitation? In either case, I'd recommend running the resolver on a separate machine. If security is your concern, it makes even more sense, and you don't have to rewrite the Internet to do it. - Kandra #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 15:14:36 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13341 for ; Fri, 21 Feb 2003 15:14:34 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJ2woE021766 for ; Fri, 21 Feb 2003 20:02:58 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LJ2wjL021765 for dnsop-outgoing; Fri, 21 Feb 2003 20:02:58 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from igor.alcpress.com (igor.alcpress.com [208.151.249.202]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJ2uoE021760 for ; Fri, 21 Feb 2003 20:02:57 +0100 (MET) Received: from db.panug.org (db.panug.org [208.151.249.203]) by igor.alcpress.com (Postfix) with ESMTP id 6D2335585E; Fri, 21 Feb 2003 11:02:53 -0800 (PST) Subject: Re: Why one port? From: Ed Sawicki To: bert hubert Cc: dnsop@cafax.se In-Reply-To: <20030221170833.GA14879@outpost.ds9a.nl> References: <86549.1045820819@shell.nominum.com> <1045846375.1153.209.camel@red> <20030221170833.GA14879@outpost.ds9a.nl> Content-Type: text/plain Organization: ALC Message-Id: <1045854172.1153.222.camel@red> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.2.1 Date: 21 Feb 2003 11:02:53 -0800 Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit On Fri, 2003-02-21 at 09:08, bert hubert wrote: > On Fri, Feb 21, 2003 at 08:52:56AM -0800, Ed Sawicki wrote: > > > > Beats changing the whole internet, no? > > > > I suspect my response to this comment would be unpopular here. > > For what it's worth - if DNS continues to (d)evolve at the current rate, I > expect it soon to be usurped by other directory protocols that perhaps only > use DNS to find their .NET or whatever NameResolverService. > > Grabbing the namespace is way too juicy a target for many to let it die and > degrade without trying to take over. > > Why is it dying? The current issues with DNSSEC, AXFR interoperability, the > arbitrary creation of some top level domains and not others and the UTF-8 > plugin & takeover by VRSN. > > So I'd be all in favour of looking with an open mind towards 'DNS2'. Oh, it looks like my opinions would not be completely unpopular here. Still, is this the right place for criticism of ICANN, BIND, AXFR, DNSSEC, Verisign/NSI, conflicting RFCs, etc.? I'd planned on sticking to specific technical aspects of DNS but questions like "Beats changing the whole internet, no?" leaves little room for avoiding controversial issues. -- Ed Sawicki ALC #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 15:29:23 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA13722 for ; Fri, 21 Feb 2003 15:29:22 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LKEaoE022647 for ; Fri, 21 Feb 2003 21:14:36 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LKEaem022646 for dnsop-outgoing; Fri, 21 Feb 2003 21:14:36 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from momotombo.TechFak.Uni-Bielefeld.DE (momotombo.TechFak.Uni-Bielefeld.DE [129.70.136.107]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LKEaoE022641 for ; Fri, 21 Feb 2003 21:14:36 +0100 (MET) Received: from grimsvotn.TechFak.Uni-Bielefeld.DE (grimsvotn.TechFak.Uni-Bielefeld.DE [129.70.137.40]) by momotombo.TechFak.Uni-Bielefeld.DE (8.11.6+Sun/8.11.6/TechFak/pk+ro20010720) with ESMTP id h1LKEZD02965 for ; Fri, 21 Feb 2003 21:14:35 +0100 (MET) Received: from localhost (pk@localhost) by grimsvotn.TechFak.Uni-Bielefeld.DE (8.11.6+Sun/8.9.1) with SMTP id h1LKEZK00939 for ; Fri, 21 Feb 2003 21:14:35 +0100 (MET) Message-Id: <200302212014.h1LKEZK00939@grimsvotn.TechFak.Uni-Bielefeld.DE> X-Authentication-Warning: grimsvotn.TechFak.Uni-Bielefeld.DE: pk owned process doing -bs X-Authentication-Warning: grimsvotn.TechFak.Uni-Bielefeld.DE: pk@localhost didn't use HELO protocol To: dnsop@cafax.se Subject: Re: Why one port? In-reply-to: Your message of "21 Feb 2003 11:24:28 PST." <1045855468.1155.247.camel@red> X-Organization: Uni Bielefeld, Technische Fakultaet X-Phone: +49 521 106 2902 Date: Fri, 21 Feb 2003 21:14:35 +0100 From: Peter Koch Sender: owner-dnsop@cafax.se Precedence: bulk "Ed Sawicki" wrote: > Many people are using /28 and /29 nets and some have only a single > IP address assigned to them by, in some cases, the only ISP in town. > Yet, they want to take control of their DNS _and_ not be prone to > attacks such as cache poisoning. Why should they be forced to use > up two precious or non-existent IP addresses when the limitation > is really artificial? if they have only one externally routable IP address available, to whom would they like to offer recursive resolving services? -Peter #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 15:55:20 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA14575 for ; Fri, 21 Feb 2003 15:55:18 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJk5oE022313 for ; Fri, 21 Feb 2003 20:46:05 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1LJk5Ab022312 for dnsop-outgoing; Fri, 21 Feb 2003 20:46:05 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from poledra (as7-2-2.bn.g.bonet.se [217.215.21.151]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1LJk4oE022307 for ; Fri, 21 Feb 2003 20:46:04 +0100 (MET) Received: from amalthea.8in.net ([192.168.242.14] helo=amalthea) by poledra with asmtp (Exim 3.35 #1 (Debian)) id 18mJ7P-0004Ah-00; Fri, 21 Feb 2003 20:45:59 +0100 Message-ID: <05e401c2d9e1$cabeb500$0ef2a8c0@amalthea> From: =?iso-8859-1?Q?Kandra_Nyg=E5rds?= To: "Ed Sawicki" Cc: References: <1045767795.1155.135.camel@red> <05cd01c2d9d7$b681a160$0ef2a8c0@amalthea> <1045855468.1155.247.camel@red> Subject: Re: Why one port? Date: Fri, 21 Feb 2003 20:45:10 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2720.3000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit From: "Ed Sawicki" > I'm not sure if you intended this as humor. If you didn't, why was > FTP assigned two ports without clients getting confused? One control channel, one data channel, so to speak. You might have noticed how the two assigned ports are called "ftp" and "ftp-data" respectively. > > It does make some sense in allowing a user-configurable port, but it makes > > (IMHO) a lot more sense in sticking to a single DNS-port. > > I never suggested that we need a user-configurable port. We need > a fixed UDP port for our recursive name servers/caches. Ah, in that case no. It makes no sense at all to use separate ports, just like it makes no sense at all to use a different port for SMTP between mail relays as between a client and server. It's the same protocol. > Many people are using /28 and /29 nets and some have only a single > IP address assigned to them by, in some cases, the only ISP in town. > Yet, they want to take control of their DNS _and_ not be prone to > attacks such as cache poisoning. Why should they be forced to use > up two precious or non-existent IP addresses when the limitation > is really artificial? NAT or portforward to 1918-space, if you've no other option. However, I still maintain that you should either pick a provider with clue, or find a better solution. If you don't have a clueful ISP, use a colo-facility for your authorative servers (which, in itself, is a pretty good idea). Question, how would running two instances of DNS software on the same machine, using different ports protect against cache poisoning? > >and you don't have to rewrite the Internet to do it. > > This seems to be a popular theme here. I see it as an exaggeration. The DNS protocol has worked quite well so far. I see no need to rewrite it in order to enable users perform less than clueful tasks. - Kandra #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 20:49:13 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA20986 for ; Fri, 21 Feb 2003 20:49:12 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1M1H1oE025285 for ; Sat, 22 Feb 2003 02:17:01 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1M1H1wJ025284 for dnsop-outgoing; Sat, 22 Feb 2003 02:17:01 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from shell.nominum.com (shell.nominum.com [128.177.192.160]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1M1H0oE025279 for ; Sat, 22 Feb 2003 02:17:00 +0100 (MET) Received: from shell.nominum.com (localhost [127.0.0.1]) by shell.nominum.com (Postfix) with ESMTP id 32BE5137F06; Fri, 21 Feb 2003 17:16:57 -0800 (PST) To: Ed Sawicki Cc: dnsop@cafax.se Subject: Re: Why one port? In-Reply-To: Your message of "21 Feb 2003 11:09:15 PST." <1045854555.1153.230.camel@red> Date: Fri, 21 Feb 2003 17:16:57 -0800 Message-ID: <1185.1045876617@shell.nominum.com> From: Jim Reid Sender: owner-dnsop@cafax.se Precedence: bulk >>>>> "Ed" == Ed Sawicki writes: Ed> It sounds like you agree that "ring-fencing" is an effective Ed> means of securing the processes. I've never had a CPU catch Ed> fire and my power cables are not exposed to foot traffic so I Ed> rate that risk as low for my network. This does not amount to a justification for requiring the DNS to use two different port numbers and forcing every bit of DNS software on this planet to be changed. #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 20:49:15 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA21000 for ; Fri, 21 Feb 2003 20:49:15 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1M1RMoE025360 for ; Sat, 22 Feb 2003 02:27:22 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1M1RMpa025359 for dnsop-outgoing; Sat, 22 Feb 2003 02:27:22 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from shell.nominum.com (shell.nominum.com [128.177.192.160]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1M1RLoE025354 for ; Sat, 22 Feb 2003 02:27:21 +0100 (MET) Received: from shell.nominum.com (localhost [127.0.0.1]) by shell.nominum.com (Postfix) with ESMTP id 29354137F06; Fri, 21 Feb 2003 17:27:20 -0800 (PST) To: Ed Sawicki Cc: Kandra =?ISO-8859-1?Q?Nyg=E5rds?= , dnsop@cafax.se Subject: Re: Why one port? In-Reply-To: Message from Ed Sawicki of "21 Feb 2003 11:24:28 PST." <1045855468.1155.247.camel@red> Date: Fri, 21 Feb 2003 17:27:20 -0800 Message-ID: <1478.1045877240@shell.nominum.com> From: Jim Reid Sender: owner-dnsop@cafax.se Precedence: bulk >>>>> "Ed" == Ed Sawicki writes: Ed> I'm not sure if you intended this as humor. If you didn't, why Ed> was FTP assigned two ports without clients getting confused? Because one port is used for data transfer and the other for control. This paradigm is not appropriate to the DNS. Ed> I never suggested that we need a user-configurable port. We Ed> need a fixed UDP port for our recursive name servers/caches. Isn't that what port 53 is for? >> and you don't have to rewrite the Internet to do it. Ed> This seems to be a popular theme here. I see it as an exaggeration. In that case, please explain how you propose to make everything continue to work with two ports for DNS, one for authoritative service and one for resolving, and how this could be deployed. For bonus marks, provide an implementation scheme that does not involve changing existing software or configurations. #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 21 21:01:23 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA21183 for ; Fri, 21 Feb 2003 21:01:22 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1M1g6oE025542 for ; Sat, 22 Feb 2003 02:42:06 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1M1g69T025541 for dnsop-outgoing; Sat, 22 Feb 2003 02:42:06 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from shell.nominum.com (shell.nominum.com [128.177.192.160]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1M1g5oE025535 for ; Sat, 22 Feb 2003 02:42:05 +0100 (MET) Received: from shell.nominum.com (localhost [127.0.0.1]) by shell.nominum.com (Postfix) with ESMTP id 06300137F06; Fri, 21 Feb 2003 17:42:04 -0800 (PST) To: Ed Sawicki Cc: bert hubert , dnsop@cafax.se Subject: Re: Why one port? In-Reply-To: Message from Ed Sawicki of "21 Feb 2003 11:02:53 PST." <1045854172.1153.222.camel@red> Date: Fri, 21 Feb 2003 17:42:03 -0800 Message-ID: <1733.1045878123@shell.nominum.com> From: Jim Reid Sender: owner-dnsop@cafax.se Precedence: bulk >>>>> "Ed" == Ed Sawicki writes: Ed> Oh, it looks like my opinions would not be completely Ed> unpopular here. Still, is this the right place for criticism Ed> of ICANN, BIND, AXFR, DNSSEC, Verisign/NSI, conflicting RFCs, Ed> etc.? I'd planned on sticking to specific technical aspects of Ed> DNS but questions like "Beats changing the whole internet, Ed> no?" leaves little room for avoiding controversial issues. There are plenty of places where you can vent your spleen about your pet peeves. Most of them are not relevant to this list. You can work out which ones may be appropriate from the charter of this WG and its mailing list: The DNS Operations Working Group will develop guidelines for the operation DNS name servers and the administration of DNS zone files. These guidelines will provide technical information relating to the implementation of the DNS protocol by the operators and administrators of DNS domains. You invited controversy by making a suggestion which would mean changing every DNS server and client on the internet. And annoying IANA. You didn't give a valid reason for that change. Other than it would be convenient for the almost unique constraints that are imposed on the way you operate your name server. #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sat Feb 22 12:51:06 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA13767 for ; Sat, 22 Feb 2003 12:51:04 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MHaioE001070 for ; Sat, 22 Feb 2003 18:36:44 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1MHaiv6001069 for dnsop-outgoing; Sat, 22 Feb 2003 18:36:44 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from relay-5m.club-internet.fr (relay-5m.club-internet.fr [194.158.104.44]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MHahoE001064 for ; Sat, 22 Feb 2003 18:36:43 +0100 (MET) Received: from mine.club-internet.fr (f02v-7-27.d1.club-internet.fr [212.194.30.27]) by relay-5m.club-internet.fr (Postfix) with ESMTP id 4AD27E22B for ; Sat, 22 Feb 2003 18:36:58 +0100 (CET) Message-Id: <5.2.0.9.0.20030222174204.0241d9d0@mail.club-internet.fr> X-Sender: jefsey@mail.club-internet.fr X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Sat, 22 Feb 2003 17:53:36 +0100 To: dnsop@cafax.se From: "J-F C. (Jefsey) Morfin" Subject: Re: Why one port? In-Reply-To: <1045846375.1153.209.camel@red> References: <86549.1045820819@shell.nominum.com> <86549.1045820819@shell.nominum.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-dnsop@cafax.se Precedence: bulk Truly, why not to define a DNS.2 system on another set of ports, performing DNS+ services? With resolvers.2 to query them. There would be nothing to change. Just value added. There should only be a program to co-produce the DNS1&2 files. Who wants implement them. The interest is that these two DNS parallel systems would be asynchronously managed. So they could immediately permit to check the validity of a response in one by the other. Since 2 would not be in real operations, it could be considered as a test. But in starting with common services with low additional CPU and complexity, DNS.2 could bring some immediate plus. And produce good field test data. However, I suppose the test could go very fast if DNS.2 "tested" the direct support of Unicode names. Also if the user resolvers had their own root file? I am ready to maintain a DNS wish list on dot-root, to see what could be the suggestions? If they do not make sense we will see it quick, otherwise it would give some ideas to chew. jfc On 17:52 21/02/03, Ed Sawicki said: >On Fri, 2003-02-21 at 01:46, Jim Reid wrote: > > >>>>> "Ed" == Ed Sawicki writes: > > > > Ed> I want my systems to be as secure from attack as possible. To > > Ed> me, this means never allowing both functions to be provided by > > Ed> the same codebase. > > > > Fine. But by the same reasoning, you wouldn't want to provide both > > functions on the same box. > >I can run both processes in the same computer safely because each >is running as a different non-root user and each is chrooted to >a different place in the file system. If I'm really paranoid, I >can run each in its own Linux virtual machine (UML) - all the while >using only one IP address. > > > Beats changing the whole internet, no? > >I suspect my response to this comment would be unpopular here. > >-- >Ed Sawicki >ALC > >#---------------------------------------------------------------------- ># To unsubscribe, send a message to . > > > >--- >Incoming mail is certified Virus Free. >Checked by AVG anti-virus system (http://www.grisoft.com). >Version: 6.0.454 / Virus Database: 253 - Release Date: 10/02/03 #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sat Feb 22 14:53:29 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA14866 for ; Sat, 22 Feb 2003 14:53:29 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MJajoE001823 for ; Sat, 22 Feb 2003 20:36:45 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1MJaiEa001822 for dnsop-outgoing; Sat, 22 Feb 2003 20:36:44 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from shell.nominum.com (shell.nominum.com [128.177.192.160]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MJahoE001817 for ; Sat, 22 Feb 2003 20:36:44 +0100 (MET) Received: from nominum.com (shell.nominum.com [128.177.192.160]) by shell.nominum.com (Postfix) with ESMTP id D2339137F03; Sat, 22 Feb 2003 11:36:41 -0800 (PST) Date: Sat, 22 Feb 2003 11:36:41 -0800 Subject: Re: Why one port? Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) Cc: dnsop@cafax.se To: "J-F C. (Jefsey) Morfin" From: David Conrad In-Reply-To: <5.2.0.9.0.20030222174204.0241d9d0@mail.club-internet.fr> Message-Id: Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.551) Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit On Saturday, February 22, 2003, at 08:53 AM, J-F C. (Jefsey) Morfin wrote: > Truly, why not to define a DNS.2 system on another set of ports, > performing DNS+ services? Where is the ID that describes DNS+ services so I can read it? Rgds, -drc #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sat Feb 22 18:11:17 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA17031 for ; Sat, 22 Feb 2003 18:11:09 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MMpAoE002827 for ; Sat, 22 Feb 2003 23:51:10 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1MMpAIu002826 for dnsop-outgoing; Sat, 22 Feb 2003 23:51:10 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from picard.skynet.be (picard.skynet.be [195.238.3.88]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MMp9oE002821 for ; Sat, 22 Feb 2003 23:51:09 +0100 (MET) Received: from [10.0.1.4] (ip-26.shub-internet.org [194.78.144.26] (may be forged)) by picard.skynet.be (8.12.7/8.12.7/Skynet-OUT-2.21) with ESMTP id h1MMoV7o009493; Sat, 22 Feb 2003 23:50:49 +0100 (MET) (envelope-from ) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <1045855468.1155.247.camel@red> References: <1045767795.1155.135.camel@red> <05cd01c2d9d7$b681a160$0ef2a8c0@amalthea> <1045855468.1155.247.camel@red> Date: Sat, 22 Feb 2003 23:22:33 +0100 To: Ed Sawicki From: Brad Knowles Subject: Re: Why one port? Cc: Kandra =?iso-8859-1?Q?Nyg=E5rds?= , dnsop@cafax.se Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 11:24 AM -0800 2003/02/21, Ed Sawicki wrote: > Many people are using /28 and /29 nets and some have only a single > IP address assigned to them by, in some cases, the only ISP in town. > Yet, they want to take control of their DNS _and_ not be prone to > attacks such as cache poisoning. Why should they be forced to use > up two precious or non-existent IP addresses when the limitation > is really artificial? In that case, they can run a recursive resolver on 127.0.0.1 and the authoritative server on their officially assigned IP address. Just because they've got only one officially assigned IP address doesn't mean that they can't run both a caching recursive resolver and an authoritative server on the same box. I still recommend separating the services and running them on separate machines (where possible), but you can run two copies of the nameserver on the same machine, each listening to different IP addresses. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sat Feb 22 18:11:16 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA17030 for ; Sat, 22 Feb 2003 18:11:09 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MMpOoE002846 for ; Sat, 22 Feb 2003 23:51:24 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1MMpOqX002845 for dnsop-outgoing; Sat, 22 Feb 2003 23:51:24 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from picard.skynet.be (picard.skynet.be [195.238.3.88]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MMpNoE002840 for ; Sat, 22 Feb 2003 23:51:24 +0100 (MET) Received: from [10.0.1.4] (ip-26.shub-internet.org [194.78.144.26] (may be forged)) by picard.skynet.be (8.12.7/8.12.7/Skynet-OUT-2.21) with ESMTP id h1MMoV7s009493; Sat, 22 Feb 2003 23:51:12 +0100 (MET) (envelope-from ) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <5.2.0.9.0.20030222174204.0241d9d0@mail.club-internet.fr> References: <86549.1045820819@shell.nominum.com> <86549.1045820819@shell.nominum.com> <5.2.0.9.0.20030222174204.0241d9d0@mail.club-internet.fr> Date: Sat, 22 Feb 2003 23:36:07 +0100 To: "J-F C. (Jefsey) Morfin" From: Brad Knowles Subject: Re: Why one port? Cc: dnsop@cafax.se Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 5:53 PM +0100 2003/02/22, J-F C. (Jefsey) Morfin wrote: > The interest is that these two DNS parallel systems would be > asynchronously managed. So they could immediately permit to check > the validity of a response in one by the other. Not really. They will be separately managed, and therefore you can be reasonably guaranteed that you will frequently get different answers from the two different services. So, when they disagree (and they frequently will), which is wrong? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sat Feb 22 18:57:11 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA17032 for ; Sat, 22 Feb 2003 18:11:11 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MMpGoE002835 for ; Sat, 22 Feb 2003 23:51:16 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1MMpFuo002834 for dnsop-outgoing; Sat, 22 Feb 2003 23:51:15 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from picard.skynet.be (picard.skynet.be [195.238.3.88]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1MMpFoE002829 for ; Sat, 22 Feb 2003 23:51:15 +0100 (MET) Received: from [10.0.1.4] (ip-26.shub-internet.org [194.78.144.26] (may be forged)) by picard.skynet.be (8.12.7/8.12.7/Skynet-OUT-2.21) with ESMTP id h1MMoV7q009493; Sat, 22 Feb 2003 23:50:58 +0100 (MET) (envelope-from ) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <05e401c2d9e1$cabeb500$0ef2a8c0@amalthea> References: <1045767795.1155.135.camel@red> <05cd01c2d9d7$b681a160$0ef2a8c0@amalthea> <1045855468.1155.247.camel@red> <05e401c2d9e1$cabeb500$0ef2a8c0@amalthea> Date: Sat, 22 Feb 2003 23:29:52 +0100 To: Kandra =?iso-8859-1?Q?Nyg=E5rds?= From: Brad Knowles Subject: Re: Why one port? Cc: "Ed Sawicki" , Content-Type: text/plain; charset="iso-8859-1" ; format="flowed" Content-Transfer-Encoding: 8bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 8bit At 8:45 PM +0100 2003/02/21, Kandra Nygårds wrote: > Question, how would running two instances of DNS software on the same > machine, using different ports protect against cache poisoning? The authoritative-only server doesn't do any caching, and therefore there is no poisoning or pollution of the cache. The caching-only server isn't authoritative for anything, and while the cache could potentially become polluted, it can't pass that pollution on to clients in an authoritative manner (which is the real danger). > The DNS protocol has worked quite well so far. I see no need to rewrite it > in order to enable users perform less than clueful tasks. There are some problems in the DNS, but I am still convinced that we can fix these problems without throwing out the whole thing. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sun Feb 23 05:27:59 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA05629 for ; Sun, 23 Feb 2003 05:27:58 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1NA8DoE006792 for ; Sun, 23 Feb 2003 11:08:13 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1NA8DW6006791 for dnsop-outgoing; Sun, 23 Feb 2003 11:08:13 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from relay-4m.club-internet.fr (relay-4m.club-internet.fr [194.158.104.43]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1NA8CoE006786 for ; Sun, 23 Feb 2003 11:08:12 +0100 (MET) Received: from mine.club-internet.fr (f09v-10-62.d1.club-internet.fr [212.194.189.62]) by relay-4m.club-internet.fr (Postfix) with ESMTP id 9C30FE07C for ; Sun, 23 Feb 2003 11:08:10 +0100 (CET) Message-Id: <5.2.0.9.0.20030223095437.028fb990@mail.club-internet.fr> X-Sender: jefsey@mail.club-internet.fr X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Sun, 23 Feb 2003 10:00:26 +0100 To: dnsop@cafax.se From: "J-F C. (Jefsey) Morfin" Subject: Re: Why one port? In-Reply-To: References: <5.2.0.9.0.20030222174204.0241d9d0@mail.club-internet.fr> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-dnsop@cafax.se Precedence: bulk On 20:36 22/02/03, David Conrad said: >On Saturday, February 22, 2003, at 08:53 AM, J-F C. (Jefsey) Morfin wrote: >>Truly, why not to define a DNS.2 system on another set of ports, >>performing DNS+ services? > >Where is the ID that describes DNS+ services so I can read it? It will be where we will have drafted it from the received inputs. Many have suggestions but I do not think that any of us can make a complete list yet. So the suggested scheme would be: 1. to call and welcome suggestions 2. collectively discuss and asses them 3. interested parties to propose two drafts for information: - services to be supported (named DNS+ services from existing various experiences) - investigations on how to support them through a DNS.2 4. everyone can read them and assess if there is an interest or not to pursue. rgds. jfc #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sun Feb 23 05:27:59 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA05628 for ; Sun, 23 Feb 2003 05:27:58 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1NA8FoE006800 for ; Sun, 23 Feb 2003 11:08:15 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1NA8F6D006799 for dnsop-outgoing; Sun, 23 Feb 2003 11:08:15 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from relay-4m.club-internet.fr (relay-4m.club-internet.fr [194.158.104.43]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1NA8EoE006794 for ; Sun, 23 Feb 2003 11:08:14 +0100 (MET) Received: from mine.club-internet.fr (f09v-10-62.d1.club-internet.fr [212.194.189.62]) by relay-4m.club-internet.fr (Postfix) with ESMTP id 21B25E237 for ; Sun, 23 Feb 2003 11:08:12 +0100 (CET) Message-Id: <5.2.0.9.0.20030223100134.042f2ae0@mail.club-internet.fr> X-Sender: jefsey@mail.club-internet.fr X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Sun, 23 Feb 2003 10:12:13 +0100 To: dnsop@cafax.se From: "J-F C. (Jefsey) Morfin" Subject: Re: Why one port? In-Reply-To: References: < <5.2.0.9.0.20030222174204.0241d9d0@mail.club-internet.fr> <86549.1045820819@shell.nominum.com> <86549.1045820819@shell.nominum.com> <5.2.0.9.0.20030222174204.0241d9d0@mail.club-internet.fr> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-dnsop@cafax.se Precedence: bulk On 23:36 22/02/03, Brad Knowles said: >At 5:53 PM +0100 2003/02/22, J-F C. (Jefsey) Morfin wrote: > >> The interest is that these two DNS parallel systems would be >> asynchronously managed. So they could immediately permit to check >> the validity of a response in one by the other. > >Not really. They will be separately managed, and therefore you can be >reasonably guaranteed that you will frequently get different answers from >the two different services. So, when they disagree (and they frequently >will), which is wrong? Absolutely true. But remember that I suggest DNS.2 to be first just an "under development system". So it would first act only as an alarm. There will be first discrepancies because of bugs. They will help debugging faster since DNS.1 would act as reference. Then the discrepancies will be reduced and may be DNS.1 flaws also reduced. Ahain this would permit to progressively have DNS.2 switching from an alarm, to a back-up, to a replacement. We all agree that sometimes the DNS will have to support Unicode and new services. I think the earlier we start working and testing, the smoother will be the transition (may take 10 years). The difference in such an approach with IPv6 would be that there would be no need for "tunels". It would start with very limited services plus test, and progressively more and more services, without killing DNS.1. Ideal would be that DNS.2 stays compatible with DNS.1 permitting an enhancement and not a transition. To know if it is possible we need to consider the suggestions. At this stage I am just suggesting a "suggestions collection", and a collective analysis of what we may get. jfc >-- >Brad Knowles, > >"They that can give up essential liberty to obtain a little temporary >safety deserve neither liberty nor safety." > -Benjamin Franklin, Historical Review of Pennsylvania. > >GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ >!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) >tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) > > > > > >--- >Incoming mail is certified Virus Free. >Checked by AVG anti-virus system (http://www.grisoft.com). >Version: 6.0.454 / Virus Database: 253 - Release Date: 10/02/03 #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sun Feb 23 13:23:39 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA10830 for ; Sun, 23 Feb 2003 13:23:38 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1NI80oE009098 for ; Sun, 23 Feb 2003 19:08:00 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1NI80dQ009097 for dnsop-outgoing; Sun, 23 Feb 2003 19:08:00 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from shell.nominum.com (shell.nominum.com [128.177.192.160]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1NI7woE009092 for ; Sun, 23 Feb 2003 19:07:59 +0100 (MET) Received: from nominum.com (shell.nominum.com [128.177.192.160]) by shell.nominum.com (Postfix) with ESMTP id 4D39C137F03; Sun, 23 Feb 2003 10:07:57 -0800 (PST) Date: Sun, 23 Feb 2003 10:07:58 -0800 Subject: Re: Why one port? Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v551) Cc: dnsop@cafax.se To: "J-F C. (Jefsey) Morfin" From: David Conrad In-Reply-To: <5.2.0.9.0.20030223095437.028fb990@mail.club-internet.fr> Message-Id: Content-Transfer-Encoding: 7bit X-Mailer: Apple Mail (2.551) Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit Jfc, On Sunday, February 23, 2003, at 01:00 AM, J-F C. (Jefsey) Morfin wrote: >> Where is the ID that describes DNS+ services so I can read it? > It will be where we will have drafted it from the received inputs. This is pretty much exactly the opposite of the way things traditionally work in the IETF. The idea behind IDs is they are submitted to prompt input and discussion. Rgds, -drc #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sun Feb 23 19:50:03 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA16138 for ; Sun, 23 Feb 2003 19:50:01 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O0MXoE011198 for ; Mon, 24 Feb 2003 01:22:33 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1O0MXWK011197 for dnsop-outgoing; Mon, 24 Feb 2003 01:22:33 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from relay-1m.club-internet.fr (relay-1m.club-internet.fr [194.158.104.40]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O0MWoE011192 for ; Mon, 24 Feb 2003 01:22:32 +0100 (MET) Received: from mine.club-internet.fr (f05v-24-111.d1.club-internet.fr [212.194.203.111]) by relay-1m.club-internet.fr (Postfix) with ESMTP id 60A54169F; Mon, 24 Feb 2003 01:22:55 +0100 (CET) Message-Id: <5.2.0.9.0.20030224010604.03e2dec0@mail.club-internet.fr> X-Sender: jefsey@mail.club-internet.fr X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Mon, 24 Feb 2003 01:20:31 +0100 To: David Conrad From: "J-F C. (Jefsey) Morfin" Subject: Re: Why one port? Cc: dnsop@cafax.se In-Reply-To: References: <5.2.0.9.0.20030223095437.028fb990@mail.club-internet.fr> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-dnsop@cafax.se Precedence: bulk At 19:07 23/02/03, David Conrad wrote: >Jfc, >On Sunday, February 23, 2003, at 01:00 AM, J-F C. (Jefsey) Morfin wrote: >>>Where is the ID that describes DNS+ services so I can read it? >>It will be where we will have drafted it from the received inputs. > >This is pretty much exactly the opposite of the way things traditionally >work in the IETF. The idea behind IDs is they are submitted to prompt >input and discussion. I understand that. Seems very much as teaching the market before making a market study. Lack of pre-brainstorming. May explain all the post-braintearing? May be the reason why the DNS.2 still expected? Frankly, don't you think there are far more competent people than me on this list to write a draft on such a matter? However this topic belongs to the dot-root project and such a draft is foreseen on an information basis. But not before months, after the iterative specification mechanism I descirbed; and probably a few pre-testings. Also by a team including a better English writer that me :-). But I certainly want to share in it. Or may be would you want to discuss it privately and try to build a draft with a few other interested? My approach is user centered, list all what we want first. jfc #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sun Feb 23 20:26:50 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA16737 for ; Sun, 23 Feb 2003 20:26:50 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O17woE011440 for ; Mon, 24 Feb 2003 02:07:58 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1O17wxO011439 for dnsop-outgoing; Mon, 24 Feb 2003 02:07:58 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from psg.com (psg.com [147.28.0.62]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O17voE011434 for ; Mon, 24 Feb 2003 02:07:57 +0100 (MET) Received: from localhost ([127.0.0.1] helo=roam.psg.com) by psg.com with esmtp (Exim 3.36 #1) id 18n764-000CLf-00 for dnsop@cafax.se; Sun, 23 Feb 2003 17:07:56 -0800 Received: from localhost ([127.0.0.1] helo=roam.psg.com ident=randy) by roam.psg.com with esmtp (Exim 4.12) id 18n75X-000KAU-00 for dnsop@cafax.se; Mon, 24 Feb 2003 10:07:23 +0900 From: Randy Bush MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Mon, 24 Feb 2003 10:07:23 +0900 To: dns op wg Subject: draft-ymbk-6to4-arpa-delegation-00.txt Message-Id: Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit would the dnsop wg consder adoptng draft-ymbk-6to4-arpa-delegation-00.txt as a wg document? randy #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Sun Feb 23 20:33:25 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA16952 for ; Sun, 23 Feb 2003 20:33:25 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O14xoE011409 for ; Mon, 24 Feb 2003 02:04:59 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1O14wIi011408 for dnsop-outgoing; Mon, 24 Feb 2003 02:04:58 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from psg.com (psg.com [147.28.0.62]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O14voE011403 for ; Mon, 24 Feb 2003 02:04:58 +0100 (MET) Received: from localhost ([127.0.0.1] helo=roam.psg.com) by psg.com with esmtp (Exim 3.36 #1) id 18n73B-000CA3-00; Sun, 23 Feb 2003 17:04:57 -0800 Received: from localhost ([127.0.0.1] helo=roam.psg.com ident=randy) by roam.psg.com with esmtp (Exim 4.12) id 18n73A-000KAA-00; Mon, 24 Feb 2003 10:04:56 +0900 From: Randy Bush MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Mon, 24 Feb 2003 10:04:55 +0900 To: "J-F C. (Jefsey) Morfin" Cc: dnsop@cafax.se Subject: Re: Why one port? References: <5.2.0.9.0.20030223095437.028fb990@mail.club-internet.fr> <5.2.0.9.0.20030224010604.03e2dec0@mail.club-internet.fr> Message-Id: Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit > Frankly, don't you think there are far more competent people than me on > this list to write a draft on such a matter? talk is cheap #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Mon Feb 24 02:12:21 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA03458 for ; Mon, 24 Feb 2003 02:12:20 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O6rvoE014200 for ; Mon, 24 Feb 2003 07:53:57 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1O6rvw5014199 for dnsop-outgoing; Mon, 24 Feb 2003 07:53:57 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from netcore.fi (netcore.fi [193.94.160.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O6ruoE014194 for ; Mon, 24 Feb 2003 07:53:56 +0100 (MET) Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id h1O6rpp17233; Mon, 24 Feb 2003 08:53:52 +0200 Date: Mon, 24 Feb 2003 08:53:51 +0200 (EET) From: Pekka Savola To: Randy Bush cc: dns op wg Subject: Re: draft-ymbk-6to4-arpa-delegation-00.txt In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-dnsop@cafax.se Precedence: bulk On Mon, 24 Feb 2003, Randy Bush wrote: > would the dnsop wg consder adoptng draft-ymbk-6to4-arpa-delegation-00.txt > as a wg document? Requires some changes IMO, but it's a good start. Aye. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Mon Feb 24 04:44:32 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA06085 for ; Mon, 24 Feb 2003 04:44:31 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O9VboE015225 for ; Mon, 24 Feb 2003 10:31:37 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1O9Vbbr015224 for dnsop-outgoing; Mon, 24 Feb 2003 10:31:37 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from excalibur.skynet.be (excalibur.skynet.be [195.238.3.90]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O9VZoE015219 for ; Mon, 24 Feb 2003 10:31:36 +0100 (MET) Received: from [10.0.1.4] (ip-26.shub-internet.org [194.78.144.26] (may be forged)) by excalibur.skynet.be (8.12.7/8.12.7/Skynet-OUT-2.21) with ESMTP id h1O9VFhi020259; Mon, 24 Feb 2003 10:31:16 +0100 (MET) (envelope-from ) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: Date: Mon, 24 Feb 2003 08:23:59 +0100 To: Randy Bush From: Brad Knowles Subject: Re: draft-ymbk-6to4-arpa-delegation-00.txt Cc: dns op wg Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 10:07 AM +0900 2003/02/24, Randy Bush wrote: > would the dnsop wg consder adoptng draft-ymbk-6to4-arpa-delegation-00.txt > as a wg document? Why do we need a separate ID for this? Shouldn't this be incorporated into I-D.moore-6to4-dns? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Mon Feb 24 04:48:01 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA06198 for ; Mon, 24 Feb 2003 04:48:00 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O9d4oE015314 for ; Mon, 24 Feb 2003 10:39:04 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1O9d4tX015313 for dnsop-outgoing; Mon, 24 Feb 2003 10:39:04 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from naptop.autonomica.net (naptop.autonomica.se [192.71.80.71]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O9cwoE015308 for ; Mon, 24 Feb 2003 10:38:58 +0100 (MET) Received: from naptop.autonomica.net (localhost [127.0.0.1]) by naptop.autonomica.net (8.12.7.Beta0/8.12.7.Beta0) with ESMTP id h1O9dhEY011124 for ; Mon, 24 Feb 2003 10:39:43 +0100 (MET) Received: (from liman@localhost) by naptop.autonomica.net (8.12.7.Beta0/8.12.7.Beta0/Submit) id h1O9dhxu011123 for dnsop@cafax.se; Mon, 24 Feb 2003 10:39:43 +0100 (MET) Received: from stoneport.math.uic.edu (stoneport.math.uic.edu [131.193.178.160]) by nic.cafax.se (8.12.5/8.12.5) with SMTP id h1MILHoE001390 for ; Sat, 22 Feb 2003 19:21:18 +0100 (MET) Received: (qmail 52497 invoked by uid 1016); 22 Feb 2003 18:21:43 -0000 Date: 22 Feb 2003 18:21:43 -0000 Message-ID: <20030222182143.52496.qmail@cr.yp.to> Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html. From: "D. J. Bernstein" To: dnsop@cafax.se Subject: Re: Why one port? References: <1045854172.1153.222.camel@red> <1733.1045878123@shell.nominum.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Sender: owner-dnsop@cafax.se Precedence: bulk Jim Reid writes: > You invited controversy by making a suggestion which would mean > changing every DNS server and client on the internet. Actually, deployment is much easier as follows: existing client -> client forwarding tool on 127.0.0.1 port 53 -> cache forwarding tool on cache IP address on another port -> existing cache on port 53 Both sides install new software, but there aren't any changes to the existing software. The same approach also makes it fairly easy to deploy client-cache security protocols. ---D. J. Bernstein, Associate Professor, Department of Mathematics, Statistics, and Computer Science, University of Illinois at Chicago #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Mon Feb 24 05:09:08 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA06746 for ; Mon, 24 Feb 2003 05:09:07 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O9usoE015470 for ; Mon, 24 Feb 2003 10:56:54 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1O9us95015469 for dnsop-outgoing; Mon, 24 Feb 2003 10:56:54 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from excalibur.skynet.be (excalibur.skynet.be [195.238.3.90]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O9uroE015464 for ; Mon, 24 Feb 2003 10:56:53 +0100 (MET) Received: from [10.0.1.4] (ip-26.shub-internet.org [194.78.144.26] (may be forged)) by excalibur.skynet.be (8.12.7/8.12.7/Skynet-OUT-2.21) with ESMTP id h1O9uchm001253; Mon, 24 Feb 2003 10:56:43 +0100 (MET) (envelope-from ) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: <5.2.0.9.0.20030224010604.03e2dec0@mail.club-internet.fr> References: <5.2.0.9.0.20030223095437.028fb990@mail.club-internet.fr> <5.2.0.9.0.20030224010604.03e2dec0@mail.club-internet.fr> Date: Mon, 24 Feb 2003 10:56:35 +0100 To: "J-F C. (Jefsey) Morfin" From: Brad Knowles Subject: Re: Why one port? Cc: David Conrad , dnsop@cafax.se Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 1:20 AM +0100 2003/02/24, J-F C. (Jefsey) Morfin wrote: > I understand that. Seems very much as teaching the market before > making a market study. Lack of pre-brainstorming. May explain all > the post-braintearing? May be the reason why the DNS.2 still > expected? See and . The way Internet Drafts work is to throw out some ideas, get comments back, then work those into future editions of the draft. If you ever get to the point where things have gelled sufficiently to turn this into an RFC (informational or otherwise), the document continues to live, at least in some form. If not, it dies after a while and is retracted. So, if you have an idea, write it up as an ID, and start using the process. Otherwise, it seems to me that you're wasting your time and ours. > Frankly, don't you think there are far more competent people than > me on this list to write a draft on such a matter? Maybe, but you seem to care so passionately about this issue (whatever it is), that you would seem to be the person best suited to take on this task. Remember, open source only works because it is a result of someone having an itch that they feel they have to scratch, not because they're the objectively best people to solve the problem in question. You've got an itch, and I'd suggest that you just go ahead and scratch it, instead of moaning to us that you can't find anyone else to scratch it for you. > However this > topic belongs to the dot-root project and such a draft is foreseen > on an information basis. But not before months, after the iterative > specification mechanism I descirbed; and probably a few > pre-testings. Also by a team including a better English writer that > me :-). But I certainly want to share in it. If you want to assign this topic somewhere else and wait for them to do something about it, that's fine. But then I'd suggest that you actually do that, and not continue to spend your time by wasting ours. > Or may be would you want to discuss it privately and try to build > a draft with a few other interested? My approach is user centered, > list all what we want first. You could do that, too. All I ask is that you go ahead and do whatever it is you're going to do, and once you've got an ID together, we can then come back to review it and comment on it. -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Mon Feb 24 05:09:23 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA06762 for ; Mon, 24 Feb 2003 05:09:22 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O9wloE015514 for ; Mon, 24 Feb 2003 10:58:47 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1O9wlPC015513 for dnsop-outgoing; Mon, 24 Feb 2003 10:58:47 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from netcore.fi (netcore.fi [193.94.160.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1O9wkoE015506 for ; Mon, 24 Feb 2003 10:58:46 +0100 (MET) Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id h1O9wfb18288; Mon, 24 Feb 2003 11:58:41 +0200 Date: Mon, 24 Feb 2003 11:58:41 +0200 (EET) From: Pekka Savola To: Brad Knowles cc: Randy Bush , dns op wg Subject: Re: draft-ymbk-6to4-arpa-delegation-00.txt In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-dnsop@cafax.se Precedence: bulk On Mon, 24 Feb 2003, Brad Knowles wrote: > At 10:07 AM +0900 2003/02/24, Randy Bush wrote: > > > would the dnsop wg consder adoptng draft-ymbk-6to4-arpa-delegation-00.txt > > as a wg document? > > Why do we need a separate ID for this? Shouldn't this be > incorporated into I-D.moore-6to4-dns? It's much easier to pass one if they don't depend on each other. I'd assume the goal is to get draft-ymbk-6to4-arpa-delegation-00.txt done ASAP, while I-D.moore-6to4-dns might take a bit longer.. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Mon Feb 24 05:26:51 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA07070 for ; Mon, 24 Feb 2003 05:26:51 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1OAFwoE015702 for ; Mon, 24 Feb 2003 11:15:58 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1OAFwT6015701 for dnsop-outgoing; Mon, 24 Feb 2003 11:15:58 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from shell.nominum.com (shell.nominum.com [128.177.192.160]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1OAFvoE015696 for ; Mon, 24 Feb 2003 11:15:57 +0100 (MET) Received: from shell.nominum.com (localhost [127.0.0.1]) by shell.nominum.com (Postfix) with ESMTP id 2AD23137F0A; Mon, 24 Feb 2003 02:15:56 -0800 (PST) To: "D. J. Bernstein" Cc: dnsop@cafax.se Subject: Re: Why one port? In-Reply-To: Message from "D. J. Bernstein" of "22 Feb 2003 18:21:43 GMT." <20030222182143.52496.qmail@cr.yp.to> Date: Mon, 24 Feb 2003 02:15:56 -0800 Message-ID: <37000.1046081756@shell.nominum.com> From: Jim Reid Sender: owner-dnsop@cafax.se Precedence: bulk >>>>> "djb" == D J Bernstein writes: >> You invited controversy by making a suggestion which would mean >> changing every DNS server and client on the internet. djb> Actually, deployment is much easier as follows: djb> existing client djb> -> client forwarding tool on 127.0.0.1 port 53 djb> -> cache forwarding tool on cache IP address on another port djb> -> existing cache on port 53 djb> Both sides install new software, but there aren't any changes djb> to the existing software. I spoke of changes to *clients* and *servers*, not DNS software. Your allegedly "easy" deployment scenario means changing every client. It has to get new software, presumably which will need some configuration file has to be looked after, and the existing resolver setup has to be tweaked. And introducing this proxy agent you propose creates more complexity and yet more ways of breaking things. This doesn't seem all that easy, does it? And what about folk like me who run a name server on their laptop and want to continue to query that server over the loopback interface? #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Mon Feb 24 07:29:27 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA11144 for ; Mon, 24 Feb 2003 07:29:26 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1OCHCoE016712 for ; Mon, 24 Feb 2003 13:17:12 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1OCHCZk016711 for dnsop-outgoing; Mon, 24 Feb 2003 13:17:12 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from four.songbird.com (four.songbird.com [206.14.4.5]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1OCH5oE016703 for ; Mon, 24 Feb 2003 13:17:06 +0100 (MET) Received: (from kent@localhost) by four.songbird.com (8.11.6/8.11.6) id h1OBQbY09457; Mon, 24 Feb 2003 03:26:37 -0800 Date: Mon, 24 Feb 2003 03:26:37 -0800 From: kent@songbird.com To: Jim Reid Cc: "D. J. Bernstein" , dnsop@cafax.se Subject: Re: Why one port? Message-ID: <20030224032637.A9336@songbird.com> Mail-Followup-To: Jim Reid , "D. J. Bernstein" , dnsop@cafax.se References: <37000.1046081756@shell.nominum.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <37000.1046081756@shell.nominum.com>; from Jim.Reid@nominum.com on Mon, Feb 24, 2003 at 02:15:56AM -0800 Sender: owner-dnsop@cafax.se Precedence: bulk On Mon, Feb 24, 2003 at 02:15:56AM -0800, Jim Reid wrote: > And what about folk like me who run a name server on their laptop and > want to continue to query that server over the loopback interface? Not to fan the flames or anything: use 127.0.0.2. :-) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Mon Feb 24 19:12:10 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA01177 for ; Mon, 24 Feb 2003 19:12:08 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1ONq6oE023437 for ; Tue, 25 Feb 2003 00:52:07 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1ONq6gu023436 for dnsop-outgoing; Tue, 25 Feb 2003 00:52:06 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from slimsixten.besserwisser.org (slimsixten.besserwisser.org [213.212.3.212]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1ONq6oE023431 for ; Tue, 25 Feb 2003 00:52:06 +0100 (MET) Received: from localhost.besserwisser.org (mansaxel@localhost.besserwisser.org [127.0.0.1]) by slimsixten.besserwisser.org (8.12.6/8.12.2) with ESMTP id h1ONpqiA018818 for ; Tue, 25 Feb 2003 00:51:52 +0100 (CET) Date: Tue, 25 Feb 2003 00:51:52 +0100 From: =?ISO-8859-1?Q?M=E5ns_Nilsson?= To: dnsop@cafax.se Subject: Re: Why one port? Message-ID: <2261660000.1046130712@localhost.besserwisser.org> In-Reply-To: <5.2.0.9.0.20030223100134.042f2ae0@mail.club-internet.fr> References: < <5.2.0.9.0.20030222174204.0241d9d0@mail.club-internet.fr> <86549.1045820819@shell.nominum.com><86549.1045820819@shell.nominum.com> <5.2.0.9.0.20030222174204.0241d9d0@mail.club-internet.fr> <5.2.0.9.0.20030223100134.042f2ae0@mail.club-internet.fr> X-Mailer: Mulberry/2.2.1 (OpenBSD/x86) X-PGP-KEY: http://vvv.besserwisser.org/key MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="==========3686078981==========" Sender: owner-dnsop@cafax.se Precedence: bulk --==========3686078981========== Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable --On Sunday, February 23, 2003 10:12:13 +0100 "J-F C. (Jefsey) Morfin" wrote: > Absolutely true. But remember that I suggest DNS.2 to be first just an > "under development system". So it would first act only as an alarm. There > will be first discrepancies because of bugs.=20 No, there will be discrepancies because some greedy loon "invents" a new TLD. If the community manages to stomp those out, there will be discrepancies because at some point the admin/tech contacts for a 2nd level domain name will be different and domains will end up in the wrong hands. If we do our homework, the technical differences will be minor. This of course only as long as this is a bugfix/new features release of DNS, albeit with a different port.=20 So, where is the draft?=20 --=20 M=E5ns Nilsson Systems Specialist +46 70 681 7204 KTHNOC MN1334-RIPE We're sysadmins. To us, data is a protocol-overhead. --==========3686078981========== Content-Type: application/pgp-signature Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (OpenBSD) iD8DBQE+WrAY02/pMZDM1cURAn6CAJ9GBsRS7Ls72kL9x5aCljkq6ZFUWgCbBRP3 6Dp7IQ2PnAiXXbTozT/LOps= =X+3T -----END PGP SIGNATURE----- --==========3686078981==========-- #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Tue Feb 25 08:34:36 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA00720 for ; Tue, 25 Feb 2003 08:34:12 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1PD9aoE029668 for ; Tue, 25 Feb 2003 14:09:36 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1PD9aG0029667 for dnsop-outgoing; Tue, 25 Feb 2003 14:09:36 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from naptop.autonomica.net (naptop.autonomica.se [192.71.80.71]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1PD9YoE029662 for ; Tue, 25 Feb 2003 14:09:34 +0100 (MET) Received: from naptop.autonomica.net (localhost [127.0.0.1]) by naptop.autonomica.net (8.12.7.Beta0/8.12.7.Beta0) with ESMTP id h1PDAKZN001315 for ; Tue, 25 Feb 2003 14:10:20 +0100 (MET) Received: (from liman@localhost) by naptop.autonomica.net (8.12.7.Beta0/8.12.7.Beta0/Submit) id h1PDAKlE001314 for dnsop@cafax.se; Tue, 25 Feb 2003 14:10:20 +0100 (MET) Received: from as.vix.com (as.vix.com [204.152.187.70]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1P0mYoE023895 for ; Tue, 25 Feb 2003 01:48:34 +0100 (MET) Received: by as.vix.com (Postfix, from userid 716) id 7E877379EF3; Tue, 25 Feb 2003 00:48:33 +0000 (GMT) To: dnsop@cafax.se Subject: wrong file name, late by a day, but here it as promised: respsize.txt From: Paul Vixie Date: 25 Feb 2003 00:48:33 +0000 Message-ID: Lines: 429 User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.2 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-dnsop@cafax.se Precedence: bulk Independent Paul Vixie, ISC (Ed.) Request for Comments: XXXX Akira Kato, WIDE Category: FYI February 23, 2003 DNS Response Size Issues Status of this Memo This memo describes the general issues surrounding DNS response sizes, with special attention to delegation responses containing numerous NS RRs. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. Copyright Notice Copyright (C) The Internet Society (2003). All Rights Reserved. Abstract With a mandated default minimum maximum of 512 octets, the DNS protocol presents some special problems for zones wishing to advertise moderate or high numbers of authority servers (NS RRs). This document explains the operational issues caused by or related to this response size limit. 1 - Introduction and Overview 1.1. The DNS standard (see [RFC1035 4.2.1]) limits message size to 512 octets. Even though this limitation was due to the required minimum UDP reassembly limit for IPv4, it is a hard DNS protocol limit and is not implicitly relaxed by changes in transport, for example to IPv6. 1.2. The EDNS0 standard (see [RFC2671 2.3, 4.5]) permits larger responses by mutual agreement of the requestor and responder. However, deployment of EDNS0 cannot be expected to reach every Internet resolver in the short or medium term. The 512 octet assumption must remain in effect at this time. 1.3. Since DNS responses include a copy of the request, the space available for response data is somewhat less than the full 512 octets. For negative or positive responses, there is rarely a space constraint. For delegation responses, though, every octet must be carefully and sparingly allocated. Vixie & Kato FYI [Page 1] RFC XXXX DNS Response Size February 23, 2003 2 - Delegation Details 2.1. A delegation response will include the following elements: Header Section: fixed length (12 octets) Question Section: original query (name, class, type) Answer Section: (empty) Authority Section: NS RRset (nameserver names) Additional Section: A and AAAA RRsets (nameserver addresses) 2.2. If the total response size would exceed 512 octets, and if the data that would not fit was in the question, answer, or authority section, then the TC bit will be set (indicating truncation) which may cause the requestor to retry using TCP, depending on what information was present and what was omitted. If a retry using TCP is needed, the total cost to the requestor goes up. 2.3. RRsets are never sent partially, so if truncation occurs, entire RRsets are omitted. Note that the authority section consists of a single RRset. It is absolutely essential that truncation not occur in the authority section. 2.4. DNS label compression allows a domain name label to be instantiated only once per DNS message, and then referenced with a two-octet "pointer" from other locations in that same DNS message. If all nameserver names in a message are similar (for example, all ending in ".ROOT-SERVERS.NET"), then more space will be left over for uncompressable data (such as nameserver addresses). 2.5. The query name can be as long as 255 characters of presentation data, which can be up to 256 octets of network data. In this worst case scenario, the question section will be 260 octets in size, which would leave only 240 octets for the authority and additional sections (after deducting 12 octets for the fixed length header.) 2.6. Average and maximum question section sizes can be predicted by the zone owner, since they will know what names actually exist, and can measure which ones are queried for most often. For performance reasons, the majority of requests should not cause truncation. 2.7. Requestors who deliberately send large queries to force truncation are only increasing their own costs, and cannot effectively attack the resources of an authority server since the requestor would have to retry using TCP to complete the attack. An attack that always used TCP would be less work. Vixie & Kato FYI [Page 2] RFC XXXX DNS Response Size February 23, 2003 2.8. The minimum useful glue is two address records. (With only one address, the probability is too high that it will refer to an unreachable server.) Truncation which occurs after two address records have been added to the additional data section is less operationally significant than truncation which occurs earlier. 2.9. The best case is no truncation. (This is because many requestors will retry using TCP by reflex, without considering whether the omitted data was actually necessary.) Vixie & Kato FYI [Page 3] RFC XXXX DNS Response Size February 23, 2003 3 - Analysis 3.1. An instrumented protocol trace of a best case delegation response follows. Note that 13 servers are named, and 13 addresses are given. This query was artificially designed to exactly reach the 512 octet limit. ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 13 ;; QUERY SECTION: ;; [23456789.123456789.123456789.\ 123456789.123456789.123456789.com A IN] ;; @80 ;; AUTHORITY SECTION: com. 86400 NS E.GTLD-SERVERS.NET. ;; @112 com. 86400 NS F.GTLD-SERVERS.NET. ;; @128 com. 86400 NS G.GTLD-SERVERS.NET. ;; @144 com. 86400 NS H.GTLD-SERVERS.NET. ;; @160 com. 86400 NS I.GTLD-SERVERS.NET. ;; @176 com. 86400 NS J.GTLD-SERVERS.NET. ;; @192 com. 86400 NS K.GTLD-SERVERS.NET. ;; @208 com. 86400 NS L.GTLD-SERVERS.NET. ;; @224 com. 86400 NS M.GTLD-SERVERS.NET. ;; @240 com. 86400 NS A.GTLD-SERVERS.NET. ;; @256 com. 86400 NS B.GTLD-SERVERS.NET. ;; @272 com. 86400 NS C.GTLD-SERVERS.NET. ;; @288 com. 86400 NS D.GTLD-SERVERS.NET. ;; @304 ;; ADDITIONAL SECTION: A.GTLD-SERVERS.NET. 86400 A 192.5.6.30 ;; @320 B.GTLD-SERVERS.NET. 86400 A 192.33.14.30 ;; @336 C.GTLD-SERVERS.NET. 86400 A 192.26.92.30 ;; @352 D.GTLD-SERVERS.NET. 86400 A 192.31.80.30 ;; @368 E.GTLD-SERVERS.NET. 86400 A 192.12.94.30 ;; @384 F.GTLD-SERVERS.NET. 86400 A 192.35.51.30 ;; @400 G.GTLD-SERVERS.NET. 86400 A 192.42.93.30 ;; @416 H.GTLD-SERVERS.NET. 86400 A 192.54.112.30 ;; @432 I.GTLD-SERVERS.NET. 86400 A 192.43.172.30 ;; @448 J.GTLD-SERVERS.NET. 86400 A 192.48.79.30 ;; @464 K.GTLD-SERVERS.NET. 86400 A 192.52.178.30 ;; @480 L.GTLD-SERVERS.NET. 86400 A 192.41.162.30 ;; @496 M.GTLD-SERVERS.NET. 86400 A 192.55.83.30 ;; @512 ;; MSG SIZE sent: 80 rcvd: 512 Vixie & Kato FYI [Page 4] RFC XXXX DNS Response Size February 23, 2003 3.2. For longer query names, the number of address records supplied will be lower. Furthermore, it is only by using a common parent name (which is GTLD-SERVERS.NET in this example) that all 13 addresses are able to fit. The following output from a response simulator demonstrates these properties: % perl respsize.pl 13 13 0 common name, average case: msg:303 glue#13 (green) common name, worst case: msg:495 glue# 1 (red) uncommon name, average case: msg:457 glue# 3 (orange) uncommon name, worst case: msg:649(*) glue# 0 (red) % perl respsize.pl 13 13 2 common name, average case: msg:303 glue#11 (orange) common name, worst case: msg:495 glue# 1 (red) uncommon name, average case: msg:457 glue# 2 (orange) uncommon name, worst case: msg:649(*) glue# 0 (red) (Note: The response simulator's source code is contained in the appendix.) Here we give the term "green" if all address records could fit, or "orange" if two or more could fit, or "red" if fewer than two could fit. It's clear that without a common parent for nameserver names, much space would be lost. 4 - Further Work 4.1. Traces from one or more root name servers and at least a dozen diverse TLD name servers should be analyzed to measure the actual minimum, maximum, average, and standard deviation in query name sizes. 4.2. Current delegation response sizes from the root server system for all TLDs should be measured in light of the known query name sizes found to be in use. 4.3. A policy should be created for the addition of AAAA RR's for existing name servers, in both TLD delegations under the root zone, and SLD delegations under interested TLDs. 4.4. Participants in the Internationalized Domain Names (IDN) effort should take careful note of the performance effects of larger query names on root name server system delegation sizes. Vixie & Kato FYI [Page 5] RFC XXXX DNS Response Size February 23, 2003 5 - Source Code #!/usr/bin/perl -w $asize = 2+2+2+4+2+4; $aaaasize = 2+2+2+4+2+16; ($nns, $na, $naaaa) = @ARGV; test("common", "average", common_name_average($nns), $na, $naaaa); test("common", "worst", common_name_worst($nns), $na, $naaaa); test("uncommon", "average", uncommon_name_average($nns), $na, $naaaa); test("uncommon", "worst", uncommon_name_worst($nns), $na, $naaaa); exit 0; sub test { my ($namekind, $casekind, $msg, $na, $naaaa) = @_; my $nglue = numglue($msg, $na, $naaaa); printf "%8s name, %7s case: msg:%3d%s glue#%2d (%s)\n", $namekind, $casekind, $msg, ($msg > 512) ? "(*)" : " ", $nglue, ($nglue == $na + $naaaa) ? "green" : ($nglue >= 2) ? "orange" : "red"; } sub pnum { my ($num, $tot) = @_; return sprintf "%3d%s", } sub numglue { my ($msg, $na, $naaaa) = @_; my $space = ($msg > 512) ? 0 : (512 - $msg); my $num = 0; while ($space && ($na || $naaaa )) { if ($na) { if ($space >= $asize) { $space -= $asize; $num++; } $na--; } if ($naaaa) { if ($space >= $aaaasize) { $space -= $aaaasize; $num++; } $naaaa--; Vixie & Kato FYI [Page 6] RFC XXXX DNS Response Size February 23, 2003 } } return $num; } sub msgsize { my ($qname, $nns, $nsns) = @_; return 12 + # header $qname+2+2 + # query 0 + # answer $nns * (4+2+2+4+2+$nsns); # authority } sub average_case { my ($nns, $nsns) = @_; return msgsize(64, $nns, $nsns); } sub worst_case { my ($nns, $nsns) = @_; return msgsize(256, $nns, $nsns); } sub common_name_average { my ($nns) = @_; return 15 + average_case($nns, 2); } sub common_name_worst { my ($nns) = @_; return 15 + worst_case($nns, 2); } sub uncommon_name_average { my ($nns) = @_; return average_case($nns, 15); } sub uncommon_name_worst { my ($nns) = @_; return worst_case($nns, 15); } Vixie & Kato FYI [Page 7] RFC XXXX DNS Response Size February 23, 2003 5 - Author's Address Paul Vixie 950 Charter Street Redwood City, CA 94063 +1 650 779 7000 paul@vix.com Akira Kato University of Tokyo, Information Technology Center 2-11-16 Yayoi Bunkyo Tokyo 113-8658, JAPAN +81 3 5841 2750 kato@wide.ad.jp Vixie & Kato FYI [Page 8] -- Paul Vixie #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Wed Feb 26 09:19:21 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA06053 for ; Wed, 26 Feb 2003 09:19:20 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1QE2AoE013308 for ; Wed, 26 Feb 2003 15:02:10 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1QE2AB3013307 for dnsop-outgoing; Wed, 26 Feb 2003 15:02:10 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from ietf.org (odin.ietf.org [132.151.1.176]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1QE27oE013302 for ; Wed, 26 Feb 2003 15:02:08 +0100 (MET) Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA04366; Wed, 26 Feb 2003 08:58:12 -0500 (EST) Message-Id: <200302261358.IAA04366@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: IETF-Announce: ; Cc: dnsop@cafax.se From: Internet-Drafts@ietf.org Reply-to: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-dnsop-interim-signed-root-00.txt Date: Wed, 26 Feb 2003 08:58:11 -0500 Sender: owner-dnsop@cafax.se Precedence: bulk --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Domain Name Server Operations Working Group of the IETF. Title : An Interim Scheme for Signing the Public DNS Root Author(s) : J. Ihren Filename : draft-ietf-dnsop-interim-signed-root-00.txt Pages : 0 Date : 2003-2-25 This memo documents a proposed mechanism for a first stage of a transition from an unsigned DNS root to a signed root, such that the data in the root zone is accompanied by DNSSEC signatures to allow validation. The underlying reason for signing the root is to be able to provide a more secure DNS hierarchy, where it is possible to distinguish false answers from correct answers. For the special case of the DNS root zone, an interim scheme is proposed. This scheme is mostly aimed at securing the root zone itself for technical and operational reasons, and to give operational experience of DNSSEC. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-dnsop-interim-signed-root-00.txt To remove yourself from the IETF Announcement list, send a message to ietf-announce-request with the word unsubscribe in the body of the message. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-dnsop-interim-signed-root-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-dnsop-interim-signed-root-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2003-2-25155711.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-dnsop-interim-signed-root-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-dnsop-interim-signed-root-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2003-2-25155711.I-D@ietf.org> --OtherAccess-- --NextPart-- #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Wed Feb 26 09:19:24 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA06069 for ; Wed, 26 Feb 2003 09:19:23 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1QE0toE013282 for ; Wed, 26 Feb 2003 15:00:55 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1QE0t0d013281 for dnsop-outgoing; Wed, 26 Feb 2003 15:00:55 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from pollux.asml.nl (ns.asml.nl [195.109.200.66]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1QE0soE013276 for ; Wed, 26 Feb 2003 15:00:54 +0100 (MET) Received: from creon.asml.nl (creon [146.106.1.223]) by pollux.asml.nl (8.8.8+Sun/8.8.8) with ESMTP id PAA00049; Wed, 26 Feb 2003 15:00:47 +0100 (MET) Received: from titan.asml.nl (titan [146.106.1.9]) by creon.asml.nl (8.11.6+Sun/8.11.6) with ESMTP id h1QE0kq03397; Wed, 26 Feb 2003 15:00:46 +0100 (MET) Received: from [10.0.1.4] (frobozz.asml.nl [146.106.12.76]) by titan.asml.nl (8.9.3+Sun/8.9.3) with ESMTP id PAA08773; Wed, 26 Feb 2003 15:00:46 +0100 (MET) Mime-Version: 1.0 X-Sender: bs663385@pop.skynet.be Message-Id: In-Reply-To: References: Date: Wed, 26 Feb 2003 14:36:35 +0100 To: Paul Vixie From: Brad Knowles Subject: Re: wrong file name, late by a day, but here it as promised: respsize.txt Cc: dnsop@cafax.se Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-dnsop@cafax.se Precedence: bulk At 12:48 AM +0000 2003/02/25, Paul Vixie wrote: > With a mandated default minimum maximum of 512 octets, the DNS > protocol presents some special problems for zones wishing to > advertise moderate or high numbers of authority servers (NS RRs). > This document explains the operational issues caused by or related to > this response size limit. Hmm. Back in '97 (I think), there was a draft that was created on pretty much the same topic. This was right after the 19-hour downtime at AOL, and where much of the Internet was unable to send e-mail because we were advertising too many MXes (45?), and combined with the two minute TCP timeout and typical queue runner startup times (every sixty minutes), many sites would stack up queue runners until they ran out of memory (real & virtual) and the server would crash. These queue runners would get a timeout on each of the advertised MXes, and not be able to process any other mail while sitting and spinning their wheels. However, that draft ultimately died. Both qmail and postfix should avoid excessive problems of this sort, and intelligent installations of sendmail should avoid problems of this sort, but I'm sure that there are plenty of sites out there that are still vulnerable to this sort of thing. Would it be possible to incorporate some analysis and recommendations on this issue in future versions of this draft? -- Brad Knowles, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -Benjamin Franklin, Historical Review of Pennsylvania. GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+ !w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++) tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++) #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 27 13:19:30 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA14957 for ; Thu, 27 Feb 2003 13:19:29 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1RHuIoE001430 for ; Thu, 27 Feb 2003 18:56:18 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1RHuIj8001429 for dnsop-outgoing; Thu, 27 Feb 2003 18:56:18 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from rtp-core-1.cisco.com (rtp-core-1.cisco.com [64.102.124.12]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1RHuGoE001422 for ; Thu, 27 Feb 2003 18:56:17 +0100 (MET) Received: from dingdong.cisco.com (IDENT:mirapoint@dingdong.cisco.com [64.102.17.16]) by rtp-core-1.cisco.com (8.12.6/8.12.6) with ESMTP id h1RHuEJR012269 for ; Thu, 27 Feb 2003 12:56:15 -0500 (EST) Received: from cisco.com (dhcp-64-102-59-109.cisco.com [64.102.59.109]) by dingdong.cisco.com (Mirapoint Messaging Server MOS 3.2.1-GA) with ESMTP id ABP26785; Thu, 27 Feb 2003 12:52:34 -0500 (EST) Message-ID: <3E5E513B.1010903@cisco.com> Date: Thu, 27 Feb 2003 12:56:11 -0500 From: Ed Warnicke User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20021226 Debian/1.2.1-9 MIME-Version: 1.0 To: dnsop@cafax.se Subject: Request for review of DNS related draft Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit I have published a draft defining a method for using DNS given an IP address to resolve the subnet that contains that IP address, the netmask of that network, and the gateway(s) on that network. It is very similar in purpose the RFC 1101, but allows for variable length subnets, and the delegation of zones on non-octet boundaries. The draft is available here: http://www.ietf.org/internet-drafts/draft-warnicke-network-dns-resolution-00.txt My intention is to pursue having this published as an informational RFC. I would very much appreciate any comments or criticism of the draft. Thank you for your time, Ed Warnicke #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 27 15:52:33 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA23204 for ; Thu, 27 Feb 2003 15:52:32 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1RKSAoE003395 for ; Thu, 27 Feb 2003 21:28:10 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1RKSAsA003394 for dnsop-outgoing; Thu, 27 Feb 2003 21:28:10 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from home.sewingwitch.com (12-240-15-89.client.attbi.com [12.240.15.89]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1RKS8oE003389 for ; Thu, 27 Feb 2003 21:28:08 +0100 (MET) Received: from [10.69.3.69] (uugw.kensingtonlabs.com [65.200.126.98]) by home.sewingwitch.com (8.11.6/8.11.6) with ESMTP id h1RKS1R06088 for ; Thu, 27 Feb 2003 12:28:01 -0800 Date: Thu, 27 Feb 2003 12:28:00 -0800 From: Kenneth Porter To: dnsop@cafax.se Subject: Re: Request for review of DNS related draft Message-ID: <181971000.1046348880@[10.69.3.69]> In-Reply-To: <3E5E513B.1010903@cisco.com> References: <3E5E513B.1010903@cisco.com> X-Mailer: Mulberry/3.0.0 (Win32) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit --On Thursday, February 27, 2003 12:56 PM -0500 Ed Warnicke wrote: > I have published a draft defining a method for using DNS given > an IP address to resolve the subnet that contains that IP address, > the netmask of that network, and the gateway(s) on that network. I'm curious to know why one would use this instead of DHCP, which is also commonly provided in routers. #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 27 16:22:40 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA24366 for ; Thu, 27 Feb 2003 16:22:38 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1RL1EoE003779 for ; Thu, 27 Feb 2003 22:01:14 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1RL1E9U003778 for dnsop-outgoing; Thu, 27 Feb 2003 22:01:14 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from rtp-core-1.cisco.com (rtp-core-1.cisco.com [64.102.124.12]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1RL1AoE003771 for ; Thu, 27 Feb 2003 22:01:13 +0100 (MET) Received: from dingdong.cisco.com (IDENT:mirapoint@dingdong.cisco.com [64.102.17.16]) by rtp-core-1.cisco.com (8.12.6/8.12.6) with ESMTP id h1RL17JR025578; Thu, 27 Feb 2003 16:01:08 -0500 (EST) Received: from cisco.com (dhcp-64-102-59-109.cisco.com [64.102.59.109]) by dingdong.cisco.com (Mirapoint Messaging Server MOS 3.2.1-GA) with ESMTP id ABP34210; Thu, 27 Feb 2003 15:57:27 -0500 (EST) Message-ID: <3E5E7C8F.2000404@cisco.com> Date: Thu, 27 Feb 2003 16:01:03 -0500 From: Ed Warnicke User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20021226 Debian/1.2.1-9 MIME-Version: 1.0 To: Kenneth Porter CC: dnsop@cafax.se Subject: Re: Request for review of DNS related draft References: <3E5E513B.1010903@cisco.com> <181971000.1046348880@[10.69.3.69]> In-Reply-To: <181971000.1046348880@[10.69.3.69]> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit For configuring endpoints I would agree that DHCP would perform this task more effectively. But DHCP will not allow a device which is not the endpoint ( or the DHCP server ) to discover the network which contains an IP address and the first hop gateway(s) which service that network. Ed Kenneth Porter wrote: >--On Thursday, February 27, 2003 12:56 PM -0500 Ed Warnicke >wrote: > > > >>I have published a draft defining a method for using DNS given >>an IP address to resolve the subnet that contains that IP address, >>the netmask of that network, and the gateway(s) on that network. >> >> > >I'm curious to know why one would use this instead of DHCP, which is also >commonly provided in routers. >#---------------------------------------------------------------------- ># To unsubscribe, send a message to . > > #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Thu Feb 27 16:31:23 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA24770 for ; Thu, 27 Feb 2003 16:31:21 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1RLAnoE003868 for ; Thu, 27 Feb 2003 22:10:49 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1RLAnT2003867 for dnsop-outgoing; Thu, 27 Feb 2003 22:10:49 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from home.sewingwitch.com (12-240-15-89.client.attbi.com [12.240.15.89]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1RLAhoE003856 for ; Thu, 27 Feb 2003 22:10:45 +0100 (MET) Received: from [10.69.3.69] (uugw.kensingtonlabs.com [65.200.126.98]) by home.sewingwitch.com (8.11.6/8.11.6) with ESMTP id h1RLAcR06476 for ; Thu, 27 Feb 2003 13:10:38 -0800 Date: Thu, 27 Feb 2003 13:10:38 -0800 From: Kenneth Porter To: dnsop@cafax.se Subject: Re: Request for review of DNS related draft Message-ID: <184528127.1046351438@[10.69.3.69]> In-Reply-To: <3E5E7C8F.2000404@cisco.com> References: <3E5E513B.1010903@cisco.com> <181971000.1046348880@[10.69.3.69]> <3E5E7C8F.2000404@cisco.com> X-Mailer: Mulberry/3.0.0 (Win32) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-dnsop@cafax.se Precedence: bulk Content-Transfer-Encoding: 7bit --On Thursday, February 27, 2003 4:01 PM -0500 Ed Warnicke wrote: > For configuring endpoints I would agree that DHCP would perform > this task more effectively. But DHCP will not allow a device which > is not the endpoint ( or the DHCP server ) to discover the network which > contains an IP address and the first hop gateway(s) which service that > network. Can you give an example of a device like that? I'm having trouble getting the motivation here. #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 28 06:35:50 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA21009 for ; Fri, 28 Feb 2003 06:35:49 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SB7ToE010769 for ; Fri, 28 Feb 2003 12:07:29 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1SB7TpG010768 for dnsop-outgoing; Fri, 28 Feb 2003 12:07:29 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from ratree.psu.ac.th ([202.12.73.3]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SB7HoE010759 for ; Fri, 28 Feb 2003 12:07:19 +0100 (MET) Received: from delta.cs.mu.OZ.AU (delta.coe.psu.ac.th [172.30.0.98]) by ratree.psu.ac.th (8.11.6/8.11.6) with ESMTP id h1SB76O12701; Fri, 28 Feb 2003 18:07:07 +0700 (ICT) Received: from munnari.OZ.AU (localhost [127.0.0.1]) by delta.cs.mu.OZ.AU (8.11.6/8.11.6) with ESMTP id h1SB70o03503; Fri, 28 Feb 2003 18:07:00 +0700 (ICT) From: Robert Elz To: Ed Warnicke cc: Kenneth Porter , dnsop@cafax.se Subject: Re: Request for review of DNS related draft In-Reply-To: <3E5E7C8F.2000404@cisco.com> References: <3E5E7C8F.2000404@cisco.com> <3E5E513B.1010903@cisco.com> <181971000.1046348880@[10.69.3.69]> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Fri, 28 Feb 2003 18:07:00 +0700 Message-ID: <3501.1046430420@munnari.OZ.AU> Sender: owner-dnsop@cafax.se Precedence: bulk Date: Thu, 27 Feb 2003 16:01:03 -0500 From: Ed Warnicke Message-ID: <3E5E7C8F.2000404@cisco.com> | But DHCP will not allow a device which | is not the endpoint ( or the DHCP server ) to discover the network which | contains | an IP address and the first hop gateway(s) which service that network. Rather than how, perhaps the question should be why would anyone care? That's largely why 1101 never got used - the nodes for which it might have provided information that could didn't already know it via other means, never had much of a reason to care. Why would my nodes care what the network that contains some random IP address might happen to be (or why would I ever care more than the routing tables will tell me) ? kre #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 28 07:55:24 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA25117 for ; Fri, 28 Feb 2003 07:55:23 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SCVnoE011525 for ; Fri, 28 Feb 2003 13:31:49 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1SCVnNJ011524 for dnsop-outgoing; Fri, 28 Feb 2003 13:31:49 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from sj-msg-core-1.cisco.com (sj-msg-core-1.cisco.com [171.71.163.11]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SCVhoE011519 for ; Fri, 28 Feb 2003 13:31:48 +0100 (MET) Received: from eaw-u5.cisco.com (eaw-u5.cisco.com [64.102.39.24]) by sj-msg-core-1.cisco.com (8.12.2/8.12.6) with ESMTP id h1SCVV57016096; Fri, 28 Feb 2003 04:31:31 -0800 (PST) Date: Fri, 28 Feb 2003 07:31:31 -0500 (EST) From: Edward Warnicke To: Robert Elz cc: Kenneth Porter , Subject: Re: Request for review of DNS related draft In-Reply-To: <3501.1046430420@munnari.OZ.AU> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-dnsop@cafax.se Precedence: bulk Not everyone is privy to the routing tables. For example. Imagine an MGCP call agent which wishes to perform a maintenance activity that requires the cooperation of the first hop gateway for an MGCP gateway. I'm aware of no MGCP call agent which participates in the IGP for the networks containing those endpoints. Additionally almost all IGPs will allow for some route summarization which would prevent me from actually knowing who the first hop gateway is in some circumstances. So in this example I would either have to provision the MGCP call agent with information about where the first hop gateway for each endpoint was, or allow it to use the method of the draft to resolve it. Since many of the environments where MGCP is seeing deployment have a very large number of endpoints, and an unusually large churn of first hop gateway changes ( think splitting a cable node ), as well as a tendency toward hierarchical distibution of control of the network, DNS resolution of this information seemed to make sense. The reason RFC 1101 doesn't get used for these sorts of purposes is that it doesn't support features in common use in these networks ( variable length subnet masks ). Ed On Fri, 28 Feb 2003, Robert Elz wrote: > Date: Thu, 27 Feb 2003 16:01:03 -0500 > From: Ed Warnicke > Message-ID: <3E5E7C8F.2000404@cisco.com> > > | But DHCP will not allow a device which > | is not the endpoint ( or the DHCP server ) to discover the network which > | contains > | an IP address and the first hop gateway(s) which service that network. > > Rather than how, perhaps the question should be why would anyone care? > > That's largely why 1101 never got used - the nodes for which it might > have provided information that could didn't already know it via other > means, never had much of a reason to care. > > Why would my nodes care what the network that contains some random IP > address might happen to be (or why would I ever care more than the > routing tables will tell me) ? > > kre > > #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 28 09:57:12 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA00643 for ; Fri, 28 Feb 2003 09:57:12 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SEegoE013168 for ; Fri, 28 Feb 2003 15:40:42 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1SEegoI013167 for dnsop-outgoing; Fri, 28 Feb 2003 15:40:42 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from netcore.fi (netcore.fi [193.94.160.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SEeaoE013162 for ; Fri, 28 Feb 2003 15:40:36 +0100 (MET) Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id h1SEboU21855; Fri, 28 Feb 2003 16:37:50 +0200 Date: Fri, 28 Feb 2003 16:37:50 +0200 (EET) From: Pekka Savola To: Robert Elz cc: Ed Warnicke , Kenneth Porter , Subject: Re: Request for review of DNS related draft In-Reply-To: <3501.1046430420@munnari.OZ.AU> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-dnsop@cafax.se Precedence: bulk On Fri, 28 Feb 2003, Robert Elz wrote: [...] > Why would my nodes care what the network that contains some random IP > address might happen to be (or why would I ever care more than the > routing tables will tell me) ? Being able to do something like this would have quite a few security considerations, besides -- in addition to operational reluctance to take it to use. Finding your *own* info could be useful, but you really need most of that information before you can make the DNS query.. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 28 11:32:38 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA03975 for ; Fri, 28 Feb 2003 11:32:37 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SGFWoE014258 for ; Fri, 28 Feb 2003 17:15:32 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1SGFWlP014257 for dnsop-outgoing; Fri, 28 Feb 2003 17:15:32 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from sj-msg-core-1.cisco.com (sj-msg-core-1.cisco.com [171.71.163.11]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SGFPoE014246 for ; Fri, 28 Feb 2003 17:15:30 +0100 (MET) Received: from eaw-u5.cisco.com (eaw-u5.cisco.com [64.102.39.24]) by sj-msg-core-1.cisco.com (8.12.2/8.12.6) with ESMTP id h1SGFD57020944; Fri, 28 Feb 2003 08:15:14 -0800 (PST) Date: Fri, 28 Feb 2003 11:15:12 -0500 (EST) From: Edward Warnicke To: Pekka Savola cc: Robert Elz , Kenneth Porter , Subject: Re: Request for review of DNS related draft In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-dnsop@cafax.se Precedence: bulk Could you be more specific about what security considerations you see? In terms of operational resistance to use, I'd expect it to be about on par with the use of rp and hinfo records. Organizations which find utility in having those records populated use them, organizations that don't see value don't use them. I've been in organizations which break both ways on hinfo and rp records. If an organization finds value in deploying this scheme, they will. It's a question of applications. Ed On Fri, 28 Feb 2003, Pekka Savola wrote: > On Fri, 28 Feb 2003, Robert Elz wrote: > [...] > > Why would my nodes care what the network that contains some random IP > > address might happen to be (or why would I ever care more than the > > routing tables will tell me) ? > > Being able to do something like this would have quite a few security > considerations, besides -- in addition to operational reluctance to take > it to use. > > Finding your *own* info could be useful, but you really need most of that > information before you can make the DNS query.. > > -- > Pekka Savola "You each name yourselves king, yet the > Netcore Oy kingdom bleeds." > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings > > #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 28 13:08:45 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07716 for ; Fri, 28 Feb 2003 13:08:44 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SHnsoE015358 for ; Fri, 28 Feb 2003 18:49:54 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1SHnsI4015357 for dnsop-outgoing; Fri, 28 Feb 2003 18:49:54 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from citation.av8.net (relay2.av8.net [130.105.12.4] (may be forged)) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SHnmoE015349 for ; Fri, 28 Feb 2003 18:49:48 +0100 (MET) Received: from commander.av8.net (IDENT:dean@commander.av8.net [130.105.11.4]) by citation.av8.net (8.9.3/8.9.3) with ESMTP id MAA12261; Fri, 28 Feb 2003 12:42:11 -0500 Date: Fri, 28 Feb 2003 12:43:42 -0500 (EST) From: Dean Anderson X-X-Sender: dean@commander.av8.net To: Edward Warnicke cc: Robert Elz , Kenneth Porter , Subject: Re: Request for review of DNS related draft In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-dnsop@cafax.se Precedence: bulk This seems the wrong way to go about MGCP management activity. What makes you think the first hop router will have anything to do with VOIP or MGCP? In the VOIP networks that I've worked with (a number of large voip installations since 1998), the first hop routers were never VOIP-aware at all. --Dean On Fri, 28 Feb 2003, Edward Warnicke wrote: > Not everyone is privy to the routing tables. > > For example. Imagine an MGCP call agent which wishes to > perform a maintenance activity that requires the cooperation > of the first hop gateway for an MGCP gateway. I'm aware > of no MGCP call agent which participates in the IGP for > the networks containing those endpoints. Additionally > almost all IGPs will allow for some route summarization > which would prevent me from actually knowing who the > first hop gateway is in some circumstances. > > So in this example I would either have to provision the MGCP > call agent with information about where the first hop gateway > for each endpoint was, or allow it to use the method of the > draft to resolve it. > > Since many of the environments where MGCP is seeing deployment > have a very large number of endpoints, and an unusually large > churn of first hop gateway changes ( think splitting a cable > node ), as well as a tendency toward hierarchical distibution > of control of the network, DNS resolution of this information > seemed to make sense. > > The reason RFC 1101 doesn't get used for these sorts of > purposes is that it doesn't support features in common use > in these networks ( variable length subnet masks ). > > Ed > > On Fri, 28 Feb 2003, Robert Elz wrote: > > > Date: Thu, 27 Feb 2003 16:01:03 -0500 > > From: Ed Warnicke > > Message-ID: <3E5E7C8F.2000404@cisco.com> > > > > | But DHCP will not allow a device which > > | is not the endpoint ( or the DHCP server ) to discover the network which > > | contains > > | an IP address and the first hop gateway(s) which service that network. > > > > Rather than how, perhaps the question should be why would anyone care? > > > > That's largely why 1101 never got used - the nodes for which it might > > have provided information that could didn't already know it via other > > means, never had much of a reason to care. > > > > Why would my nodes care what the network that contains some random IP > > address might happen to be (or why would I ever care more than the > > routing tables will tell me) ? > > > > kre > > > > > > > > #---------------------------------------------------------------------- > # To unsubscribe, send a message to . > #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 28 13:09:02 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA07730 for ; Fri, 28 Feb 2003 13:09:01 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SHpqoE015387 for ; Fri, 28 Feb 2003 18:51:52 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1SHpqcR015386 for dnsop-outgoing; Fri, 28 Feb 2003 18:51:52 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from citation.av8.net (relay2.av8.net [130.105.12.4] (may be forged)) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SHppoE015381 for ; Fri, 28 Feb 2003 18:51:51 +0100 (MET) Received: from commander.av8.net (IDENT:dean@commander.av8.net [130.105.11.4]) by citation.av8.net (8.9.3/8.9.3) with ESMTP id MAA12266; Fri, 28 Feb 2003 12:42:54 -0500 Date: Fri, 28 Feb 2003 12:44:24 -0500 (EST) From: Dean Anderson X-X-Sender: dean@commander.av8.net To: Pekka Savola cc: Robert Elz , Ed Warnicke , Kenneth Porter , Subject: Re: Request for review of DNS related draft In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-dnsop@cafax.se Precedence: bulk Not to mention that it would be quite useful to smurfers. --Dean On Fri, 28 Feb 2003, Pekka Savola wrote: > On Fri, 28 Feb 2003, Robert Elz wrote: > [...] > > Why would my nodes care what the network that contains some random IP > > address might happen to be (or why would I ever care more than the > > routing tables will tell me) ? > > Being able to do something like this would have quite a few security > considerations, besides -- in addition to operational reluctance to take > it to use. > > Finding your *own* info could be useful, but you really need most of that > information before you can make the DNS query.. > > -- > Pekka Savola "You each name yourselves king, yet the > Netcore Oy kingdom bleeds." > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings > > #---------------------------------------------------------------------- > # To unsubscribe, send a message to . > #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 28 16:50:35 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA14298 for ; Fri, 28 Feb 2003 16:50:34 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SLNNoE017659 for ; Fri, 28 Feb 2003 22:23:23 +0100 (MET) Received: by nic.cafax.se (8.12.5/8.12.5/Submit) id h1SLNME9017658 for dnsop-outgoing; Fri, 28 Feb 2003 22:23:22 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from stoneport.math.uic.edu (stoneport.math.uic.edu [131.193.178.160]) by nic.cafax.se (8.12.5/8.12.5) with SMTP id h1SLNGoE017653 for ; Fri, 28 Feb 2003 22:23:22 +0100 (MET) Received: (qmail 43810 invoked by uid 1016); 28 Feb 2003 21:23:40 -0000 Date: 28 Feb 2003 21:23:40 -0000 Message-ID: <20030228212340.43809.qmail@cr.yp.to> Automatic-Legal-Notices: See http://cr.yp.to/mailcopyright.html. From: "D. J. Bernstein" To: dnsop@cafax.se Subject: Re: wrong file name, late by a day, but here it as promised: respsize.txt References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Sender: owner-dnsop@cafax.se Precedence: bulk Paul Vixie writes: > Furthermore, it is only by using a common parent name (which is > GTLD-SERVERS.NET in this example) that all 13 addresses are able to fit. Of course, there's quite a bit of extra space in the 512-byte packet--- enough for more than 20 IP addresses overall---if you reduce the number of _server_ names. ---D. J. Bernstein, Associate Professor, Department of Mathematics, Statistics, and Computer Science, University of Illinois at Chicago #---------------------------------------------------------------------- # To unsubscribe, send a message to . From owner-dnsop@cafax.se Fri Feb 28 16:56:48 2003 Received: from nic.cafax.se (nic.cafax.se [192.71.228.17]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA14531 for ; Fri, 28 Feb 2003 16:56:47 -0500 (EST) Received: from nic.cafax.se (localhost [127.0.0.1]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SLcsoE017837 for ; Fri, 28 Feb 2003 22:38:54 +0100 (MET) Received: from localhost (localhost [[UNIX: localhost]]) by nic.cafax.se (8.12.5/8.12.5/Submit) id h1SLcrJg017836 for dnsop-outgoing; Fri, 28 Feb 2003 22:38:53 +0100 (MET) X-Authentication-Warning: nic.cafax.se: majordom set sender to owner-dnsop@cafax.se using -f Received: from sj-msg-core-1.cisco.com (sj-msg-core-1.cisco.com [171.71.163.11]) by nic.cafax.se (8.12.5/8.12.5) with ESMTP id h1SLcqoE017831 for ; Fri, 28 Feb 2003 22:38:52 +0100 (MET) Received: from eaw-u5.cisco.com (eaw-u5.cisco.com [64.102.39.24]) by sj-msg-core-1.cisco.com (8.12.2/8.12.6) with ESMTP id h1SLcH57011055; Fri, 28 Feb 2003 13:38:17 -0800 (PST) Date: Fri, 28 Feb 2003 16:38:16 -0500 (EST) From: Edward Warnicke To: Dean Anderson cc: Pekka Savola , Robert Elz , Kenneth Porter , Subject: Re: Request for review of DNS related draft In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-dnsop@cafax.se Precedence: bulk True, if directed broadcasts for a network implementing this draft have not been disabled, but no more so than any information about the structure of the network would help a smurfer. So it does reduce security through obscurity by reducing obscurity. However, if an organization is concerned they can limit which zones/domainnames they expose to the outside world. I would expect it to be handled in the same way that organization handle the question of which A records they choose to make visible to the internet ( split DNS, bind9 views, etc ). Would folks feel better about this if I were to put a paragraph in the "security considerations" section noting that availability to the outside world of information about the network structure of a network may be used for DOS attacks like smurphing, and recommending that organizations consider carefully the acceptable visibility of such records? Ed On Fri, 28 Feb 2003, Dean Anderson wrote: > Not to mention that it would be quite useful to smurfers. > > --Dean > > On Fri, 28 Feb 2003, Pekka Savola wrote: > > > On Fri, 28 Feb 2003, Robert Elz wrote: > > [...] > > > Why would my nodes care what the network that contains some random IP > > > address might happen to be (or why would I ever care more than the > > > routing tables will tell me) ? > > > > Being able to do something like this would have quite a few security > > considerations, besides -- in addition to operational reluctance to take > > it to use. > > > > Finding your *own* info could be useful, but you really need most of that > > information before you can make the DNS query.. > > > > -- > > Pekka Savola "You each name yourselves king, yet the > > Netcore Oy kingdom bleeds." > > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings > > > > #---------------------------------------------------------------------- > > # To unsubscribe, send a message to . > > > > #---------------------------------------------------------------------- # To unsubscribe, send a message to .