From owner-namedroppers@ops.ietf.org Tue Sep 1 00:29:34 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 177FF3A6876; Tue, 1 Sep 2009 00:29:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.345 X-Spam-Level: X-Spam-Status: No, score=-0.345 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XBHr2lKvk3EQ; Tue, 1 Sep 2009 00:29:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 90E6C3A69BB; Tue, 1 Sep 2009 00:27:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiNh3-0001nH-8z for namedroppers-data0@psg.com; Tue, 01 Sep 2009 07:22:17 +0000 Received: from [74.125.78.26] (helo=ey-out-2122.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiNgz-0001m2-Oe for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 07:22:15 +0000 Received: by ey-out-2122.google.com with SMTP id 9so855559eyd.53 for ; Tue, 01 Sep 2009 00:22:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=u2i1YNp9+HB6XPsQg2Lz7x8gTtcUcg8PMyjd/r/FZpU=; b=E0u2ZxTBlPZZEvzTEhVE26UyNbCsj45+qgV2wFUOYYlg4DEj0WWcyeDG3OIDQnkxq2 dzuwhK3Vmtmph5M71ATNjyCJl/XxeGIDkOuDItxxrqn5XVvBKvdBNcJTfkVmOWBR56aY ilBsKDE5teqTTjOuhTF7M/OzwBogRjg4N0n7s= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=IPY+GVBtIv/tIKBMMYLscUjwMXBeURaePAnEz154fIdZBg2bQnKhohnF6/r+M1yyTU TKNHJIkdNECOoGg6JksaF6W3Y5WID6ykb2IbqLT8nXuN1dmvkh/QIZwBUnhKRh8LsnjW ifwBx+iksLTWkapE1CfUa2Okbvf1KtO31CSRc= MIME-Version: 1.0 Received: by 10.211.158.8 with SMTP id k8mr6640903ebo.38.1251789732392; Tue, 01 Sep 2009 00:22:12 -0700 (PDT) In-Reply-To: <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> From: bert hubert Date: Tue, 1 Sep 2009 09:21:52 +0200 Message-ID: <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> Subject: Re: [dnsext] EDNS0 fallback "revisited" To: =?ISO-8859-1?Q?Patrik_F=E4ltstr=F6m?= Cc: Nicholas Weaver , Alex Bligh , "Olafur Gudmundsson/DNSEXT chair" , namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: 2009/9/1 Patrik F=E4ltstr=F6m : > The question is who the complaint is going to. Some DNSSEC problems will > target the large ISPs that run the large resolvers. They will detect peop= le > with broken signed zones -- but they will most certainly _not_ have the > fragmentation issues (or they have serious problems anyway). The complain= ts I'm not sure about the latter. What will probably happen a lot is the following scenario: 1) ISP/Corporation turns on DNSSEC validation 2) complaints come in that goodsecuritybank.org does not resolve anymore (because of fragments not arriving or TCP/IP not working), or is slow to resolve. badsecuritybank.org resolves normally! 3) ISP/Corporation turns off DNSSEC validation, goodsecuritybank.org is fast again. 3a) goodsecuritybank.org reads about itself online, and its domain not resolving, and thinks twice about its DNSSEC signing.. 3b) badsecuritybank.org thinks they were right all along 4) Wait.. and perhaps go back to step 1 A well-motivated ISP or corporation with time on its hand should of course launch a good investigation after step 2, and fix their own (corporate) firewalls or access lists. The steps outlined above become worse if they only happen over time. Say, at first things fit within a single packet, and people consider the 'turn on DNSSEC validation' project a success. Few weeks later things start breaking down (move to NSEC3, or larger keys, or key rollover..), no one has time to investigate, and as a workaround, validation is shut off. Do realise that Nicholas' numbers indicate that 13% of all resolvers today that understand EDNS appear to be *unable* to receive an answer that requires fragmentation or TCP to be working. So if we roll out DNSSEC that needs fragmentation (even if only for one DNSKEY in the trust chain), which appears likely, 1 in 7 places would get into problems if they turned on DNSSEC validation. Anyone not impressed by this number might want to talk to people that carry responsibility for system administration, and see what they think of it. Bert From owner-namedroppers@ops.ietf.org Tue Sep 1 00:35:54 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5AA7B28C494; Tue, 1 Sep 2009 00:35:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.736 X-Spam-Level: X-Spam-Status: No, score=-4.736 tagged_above=-999 required=5 tests=[AWL=-2.608, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, RCVD_NUMERIC_HELO=2.067, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iADvizfuN8+p; Tue, 1 Sep 2009 00:35:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7239128C43F; Tue, 1 Sep 2009 00:35:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiNqi-00066H-Ru for namedroppers-data0@psg.com; Tue, 01 Sep 2009 07:32:16 +0000 Received: from [171.71.176.70] (helo=sj-iport-1.cisco.com) by psg.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiNqe-00063w-35 for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 07:32:15 +0000 X-Files: PGP.sig : 186 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Aq8EAFFrnEqrR7O6/2dsb2JhbACKDpB9qFaIQQGPWAWEGoFa X-IronPort-AV: E=Sophos;i="4.44,311,1249257600"; d="sig'?scan'208";a="235662836" Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-1.cisco.com with ESMTP; 01 Sep 2009 07:32:11 +0000 Received: from sj-core-2.cisco.com (sj-core-2.cisco.com [171.71.177.254]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id n817WBqA012168; Tue, 1 Sep 2009 00:32:11 -0700 Received: from xbh-ams-101.cisco.com (xbh-ams-101.cisco.com [144.254.74.71]) by sj-core-2.cisco.com (8.13.8/8.14.3) with ESMTP id n817VpV8029675; Tue, 1 Sep 2009 07:32:10 GMT Received: from xfe-ams-102.cisco.com ([144.254.231.94]) by xbh-ams-101.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 1 Sep 2009 09:32:06 +0200 Received: from 79.138.133.127.bredband.tre.se ([10.61.69.237]) by xfe-ams-102.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 1 Sep 2009 09:32:04 +0200 Cc: Nicholas Weaver , Alex Bligh , "Olafur Gudmundsson/DNSEXT chair" , namedroppers@ops.ietf.org Message-Id: <4437D106-7797-46B4-8ADE-FCE69077C88E@cisco.com> From: =?ISO-8859-1?Q?Patrik_F=E4ltstr=F6m?= To: bert hubert In-Reply-To: <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Apple-Mail-154-752696396" Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] EDNS0 fallback "revisited" Date: Tue, 1 Sep 2009 09:31:59 +0200 References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> X-Pgp-Agent: GPGMail d55 (v55, Leopard) X-Mailer: Apple Mail (2.936) X-OriginalArrivalTime: 01 Sep 2009 07:32:05.0357 (UTC) FILETIME=[4E0181D0:01CA2AD6] X-TM-AS-Product-Ver: SMEX-8.0.0.1181-5.600.1016-16860.003 X-TM-AS-Result: No--4.904400-8.000000-31 X-TM-AS-User-Approved-Sender: No X-TM-AS-User-Blocked-Sender: No DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=2411; t=1251790331; x=1252654331; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=paf@cisco.com; z=From:=20=3D?ISO-8859-1?Q?Patrik_F=3DE4ltstr=3DF6m?=3D=20

|Subject:=20Re=3A=20[dnsext]=20EDNS0=20fallback=20=22revisi ted=22 |Sender:=20; bh=bGlTapJieWMWeWzQa1HR8dD5MFM/5n6BX72S0PRnpf4=; b=j2XlO2KXUIQ7pT07/tx5xQDT/dNR9nXZ7UvxihZyP0MfxYR5HueOgEBRBT cxGfswEW09SWf90j+4MZzfppWWrL77hfnsxlBKuqKH5Wx7PQhWUB03fluybu nGAjmNJanI; Authentication-Results: sj-dkim-2; header.From=paf@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; ); Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --Apple-Mail-154-752696396 Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit On 1 sep 2009, at 09.21, bert hubert wrote: > Do realise that Nicholas' numbers indicate that 13% of all resolvers > today that understand EDNS appear to be *unable* to receive an answer > that requires fragmentation or TCP to be working. I do understand your scenario description, and I do know about Nicholas number. But I do not understand why we have not seen any problems in newspapers in Sweden where we have been running DNSSEC for quite some time. Is that because the large resolvers (with many queries) "of course" are not behind a firewall (something I find being a pretty weird thing) or behind a firewall that do the right thing (those exists, remember), and in reality the people that have participated in Nic's tests are the ones that really are behind broken things that "just want to test"? I.e. you simply do not run Nic's tests if it is not the case that you already do see some problems. Sure, I agree the 13% number is large, very large, and even if the real number of affected queries is 0.1% it might be too large. I would even be surprised if 13% of the resolvers in the world that send queries to the TLDs etc have this problem. But even 1% might be too large! > Anyone not impressed by this number might want to talk to people that > carry responsibility for system administration, and see what they > think of it. Bert, I do. I really do. And that is what confuses me. People that do carry responsibility for DNSSEC validating resolvers in Sweden are worried about DNSSEC, but not about these findings. They do not say these issues exist. I am not saying you are wrong. I am just saying I hear different things from two camps. Which makes me confused! Patrik --Apple-Mail-154-752696396 content-type: application/pgp-signature; x-mac-type=70674453; name=PGP.sig content-description: This is a digitally signed message part content-disposition: inline; filename=PGP.sig content-transfer-encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iD8DBQFKnM3vvHlR2X0luNwRApZcAKCSIzWgfjgdk/5QvcLeb3fBNDQAnACgvG+a aiNvT3XktPvPLKFIX5BlzhQ= =2r0i -----END PGP SIGNATURE----- --Apple-Mail-154-752696396-- From owner-namedroppers@ops.ietf.org Tue Sep 1 01:39:20 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CC3B23A6F17; Tue, 1 Sep 2009 01:39:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.864 X-Spam-Level: X-Spam-Status: No, score=-4.864 tagged_above=-999 required=5 tests=[AWL=-0.669, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7hmf2pGeUOSa; Tue, 1 Sep 2009 01:39:19 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 97C963A6F7E; Tue, 1 Sep 2009 01:39:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiOnj-0007Wn-2b for namedroppers-data0@psg.com; Tue, 01 Sep 2009 08:33:15 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiOne-0007Vk-DG for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 08:33:13 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n818VjZW008147; Tue, 1 Sep 2009 08:31:45 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n818VjGD008146; Tue, 1 Sep 2009 08:31:45 GMT Date: Tue, 1 Sep 2009 08:31:45 +0000 From: bmanning@vacation.karoshi.com To: Patrik =?iso-8859-1?B?RuRsdHN0cvZt?= Cc: bert hubert , Nicholas Weaver , Alex Bligh , Olafur Gudmundsson/DNSEXT chair , namedroppers@ops.ietf.org Subject: Re: [dnsext] EDNS0 fallback "revisited" Message-ID: <20090901083145.GA7493@vacation.karoshi.com.> References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <4437D106-7797-46B4-8ADE-FCE69077C88E@cisco.com> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <4437D106-7797-46B4-8ADE-FCE69077C88E@cisco.com> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 01, 2009 at 09:31:59AM +0200, Patrik Fdltstrvm wrote: > On 1 sep 2009, at 09.21, bert hubert wrote: > > >Do realise that Nicholas' numbers indicate that 13% of all resolvers > >today that understand EDNS appear to be *unable* to receive an answer > >that requires fragmentation or TCP to be working. > > I do understand your scenario description, and I do know about > Nicholas number. But I do not understand why we have not seen any > problems in newspapers in Sweden where we have been running DNSSEC for > quite some time. > > Is that because the large resolvers (with many queries) "of course" > are not behind a firewall (something I find being a pretty weird > thing) or behind a firewall that do the right thing (those exists, > remember), and in reality the people that have participated in Nic's > tests are the ones that really are behind broken things that "just > want to test"? I.e. you simply do not run Nic's tests if it is not the > case that you already do see some problems. > some very interesting advice from Roland Dobbins - Don't put your webservers/dnsservers behind firewalls. - this to the assembled folks @ ausnog yesterday. - so maybe not so weird. > Sure, I agree the 13% number is large, very large, and even if the > real number of affected queries is 0.1% it might be too large. I would > even be surprised if 13% of the resolvers in the world that send > queries to the TLDs etc have this problem. But even 1% might be too > large! a much smaller sample was run by me today - testing against Duanes MTU-checker. 7 of 31 have an MTU smaller than 2048. would need more testing to see if the path can handle UDP frags or TCP. ... even if they do, thats not looking good for signed data. Lots of extra traffic - even if it does work. Geo. Michaelson noticed and commented on the fact that the need to handle NXDOMAIN replies and the amnt of traffic was unexpected and not planned for. This is going ot be exciting and a little bit precarious. I would not want ot be front line helpdesk next year > > >Anyone not impressed by this number might want to talk to people that > >carry responsibility for system administration, and see what they > >think of it. > > Bert, I do. I really do. And that is what confuses me. People that do > carry responsibility for DNSSEC validating resolvers in Sweden are > worried about DNSSEC, but not about these findings. They do not say > these issues exist. > > I am not saying you are wrong. I am just saying I hear different > things from two camps. Which makes me confused! > > Patrik > From owner-namedroppers@ops.ietf.org Tue Sep 1 02:04:47 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4237C3A6F08; Tue, 1 Sep 2009 02:04:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.048 X-Spam-Level: X-Spam-Status: No, score=-1.048 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Psxk6ZR-v301; Tue, 1 Sep 2009 02:04:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5630E28C4D5; Tue, 1 Sep 2009 02:04:46 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiPET-000IEl-6z for namedroppers-data0@psg.com; Tue, 01 Sep 2009 09:00:53 +0000 Received: from [80.64.7.196] (helo=mx11.tdc.fi) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiPEO-000IDU-Ru for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 09:00:50 +0000 X-IronPort-AV: E=Sophos;i="4.44,311,1249246800"; d="scan'208";a="57715" Received: from fi-hel2ex01.nordiclan.net ([194.100.219.27]) by mail-gw2.tdc.fi with ESMTP; 01 Sep 2009 12:00:45 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Subject: RE: [dnsext] EDNS0 fallback "revisited" Date: Tue, 1 Sep 2009 12:00:45 +0300 Message-ID: <86048CA3B4B17E459FFD4F3F383AD88F1539705B@fi-hel2ex01.nordiclan.net> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [dnsext] EDNS0 fallback "revisited" Thread-Index: Acoq4isqFFkDeyWMRZ+dYknQPgvkMQAADEQA References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <4437D106-7797-46B4-8ADE-FCE69077C88E@cisco.com> <20090901083145.GA7493@vacation.karoshi.com.> From: "Aki Tuomi" To: Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBvd25lci1uYW1lZHJvcHBlcnNA b3BzLmlldGYub3JnIFttYWlsdG86b3duZXItDQo+IG5hbWVkcm9wcGVyc0BvcHMuaWV0Zi5vcmdd IE9uIEJlaGFsZiBPZiBibWFubmluZ0B2YWNhdGlvbi5rYXJvc2hpLmNvbQ0KPiBTZW50OiBUdWVz ZGF5LCBTZXB0ZW1iZXIgMDEsIDIwMDkgMTE6MzIgQU0NCj4gVG86IFBhdHJpayBGw6RsdHN0csO2 bQ0KPiBDYzogYmVydCBodWJlcnQ7IE5pY2hvbGFzIFdlYXZlcjsgQWxleCBCbGlnaDsgT2xhZnVy IEd1ZG11bmRzc29uL0ROU0VYVA0KPiBjaGFpcjsgbmFtZWRyb3BwZXJzQG9wcy5pZXRmLm9yZw0K PiBTdWJqZWN0OiBSZTogW2Ruc2V4dF0gRUROUzAgZmFsbGJhY2sgInJldmlzaXRlZCINCj4gDQo+ IE9uIFR1ZSwgU2VwIDAxLCAyMDA5IGF0IDA5OjMxOjU5QU0gKzAyMDAsIFBhdHJpayBGZGx0c3Ry dm0gd3JvdGU6DQo+ID4gT24gMSBzZXAgMjAwOSwgYXQgMDkuMjEsIGJlcnQgaHViZXJ0IHdyb3Rl Og0KPiA+DQo+ID4gSXMgdGhhdCBiZWNhdXNlIHRoZSBsYXJnZSByZXNvbHZlcnMgKHdpdGggbWFu eSBxdWVyaWVzKSAib2YgY291cnNlIg0KPiA+IGFyZSBub3QgYmVoaW5kIGEgZmlyZXdhbGwgKHNv bWV0aGluZyBJIGZpbmQgYmVpbmcgYSBwcmV0dHkgd2VpcmQNCj4gPiB0aGluZykgb3IgYmVoaW5k IGEgZmlyZXdhbGwgdGhhdCBkbyB0aGUgcmlnaHQgdGhpbmcgKHRob3NlIGV4aXN0cywNCj4gPiBy ZW1lbWJlciksIGFuZCBpbiByZWFsaXR5IHRoZSBwZW9wbGUgdGhhdCBoYXZlIHBhcnRpY2lwYXRl ZCBpbiBOaWMncw0KPiA+IHRlc3RzIGFyZSB0aGUgb25lcyB0aGF0IHJlYWxseSBhcmUgYmVoaW5k IGJyb2tlbiB0aGluZ3MgdGhhdCAianVzdA0KPiA+IHdhbnQgdG8gdGVzdCI/IEkuZS4geW91IHNp bXBseSBkbyBub3QgcnVuIE5pYydzIHRlc3RzIGlmIGl0IGlzIG5vdA0KPiB0aGUNCj4gPiBjYXNl IHRoYXQgeW91IGFscmVhZHkgZG8gc2VlIHNvbWUgcHJvYmxlbXMuDQo+ID4NCj4gCXNvbWUgdmVy eSBpbnRlcmVzdGluZyBhZHZpY2UgZnJvbSBSb2xhbmQgRG9iYmlucyAtIERvbid0DQo+IAlwdXQg eW91ciB3ZWJzZXJ2ZXJzL2Ruc3NlcnZlcnMgYmVoaW5kIGZpcmV3YWxscy4gIC0gdGhpcyB0bw0K PiAJdGhlIGFzc2VtYmxlZCBmb2xrcyBAIGF1c25vZyB5ZXN0ZXJkYXkuICAtICBzbyBtYXliZSBu b3Qgc28NCj4gd2VpcmQuDQo+IA0KIA0KPHNuaXAgLz4NCg0KVGhlcmUgaXMgcmFyZWx5IGFueSBu ZWVkIHRvIHB1dCBib3JkZXIgYXV0aG9yaXRhdGl2ZSBzZXJ2ZXJzIChvciByZXNvbHZlcnMsIGZv ciB0aGF0IG1hdHRlcikgYmVoaW5kIGZpcmV3YWxsLiBVbmZvcnR1bmF0ZWx5IHRoaXMgaXMgbm90 IGtub3duIGJ5IG1hbnkgYWRtaW5pc3RyYXRvcnMsIGJ1dCBwZXJoYXBzIFN3ZWRpc2ggb25lcyBr bm93IHRoaXMgcXVpdGUgd2VsbD8gDQoNCkl0IHdhcyBhcmd1ZWQgaW4gYSBwcmV2aW91cyBtYWls IHRoYXQgTmljaG9sYXMgbnVtYmVycyBjb3VsZCBiZSBiaWFzZWQgYnkgcGVvcGxlIGRvaW5nIHRo ZSB0ZXN0IG9ubHkgd2hlbiB0aGVyZSBpcyBuZWVkIHRvIHRlc3QuIENvdWxkIGJlLCBidXQgSSBk b24ndCBrbm93IGlmIHdlIGNhbiB1c2UgU3dlZGVuIGFzIHN0YXRpc3RpY2FsbHkgcmVwcmVzZW50 YXRpdmUgZ3JvdXAgZWl0aGVyLiANCg0KQWtpIFR1b21pDQo= From leeming@acebike.com.cn Tue Sep 1 02:38:55 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C5CB028C6B7 for ; Tue, 1 Sep 2009 02:38:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.765 X-Spam-Level: X-Spam-Status: No, score=-15.765 tagged_above=-999 required=5 tests=[BAYES_80=2, HELO_EQ_DSL=1.129, HELO_EQ_PL=1.135, HOST_EQ_PL=1.95, HTML_IMAGE_ONLY_04=2.041, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, SARE_HTML_A_BODY=0.742, SARE_HTML_IMG_ONLY=1.666, TVD_SPACE_RATIO=2.219, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V+-cdUiBQdD5 for ; Tue, 1 Sep 2009 02:38:49 -0700 (PDT) Received: from ivm210.internetdsl.tpnet.pl (ivm210.internetdsl.tpnet.pl [95.48.38.210]) by core3.amsl.com (Postfix) with SMTP id 1B4A228C69E for ; Tue, 1 Sep 2009 02:38:47 -0700 (PDT) To: Subject: Delivery Status Notification From: MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20090901093848.1B4A228C69E@core3.amsl.com> Date: Tue, 1 Sep 2009 02:38:47 -0700 (PDT) Show picture and go to site now! From owner-namedroppers@ops.ietf.org Tue Sep 1 04:54:49 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 261403A6997; Tue, 1 Sep 2009 04:54:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, J_CHICKENPOX_44=0.6, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S3144c185qEX; Tue, 1 Sep 2009 04:54:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 41FB93A6880; Tue, 1 Sep 2009 04:54:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiRqh-0003b4-Fg for namedroppers-data0@psg.com; Tue, 01 Sep 2009 11:48:31 +0000 Received: from [131.111.8.136] (helo=ppsw-6.csi.cam.ac.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiRqe-0003SH-2Z for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 11:48:29 +0000 X-Cam-AntiVirus: no malware found X-Cam-SpamDetails: not scanned X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Received: from hermes-2.csi.cam.ac.uk ([131.111.8.54]:38424) by ppsw-6.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.156]:25) with esmtpa (EXTERNAL:cet1) id 1MiRqc-0001Z9-Kq (Exim 4.70) (return-path ); Tue, 01 Sep 2009 12:48:26 +0100 Received: from prayer by hermes-2.csi.cam.ac.uk (hermes.cam.ac.uk) with local (PRAYER:cet1) id 1MiRqc-0003s7-EM (Exim 4.67) (return-path ); Tue, 01 Sep 2009 12:48:26 +0100 Received: from [131.111.11.47] by webmail.hermes.cam.ac.uk with HTTP (Prayer-1.3.1); 01 Sep 2009 12:48:26 +0100 Date: 01 Sep 2009 12:48:26 +0100 From: Chris Thompson To: namedroppers@ops.ietf.org Cc: Alex Bligh , Tony Finch Subject: Re: [dnsext] root DNSKEY response is 1749 bytes Message-ID: In-Reply-To: References: <4A907B6D.1050905@gmail.com> <61661.1251006812@nsa.vix.com> <3efd34cc0908230247s3678e811q6809608ddc620746@mail.gmail.com> <4A93013E.6030806@isc.org> <20090824220451.GF17279@vacation.karoshi.com.> <0C66638E-0D60-4A8E-8480-6977B8AB73CE@icsi.berkeley.edu> <40C2A0A89CFE6F174BCCD299@Ximines.local> X-Mailer: Prayer v1.3.1 Mime-Version: 1.0 Content-Type: text/plain; format=flowed; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Aug 31 2009, Tony Finch wrote: >On Mon, 31 Aug 2009, Alex Bligh wrote: >> >> Question: do stub resolvers on popular operating systems actually >> fall back to TCP, and if so, do they pipeline? > >The usual high-level resolver APIs don't allow pipelining, but GNU adns >(for example) makes it easy. You can pipeline using the low-level >resolver API but it's much more fiddly. Olaf Kolkman's Perl module Net::DNS supports a "persistent_tcp" option: | Get or set the persistent TCP setting. If set to true, Net::DNS | will keep a TCP socket open for each host:port to which it connects. | This is useful if you're using TCP and need to make a lot of queries | or updates to the same nameserver. | | This option defaults to false unless you're running under a | SOCKSified Perl, in which case it defaults to true. I have used this in some local applications. -- Chris Thompson University of Cambridge Computing Service, Email: cet1@ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QH, Phone: +44 1223 334715 United Kingdom. From owner-namedroppers@ops.ietf.org Tue Sep 1 04:55:13 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DE9383A6997; Tue, 1 Sep 2009 04:55:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.419 X-Spam-Level: **** X-Spam-Status: No, score=4.419 tagged_above=-999 required=5 tests=[AWL=-0.283, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, HTML_MESSAGE=0.001, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d5wN-5Y6GCSy; Tue, 1 Sep 2009 04:55:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 11CFB3A6880; Tue, 1 Sep 2009 04:55:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiRub-0004oq-Pt for namedroppers-data0@psg.com; Tue, 01 Sep 2009 11:52:33 +0000 Received: from [195.188.213.6] (helo=smtp-out3.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiRuW-0004jN-GE for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 11:52:31 +0000 Received: from [172.23.170.144] (helo=anti-virus03-07) by smtp-out3.blueyonder.co.uk with smtp (Exim 4.52) id 1MiRuU-0006Dl-NP for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 12:52:27 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out6.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MiRuU-0002IT-0t for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 12:52:26 +0100 Message-ID: <741D2CE589EF45F48343B6B970D856AD@localhost> From: "George Barwood" To: Subject: [dnsext] Amplification attacks, RFC3704 etc. Date: Tue, 1 Sep 2009 12:52:21 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0381_01CA2B03.0B84F6C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is a multi-part message in MIME format. ------=_NextPart_000_0381_01CA2B03.0B84F6C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I have some questions: (1) Since RFC3704 ( http://www.ietf.org/rfc/rfc3704.txt ) is there any evidence of progress on prevention of IP spoofing? (2) Are there amplification attacks that have similar or greater = amplification=20 than the DNS-based attacks ( which have an amplification of roughly x 70 = ) ? which leads to (3) Is everyone happy about deploying EDNS/DNSSEC when it can be used to mount DoS attacks on third parties? George ------=_NextPart_000_0381_01CA2B03.0B84F6C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

I have some questions:
 
(1) Since RFC3704 ( http://www.ietf.org/rfc/rfc3= 704.txt ) is there any
evidence of progress=20 on prevention of IP spoofing?
 
(2) Are there amplification attacks = that have=20 similar or greater amplification 
than the DNS-based attacks ( which have = an=20 amplification of roughly x 70 ) ?
 
which leads to
 
(3) Is everyone happy about deploying = EDNS/DNSSEC=20 when it can be used to
mount DoS attacks on third = parties?
 
George
 
------=_NextPart_000_0381_01CA2B03.0B84F6C0-- From owner-namedroppers@ops.ietf.org Tue Sep 1 05:43:37 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EC29F28C6E6; Tue, 1 Sep 2009 05:43:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.115 X-Spam-Level: X-Spam-Status: No, score=-5.115 tagged_above=-999 required=5 tests=[AWL=-0.067, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id srKnDJzuH0SN; Tue, 1 Sep 2009 05:43:37 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7CB8428C700; Tue, 1 Sep 2009 05:28:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiSQT-000FPZ-Jf for namedroppers-data0@psg.com; Tue, 01 Sep 2009 12:25:29 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiSQN-000FMV-QE for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 12:25:27 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n81CPMEZ006090; Tue, 1 Sep 2009 05:25:22 -0700 (PDT) Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. Mime-Version: 1.0 (Apple Message framework v1075.2) Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes From: Nicholas Weaver X-Priority: 3 In-Reply-To: <741D2CE589EF45F48343B6B970D856AD@localhost> Date: Tue, 1 Sep 2009 05:25:21 -0700 Cc: Nicholas Weaver , Content-Transfer-Encoding: 7bit Message-Id: <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> References: <741D2CE589EF45F48343B6B970D856AD@localhost> To: "George Barwood" X-Mailer: Apple Mail (2.1075.2) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 1, 2009, at 4:52 AM, George Barwood wrote: > I have some questions: > > (1) Since RFC3704 ( http://www.ietf.org/rfc/rfc3704.txt ) is there any > evidence of progress on prevention of IP spoofing? THe MIT Spoofer project: http://spoofer.csail.mit.edu/summary.php > (2) Are there amplification attacks that have similar or greater > amplification > than the DNS-based attacks ( which have an amplification of roughly > x 70 ) ? There are sufficient non-DNSSEC queries you can target at open recursive resolvers which also have high amplification factors. EG, you can always make one: a giant TXT record on amplifier (x).baddomain, and then launch spoofed queries to recursive resolvers to trigger it. From owner-namedroppers@ops.ietf.org Tue Sep 1 06:20:27 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E89CF28C297; Tue, 1 Sep 2009 06:20:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.023 X-Spam-Level: **** X-Spam-Status: No, score=4.023 tagged_above=-999 required=5 tests=[AWL=0.128, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BdZgVb8js1Fg; Tue, 1 Sep 2009 06:20:26 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9F57628C528; Tue, 1 Sep 2009 06:18:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiTBO-000PTD-8Q for namedroppers-data0@psg.com; Tue, 01 Sep 2009 13:13:58 +0000 Received: from [195.188.213.6] (helo=smtp-out3.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiTBJ-000PS6-DT for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 13:13:55 +0000 Received: from [172.23.170.140] (helo=anti-virus02-07) by smtp-out3.blueyonder.co.uk with smtp (Exim 4.52) id 1MiTBI-0007nn-9c; Tue, 01 Sep 2009 14:13:52 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out2.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MiTBG-0008Lk-5s; Tue, 01 Sep 2009 14:13:50 +0100 Message-ID: <8BE80AE8D80C4D49B836D72C399D05DA@localhost> From: "George Barwood" To: "Nicholas Weaver" Cc: "Nicholas Weaver" , References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. Date: Tue, 1 Sep 2009 14:13:45 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIk5pY2hvbGFzIFdlYXZlciIg PG53ZWF2ZXJASUNTSS5CZXJrZWxleS5FRFU+DQpUbzogIkdlb3JnZSBCYXJ3b29kIiA8Z2Vvcmdl LmJhcndvb2RAYmx1ZXlvbmRlci5jby51az4NCkNjOiAiTmljaG9sYXMgV2VhdmVyIiA8bndlYXZl ckBJQ1NJLkJlcmtlbGV5LkVEVT47IDxuYW1lZHJvcHBlcnNAb3BzLmlldGYub3JnPg0KU2VudDog VHVlc2RheSwgU2VwdGVtYmVyIDAxLCAyMDA5IDE6MjUgUE0NClN1YmplY3Q6IFJlOiBbZG5zZXh0 XSBBbXBsaWZpY2F0aW9uIGF0dGFja3MsIFJGQzM3MDQgZXRjLg0KDQoNCj4gDQo+IE9uIFNlcCAx LCAyMDA5LCBhdCA0OjUyIEFNLCBHZW9yZ2UgQmFyd29vZCB3cm90ZToNCj4gDQo+PiBJIGhhdmUg c29tZSBxdWVzdGlvbnM6DQo+Pg0KPj4gKDEpIFNpbmNlIFJGQzM3MDQgKCBodHRwOi8vd3d3Lmll dGYub3JnL3JmYy9yZmMzNzA0LnR4dCApIGlzIHRoZXJlIGFueQ0KPj4gZXZpZGVuY2Ugb2YgcHJv Z3Jlc3Mgb24gcHJldmVudGlvbiBvZiBJUCBzcG9vZmluZz8NCj4gDQo+IFRIZSBNSVQgU3Bvb2Zl ciBwcm9qZWN0Og0KPiBodHRwOi8vc3Bvb2Zlci5jc2FpbC5taXQuZWR1L3N1bW1hcnkucGhwDQoN ClRoYW5rcywgdGhhdCBsb29rcyBzY2FyeS4NCg0KPj4gKDIpIEFyZSB0aGVyZSBhbXBsaWZpY2F0 aW9uIGF0dGFja3MgdGhhdCBoYXZlIHNpbWlsYXIgb3IgZ3JlYXRlciAgDQo+PiBhbXBsaWZpY2F0 aW9uDQo+PiB0aGFuIHRoZSBETlMtYmFzZWQgYXR0YWNrcyAoIHdoaWNoIGhhdmUgYW4gYW1wbGlm aWNhdGlvbiBvZiByb3VnaGx5ICANCj4+IHggNzAgKSA/DQo+IA0KPiBUaGVyZSBhcmUgc3VmZmlj aWVudCBub24tRE5TU0VDIHF1ZXJpZXMgeW91IGNhbiB0YXJnZXQgYXQgb3BlbiAgDQo+IHJlY3Vy c2l2ZSByZXNvbHZlcnMgd2hpY2ggYWxzbyBoYXZlIGhpZ2ggYW1wbGlmaWNhdGlvbiBmYWN0b3Jz Lg0KPiANCj4gRUcsIHlvdSBjYW4gYWx3YXlzIG1ha2Ugb25lOiBhIGdpYW50IFRYVCByZWNvcmQg b24gYW1wbGlmaWVyIA0KPiAoeCkuYmFkZG9tYWluLCBhbmQgdGhlbiBsYXVuY2ggc3Bvb2ZlZCBx dWVyaWVzIHRvIHJlY3Vyc2l2ZSByZXNvbHZlcnMgIA0KPiB0byB0cmlnZ2VyIGl0Lg0KDQpZZXMs IGJ1dCBhcmUgdGhlcmUgYW55IG5vbi1ETlMgb25lcyB3aXRoIGhpZ2ggYW1wbGlmaWNhdGlvbj8N Cg0KSSdtIHN1Z2dlc3RpbmcgdGhhdCBFRE5TIGJlIGZpeGVkL3JlcGxhY2VkLg0KDQpXb3VsZCB0 aGF0IGNvbnRyaWJ1dGUgYW55dGhpbmcgdG8gaW50ZXJuZXQgc3RhYmlsaXR5Pw0KDQpJZiB0aGVy ZSBhcmUgb3RoZXIgaGlnaCBhbXBsaWZpY2F0aW9uIGF0dGFja3Mgb3V0IHRoZXJlICh0aGF0IGNh bm5vdCBiZSBmaXhlZCksIGl0IHdvbid0Lg0KDQpJZiBub3QsIGl0IG1pZ2h0Lg0KDQpHZW9yZ2UN Cg== From owner-namedroppers@ops.ietf.org Tue Sep 1 06:32:01 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 68FC13A685B; Tue, 1 Sep 2009 06:32:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.954 X-Spam-Level: X-Spam-Status: No, score=-0.954 tagged_above=-999 required=5 tests=[AWL=-0.759, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J8m+TIsfpC80; Tue, 1 Sep 2009 06:32:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 60AD73A6BDA; Tue, 1 Sep 2009 06:31:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiTNU-0002Px-Qp for namedroppers-data0@psg.com; Tue, 01 Sep 2009 13:26:28 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiTNQ-0002Ng-Kf for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 13:26:26 +0000 Received: from Puki.ogud.com (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n81DQEux048757; Tue, 1 Sep 2009 09:26:14 -0400 (EDT) (envelope-from ogud@ogud.com) Message-Id: <200909011326.n81DQEux048757@stora.ogud.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Tue, 01 Sep 2009 09:19:02 -0400 To: bert hubert , Patrik =?iso-8859-1?Q?F=E4ltstr=F6m?= From: Olafur Gudmundsson Subject: Re: [dnsext] EDNS0 fallback "revisited" Cc: namedroppers@ops.ietf.org In-Reply-To: <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.co m> References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1"; format=flowed Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 03:21 01/09/2009, bert hubert wrote: >2009/9/1 Patrik F=E4ltstr=F6m : > > The question is who the complaint is going to. Some DNSSEC problems will > > target the large ISPs that run the large resolvers. They will detect= people > > with broken signed zones -- but they will most certainly _not_ have the > > fragmentation issues (or they have serious problems anyway). The= complaints > >I'm not sure about the latter. What will probably happen a lot is the >following scenario: > >1) ISP/Corporation turns on DNSSEC validation I think before they perform this step ALL HOWTO guides should say something 0) Test your DNS: Run test XXXXX Run test YYYYY Update configurations see http:..... Blindly turning on DNSSEC validation should only be done if a) the DNSSEC validator is capable of discovering its path and check it= works for strange corner cases b) the operator has checked the path=20 characteristics and possibly performed some tuning to make DNSSEC answers get through. Olafur From owner-namedroppers@ops.ietf.org Tue Sep 1 06:48:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A89033A6880; Tue, 1 Sep 2009 06:48:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.439 X-Spam-Level: X-Spam-Status: No, score=-0.439 tagged_above=-999 required=5 tests=[AWL=0.056, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vKqyHz4AlDO5; Tue, 1 Sep 2009 06:48:14 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 63B713A6FD7; Tue, 1 Sep 2009 06:47:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiTev-00072O-KT for namedroppers-data0@psg.com; Tue, 01 Sep 2009 13:44:29 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiTer-0006xH-UF for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 13:44:27 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id B9AD61542060; Tue, 1 Sep 2009 14:44:22 +0100 (BST) From: Jim Reid To: "George Barwood" In-Reply-To: <8BE80AE8D80C4D49B836D72C399D05DA@localhost> Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. X-Priority: 3 References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> Message-Id: <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Tue, 1 Sep 2009 14:44:22 +0100 Cc: "Nicholas Weaver" , X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 1 Sep 2009, at 14:13, George Barwood wrote: > I'm suggesting that EDNS be fixed/replaced. > > Would that contribute anything to internet stability? No. EDNS is not broken. It doesn't need fixing or replacing. Tinkering with working protocols in the vague hope of devising something better -- for some definition of better -- is very damaging to stability and interoperability. BTW, it's not enough to just "suggest that EDNS be fixed/replaced". You need to explain why. Even if something better could be devised -- and that's a very big if -- it will not make the slightest difference to DNS amplification attacks. You seem to have ignored that these attacks depend on a DNS query causing a server to return a large amount of data. That behaviour is determined by what data the server holds for some name/ qtype/class tuple, not how that data get transmitted over the network. Also, given the endless discussion here about middleboxes failing to support EDNS packets and/or fragmentation of DNS packets, you should realise by now nothing other than replacement is ever going to fix those broken devices. So what hope is there that these boxes which don't do The Right Thing with EDNS today will somehow behave perfectly with something totally new that "fixes" or supersedes EDNS? BTW, the scope for DNS amplification attacks (and all sorts of other nasties) would be much reduced if ISPs did proper egress filtering. That's a topic for another WG. From owner-namedroppers@ops.ietf.org Tue Sep 1 06:50:18 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F1F83A6F87; Tue, 1 Sep 2009 06:50:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.684 X-Spam-Level: X-Spam-Status: No, score=-3.684 tagged_above=-999 required=5 tests=[AWL=-0.385, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xjFiOEwnJMD6; Tue, 1 Sep 2009 06:50:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 410373A6FCB; Tue, 1 Sep 2009 06:50:17 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiThX-0007lR-TQ for namedroppers-data0@psg.com; Tue, 01 Sep 2009 13:47:11 +0000 Received: from [131.111.8.130] (helo=ppsw-0.csi.cam.ac.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiThR-0007jn-41 for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 13:47:09 +0000 X-Cam-AntiVirus: no malware found X-Cam-SpamDetails: not scanned X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Received: from hermes-2.csi.cam.ac.uk ([131.111.8.54]:43756) by ppsw-0.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.150]:25) with esmtpa (EXTERNAL:fanf2) id 1MiThQ-0000eV-1c (Exim 4.70) (return-path ); Tue, 01 Sep 2009 14:47:04 +0100 Received: from fanf2 (helo=localhost) by hermes-2.csi.cam.ac.uk (hermes.cam.ac.uk) with local-esmtp id 1MiThQ-0000HN-Fi (Exim 4.67) (return-path ); Tue, 01 Sep 2009 14:47:04 +0100 Date: Tue, 1 Sep 2009 14:47:04 +0100 From: Tony Finch X-X-Sender: fanf2@hermes-2.csi.cam.ac.uk To: bert hubert cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] root DNSKEY response is 1749 bytes In-Reply-To: <3efd34cc0908311431x48eb17f1s6beb3281c934a842@mail.gmail.com> Message-ID: References: <4A907B6D.1050905@gmail.com> <61661.1251006812@nsa.vix.com> <3efd34cc0908230247s3678e811q6809608ddc620746@mail.gmail.com> <4A93013E.6030806@isc.org> <20090824220451.GF17279@vacation.karoshi.com.> <0C66638E-0D60-4A8E-8480-6977B8AB73CE@icsi.berkeley.edu> <40C2A0A89CFE6F174BCCD299@Ximines.local> <200908312111.n7VLBBko016730@drugs.dv.isc.org> <3efd34cc0908311431x48eb17f1s6beb3281c934a842@mail.gmail.com> User-Agent: Alpine 2.00 (LSU 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, 31 Aug 2009, bert hubert wrote: > > I would not even be very surprised if it turns out the default Windows > stub can't do it. My friends with windows boxes (of various kinds) get the right result from running nslookup big.dotat.at (response size 617 bytes). Tony. -- f.anthony.n.finch http://dotat.at/ GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS. MODERATE OR GOOD. From owner-namedroppers@ops.ietf.org Tue Sep 1 06:55:56 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4220E28C692; Tue, 1 Sep 2009 06:55:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.114 X-Spam-Level: X-Spam-Status: No, score=-5.114 tagged_above=-999 required=5 tests=[AWL=-0.066, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BuYenlwYJxtP; Tue, 1 Sep 2009 06:55:55 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E1DC528C6BF; Tue, 1 Sep 2009 06:51:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiTjL-0008Hj-Ql for namedroppers-data0@psg.com; Tue, 01 Sep 2009 13:49:03 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiTjG-0008GG-Fi for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 13:49:01 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n81DmXxI013993; Tue, 1 Sep 2009 06:48:33 -0700 (PDT) Subject: Re: [dnsext] EDNS0 fallback "revisited" Mime-Version: 1.0 (Apple Message framework v1075.2) Content-Type: text/plain; charset=iso-8859-1; format=flowed; delsp=yes From: Nicholas Weaver In-Reply-To: <200909011326.n81DQEux048757@stora.ogud.com> Date: Tue, 1 Sep 2009 06:48:33 -0700 Cc: Nicholas Weaver , bert hubert , =?iso-8859-1?Q?Patrik__F=E4ltstr=F6m?= , namedroppers@ops.ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <56AA7995-8967-48AE-A5DC-1D95A135299B@icsi.berkeley.edu> References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <200909011326.n81DQEux048757@stora.ogud.com> To: Olafur Gudmundsson X-Mailer: Apple Mail (2.1075.2) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 1, 2009, at 6:19 AM, Olafur Gudmundsson wrote: > > At 03:21 01/09/2009, bert hubert wrote: >> 2009/9/1 Patrik F=E4ltstr=F6m : >> > The question is who the complaint is going to. Some DNSSEC =20 >> problems will >> > target the large ISPs that run the large resolvers. They will =20 >> detect people >> > with broken signed zones -- but they will most certainly _not_ =20 >> have the >> > fragmentation issues (or they have serious problems anyway). The =20= >> complaints >> >> I'm not sure about the latter. What will probably happen a lot is the >> following scenario: >> >> 1) ISP/Corporation turns on DNSSEC validation > > I think before they perform this step ALL HOWTO guides should say =20 > something > 0) Test your DNS: > Run test XXXXX > Run test YYYYY > Update configurations see http:..... > > Blindly turning on DNSSEC validation should only be done if > a) the DNSSEC validator is capable of discovering its path and check =20= > it works > for strange corner cases > b) the operator has checked the path characteristics and possibly =20 > performed some > tuning to make DNSSEC answers get through. Except the problem is not blindly turning on DNSSEC validation, but =20 blindly turning on requesting DNSSEC records. Which bind does by default. This hasn't been a problem yet, because =20 nobody is really signing anything. But it may be once major TLDs =20 start signing things eagerly. From owner-namedroppers@ops.ietf.org Tue Sep 1 07:11:17 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 93AAB28C41C; Tue, 1 Sep 2009 07:11:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.958 X-Spam-Level: X-Spam-Status: No, score=-4.958 tagged_above=-999 required=5 tests=[AWL=-0.463, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hP3zBqCu1LKM; Tue, 1 Sep 2009 07:11:16 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3946528C367; Tue, 1 Sep 2009 07:11:16 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiU1Q-000DKt-Lo for namedroppers-data0@psg.com; Tue, 01 Sep 2009 14:07:44 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiU1M-000DJj-Ql for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 14:07:42 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n81E60ZW010818; Tue, 1 Sep 2009 14:06:00 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n81E60xU010817; Tue, 1 Sep 2009 14:06:00 GMT Date: Tue, 1 Sep 2009 14:06:00 +0000 From: bmanning@vacation.karoshi.com To: Nicholas Weaver Cc: Olafur Gudmundsson , bert hubert , Patrik =?iso-8859-1?B?RuRsdHN0cvZt?= , namedroppers@ops.ietf.org Subject: Re: [dnsext] EDNS0 fallback "revisited" Message-ID: <20090901140600.GC10230@vacation.karoshi.com.> References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <200909011326.n81DQEux048757@stora.ogud.com> <56AA7995-8967-48AE-A5DC-1D95A135299B@icsi.berkeley.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <56AA7995-8967-48AE-A5DC-1D95A135299B@icsi.berkeley.edu> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 01, 2009 at 06:48:33AM -0700, Nicholas Weaver wrote: > > On Sep 1, 2009, at 6:19 AM, Olafur Gudmundsson wrote: > > > > >At 03:21 01/09/2009, bert hubert wrote: > >>2009/9/1 Patrik Fdltstrvm : > >>> The question is who the complaint is going to. Some DNSSEC > >>problems will > >>> target the large ISPs that run the large resolvers. They will > >>detect people > >>> with broken signed zones -- but they will most certainly _not_ > >>have the > >>> fragmentation issues (or they have serious problems anyway). The > >>complaints > >> > >>I'm not sure about the latter. What will probably happen a lot is the > >>following scenario: > >> > >>1) ISP/Corporation turns on DNSSEC validation > > > >I think before they perform this step ALL HOWTO guides should say > >something > >0) Test your DNS: > > Run test XXXXX > > Run test YYYYY > > Update configurations see http:..... > > > >Blindly turning on DNSSEC validation should only be done if > >a) the DNSSEC validator is capable of discovering its path and check > >it works > > for strange corner cases > >b) the operator has checked the path characteristics and possibly > >performed some > > tuning to make DNSSEC answers get through. > > Except the problem is not blindly turning on DNSSEC validation, but > blindly turning on requesting DNSSEC records. > > Which bind does by default. This hasn't been a problem yet, because > nobody is really signing anything. But it may be once major TLDs > start signing things eagerly. > > or ... once the root gets signed - then every priming query will have DNSSEC data in the response. --bill From owner-namedroppers@ops.ietf.org Tue Sep 1 07:30:32 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CC2CD28C743; Tue, 1 Sep 2009 07:30:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.344 X-Spam-Level: X-Spam-Status: No, score=-0.344 tagged_above=-999 required=5 tests=[AWL=-0.744, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ag0VomyW-YD1; Tue, 1 Sep 2009 07:30:32 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9809328C734; Tue, 1 Sep 2009 07:29:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiUIV-000HHi-5J for namedroppers-data0@psg.com; Tue, 01 Sep 2009 14:25:23 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiUIR-000HH3-5L for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 14:25:20 +0000 Received: from crankycanuck.ca (76-10-166-247.dsl.teksavvy.com [76.10.166.247]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id CA5052FE8CB8 for ; Tue, 1 Sep 2009 14:25:17 +0000 (UTC) Date: Tue, 1 Sep 2009 10:25:15 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Cryptographic Algorithm Identifier Allocation for DNSSEC Message-ID: <20090901142514.GB14929@shinkuro.com> References: <20090826043344.GI5405@shinkuro.com> <934623C28D56444CB073F90BC35244BB05365B@TK5EX14MBXC128.redmond.corp.microsoft.com> <934623C28D56444CB073F90BC35244BB05E980@TK5EX14MBXC121.redmond.corp.microsoft.com> <20090827180305.GK7821@shinkuro.com> <200908272358.n7RNwrvr038970@drugs.dv.isc.org> <20090828144512.GT7821@shinkuro.com> <200908282207.n7SM73bf056581@drugs.dv.isc.org> <20090831182103.GQ13987@shinkuro.com> <200909010055.n810tI2W047942@drugs.dv.isc.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200909010055.n810tI2W047942@drugs.dv.isc.org> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: No hat. On Tue, Sep 01, 2009 at 10:55:18AM +1000, Mark Andrews wrote: > SHA256 was special because we had to teach the working group that > new signature algorithms need to support both NSEC and NSEC3. It was also special because those who decided they had "teach the working group" didn't make that decision until after WGLC had closed, at which point there was a threat of appeal. Which is exactly my point: the current state of affairs requires the entire machinery of the IETF to spin into action every time we want to support a new algorithm. > SHA256 should not be seen as representative of the time it will > take in future. On what basis do you say this? We don't even know yet whether during IETF last call the SHA2 draft will not face a demand for the restoration of the NSEC and NSEC3 alias strategy, since we nowhere have a document that says "NSEC3 support is mandatory". The fact is that we're a WG that mostly maintains a mature protocol; this tends to mean urgency for review &c. is not great. > DNSEXT goes from one extreme to the other. RR allocation was a > example of that. New procedures were defined and people complained > that RR's take too long without even trying the new procedures. They complain of that because they remember the old ways -- ways that hung around for a long time because this WG was (and, I am frequently told by other WG Chairs and IETF participants, still is) regarded as obstructionist, unwilling to understand the uses to which people want to put the protocol, and generally unhelpful. We can do something about that by making our procedures in this new area flexible to begin with. Otherwise, people will (again) dismiss us as hidebound control freaks who are protecting our protocol turf rather than trying to help the rest of the users of the Internet. This is not my view -- I understand the motivation for conservatism -- but we need to appreciate that there is a widespread view of the DNS protocol people that is roughly the one I describe. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Tue Sep 1 07:33:29 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 84C4B3A6FB9; Tue, 1 Sep 2009 07:33:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.019 X-Spam-Level: **** X-Spam-Status: No, score=4.019 tagged_above=-999 required=5 tests=[AWL=0.124, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 83WQxpuAGNA5; Tue, 1 Sep 2009 07:33:28 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DB62228C6DF; Tue, 1 Sep 2009 07:31:37 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiULs-000HzE-9R for namedroppers-data0@psg.com; Tue, 01 Sep 2009 14:28:52 +0000 Received: from [195.188.213.8] (helo=smtp-out5.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiULo-000HyY-6G for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 14:28:50 +0000 Received: from [172.23.170.138] (helo=anti-virus01-09) by smtp-out5.blueyonder.co.uk with smtp (Exim 4.52) id 1MiULm-0001QZ-V0; Tue, 01 Sep 2009 15:28:46 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out5.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MiULm-00022e-B0; Tue, 01 Sep 2009 15:28:46 +0100 Message-ID: From: "George Barwood" To: "Jim Reid" Cc: "Nicholas Weaver" , References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. Date: Tue, 1 Sep 2009 15:28:41 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIkppbSBSZWlkIiA8amltQHJm YzEwMzUuY29tPg0KVG86ICJHZW9yZ2UgQmFyd29vZCIgPGdlb3JnZS5iYXJ3b29kQGJsdWV5b25k ZXIuY28udWs+DQpDYzogIk5pY2hvbGFzIFdlYXZlciIgPG53ZWF2ZXJASUNTSS5CZXJrZWxleS5F RFU+OyA8bmFtZWRyb3BwZXJzQG9wcy5pZXRmLm9yZz4NClNlbnQ6IFR1ZXNkYXksIFNlcHRlbWJl ciAwMSwgMjAwOSAyOjQ0IFBNDQpTdWJqZWN0OiBSZTogW2Ruc2V4dF0gQW1wbGlmaWNhdGlvbiBh dHRhY2tzLCBSRkMzNzA0IGV0Yy4NCg0KDQo+IE9uIDEgU2VwIDIwMDksIGF0IDE0OjEzLCBHZW9y Z2UgQmFyd29vZCB3cm90ZToNCj4gDQo+PiBJJ20gc3VnZ2VzdGluZyB0aGF0IEVETlMgYmUgZml4 ZWQvcmVwbGFjZWQuDQo+Pg0KPj4gV291bGQgdGhhdCBjb250cmlidXRlIGFueXRoaW5nIHRvIGlu dGVybmV0IHN0YWJpbGl0eT8NCj4gDQo+IE5vLg0KPiANCj4gRUROUyBpcyBub3QgYnJva2VuLiBJ dCBkb2Vzbid0IG5lZWQgZml4aW5nIG9yIHJlcGxhY2luZy4gVGlua2VyaW5nICANCj4gd2l0aCB3 b3JraW5nIHByb3RvY29scyBpbiB0aGUgdmFndWUgaG9wZSBvZiBkZXZpc2luZyBzb21ldGhpbmcg YmV0dGVyICANCj4gLS0gZm9yIHNvbWUgZGVmaW5pdGlvbiBvZiBiZXR0ZXIgLS0gaXMgdmVyeSBk YW1hZ2luZyB0byBzdGFiaWxpdHkgYW5kICANCj4gaW50ZXJvcGVyYWJpbGl0eS4gQlRXLCBpdCdz IG5vdCBlbm91Z2ggdG8ganVzdCAic3VnZ2VzdCB0aGF0IEVETlMgYmUgIA0KPiBmaXhlZC9yZXBs YWNlZCIuIFlvdSBuZWVkIHRvIGV4cGxhaW4gd2h5Lg0KDQpUaGUgcmVhc29uIHdoeSBpcyB0aGF0 IGl0IGFwcGVhcnMgdG8gYmUgYSBtZW5hY2UuDQpJdCBoYXMgYWxyZWFkeSBiZWluZyB1c2VkIGZv ciBhdHRhY2tzIG9uIHRoaXJkIHBhcnRpZXMuDQogDQo+IEV2ZW4gaWYgc29tZXRoaW5nIGJldHRl ciBjb3VsZCBiZSBkZXZpc2VkIC0tIGFuZCB0aGF0J3MgYSB2ZXJ5IGJpZyBpZiAgDQo+IC0tIGl0 IHdpbGwgbm90IG1ha2UgdGhlIHNsaWdodGVzdCBkaWZmZXJlbmNlIHRvIEROUyBhbXBsaWZpY2F0 aW9uICANCj4gYXR0YWNrcy4gWW91IHNlZW0gdG8gaGF2ZSBpZ25vcmVkIHRoYXQgdGhlc2UgYXR0 YWNrcyBkZXBlbmQgb24gYSBETlMgIA0KPiBxdWVyeSBjYXVzaW5nIGEgc2VydmVyIHRvIHJldHVy biBhIGxhcmdlIGFtb3VudCBvZiBkYXRhLiBUaGF0ICANCj4gYmVoYXZpb3VyIGlzIGRldGVybWlu ZWQgYnkgd2hhdCBkYXRhIHRoZSBzZXJ2ZXIgaG9sZHMgZm9yIHNvbWUgbmFtZS8gDQo+IHF0eXBl L2NsYXNzIHR1cGxlLCBub3QgaG93IHRoYXQgZGF0YSBnZXQgdHJhbnNtaXR0ZWQgb3ZlciB0aGUg bmV0d29yay4NCg0KTm8sIGl0IGRvZXMgdmVyeSBtdWNoIGRlcGVuZCBvbiBob3cgaXQgaXMgdHJh bnNtaXR0ZWQuDQoNCklmIHRoZXJlIGlzIGEgaGFuZC1zaGFrZSwgYXMgd2l0aCBUQ1AsIHNwb29m aW5nIGFtcGxpZmljYXRpb24gYXR0YWNrcw0KYXJlIG5vdCBwb3NzaWJsZSAoIGlmIHRoZSBoYW5k LXNoYWtlIGlzIGNvcnJlY3RseSBpbXBsZW1lbnRlZCApLg0KDQpTbyBwcmltYSBmYWNpZSwgaXQg Y2VydGFpbmx5IGNhbiBtYWtlIGEgZGlmZmVyZW5jZS4NCg0KSXQgbWF5IGJlIHRoYXQgdGhlIGlu dGVybmV0IGlzIHNvIHVuc3RhYmxlIGFueXdheSB0aGF0IGluIHByYWN0aWNlDQp0aGUgZGlmZmVy ZW5jZSBpcyBuZWdsaWdpYmxlLCB0aGF0J3MgcGFydCBvZiB3aGF0IEknbSB0cnlpbmcgdG8gYXNj ZXJ0YWluLg0KDQo+IEFsc28sIGdpdmVuIHRoZSBlbmRsZXNzIGRpc2N1c3Npb24gaGVyZSBhYm91 dCBtaWRkbGVib3hlcyBmYWlsaW5nIHRvICANCj4gc3VwcG9ydCBFRE5TIHBhY2tldHMgYW5kL29y IGZyYWdtZW50YXRpb24gb2YgRE5TIHBhY2tldHMsIHlvdSBzaG91bGQgIA0KPiByZWFsaXNlIGJ5 IG5vdyBub3RoaW5nIG90aGVyIHRoYW4gcmVwbGFjZW1lbnQgaXMgZXZlciBnb2luZyB0byBmaXgg IA0KPiB0aG9zZSBicm9rZW4gZGV2aWNlcy4gU28gd2hhdCBob3BlIGlzIHRoZXJlIHRoYXQgdGhl c2UgYm94ZXMgd2hpY2ggIA0KPiBkb24ndCBkbyBUaGUgUmlnaHQgVGhpbmcgd2l0aCBFRE5TIHRv ZGF5IHdpbGwgc29tZWhvdyBiZWhhdmUgcGVyZmVjdGx5ICANCj4gd2l0aCBzb21ldGhpbmcgdG90 YWxseSBuZXcgdGhhdCAiZml4ZXMiIG9yIHN1cGVyc2VkZXMgRUROUz8NCg0KTW9zdCBvZiB0aGVz ZSBib3hlcyB3aWxsIHBhc3MgVURQIGFuZCBUQ1AgcGVyZmVjdGx5IHdlbGwsIGVzcGVjaWFsbHkN CmlmICBmcmFnbWVudGF0aW9uIGlzIGF2b2lkZWQgKCB3aGljaCBpcyB0aGUgY2FzZSBmb3IgVENQ ICkuDQoNCkZpeGluZyB0aGVzZSBib3hlcyB3aWxsIGRvIG5vdGhpbmcgdG8gc3RvcCBhbXBsaWZp Y2F0aW9uIGF0dGFjaywgd2hpY2gNCmluIG15IG1pbmQgaXMgcG90ZW50aWFsbHkgYSBtdWNoIG1v cmUgc2VyaW91cyBjb25jZXJuLg0KIA0KPiBCVFcsIHRoZSBzY29wZSBmb3IgRE5TIGFtcGxpZmlj YXRpb24gYXR0YWNrcyAoYW5kIGFsbCBzb3J0cyBvZiBvdGhlciAgDQo+IG5hc3RpZXMpIHdvdWxk IGJlIG11Y2ggcmVkdWNlZCBpZiBJU1BzIGRpZCBwcm9wZXIgZWdyZXNzIGZpbHRlcmluZy4gIA0K PiBUaGF0J3MgYSB0b3BpYyBmb3IgYW5vdGhlciBXRy4NCg0KQWdyZWVkLiBCdXQgDQoNCihhKSBJ J20gbm90IGNvbnZpbmNlZCBpdCB3aWxsIGV2ZXIgaGFwcGVuICggYnV0IG5vdCBteSBmaWVsZCwg c28gSSdtIGFza2luZyApLg0KDQooYikgSSBkb24ndCB0aGluayBpdCBpcyBhIGdvb2Qgc2VjdXJp dHkgbW9kZWwuIEl0J3MgYmV0dGVyIHRvIGFzc3VtZSB0aGF0DQphZHZlcnNhcmllcyBoYXZlIHRo ZSBhYmlsaXR5IHRvIGluamVjdCBiYWQgZmFpdGggcGFja2V0cyBpbnRvIGEgZ2xvYmFsDQpwYWNr ZXQgc3dpdGNoZWQgbmV0d29yaywgYW5kIGRlc2lnbiBwcm90b2NvbHMgc28gdGhhdCB0aGV5IGFy ZQ0KcmVhc29uYWJseSByb2J1c3QgdW5kZXIgdGhhdCBhc3N1bXB0aW9uLCBhbmQgYXQgYSBtaW5p bXVuIGNhbm5vdA0KYmUgdXNlZCBhcyBhdHRhY2sgd2VhcG9ucy4NCg0KR2VvcmdlDQo= From owner-namedroppers@ops.ietf.org Tue Sep 1 08:52:22 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 30CC23A6C19; Tue, 1 Sep 2009 08:52:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.605 X-Spam-Level: X-Spam-Status: No, score=-0.605 tagged_above=-999 required=5 tests=[AWL=-0.110, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RHpG7lNNp1RF; Tue, 1 Sep 2009 08:52:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 58F1F28C2C9; Tue, 1 Sep 2009 08:52:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiVZ9-0007GN-Fi for namedroppers-data0@psg.com; Tue, 01 Sep 2009 15:46:39 +0000 Received: from [204.14.89.4] (helo=mail2.fluidhosting.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiVZ5-0007Fe-OL for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 15:46:37 +0000 Received: (qmail 21074 invoked by uid 399); 1 Sep 2009 15:46:28 -0000 Received: from localhost (HELO foreign.dougb.net) (dougb@dougbarton.us@127.0.0.1) by localhost with ESMTPAM; 1 Sep 2009 15:46:28 -0000 X-Originating-IP: 127.0.0.1 X-Sender: dougb@dougbarton.us Message-ID: <4A9D41CF.6070707@dougbarton.us> Date: Tue, 01 Sep 2009 08:46:23 -0700 From: Doug Barton User-Agent: Thunderbird 2.0.0.23 (X11/20090822) MIME-Version: 1.0 To: Mark Andrews CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] Working around proxies References: <4CB0582F89044745BF1D1EBF09E549B6@localhost> <4A998A15.6050602@dougbarton.us> <4A9AC3CF.4000106@dougbarton.us> <200908310153.n7V1rUhR088199@drugs.dv.isc.org> <1009805BA49B4D22BAD2E408B06FA87B@localhost> <200908311222.n7VCMX8j000197@drugs.dv.isc.org> <339C5564ABB948BAB7F9591DF3325140@localhost> <200908311403.n7VE3iNe004282@drugs.dv.isc.org> <1BE8B1F5-0CAB-4375-99F5-32ACF6FB9D90@icsi.berkeley.edu> <200908311520.n7VFK0Ti013253@drugs.dv.isc.org> <4A9C2374.5090105@necom830.hpcl.titech.ac.jp> <200908312200.n7VM06PF017221@drugs.dv.isc.org> In-Reply-To: <200908312200.n7VM06PF017221@drugs.dv.isc.org> X-Enigmail-Version: 0.96.0 OpenPGP: id=D5B2F0FB Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Mark Andrews wrote: > Except it is. It's cruch time and residential ISP are now reacting. > There are commisioning CPE product development, now, to allow them > to support both IPv4 (NAT'd) and IPv6 into the future. I agree totally with Mark here. All this effort spent trying to figure out how to work around broken middleboxes is (to put it in the politest possible terms) wasted. We have a LANDMARK opportunity here to educate CPE manufacturers about the need to include proper DNS support (including DNSSEC, EDNS and TCP) in their products while they are redesigning them for IPv6. DNSSEC and IPv6 are likely to be the last 2 major renovations of Internet protocols that we will ever be able to do. If we miss this opportunity it's gone forever. The fact is that there will either be market demand for IPv6 and DNSSEC, or there will not. If there is sufficient market demand then the CPEs that don't work with it/them will have to be replaced anyway. If there is not sufficient market demand then we're wasting our effort trying to make them work. Doug From owner-namedroppers@ops.ietf.org Tue Sep 1 08:58:30 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D8B8328C80C; Tue, 1 Sep 2009 08:58:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.598 X-Spam-Level: X-Spam-Status: No, score=-0.598 tagged_above=-999 required=5 tests=[AWL=-0.103, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4HGwCX1sxRjL; Tue, 1 Sep 2009 08:58:30 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 27DF23A68AE; Tue, 1 Sep 2009 08:58:30 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiVhM-0008kV-Hr for namedroppers-data0@psg.com; Tue, 01 Sep 2009 15:55:08 +0000 Received: from [204.14.89.4] (helo=mail2.fluidhosting.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiVh8-0008ih-6x for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 15:54:57 +0000 Received: (qmail 6309 invoked by uid 399); 1 Sep 2009 15:54:49 -0000 Received: from localhost (HELO foreign.dougb.net) (dougb@dougbarton.us@127.0.0.1) by localhost with ESMTPAM; 1 Sep 2009 15:54:49 -0000 X-Originating-IP: 127.0.0.1 X-Sender: dougb@dougbarton.us Message-ID: <4A9D43C4.4080502@dougbarton.us> Date: Tue, 01 Sep 2009 08:54:44 -0700 From: Doug Barton User-Agent: Thunderbird 2.0.0.23 (X11/20090822) MIME-Version: 1.0 To: bmanning@vacation.karoshi.com CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] EDNS0 fallback "revisited" References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <4437D106-7797-46B4-8ADE-FCE69077C88E@cisco.com> <20090901083145.GA7493@vacation.karoshi.com.> In-Reply-To: <20090901083145.GA7493@vacation.karoshi.com.> X-Enigmail-Version: 0.96.0 OpenPGP: id=D5B2F0FB Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: bmanning@vacation.karoshi.com wrote: > some very interesting advice from Roland Dobbins - Don't > put your webservers/dnsservers behind firewalls. - this to > the assembled folks @ ausnog yesterday. - so maybe not so weird. I've advocated this for years. The only thing running on those servers that is visible to the outside world is the key service (DNS or HTTP[S]). You can run ssh with tcp wrappers so that it's only accessible from appropriate locations. Things get a little more complicated if your name server needs access to a database, but even that can be wrapped up appropriately. Of course YMMV, but this configuration has worked well for me for years. Doug From owner-namedroppers@ops.ietf.org Tue Sep 1 09:19:52 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E293D3A6C3F; Tue, 1 Sep 2009 09:19:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.326 X-Spam-Level: X-Spam-Status: No, score=-0.326 tagged_above=-999 required=5 tests=[AWL=-0.726, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3t5VnisZdUkR; Tue, 1 Sep 2009 09:19:52 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7DF3F3A7046; Tue, 1 Sep 2009 09:17:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiVzq-000C7s-Up for namedroppers-data0@psg.com; Tue, 01 Sep 2009 16:14:14 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiVzm-000C7B-Sx for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 16:14:13 +0000 Received: from crankycanuck.ca (76-10-166-247.dsl.teksavvy.com [76.10.166.247]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id C4B752FE8CB8; Tue, 1 Sep 2009 16:14:05 +0000 (UTC) Date: Tue, 1 Sep 2009 12:14:03 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Cc: dnsext-chairs chairs , int-ads@tools.ietf.org Subject: [dnsext] Afiliation of DNSEXT WG chairs Message-ID: <20090901161401.GH14929@shinkuro.com> References: <5D4BEBA1-8052-4F60-96E5-F9A23ACBB60B@cisco.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5D4BEBA1-8052-4F60-96E5-F9A23ACBB60B@cisco.com> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues, The IESG has asked us to ensure that our employment affiliation and sponsorship is clear, under a recommendation that's being added to http://trac.tools.ietf.org/group/iesg/trac/wiki/ManageWorkingGroup. We believe this information is widely known, but in case it is not, both Olafur and Andrew work for Shinkuro, Inc., and in fact report to the same person at Shinkuro. We are aware that this may make some situations more awkward than others. We have so far tried, and will continue to try, to deal with such situations case by case. If you have concerns about the Chairs' actions in a given situation, we implore you to raise your concerns directly to us or, if you prefer, to the wider working group (or to follow both options if you deem it best). It is our intention that the WG be operated transparently, in keeping with the traditions of the IETF. Best regards, Olafur and Andrew (Chairs) -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Tue Sep 1 10:13:49 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0E5D328C744; Tue, 1 Sep 2009 10:13:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.766 X-Spam-Level: X-Spam-Status: No, score=-1.766 tagged_above=-999 required=5 tests=[AWL=-0.833, BAYES_00=-2.599, SARE_URI_CONS9=1.666] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lDwhIo+oP9vQ; Tue, 1 Sep 2009 10:13:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3FDFE28C6A6; Tue, 1 Sep 2009 10:13:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiWoT-000LxJ-JE for namedroppers-data0@psg.com; Tue, 01 Sep 2009 17:06:33 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiWoN-000LwX-RM for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 17:06:31 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 70DF8B4D33 for ; Tue, 1 Sep 2009 17:06:27 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] EDNS0 fallback "revisited" In-Reply-To: Your message of "Tue, 01 Sep 2009 06:48:33 MST." <56AA7995-8967-48AE-A5DC-1D95A135299B@icsi.berkeley.edu> References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <200909011326.n81DQEux048757@stora.ogud.com> <56AA7995-8967-48AE-A5DC-1D95A135299B@icsi.berkeley.edu> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Tue, 01 Sep 2009 17:06:27 +0000 Message-ID: <33866.1251824787@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Nicholas Weaver > Date: Tue, 1 Sep 2009 06:48:33 -0700 > ... > Except the problem is not blindly turning on DNSSEC validation, but > blindly turning on requesting DNSSEC records. > > Which bind does by default. This hasn't been a problem yet, because > nobody is really signing anything. But it may be once major TLDs start > signing things eagerly. by that reasoning, BIND folks (85% market share) would be seeing a lot of timeouts on nonexistent ORG subdomains, and there are no reports of same. ; <<>> DiG 9.4.1-P1 <<>> +dnssec lkjhdsflkjhdsf.org mx ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 48597 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 8, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 4096 ;; QUESTION SECTION: ;lkjhdsflkjhdsf.org. IN MX ... ;; Query time: 27 msec ;; SERVER: 204.152.187.17#53(204.152.187.17) ;; WHEN: Tue Sep 1 17:03:36 2009 ;; MSG SIZE rcvd: 1004 i think we may be overblowing this. From owner-namedroppers@ops.ietf.org Tue Sep 1 10:16:10 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 49B613A7012; Tue, 1 Sep 2009 10:16:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.276 X-Spam-Level: X-Spam-Status: No, score=-2.276 tagged_above=-999 required=5 tests=[AWL=-0.277, BAYES_00=-2.599, J_CHICKENPOX_31=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YO9PrbcoxRFw; Tue, 1 Sep 2009 10:16:09 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 63BDC3A6BEE; Tue, 1 Sep 2009 10:16:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiWuo-000N4l-8V for namedroppers-data0@psg.com; Tue, 01 Sep 2009 17:13:06 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiWui-000N2e-Qj for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 17:13:03 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 71279B4D00 for ; Tue, 1 Sep 2009 17:13:00 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. In-Reply-To: Your message of "Tue, 01 Sep 2009 15:28:41 +0100." References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Tue, 01 Sep 2009 17:13:00 +0000 Message-ID: <34182.1251825180@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: "George Barwood" > Date: Tue, 1 Sep 2009 15:28:41 +0100 > > The reason why is that it appears to be a menace. > It has already being used for attacks on third parties. EDNS isn't nec'y or sufficient for menacing third parties. Widespread lack of BCP38 deployment is nec'y, and any wide area UDP protocol is sufficient; any moderate sized DNS response (google.com MX, for example) is sufficient. The fact that DNSSEC with EDNS makes these attacks more easily devastating does not mean EDNS is required for them to be devastating. Let's not add moving parts and friction to the machine unless it *solves* a problem. If you want to *solve* amplified DDoS, focus your efforts on deploying BCP38. From owner-namedroppers@ops.ietf.org Tue Sep 1 10:25:53 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DD79328C8BA; Tue, 1 Sep 2009 10:25:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.427 X-Spam-Level: X-Spam-Status: No, score=0.427 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aDakra6KcUel; Tue, 1 Sep 2009 10:25:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C9A1928C8C2; Tue, 1 Sep 2009 10:25:52 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiX4c-000PF9-7t for namedroppers-data0@psg.com; Tue, 01 Sep 2009 17:23:14 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiX4Y-000PE6-Jr for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 17:23:12 +0000 Received: from stora.ogud.com (localhost [127.0.0.1]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n81HN2G0050682 for ; Tue, 1 Sep 2009 13:23:02 -0400 (EDT) (envelope-from namedroppers@stora.ogud.com) Received: (from namedroppers@localhost) by stora.ogud.com (8.14.3/8.14.3/Submit) id n81HN2xF050681 for namedroppers@ops.ietf.org; Tue, 1 Sep 2009 13:23:02 -0400 (EDT) (envelope-from namedroppers) Received: from [74.125.78.26] (helo=ey-out-2122.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiODX-000Gqj-Fy for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 07:55:53 +0000 Received: by ey-out-2122.google.com with SMTP id 9so858219eyd.53 for ; Tue, 01 Sep 2009 00:55:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:received:in-reply-to :references:from:date:x-google-sender-auth:message-id:subject:to:cc :content-type:content-transfer-encoding; bh=+k9O5R03ai+aQIrW0u+WwzHarL20wCS/fXanXbusVIY=; b=lwpnpaP666EIHH8f3rD9NCojNH6yAkHqu6bqEQOa6FOTW1dJYRWJGXxhQOKIcirdM7 LYayEqvbQvPsALxdoEojBRWTb/rNo00n1Bl0TrDvo0P1Bd3a7RwlSgl0Dkc3EeYvMbJq AOpwHJ7Zj6g+q085yB8834TIFx1+uipfgjzZM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:cc:content-type :content-transfer-encoding; b=I2G8CoULjwz0bw2lfWE4IkjpAs5SIYB4mNnyn706G2xqzDBGczAQx6DsydloqZKes4 aMOzFIyoKRu14OiRaXrkpOaso8QJHtqxUUwtflmQHU6NUf1GZM6KYGDd1SxhHM+o5Nub GmD6KlDCdDeQ45VyfR2Ol67/gQH81QskO16KE= MIME-Version: 1.0 Received: by 10.210.96.1 with SMTP id t1mr6778948ebb.17.1251791749134; Tue, 01 Sep 2009 00:55:49 -0700 (PDT) In-Reply-To: <4437D106-7797-46B4-8ADE-FCE69077C88E@cisco.com> References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <4437D106-7797-46B4-8ADE-FCE69077C88E@cisco.com> From: bert hubert Date: Tue, 1 Sep 2009 09:55:29 +0200 X-Google-Sender-Auth: 9c0ddf5866fb67d3 Message-ID: <3efd34cc0909010055sdd6c148u8e3484df6662c6d4@mail.gmail.com> Subject: Re: [dnsext] EDNS0 fallback "revisited" To: =?ISO-8859-1?Q?Patrik_F=E4ltstr=F6m?= Cc: Nicholas Weaver , Alex Bligh , "Olafur Gudmundsson/DNSEXT chair" , namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: [ Moderators note: Post was moderated, either because it was posted by a non-subscriber, or because it was over 20K. With the massive amount of spam, it is easy to miss and therefore delete relevant posts by non-subscribers. Please fix your subscription addresses. ] 2009/9/1 Patrik F=E4ltstr=F6m : > I do understand your scenario description, and I do know about Nicholas > number. But I do not understand why we have not seen any problems in > newspapers in Sweden where we have been running DNSSEC for quite some tim= e. (to the list) I continued this conversation with Patrik off-list, will let you know if we've discovered why Sweden sees no problems. Maybe everything IS better in Sweden? ;-) > I am not saying you are wrong. I am just saying I hear different things f= rom > two camps. Which makes me confused! > > =A0 Patrik From owner-namedroppers@ops.ietf.org Tue Sep 1 10:25:55 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 92AD328C8BC; Tue, 1 Sep 2009 10:25:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.62 X-Spam-Level: X-Spam-Status: No, score=-0.62 tagged_above=-999 required=5 tests=[AWL=-0.125, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ail66pLNSOXE; Tue, 1 Sep 2009 10:25:54 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B11A228C8BA; Tue, 1 Sep 2009 10:25:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiX42-000P6E-HL for namedroppers-data0@psg.com; Tue, 01 Sep 2009 17:22:38 +0000 Received: from [209.85.219.215] (helo=mail-ew0-f215.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiX3w-000P0X-Jd for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 17:22:36 +0000 Received: by ewy11 with SMTP id 11so123114ewy.11 for ; Tue, 01 Sep 2009 10:22:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=dQluxufAz9Ya9/9P6ZG8SDghUwACaxrESPQdQjfL8lE=; b=u4CnbGkThgaIcNT3NeVxpA6W8S7mqM7Zesjk9Ty6w1MUDs0JZ9ONmRax6NIR3rUtCU ZM8rC1ylOmYPQfX2puojUVjh8UHJjJaTk/ypBxAjUQ+NMdH3m57uM8iPfJ9OebjDkjV0 QCTpHB6PaGHD/QiAjc5IzgpbYPTv8u9U6ItEE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; b=lpbR7q/GBfOiAXZfdxOMC3YmC1KL32SPPCL6/PSvP1XTgW9U+JFsEJtCLA60jyFtEV TapwIuLO/HdCJMvHeDgIfMlqs4E5RmJbIIOkNKIY5RpzzM3meQ6P2KBJlXfroCcDWZi5 0hDOMpO1C5oYHwG+xM3Mwdr6JHq07ahvA2Rzc= Received: by 10.210.80.17 with SMTP id d17mr6497615ebb.67.1251825750937; Tue, 01 Sep 2009 10:22:30 -0700 (PDT) Received: from Wastrel.local (c-68-42-73-61.hsd1.mi.comcast.net [68.42.73.61]) by mx.google.com with ESMTPS id 10sm24045eyz.36.2009.09.01.10.22.29 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 01 Sep 2009 10:22:30 -0700 (PDT) Message-ID: <4A9D5854.3030105@gmail.com> Date: Tue, 01 Sep 2009 13:22:28 -0400 From: William Allen Simpson User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: namedroppers@ops.ietf.org Subject: [dnsext] Re: Signing the root with SHA-1 by Sep 1st References: <4A7DC199.9040700@gmail.com> In-Reply-To: <4A7DC199.9040700@gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: William Allen Simpson wrote: > My rationale is that educational institutions will be started, or ready > to start shortly thereafter. They are already dealing with new students, > and help desks will be able to give strong feedback on any problems. > > Likewise, many/most businesses will have their staff back from holidays. > > Finally, it's a Tuesday. I've always found it best to roll out changes > on Tuesday, as it gives plenty of customer feedback time during the week. > Mondays are often consumed with catching up on any operational problems > over the weekend. Tuesday is better. 02:00 UTC is my favorite, although > anytime after 00:00 UTC usually works OK. > That message was posted August 8th. The root did not begin running DNSsec today. Does anybody have a fixed date in writing? From owner-namedroppers@ops.ietf.org Tue Sep 1 10:51:27 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4A79E3A7033; Tue, 1 Sep 2009 10:51:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.568 X-Spam-Level: X-Spam-Status: No, score=-2.568 tagged_above=-999 required=5 tests=[AWL=0.031, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BlbsQ1Z3FXaJ; Tue, 1 Sep 2009 10:51:26 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5A45028C8E0; Tue, 1 Sep 2009 10:51:26 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiXSb-0004mR-8z for namedroppers-data0@psg.com; Tue, 01 Sep 2009 17:48:01 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiXSX-0004lk-7o for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 17:47:58 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id E9377B4D40 for ; Tue, 1 Sep 2009 17:47:56 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: Signing the root with SHA-1 by Sep 1st In-Reply-To: Your message of "Tue, 01 Sep 2009 13:22:28 -0400." <4A9D5854.3030105@gmail.com> References: <4A7DC199.9040700@gmail.com> <4A9D5854.3030105@gmail.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Tue, 01 Sep 2009 17:47:56 +0000 Message-ID: <35668.1251827276@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Tue, 01 Sep 2009 13:22:28 -0400 > From: William Allen Simpson > ... > ... The root did not begin running DNSsec today. > Does anybody have a fixed date in writing? craftily, there is no one person who could put such a thing in writing, and therefore noone who can be personally blamed for doing it, or not doing it. we're signing the root by invisible consensus, where anyone who knows where the dependencies are is bound to secrecy lest they be removed from the loop. estimates heard floating on the wind are, december of 2009. From owner-namedroppers@ops.ietf.org Tue Sep 1 11:09:08 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3609828C8D1; Tue, 1 Sep 2009 11:09:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.458 X-Spam-Level: X-Spam-Status: No, score=-0.458 tagged_above=-999 required=5 tests=[AWL=0.038, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id diiO3N1vVhP0; Tue, 1 Sep 2009 11:09:07 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6420028C802; Tue, 1 Sep 2009 11:09:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiXjX-0008Qi-UM for namedroppers-data0@psg.com; Tue, 01 Sep 2009 18:05:31 +0000 Received: from [74.125.78.25] (helo=ey-out-2122.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiXjT-0008Pf-Ki for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 18:05:30 +0000 Received: by ey-out-2122.google.com with SMTP id 9so52753eyd.53 for ; Tue, 01 Sep 2009 11:05:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=CaqEqc8F8UqXTPcnFOC3liPt46YieyVIMDRGEx8otdA=; b=FolI2BReXJ1Zd4jPUm4GNYbavx8ZvbRygtTVVtr1gqHwDKkbSMwxmcvlatKvUJDYYQ DJz1jUmhC1fdO4jFO1ckoDDx6fMtcFJHQg1E66zbmNP0sdHY7ANjfQ7pLRMu02UTS5dp 2my7mN6TcQjGimcgDVuJxJ9DO1aotGru4SsCw= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=v0bBaM9QY5gcrnwX/aL9M0BZisJNSL0Dew2p6uLKbSkGDWpMC+Yt/VnQMIo/fo3r88 vSMBZNjbSwwUDr/ZFMx/kIWwHOLfyEXqtS8qFNT82E85zRX5vzjbM3nU7L23uhyBdpwk rB8QF6vSa2NdBkTVhVpE4tZgwHUqstTay2d3c= MIME-Version: 1.0 Received: by 10.211.145.15 with SMTP id x15mr7581327ebn.6.1251828326284; Tue, 01 Sep 2009 11:05:26 -0700 (PDT) In-Reply-To: <33866.1251824787@nsa.vix.com> References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <200909011326.n81DQEux048757@stora.ogud.com> <56AA7995-8967-48AE-A5DC-1D95A135299B@icsi.berkeley.edu> <33866.1251824787@nsa.vix.com> From: bert hubert Date: Tue, 1 Sep 2009 20:05:06 +0200 Message-ID: <3efd34cc0909011105k247cbaddsadda7e9b5b2aab58@mail.gmail.com> Subject: Re: [dnsext] EDNS0 fallback "revisited" To: Paul Vixie Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 1, 2009 at 7:06 PM, Paul Vixie wrote: > by that reasoning, BIND folks (85% market share) would be seeing a lot of > timeouts on nonexistent ORG subdomains, and there are no reports of same. We should keep the numbers straight. Only 4% of people can only do <= 512, plus BIND then tries TCP, and if that does not work it drops EDNS all together. So almost nobody will be seeing timeouts at this stage. We did see the 250-fold increase in .org TCP queries - those were not imagined. > i think we may be overblowing this. Maybe. But so far all you know is that unfragmented responses do not cause noticeable problems in a population that drops back to TCP and then to do=0. This is not a datapoint on fragmented responses - and the only fragmented responses going out in bulk are .GOV NXDOMAINS. Any validating resolver will still need to have a clear >1470 path to authoritative servers - either using fragmented answers, or over TCP. Bert From owner-namedroppers@ops.ietf.org Tue Sep 1 11:53:38 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 46B1928C940; Tue, 1 Sep 2009 11:53:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.408 X-Spam-Level: * X-Spam-Status: No, score=1.408 tagged_above=-999 required=5 tests=[AWL=-0.755, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cw5jz7Ph1jLu; Tue, 1 Sep 2009 11:53:37 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4509B28C937; Tue, 1 Sep 2009 11:53:37 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiYO9-000GNm-8P for namedroppers-data0@psg.com; Tue, 01 Sep 2009 18:47:29 +0000 Received: from [209.86.89.64] (helo=elasmtp-curtail.atl.sa.earthlink.net) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiYO2-000GLr-20 for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 18:47:27 +0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=ix.netcom.com; b=gdDdGX1koAKxdyI1iTKw4dAmgTD83GiVMJrZ87aGs+F4b2JeeMzQGq2kPlkl1Osz; h=Message-ID:Date:From:Reply-To:To:Subject:Cc:Mime-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:X-ELNK-Trace:X-Originating-IP; Received: from [209.86.224.45] (helo=elwamui-polski.atl.sa.earthlink.net) by elasmtp-curtail.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from ) id 1MiYO0-0001SL-Fa; Tue, 01 Sep 2009 14:47:20 -0400 Received: from 209.44.32.166 by webmail.earthlink.net with HTTP; Tue, 1 Sep 2009 14:47:20 -0400 Message-ID: <9827262.1251830840426.JavaMail.root@elwamui-polski.atl.sa.earthlink.net> Date: Tue, 1 Sep 2009 13:47:20 -0500 (GMT-05:00) From: "Jeffrey A. Williams" Reply-To: "Jeffrey A. Williams" To: Andrew Sullivan , namedroppers@ops.ietf.org Subject: Re: [dnsext] Afiliation of DNSEXT WG chairs Cc: dnsext-chairs chairs , int-ads@tools.ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Mailer: EarthLink Zoo Mail 1.0 X-ELNK-Trace: c8e3929e1e9c87a874cfc7ce3b1ad11381c87f5e5196068868a69a02024f64c1a0c84d47c035ea4f350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 209.86.224.45 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Andrew and all, FWIW, in my opinion this request is way to far overly politically charged and should not be ask or responded to. -----Original Message----- >From: Andrew Sullivan >Sent: Sep 1, 2009 11:14 AM >To: namedroppers@ops.ietf.org >Cc: dnsext-chairs chairs , int-ads@tools.ietf.org >Subject: [dnsext] Afiliation of DNSEXT WG chairs > >Dear colleagues, > >The IESG has asked us to ensure that our employment affiliation and >sponsorship is clear, under a recommendation that's being added to >http://trac.tools.ietf.org/group/iesg/trac/wiki/ManageWorkingGroup. > >We believe this information is widely known, but in case it is not, >both Olafur and Andrew work for Shinkuro, Inc., and in fact report to >the same person at Shinkuro. > >We are aware that this may make some situations more awkward than >others. We have so far tried, and will continue to try, to deal with >such situations case by case. If you have concerns about the Chairs' >actions in a given situation, we implore you to raise your concerns >directly to us or, if you prefer, to the wider working group (or to >follow both options if you deem it best). It is our intention that >the WG be operated transparently, in keeping with the traditions of >the IETF. > >Best regards, >Olafur and Andrew (Chairs) > >-- >Andrew Sullivan >ajs@shinkuro.com >Shinkuro, Inc. > Regards, Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 294k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1@ix.netcom.com Phone: 214-244-4827 From owner-namedroppers@ops.ietf.org Tue Sep 1 14:05:05 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE4C53A6C17; Tue, 1 Sep 2009 14:05:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.04 X-Spam-Level: X-Spam-Status: No, score=-2.04 tagged_above=-999 required=5 tests=[AWL=-0.041, BAYES_00=-2.599, J_CHICKENPOX_33=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n5QJe8+htBmv; Tue, 1 Sep 2009 14:05:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EE74E3A6BDF; Tue, 1 Sep 2009 14:05:04 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiaR1-000GsG-Du for namedroppers-data0@psg.com; Tue, 01 Sep 2009 20:58:35 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiaQt-000GqZ-6w for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 20:58:33 +0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=monster; d=hopcount.ca; h=Received:Subject:Mime-Version:Content-Type:From:In-Reply-To:Date:Cc:Content-Transfer-Encoding:Message-Id:References:To:X-Mailer; b=nTO5BRC1QaMy25gXdUslMm9jB7oE3hRK3X0ZgyBprgwrxKQe4L+vEcBP7vosgiX1RIoCu4AIXpzdX7jw9opgJfCTqWMAacdKan8dDTGCvcAA7k0GoQSvHrYdW4tV+Hnj; Received: from [199.212.90.20] (helo=dh20.r2.owls.hopcount.ca) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiaQo-0000pd-1u; Tue, 01 Sep 2009 20:58:22 +0000 Subject: Re: [dnsext] EDNS0 fallback "revisited" Mime-Version: 1.0 (Apple Message framework v1075.2) Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes From: Joe Abley In-Reply-To: <3efd34cc0909011105k247cbaddsadda7e9b5b2aab58@mail.gmail.com> Date: Tue, 1 Sep 2009 16:58:20 -0400 Cc: Paul Vixie , namedroppers@ops.ietf.org Content-Transfer-Encoding: 7bit Message-Id: <78944763-AD70-4490-8897-6A9B18C8A557@hopcount.ca> References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <200909011326.n81DQEux048757@stora.ogud.com> <56AA7995-8967-48AE-A5DC-1D95A135299B@icsi.berkeley.edu> <33866.1251824787@nsa.vix.com> <3efd34cc0909011105k247cbaddsadda7e9b5b2aab58@mail.gmail.com> To: bert hubert X-Mailer: Apple Mail (2.1075.2) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2009-09-01, at 14:05, bert hubert wrote: > We did see the 250-fold increase in .org TCP queries - those were > not imagined. 600-fold, I think. But those were likely exaccerbated by the lack of negative caching and the zero-second TTL on the apex DNSKEY RRSet. Do we know what the steady-state increase in UDP:TCP transport for ORG is, compared to a pre-signed zone, now that those problems have been fixed? Maybe there has been analysis done, but if so I have missed it. Joe From owner-namedroppers@ops.ietf.org Tue Sep 1 14:34:49 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DB2DF3A6C6D; Tue, 1 Sep 2009 14:34:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.218 X-Spam-Level: X-Spam-Status: No, score=-3.218 tagged_above=-999 required=5 tests=[AWL=-3.381, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, J_CHICKENPOX_33=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qzQw6veWgTQs; Tue, 1 Sep 2009 14:34:49 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 650D928C934; Tue, 1 Sep 2009 14:33:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Miaup-000Mrh-1y for namedroppers-data0@psg.com; Tue, 01 Sep 2009 21:29:23 +0000 Received: from [149.20.58.5] (helo=mail.dns-oarc.net) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Miaul-000MqZ-Pa for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 21:29:21 +0000 Received: by mail.dns-oarc.net (Postfix, from userid 11202) id 3C605BDCC0; Tue, 1 Sep 2009 21:29:19 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.dns-oarc.net (Postfix) with ESMTP id 1D47FBDC41; Tue, 1 Sep 2009 21:29:19 +0000 (UTC) (envelope-from wessels@dns-oarc.net) Date: Tue, 1 Sep 2009 21:29:19 +0000 (UTC) From: Duane Wessels To: Joe Abley cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] EDNS0 fallback "revisited" In-Reply-To: <78944763-AD70-4490-8897-6A9B18C8A557@hopcount.ca> Message-ID: References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <200909011326.n81DQEux048757@stora.ogud.com> <56AA7995-8967-48AE-A5DC-1D95A135299B@icsi.berkeley.edu> <33866.1251824787@nsa.vix.com> <3efd34cc0909011105k247cbaddsadda7e9b5b2aab58@mail.gmail.com> <78944763-AD70-4490-8897-6A9B18C8A557@hopcount.ca> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, 1 Sep 2009, Joe Abley wrote: > Do we know what the steady-state increase in UDP:TCP transport for ORG is, > compared to a pre-signed zone, now that those problems have been fixed? Maybe > there has been analysis done, but if so I have missed it. Not yet. Afilias has provided some additional data to OARC (i.e. from last week), but I haven't had time to crunch it yet. DW From owner-namedroppers@ops.ietf.org Tue Sep 1 14:34:53 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CDD8A3A6CF9; Tue, 1 Sep 2009 14:34:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.757 X-Spam-Level: ** X-Spam-Status: No, score=2.757 tagged_above=-999 required=5 tests=[AWL=0.918, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_JP=1.244, RCVD_IN_NJABL_PROXY=1.643, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bo9S3EYynK1b; Tue, 1 Sep 2009 14:34:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CD78F28C9CA; Tue, 1 Sep 2009 14:34:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Miawn-000NJ2-SL for namedroppers-data0@psg.com; Tue, 01 Sep 2009 21:31:25 +0000 Received: from [131.112.32.132] (helo=necom830.hpcl.titech.ac.jp) by psg.com with smtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Miawk-000NES-Cf for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 21:31:24 +0000 Received: (qmail 74107 invoked from network); 1 Sep 2009 21:41:49 -0000 Received: from softbank219001188006.bbtec.net (HELO necom830.hpcl.titech.ac.jp) (219.1.188.6) by necom830.hpcl.titech.ac.jp with SMTP; 1 Sep 2009 21:41:49 -0000 Message-ID: <4A9D927C.7020006@necom830.hpcl.titech.ac.jp> Date: Wed, 02 Sep 2009 06:30:36 +0900 From: Masataka Ohta User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: ja, en MIME-Version: 1.0 To: Doug Barton CC: Mark Andrews , namedroppers@ops.ietf.org Subject: Re: [dnsext] Working around proxies References: <4CB0582F89044745BF1D1EBF09E549B6@localhost> <4A998A15.6050602@dougbarton.us> <4A9AC3CF.4000106@dougbarton.us> <200908310153.n7V1rUhR088199@drugs.dv.isc.org> <1009805BA49B4D22BAD2E408B06FA87B@localhost> <200908311222.n7VCMX8j000197@drugs.dv.isc.org> <339C5564ABB948BAB7F9591DF3325140@localhost> <200908311403.n7VE3iNe004282@drugs.dv.isc.org> <1BE8B1F5-0CAB-4375-99F5-32ACF6FB9D90@icsi.berkeley.edu> <200908311520.n7VFK0Ti013253@drugs.dv.isc.org> <4A9C2374.5090105@necom830.hpcl.titech.ac.jp> <200908312200.n7VM06PF017221@drugs.dv.isc.org> <4A9D41CF.6070707@dougbarton.us> In-Reply-To: <4A9D41CF.6070707@dougbarton.us> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Doug Barton wrote: >>Except it is. It's cruch time and residential ISP are now reacting. >>There are commisioning CPE product development, now, to allow them >>to support both IPv4 (NAT'd) and IPv6 into the future. > I agree totally with Mark here. All this effort spent trying to figure > out how to work around broken middleboxes is (to put it in the > politest possible terms) wasted. We have a LANDMARK opportunity here > to educate CPE manufacturers about the need to include proper DNS > support (including DNSSEC, EDNS and TCP) in their products while they > are redesigning them for IPv6. With Mark? But, he wrote: > The problem is that the boxes are not EDNS compliant or even RFC > 103[45] compliant. That is, middleboxes produced long after 103[45] was published are not 103[45] compliant. So, how can you expect middleboxes to be produced will be EDNS compliant? Note also that, if designers of middleboxes are well educated, they will randomize source port of DNS query and won't inappropriately cache glues that we don't need DNSSEC at all. > The fact is that there will either be market demand for IPv6 and > DNSSEC, or there will not. The fact we have confirmed with these 15 years of experience is that there is no market demands for IPv6 nor DNSSEC. Note also that there is no technical demands, because IPv4 address space can be extended by NAT while preserving end to end transparency and DNSSEC is not secure end to end. Masataka Ohta From owner-namedroppers@ops.ietf.org Tue Sep 1 14:37:59 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 870CB3A7098; Tue, 1 Sep 2009 14:37:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.465 X-Spam-Level: X-Spam-Status: No, score=-0.465 tagged_above=-999 required=5 tests=[AWL=0.030, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j5j3d+ehP5WI; Tue, 1 Sep 2009 14:37:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B81C83A690D; Tue, 1 Sep 2009 14:37:58 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mib0b-000Nx7-2l for namedroppers-data0@psg.com; Tue, 01 Sep 2009 21:35:21 +0000 Received: from [74.125.78.25] (helo=ey-out-2122.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mib0V-000NwG-E9 for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 21:35:19 +0000 Received: by ey-out-2122.google.com with SMTP id 9so71229eyd.53 for ; Tue, 01 Sep 2009 14:35:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=syIyJTxjXlkibUNNAY7CudCU0ekAnGl4XCEJjFu7EFA=; b=wm5J8CVSLX+Rx4V0WRHo42Du01VdW2QDfjZ1DfJW8qkVbNgGFAoriiCFIn+peVLZte zKr9cA98cstsdFE/FXa3I37zw5v2G8rC1fQzoqNJTiyBt9DJBZaRXR3JrqTvsjGmwpl0 TA5XWDziZeNdTzoMstAIAP8BvkjKgvP+dXjV0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=kACskQQ+Za3nYyQRZ+7oMlK201LTRgJsQp6zpIfK/jUAmUumxHUTL2usX4MN51WTG9 f1IYPYKUm1yP/LVUXHwHPJe0yb+g+HPvyTyw5tVZITepUaUSG8+BNyK0ClE9lZqo9QDc 5Wi5LuPc7IM0S8tDf5jZ//CP9F/3jI44JUrMY= MIME-Version: 1.0 Received: by 10.211.158.8 with SMTP id k8mr7764272ebo.38.1251840914169; Tue, 01 Sep 2009 14:35:14 -0700 (PDT) In-Reply-To: <20090901161401.GH14929@shinkuro.com> References: <5D4BEBA1-8052-4F60-96E5-F9A23ACBB60B@cisco.com> <20090901161401.GH14929@shinkuro.com> From: bert hubert Date: Tue, 1 Sep 2009 23:34:54 +0200 Message-ID: <3efd34cc0909011434o19e5105ajc21820ff21305774@mail.gmail.com> Subject: Re: [dnsext] Afiliation of DNSEXT WG chairs To: Andrew Sullivan Cc: namedroppers@ops.ietf.org, dnsext-chairs chairs Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 1, 2009 at 6:14 PM, Andrew Sullivan wrote: > The IESG has asked us to ensure that our employment affiliation and > sponsorship is clear, under a recommendation that's being added to > http://trac.tools.ietf.org/group/iesg/trac/wiki/ManageWorkingGroup. > > We believe this information is widely known, but in case it is not, > both Olafur and Andrew work for Shinkuro, Inc., and in fact report to > the same person at Shinkuro. I did not know this, although I correspond frequently with the chairs and this group. While I think life would've been much better if this change had been announced when it happened, I must simultaneously say that I have never seen either Andrew or Olafur display any form of bias. Bert From owner-namedroppers@ops.ietf.org Tue Sep 1 16:44:33 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B5BEC3A70C7; Tue, 1 Sep 2009 16:44:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[AWL=-0.101, BAYES_00=-2.599, J_CHICKENPOX_31=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9LvffJtsoE3V; Tue, 1 Sep 2009 16:44:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E623F3A70BC; Tue, 1 Sep 2009 16:44:32 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MicwC-000KDu-5g for namedroppers-data0@psg.com; Tue, 01 Sep 2009 23:38:56 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Micw7-000KDH-SW for namedroppers@ops.ietf.org; Tue, 01 Sep 2009 23:38:53 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 0D6E4E601E for ; Tue, 1 Sep 2009 23:38:50 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n81Ncm0S056506 for ; Wed, 2 Sep 2009 09:38:48 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909012338.n81Ncm0S056506@drugs.dv.isc.org> To: namedroppers@ops.ietf.org From: Mark Andrews References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. In-reply-to: Your message of "Tue, 01 Sep 2009 17:13:00 GMT." <34182.1251825180@nsa.vix.com> Date: Wed, 02 Sep 2009 09:38:48 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <34182.1251825180@nsa.vix.com>, Paul Vixie writes: > > From: "George Barwood" > > Date: Tue, 1 Sep 2009 15:28:41 +0100 > > > > The reason why is that it appears to be a menace. > > It has already being used for attacks on third parties. > > EDNS isn't nec'y or sufficient for menacing third parties. Widespread lack > of BCP38 deployment is nec'y, and any wide area UDP protocol is sufficient; > any moderate sized DNS response (google.com MX, for example) is sufficient. > > The fact that DNSSEC with EDNS makes these attacks more easily devastating > does not mean EDNS is required for them to be devastating. Let's not add > moving parts and friction to the machine unless it *solves* a problem. If > you want to *solve* amplified DDoS, focus your efforts on deploying BCP38. Especially as BCP 38 solves a whole lot of other non amplification problems as well. Spoofed packets are just plain BBBBBBBB AA DDDDDDDD ## BB BB AA AA DD DD ## BB BB AA AA DD DD ## BB BB AA AA DD DD ## BBBBBBB AAAAAAAAAA DD DD ## BB BB AA AA DD DD ## BB BB AA AA DD DD BB BB AA AA DD DD ## BBBBBBBB AA AA DDDDDDDD ## Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 1 17:15:25 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5232A3A6954; Tue, 1 Sep 2009 17:15:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[AWL=-0.098, BAYES_00=-2.599, J_CHICKENPOX_45=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kt75ldpYSiEV; Tue, 1 Sep 2009 17:15:24 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 321BB3A67EC; Tue, 1 Sep 2009 17:15:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MidRD-000P1h-5N for namedroppers-data0@psg.com; Wed, 02 Sep 2009 00:10:59 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MidKs-000OTn-4X for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 00:05:39 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 186BCE601E; Wed, 2 Sep 2009 00:04:24 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8204MPb057081; Wed, 2 Sep 2009 10:04:22 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909020004.n8204MPb057081@drugs.dv.isc.org> To: Andrew Sullivan Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <20090826043344.GI5405@shinkuro.com> <934623C28D56444CB073F90BC35244BB05365B@TK5EX14MBXC128.redmond.corp.microsoft.com> <934623C28D56444CB073F90BC35244BB05E980@TK5EX14MBXC121.redmond.corp.microsoft.com> <20090827180305.GK7821@shinkuro.com> <200908272358.n7RNwrvr038970@drugs.dv.isc.org> <20090828144512.GT7821@shinkuro.com> <200908282207.n7SM73bf056581@drugs.dv.isc.org> <20090831182103.GQ13987@shinkuro.com> <200909010055.n810tI2W047942@drugs.dv.isc.org> <20090901142514.GB14929@shinkuro.com> Subject: Re: [dnsext] Cryptographic Algorithm Identifier Allocation for DNSSEC In-reply-to: Your message of "Tue, 01 Sep 2009 10:25:15 -0400." <20090901142514.GB14929@shinkuro.com> Date: Wed, 02 Sep 2009 10:04:22 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <20090901142514.GB14929@shinkuro.com>, Andrew Sullivan writes: > No hat. > > On Tue, Sep 01, 2009 at 10:55:18AM +1000, Mark Andrews wrote: > > > SHA256 was special because we had to teach the working group that > > new signature algorithms need to support both NSEC and NSEC3. > > It was also special because those who decided they had "teach the > working group" didn't make that decision until after WGLC had closed, > at which point there was a threat of appeal. Which is exactly my > point: the current state of affairs requires the entire machinery of > the IETF to spin into action every time we want to support a new > algorithm. The timing wasn't great I will admit that. > > SHA256 should not be seen as representative of the time it will > > take in future. > > On what basis do you say this? We don't even know yet whether during > IETF last call the SHA2 draft will not face a demand for the > restoration of the NSEC and NSEC3 alias strategy, since we nowhere > have a document that says "NSEC3 support is mandatory". The fact is > that we're a WG that mostly maintains a mature protocol; this tends to > mean urgency for review &c. is not great. We have documents that say NSEC3 is manditory if you want to use this code point. Anything a TLD is likely to pickup needs to support NSEC3. Validators, de-facto, need to support NSEC3 as that is what the TLD's are using. But we've had these arguement before. We had a document that almost makes it manditory. draft-ietf-dnsext-dnssec-bis-updates needs to be revived. 2.1. NSEC3 Support [RFC5155] describes the use and behavior of the NSEC3 and NSEC3PARAM records for hashed denial of existence. Validator implementations are strongly encouraged to include support for NSEC3 as a number of highly visible zones are expected to use it. Validators that do not support validation of responses using NSEC3 will likely be hampered in validating large portions of the DNS space. [RFC5155] should be considered part of the DNS Security Document Family as described by [RFC4033], Section 10. > > DNSEXT goes from one extreme to the other. RR allocation was a > > example of that. New procedures were defined and people complained > > that RR's take too long without even trying the new procedures. > > They complain of that because they remember the old ways -- ways that > hung around for a long time because this WG was (and, I am frequently > told by other WG Chairs and IETF participants, still is) regarded as > obstructionist, unwilling to understand the uses to which people want > to put the protocol, and generally unhelpful. We can do something > about that by making our procedures in this new area flexible to begin > with. Otherwise, people will (again) dismiss us as hidebound control > freaks who are protecting our protocol turf rather than trying to help > the rest of the users of the Internet. This is not my view -- I > understand the motivation for conservatism -- but we need to > appreciate that there is a widespread view of the DNS protocol people > that is roughly the one I describe. > > A > -- > Andrew Sullivan > ajs@shinkuro.com > Shinkuro, Inc. > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 1 18:13:09 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9EFF53A6995; Tue, 1 Sep 2009 18:13:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.394 X-Spam-Level: X-Spam-Status: No, score=-2.394 tagged_above=-999 required=5 tests=[AWL=0.205, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KlkQ3dkMeGmL; Tue, 1 Sep 2009 18:13:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8185A3A697D; Tue, 1 Sep 2009 18:13:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MieKM-0009M1-K2 for namedroppers-data0@psg.com; Wed, 02 Sep 2009 01:07:58 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MieKI-0009IB-Ae for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 01:07:56 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 72C88E601C; Wed, 2 Sep 2009 01:07:52 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8217lfC058894; Wed, 2 Sep 2009 11:07:49 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909020107.n8217lfC058894@drugs.dv.isc.org> To: Masataka Ohta Cc: Doug Barton , namedroppers@ops.ietf.org From: Mark Andrews References: <4CB0582F89044745BF1D1EBF09E549B6@localhost> <4A998A15.6050602@dougbarton.us> <4A9AC3CF.4000106@dougbarton.us> <200908310153.n7V1rUhR088199@drugs.dv.isc.org> <1009805BA49B4D22BAD2E408B06FA87B@localhost> <200908311222.n7VCMX8j000197@drugs.dv.isc.org> <339C5564ABB948BAB7F9591DF3325140@localhost> <200908311403.n7VE3iNe004282@drugs.dv.isc.org> <1BE8B1F5-0CAB-4375-99F5-32ACF6FB9D90@icsi.berkeley.edu> <200908311520.n7VFK0Ti013253@drugs.dv.isc.org> <4A9C2374.5090105@necom830.hpcl.titech.ac.jp> <200908312200.n7VM06PF017221@drugs.dv.isc.org> <4A9D41CF.6070707@dougbarton.us> <4A9D927C.7020006@necom830.hpcl.titech.ac.jp> Subject: Re: [dnsext] Working around proxies In-reply-to: Your message of "Wed, 02 Sep 2009 06:30:36 +0900." <4A9D927C.7020006@necom830.hpcl.titech.ac.jp> Date: Wed, 02 Sep 2009 11:07:47 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <4A9D927C.7020006@necom830.hpcl.titech.ac.jp>, Masataka Ohta writes: > Doug Barton wrote: > > >>Except it is. It's cruch time and residential ISP are now reacting. > >>There are commisioning CPE product development, now, to allow them > >>to support both IPv4 (NAT'd) and IPv6 into the future. > > > I agree totally with Mark here. All this effort spent trying to figure > > out how to work around broken middleboxes is (to put it in the > > politest possible terms) wasted. We have a LANDMARK opportunity here > > to educate CPE manufacturers about the need to include proper DNS > > support (including DNSSEC, EDNS and TCP) in their products while they > > are redesigning them for IPv6. > > With Mark? But, he wrote: > > > The problem is that the boxes are not EDNS compliant or even RFC > > 103[45] compliant. > > That is, middleboxes produced long after 103[45] was published are > not 103[45] compliant. > > So, how can you expect middleboxes to be produced will be EDNS > compliant? By performing a EDUCATION campain. That's not just publishing RFC's. It's ringing/phoning/writing to vendors and making sure that they are aware of the issues. It's logging fault reports with vendors if you happen to have their products. It's talking to consumer orginizations and having them to product reviews on this class of products. It's talking to the tech editors of papers about the problems that are coming up if the these vendors don't act. There are some products that get this right. It's about talking those up and the ones that are broken down. The 1st aim is to get new products being developed doing the right thing. The 2nd aim is to get currently shipping products fixed so that new ones oing to the shelves don't make things worse. The 3rd aim is to encourage vendors to make fixes to existing products available. The 4th aim is to get the public to apply those fixes. I'm aiming for 100% with the 1st aim. If we get 50% I'd be happy with the 2nd aim. If we get 1% I'd be happy with the 4th aim. > Note also that, if designers of middleboxes are well educated, they > will randomize source port of DNS query and won't inappropriately > cache glues that we don't need DNSSEC at all. You are missing the point. EDNS needs to work reliably whether it is carrying DNSSEC records or not. Referrals are already too big for plain DNS to work. This is future planning whether it be DNSSEC or something else we still need EDNS to work cleanly though these boxes. > > The fact is that there will either be market demand for IPv6 and > > DNSSEC, or there will not. > > The fact we have confirmed with these 15 years of experience is that > there is no market demands for IPv6 nor DNSSEC. The future is not the past. The jury is still very much out on both of these. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 1 19:14:44 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2CCE728C14E; Tue, 1 Sep 2009 19:14:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.282 X-Spam-Level: X-Spam-Status: No, score=-0.282 tagged_above=-999 required=5 tests=[AWL=-0.702, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_31=0.6, RDNS_NONE=0.1, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pGWXG5iScnmV; Tue, 1 Sep 2009 19:14:43 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6613D3A69FC; Tue, 1 Sep 2009 19:14:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MifHU-000K6k-2c for namedroppers-data0@psg.com; Wed, 02 Sep 2009 02:09:04 +0000 Received: from [209.85.216.194] (helo=mail-px0-f194.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MifHH-000K1W-LG for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 02:08:53 +0000 Received: by pxi32 with SMTP id 32so440567pxi.25 for ; Tue, 01 Sep 2009 19:08:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=6uFYNPgU6AZCFNgMqaVuFbOSzuLufdeYpW+NF81n4nA=; b=ZfZPp3R4on0K46ZvM+ZOzzToMkoFabpH9L20xX4WVSzUJ8Ke5tBL/Lpw2tXOzg77f+ bH/BB/pYymoMg117bWt9rs0eXrUKWZkwUSRKlUQrVyNZWMYM5jYr6KD7Z0+JNL6mDiPD 8/h25I5XGmh2fKZWfM2u3CPMAluGPG5lo3Zgc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; b=ST9v8yIqHOwRCmnIhIlITQFJpp9FncvOoL3+4jHS/PjAXWOtdPu0ZQ7qr0yIFJgG5e UfAdDlNa3mifY0uBo1e6HqCbyLsqlS1SQDdcqmkFP1H5ouXfL2HXlOLNemw931uQ8XZ6 AapmBr6VubHuC4QEUo4pbkCQxDFPYy4jMrQhI= Received: by 10.115.66.10 with SMTP id t10mr5541341wak.20.1251857025074; Tue, 01 Sep 2009 19:03:45 -0700 (PDT) Received: from SJC-Office-NAT-214.mail-abuse.org (SJC-Office-NAT-214.mail-abuse.org [168.61.10.214]) by mx.google.com with ESMTPS id j28sm1277620waf.35.2009.09.01.19.03.43 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 01 Sep 2009 19:03:44 -0700 (PDT) Message-ID: <4A9DD27D.6080507@gmail.com> Date: Tue, 01 Sep 2009 19:03:41 -0700 From: Doug Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: Mark Andrews CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> <200909012338.n81Ncm0S056506@drugs.dv.isc.org> In-Reply-To: <200909012338.n81Ncm0S056506@drugs.dv.isc.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/1/09 4:38 PM, Mark Andrews wrote: > In message<34182.1251825180@nsa.vix.com>, Paul Vixie writes: >>> From: "George Barwood" >>> Date: Tue, 1 Sep 2009 15:28:41 +0100 >>> >>> The reason why is that it appears to be a menace. >>> It has already being used for attacks on third parties. >> >> EDNS isn't nec'y or sufficient for menacing third parties. Widespread lack >> of BCP38 deployment is nec'y, and any wide area UDP protocol is sufficient; >> any moderate sized DNS response (google.com MX, for example) is sufficient. >> >> The fact that DNSSEC with EDNS makes these attacks more easily devastating >> does not mean EDNS is required for them to be devastating. Let's not add >> moving parts and friction to the machine unless it *solves* a problem. If >> you want to *solve* amplified DDoS, focus your efforts on deploying BCP38. > > Especially as BCP 38 solves a whole lot of other non amplification problems > as well. Spoofed packets are just plain bad! Mark, George is not wrong about a potential problem. While implementing BCP38 is highly recommended, reflected attacks are not inhibited by egress filtering, since both source and destination IP addresses are valid. Based upon the MIT link provided by Nicholas Weaver, half of the IP addresses do not have egress filtering, and many use large CIDR filters. With hundreds of millions of compromised systems, BCP38 should not be considered comprehensive protection from reflected attacks. Only a protocol can offer comprehensive protection. In addition to EDNS0 enabling the distribution of higher gain reflected DNS payloads, packet reassembly is also made vulnerable. As such, reliance upon packet reassembly might prove a bad practice. The number of compromised systems is steadily rising. Based upon email heuristics, the last 6 months has seen the number of botted systems more than double. Reflected attacks both obscure botted systems, and in the case of EDNS0, increases their damage. Simply put, reflected attacks can defeat local egress filtering. In other words, your statement that local BCP38 filtering only permits direct attacks is not correct. -Doug From owner-namedroppers@ops.ietf.org Tue Sep 1 19:44:20 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DFDCA28C8C6; Tue, 1 Sep 2009 19:44:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.948 X-Spam-Level: X-Spam-Status: No, score=-1.948 tagged_above=-999 required=5 tests=[AWL=-0.264, BAYES_00=-2.599, J_CHICKENPOX_31=0.6, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RuVh0ePvuOH5; Tue, 1 Sep 2009 19:44:20 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3F57F3A7077; Tue, 1 Sep 2009 19:42:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mifjq-000OmG-56 for namedroppers-data0@psg.com; Wed, 02 Sep 2009 02:38:22 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mifjk-000OlP-W0 for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 02:38:20 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 43FA2E6023; Wed, 2 Sep 2009 02:38:15 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n822cCCK059837; Wed, 2 Sep 2009 12:38:13 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909020238.n822cCCK059837@drugs.dv.isc.org> To: Doug Otis Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> <200909012338.n81Ncm0S056506@drugs.dv.isc.org> <4A9DD27D.6080507@gmail.com> Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. In-reply-to: Your message of "Tue, 01 Sep 2009 19:03:41 MST." <4A9DD27D.6080507@gmail.com> Date: Wed, 02 Sep 2009 12:38:12 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <4A9DD27D.6080507@gmail.com>, Doug Otis writes: > On 9/1/09 4:38 PM, Mark Andrews wrote: > > In message<34182.1251825180@nsa.vix.com>, Paul Vixie writes: > >>> From: "George Barwood" > >>> Date: Tue, 1 Sep 2009 15:28:41 +0100 > >>> > >>> The reason why is that it appears to be a menace. > >>> It has already being used for attacks on third parties. > >> > >> EDNS isn't nec'y or sufficient for menacing third parties. Widespread lac > k > >> of BCP38 deployment is nec'y, and any wide area UDP protocol is sufficient > ; > >> any moderate sized DNS response (google.com MX, for example) is sufficient > . > >> > >> The fact that DNSSEC with EDNS makes these attacks more easily devastating > >> does not mean EDNS is required for them to be devastating. Let's not add > >> moving parts and friction to the machine unless it *solves* a problem. If > >> you want to *solve* amplified DDoS, focus your efforts on deploying BCP38. > > > > Especially as BCP 38 solves a whole lot of other non amplification problems > > as well. Spoofed packets are just plain bad! > > Mark, > > George is not wrong about a potential problem. > > While implementing BCP38 is highly recommended, reflected attacks are > not inhibited by egress filtering, since both source and destination IP > addresses are valid. If you have strict BCP38 in place you can only attack the path between the attacker and the responder. There is NOTHING you can do to prevent this. If you have wider filters then the attackers neighbours can be attacked as well however all traffic will be going through the same administative entities as is traceable. > Based upon the MIT link provided by Nicholas > Weaver, half of the IP addresses do not have egress filtering, and many > use large CIDR filters. With hundreds of millions of compromised > systems, BCP38 should not be considered comprehensive protection from > reflected attacks. Only a protocol can offer comprehensive protection. Which just means that finer grain BCP38 filters are needed. Put them close to source and they are not expensive. BCP 38 is not whack-a-mole so applying presure to get BCP38 deployed is still a worthwhile effort. > In addition to EDNS0 enabling the distribution of higher gain reflected > DNS payloads, packet reassembly is also made vulnerable. As such, > reliance upon packet reassembly might prove a bad practice. The number > of compromised systems is steadily rising. Based upon email heuristics, > the last 6 months has seen the number of botted systems more than > double. Reflected attacks both obscure botted systems, and in the case > of EDNS0, increases their damage. Simply put, reflected attacks can > defeat local egress filtering. In other words, your statement that > local BCP38 filtering only permits direct attacks is not correct. If you do BCP38 correctly you can't. ISP's should be putting the BCP 38 filters as close to the customer edge as possible. This reduces the amount of machines that will be impacted by non perfect filters to machines that are direct neighbours of the attacking machine. If the ISP is not doing this then they are not really doing BCP38. If I have a address 1.2.3.4 and my ISP only allows packet with a source address of 1.2.3.4 to pass from me to them, how can I launch a reflection attack agains 2.3.4.5 using 5.6.7.9 as the reflector? I can cause a lot of traffic between 1.2.3.4 and 5.6.7.9 but all of that traffic will have 1.2.3.4 and 5.6.7.9 in the IP packet headers. This is a amplication attack on the path not a reflection attack. There is no protocol change that will help this if you really need the data to be returned. All you can do is balance out the flows by making normal operations more bandwidth expensive and that is a bad tradeoff. Mark > -Doug -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 1 19:45:03 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B08BE28C4C4; Tue, 1 Sep 2009 19:45:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.341 X-Spam-Level: X-Spam-Status: No, score=-0.341 tagged_above=-999 required=5 tests=[AWL=-0.161, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OMMRnZ5c-sJP; Tue, 1 Sep 2009 19:45:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DCD573A68DC; Tue, 1 Sep 2009 19:45:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mifn1-000PTB-PO for namedroppers-data0@psg.com; Wed, 02 Sep 2009 02:41:39 +0000 Received: from [193.110.157.143] (helo=newtla.xelerance.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mifmy-000PSW-79 for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 02:41:37 +0000 Received: from tla.xelerance.com (tla.xelerance.com [193.110.157.130]) by newtla.xelerance.com (Postfix) with ESMTP id 252445709C; Tue, 1 Sep 2009 22:41:35 -0400 (EDT) Date: Tue, 1 Sep 2009 22:41:34 -0400 (EDT) From: Paul Wouters To: Doug Otis cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. In-Reply-To: <4A9DD27D.6080507@gmail.com> Message-ID: References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> <200909012338.n81Ncm0S056506@drugs.dv.isc.org> <4A9DD27D.6080507@gmail.com> User-Agent: Alpine 1.10 (LFD 962 2008-03-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, 1 Sep 2009, Doug Otis wrote: > With hundreds of millions of compromised systems You have no need of amplification...... Paul From owner-namedroppers@ops.ietf.org Tue Sep 1 22:15:02 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B62E63A6845; Tue, 1 Sep 2009 22:15:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.196 X-Spam-Level: X-Spam-Status: No, score=0.196 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_JP=1.244, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bUsOk97TkFwR; Tue, 1 Sep 2009 22:15:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 650343A6836; Tue, 1 Sep 2009 22:15:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mii6I-000Otu-VZ for namedroppers-data0@psg.com; Wed, 02 Sep 2009 05:09:42 +0000 Received: from [131.112.32.132] (helo=necom830.hpcl.titech.ac.jp) by psg.com with smtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mii6F-000OtJ-FT for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 05:09:41 +0000 Received: (qmail 10558 invoked from network); 2 Sep 2009 05:20:19 -0000 Received: from vaio.hpcl.titech.ac.jp (HELO necom830.hpcl.titech.ac.jp) (131.112.32.134) by necom830.hpcl.titech.ac.jp with SMTP; 2 Sep 2009 05:20:19 -0000 Message-ID: <4A9DFDEC.1050900@necom830.hpcl.titech.ac.jp> Date: Wed, 02 Sep 2009 14:09:00 +0900 From: Masataka Ohta User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: ja, en MIME-Version: 1.0 To: Mark Andrews CC: Doug Barton , namedroppers@ops.ietf.org Subject: Re: [dnsext] Working around proxies References: <4CB0582F89044745BF1D1EBF09E549B6@localhost> <4A998A15.6050602@dougbarton.us> <4A9AC3CF.4000106@dougbarton.us> <200908310153.n7V1rUhR088199@drugs.dv.isc.org> <1009805BA49B4D22BAD2E408B06FA87B@localhost> <200908311222.n7VCMX8j000197@drugs.dv.isc.org> <339C5564ABB948BAB7F9591DF3325140@localhost> <200908311403.n7VE3iNe004282@drugs.dv.isc.org> <1BE8B1F5-0CAB-4375-99F5-32ACF6FB9D90@icsi.berkeley.edu> <200908311520.n7VFK0Ti013253@drugs.dv.isc.org> <4A9C2374.5090105@necom830.hpcl.titech.ac.jp> <200908312200.n7VM06PF017221@drugs.dv.isc.org> <4A9D41CF.6070707@dougbarton.us> <4A9D927C.7020006@necom830.hpcl.titech.ac.jp> <200909020107.n8217lfC058894@drugs.dv.isc.org> In-Reply-To: <200909020107.n8217lfC058894@drugs.dv.isc.org> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Mark Andrews wrote: >>That is, middleboxes produced long after 103[45] was published are >>not 103[45] compliant. >> >>So, how can you expect middleboxes to be produced will be EDNS >>compliant? > By performing a EDUCATION campain. Good luck. >>Note also that, if designers of middleboxes are well educated, they >>will randomize source port of DNS query and won't inappropriately >>cache glues that we don't need DNSSEC at all. > You are missing the point. EDNS needs to work reliably whether it > is carrying DNSSEC records or not. Referrals are already too big > for plain DNS to work. Considering that anycast works, routing table entries for anycast addresses are not a problem compared to those for multihoming and that IPv6 won't be deployed, I can see no need for larger message size. BTW, properly designed public key DNS with 2048 bit key length does not need messages longer than 512B, either (assuming anycasting properly deployed), even during key roll over. >>The fact we have confirmed with these 15 years of experience is that >>there is no market demands for IPv6 nor DNSSEC. > The future is not the past. The jury is still very much out on > both of these. Given that technical demands disappeared, it is assured that future market demands will be less than those of the past. Masataka Ohta From owner-namedroppers@ops.ietf.org Wed Sep 2 01:25:59 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6EF653A697D; Wed, 2 Sep 2009 01:25:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.116 X-Spam-Level: X-Spam-Status: No, score=-4.116 tagged_above=-999 required=5 tests=[AWL=-0.818, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U4iZ80smrigi; Wed, 2 Sep 2009 01:25:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5D8173A6781; Wed, 2 Sep 2009 01:25:58 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mil4H-00065N-36 for namedroppers-data0@psg.com; Wed, 02 Sep 2009 08:19:49 +0000 Received: from [213.248.199.23] (helo=mx3.nominet.org.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mil4C-00064b-KJ; Wed, 02 Sep 2009 08:19:46 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:In-Reply-To:References:To:Cc: Subject:MIME-Version:X-Mailer:Message-ID:From:Date: X-MIMETrack:Content-Type; b=nafpYz2Q5yiFdtVPpsZr1ClYbVo3LNf0SWkhUzLVnE3gRf+mn9+op8qF 2hsjnu5//5/rMbH9t4oREwdI5IrY/xZH5LIF5PmbKNBeJHu56LkEdw/PH 9qep/mqa1BOcRI2; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=Ray.Bellis@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1251879584; x=1283415584; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20Ray.Bellis@nominet.org.uk|Subject:=20Re:=20[dnse xt]=20Working=20around=20proxies|Date:=20Wed,=202=20Sep =202009=2009:19:39=20+0100|Message-ID:=20|To:=20Mark=20Andrews=20|Cc:=20Alex=20Bli gh=20,=0D=0A=09Doug=20Barton=20,=0D=0A=09George=20Barwood=20,=0D=0A=09namedroppers@ops.ietf.org,=0D =0A=09owner-namedroppers@ops.ietf.org|MIME-Version:=201.0 |In-Reply-To:=20<200908310153.n7V1rUhR088199@drugs.dv.isc .org>|References:=20<4CB0582F89044745BF1D1EBF09E549B6@loc alhost>=20<4A998A15.6050602@dougbarton.us>=20=20<4A9AC3CF.4000106@doug barton.us>=20=20<2 00908310153.n7V1rUhR088199@drugs.dv.isc.org>; bh=JJBm3S40l9brQ+VZCmAS9mmLIhppOfHNWawVs8e9WuQ=; b=KRnU7KrdHeVLpDvaOBuY5MSNMZ1INj49ndMviGDaBJGltbN1rBiPfk7t i/YUxlae9XZ0/5aZroOd6nfg3FVlvJBX0y7RsTYrh5ykmfWPJEQ5HasEj HQfcTJCxW2uKaGG; X-IronPort-AV: E=Sophos;i="4.44,317,1249254000"; d="scan'208";a="17263099" Received: from notes1.nominet.org.uk ([213.248.197.128]) by mx3.nominet.org.uk with ESMTP; 02 Sep 2009 09:19:40 +0100 In-Reply-To: <200908310153.n7V1rUhR088199@drugs.dv.isc.org> References: <4CB0582F89044745BF1D1EBF09E549B6@localhost> <4A998A15.6050602@dougbarton.us> <4A9AC3CF.4000106@dougbarton.us> <200908310153.n7V1rUhR088199@drugs.dv.isc.org> To: Mark Andrews Cc: Alex Bligh , Doug Barton , George Barwood , namedroppers@ops.ietf.org, owner-namedroppers@ops.ietf.org Subject: Re: [dnsext] Working around proxies MIME-Version: 1.0 X-Mailer: Lotus Notes Release 8.5 December 05, 2008 Message-ID: From: Ray.Bellis@nominet.org.uk Date: Wed, 2 Sep 2009 09:19:39 +0100 X-MIMETrack: Serialize by Router on notes1/Nominet(Release 7.0.1FP1 | May 25, 2006) at 02/09/2009 09:19:41 AM, Serialize complete at 02/09/2009 09:19:41 AM Content-Type: multipart/alternative; boundary="=_alternative 002DBE7D80257625_=" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is a multipart message in MIME format. --=_alternative 002DBE7D80257625_= Content-Type: text/plain; charset="US-ASCII" > Ray's report would be a useful starting point, if that is allowable. > Ray do you have the necessary details on the boxes you tested? All of the details are on the ICANN SSAC page, and also at: http://download.nominet.org.uk/dnssec-cpe/ Ray --=_alternative 002DBE7D80257625_= Content-Type: text/html; charset="US-ASCII"
> Ray's report would be a useful starting point, if that is allowable.
> Ray do you have the necessary details on the boxes you tested?
All of the details are on the ICANN SSAC page, and also at:

http://download.nominet.org.uk/dnssec-cpe/

Ray
  --=_alternative 002DBE7D80257625_=-- From owner-namedroppers@ops.ietf.org Wed Sep 2 01:26:18 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 857353A6781; Wed, 2 Sep 2009 01:26:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.091 X-Spam-Level: X-Spam-Status: No, score=-4.091 tagged_above=-999 required=5 tests=[AWL=-0.793, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ejYWLrY6uLkD; Wed, 2 Sep 2009 01:26:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 981D63A6992; Wed, 2 Sep 2009 01:26:17 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mil76-0006dK-GE for namedroppers-data0@psg.com; Wed, 02 Sep 2009 08:22:44 +0000 Received: from [213.248.199.23] (helo=mx3.nominet.org.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mil6z-0006b1-Ti; Wed, 02 Sep 2009 08:22:42 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:In-Reply-To:References:To:Cc: Subject:MIME-Version:X-Mailer:Message-ID:From:Date: X-MIMETrack:Content-Type; b=lARSYRbPxGh+D+p2CRFS/K6TR9twRlg9ylVngVvDCikK366vLRu0YQn7 Jin3gOUESU1Y2/QLK4Y0Ki/+tq3wXEpbpgTsOES13teTK5UW23TAI9lQt RiawLyBMdSrWeLu; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=Ray.Bellis@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1251879757; x=1283415757; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20Ray.Bellis@nominet.org.uk|Subject:=20Re:=20[dnse xt]=20Working=20around=20proxies|Date:=20Wed,=202=20Sep =202009=2009:22:23=20+0100|Message-ID:=20|To:=20"George=20Barwood"=20|Cc:=20"Alex=20Bligh"=20,=0D=0A=09 "Doug=20Barton"=20,=0D=0A=09"Mark=20 Andrews"=20,=0D=0A=09namedroppers@ops.ietf .org,=0D=0A=09owner-namedroppers@ops.ietf.org |MIME-Version:=201.0|In-Reply-To:=20<1009805BA49B4D22BAD2 E408B06FA87B@localhost>|References:=20<4CB0582F89044745BF 1D1EBF09E549B6@localhost>=20<4A998A15.6050602@dougbarton. us>=20=20<4A9 AC3CF.4000106@dougbarton.us>=20=20=20<200908310153.n7V1rUhR088199@drugs.dv. isc.org>=20<1009805BA49B4D22BAD2E408B06FA87B@localhost>; bh=OFvmKfINwKlpjiv1bGKu3xmNafMKVqJ2soSITUXuJkU=; b=U+Ka6g1xrodWIs3/aIfOpH8tl+L++X8SlYhMsTm2vN5ojOwyJzZApQ9U M2EKJlnfUn6ib2H6IOYDV0yEr5RjulHtdXSdNEa2iGv3oDAcqj+NhdVPZ i0TObU5G6f4yMfC; X-IronPort-AV: E=Sophos;i="4.44,317,1249254000"; d="scan'208";a="17263125" Received: from notes1.nominet.org.uk ([213.248.197.128]) by mx3.nominet.org.uk with ESMTP; 02 Sep 2009 09:22:35 +0100 In-Reply-To: <1009805BA49B4D22BAD2E408B06FA87B@localhost> References: <4CB0582F89044745BF1D1EBF09E549B6@localhost> <4A998A15.6050602@dougbarton.us> <4A9AC3CF.4000106@dougbarton.us> <200908310153.n7V1rUhR088199@drugs.dv.isc.org> <1009805BA49B4D22BAD2E408B06FA87B@localhost> To: "George Barwood" Cc: "Alex Bligh" , "Doug Barton" , "Mark Andrews" , namedroppers@ops.ietf.org, owner-namedroppers@ops.ietf.org Subject: Re: [dnsext] Working around proxies MIME-Version: 1.0 X-Mailer: Lotus Notes Release 8.5 December 05, 2008 Message-ID: From: Ray.Bellis@nominet.org.uk Date: Wed, 2 Sep 2009 09:22:23 +0100 X-MIMETrack: Serialize by Router on notes1/Nominet(Release 7.0.1FP1 | May 25, 2006) at 02/09/2009 09:22:36 AM, Serialize complete at 02/09/2009 09:22:36 AM Content-Type: multipart/alternative; boundary="=_alternative 002DFE9180257625_=" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is a multipart message in MIME format. --=_alternative 002DFE9180257625_= Content-Type: text/plain; charset="US-ASCII" > The devices are NOT broken. The protocol should have been designed > to be compatible with the existing installed base. George, with respect, that's rubbish. The transport-related RFCs that I reference in RFC 5625 are all at least 10 years old. RFC 2671 (EDNS0) was published in August 1999. Ray --=_alternative 002DFE9180257625_= Content-Type: text/html; charset="US-ASCII"
> The devices are NOT broken. The protocol should have been designed
> to be compatible with the existing installed base.

George, with respect, that's rubbish.

The transport-related RFCs that I reference in RFC 5625 are all at least 10 years old.  RFC 2671 (EDNS0) was published in August 1999.

Ray
--=_alternative 002DFE9180257625_=-- From owner-namedroppers@ops.ietf.org Wed Sep 2 05:29:23 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 30F0D3A679F; Wed, 2 Sep 2009 05:29:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.955 X-Spam-Level: X-Spam-Status: No, score=-4.955 tagged_above=-999 required=5 tests=[AWL=-0.222, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tP3XutQFqw0d; Wed, 2 Sep 2009 05:29:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 344A23A6995; Wed, 2 Sep 2009 05:29:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Miorj-000OmR-BM for namedroppers-data0@psg.com; Wed, 02 Sep 2009 12:23:07 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Miorf-000Ols-IO for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 12:23:05 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n82CMrSt010914; Wed, 2 Sep 2009 05:22:54 -0700 (PDT) Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. Mime-Version: 1.0 (Apple Message framework v1075.2) Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes From: Nicholas Weaver X-Priority: 3 In-Reply-To: <04CD3B1E8C69442EA7F2221A04603B4E@localhost> Date: Wed, 2 Sep 2009 05:22:53 -0700 Cc: Nicholas Weaver , "Paul Wouters" , "Doug Otis" , Content-Transfer-Encoding: 7bit Message-Id: <85C9E1A7-4019-4215-95D6-2E3D1D621C4B@icsi.berkeley.edu> References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> <200909012338.n81Ncm0S056506@drugs.dv.isc.org> <4A9DD27D.6080507@gmail.com> <04CD3B1E8C69442EA7F2221A04603B4E@localhost> To: "George Barwood" X-Mailer: Apple Mail (2.1075.2) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 2, 2009, at 1:29 AM, George Barwood wrote: > > ----- Original Message ----- > From: "Paul Wouters" > To: "Doug Otis" > Cc: > Sent: Wednesday, September 02, 2009 3:41 AM > Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. > > >> On Tue, 1 Sep 2009, Doug Otis wrote: >> >>> With hundreds of millions of compromised systems >> >> You have no need of amplification...... > > Reflective attacks are hard to take down. > The 4000 byte TXT attack had a weakness, it could be stopped by > taking down the TXT record. > But attacks using open resolvers to fetch say ANY SE cannot be > stopped in this way. > So you have to take the compromised systems down one by one, a very > difficult task, > and new machines may be being compromised as fast as you take others > down. It doesn't have to be 4000B txt records. EG, it could be 4000B worth of "legitimate" a record answers. DNSSEC does NOT make it easier to conduct these amplification attacks, unless you assume a complete lack of attacker imagination. > What will probably happen / has already happened is that operators > will start filtering DNS fragments / DNS packets > some size. > > I'm thinking that it is this that accounts for Nicholas Weavers > statistics. Nah. Its that fragments are suprisingly HARD to deal with. EG, if you build a firewall with simple rules like ACLs, you fail to pass fragments unless you also say "all fragments after the first are allowed". > The network has reacted to EDNS like your body reacts to a virus - > it has rejected it. This is a ridiculous statement, and untrue. EDNS and large DNS replies are widely accepted out there. ITs just not UNIVERSALLY accepted. From owner-namedroppers@ops.ietf.org Wed Sep 2 06:38:00 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B06CA28C858; Wed, 2 Sep 2009 06:38:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.266 X-Spam-Level: X-Spam-Status: No, score=-3.266 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c1SsIPaTgXtu; Wed, 2 Sep 2009 06:38:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8A10B28C10B; Wed, 2 Sep 2009 06:37:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mipvy-000BfF-OQ for namedroppers-data0@psg.com; Wed, 02 Sep 2009 13:31:34 +0000 Received: from [69.46.124.26] (helo=outbound.afilias.info) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mipvv-000Bej-1q for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 13:31:32 +0000 Cc: Niclas Rosell Message-Id: <9E3740F7-6535-433B-B134-6DAC9078F417@afilias.info> From: Wayne Beaver To: namedroppers@ops.ietf.org In-Reply-To: <3efd34cc0909010055sdd6c148u8e3484df6662c6d4@mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] EDNS0 fallback "revisited" Date: Wed, 2 Sep 2009 09:31:27 -0400 References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <4437D106-7797-46B4-8ADE-FCE69077C88E@cisco.com> <3efd34cc0909010055sdd6c148u8e3484df6662c6d4@mail.gmail.com> X-Mailer: Apple Mail (2.936) X-Authenticated: True Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 1, 2009, at 3:55 AM, bert hubert wrote: > 2009/9/1 Patrik F=E4ltstr=F6m : >> I do understand your scenario description, and I do know about =20 >> Nicholas >> number. But I do not understand why we have not seen any problems in >> newspapers in Sweden where we have been running DNSSEC for quite =20 >> some time. > > (to the list) I continued this conversation with Patrik off-list, will > let you know if we've discovered why Sweden sees no problems. > >> I am not saying you are wrong. I am just saying I hear different =20 >> things from >> two camps. Which makes me confused! The following is shared pursuant to permission obtained from Niclas at =20= IIS (The Ops for .SE). Sounds like IIS did some outreach and education =20= to mitigate TCP increase from its operator community. May not scale =20 for some TLDs > Tue, 9 Jun 2009 14:54:17 +0000 (UTC) > From: Niclas Rosell > > Yes we had a increase in TCP when we introduced DNSSEC and it was =20 due to firewalls not accepting dns-packages greater than 512 byte and =20= thereby forcing TCP. ("fixup-dns-packages" or something in > Cisco PIX =20= conf was causing this). We fixed this and TCP/UDP is not much higher =20 than before. Rougly 0.5% of all traffic. wb From owner-namedroppers@ops.ietf.org Wed Sep 2 07:02:13 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AFB1F28C856; Wed, 2 Sep 2009 07:02:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.203 X-Spam-Level: **** X-Spam-Status: No, score=4.203 tagged_above=-999 required=5 tests=[AWL=-0.007, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dxiN3XhQjj8y; Wed, 2 Sep 2009 07:02:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 51F4728C84F; Wed, 2 Sep 2009 07:02:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiqMA-000GWi-PZ for namedroppers-data0@psg.com; Wed, 02 Sep 2009 13:58:38 +0000 Received: from [195.188.213.8] (helo=smtp-out5.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiqM6-000GWC-9A for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 13:58:36 +0000 Received: from [172.23.170.137] (helo=anti-virus01-08) by smtp-out5.blueyonder.co.uk with smtp (Exim 4.52) id 1MiqM1-0001ut-7G; Wed, 02 Sep 2009 14:58:29 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out1.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MiqM0-0006cr-DB; Wed, 02 Sep 2009 14:58:28 +0100 Message-ID: <6FF3EC1B8E0743D6BF7208F5B244207B@localhost> From: "George Barwood" To: "Nicholas Weaver" Cc: "Nicholas Weaver" , "Paul Wouters" , "Doug Otis" , References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> <200909012338.n81Ncm0S056506@drugs.dv.isc.org> <4A9DD27D.6080507@gmail.com> <04CD3B1E8C69442EA7F2221A04603B4E@localhost> <85C9E1A7-4019-4215-95D6-2E3D1D621C4B@icsi.berkeley.edu> Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. Date: Wed, 2 Sep 2009 14:58:22 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIk5pY2hvbGFzIFdlYXZlciIg PG53ZWF2ZXJASUNTSS5CZXJrZWxleS5FRFU+DQpUbzogIkdlb3JnZSBCYXJ3b29kIiA8Z2Vvcmdl LmJhcndvb2RAYmx1ZXlvbmRlci5jby51az4NCkNjOiAiTmljaG9sYXMgV2VhdmVyIiA8bndlYXZl ckBJQ1NJLkJlcmtlbGV5LkVEVT47ICJQYXVsIFdvdXRlcnMiIDxwYXVsQHhlbGVyYW5jZS5jb20+ OyAiRG91ZyBPdGlzIiA8ZG91Zy5tdHZpZXdAZ21haWwuY29tPjsgPG5hbWVkcm9wcGVyc0BvcHMu aWV0Zi5vcmc+DQpTZW50OiBXZWRuZXNkYXksIFNlcHRlbWJlciAwMiwgMjAwOSAxOjIyIFBNDQpT dWJqZWN0OiBSZTogW2Ruc2V4dF0gQW1wbGlmaWNhdGlvbiBhdHRhY2tzLCBSRkMzNzA0IGV0Yy4N Cg0KDQo+IA0KPiBPbiBTZXAgMiwgMjAwOSwgYXQgMToyOSBBTSwgR2VvcmdlIEJhcndvb2Qgd3Jv dGU6DQo+IA0KPj4NCj4+IC0tLS0tIE9yaWdpbmFsIE1lc3NhZ2UgLS0tLS0NCj4+IEZyb206ICJQ YXVsIFdvdXRlcnMiIDxwYXVsQHhlbGVyYW5jZS5jb20+DQo+PiBUbzogIkRvdWcgT3RpcyIgPGRv dWcubXR2aWV3QGdtYWlsLmNvbT4NCj4+IENjOiA8bmFtZWRyb3BwZXJzQG9wcy5pZXRmLm9yZz4N Cj4+IFNlbnQ6IFdlZG5lc2RheSwgU2VwdGVtYmVyIDAyLCAyMDA5IDM6NDEgQU0NCj4+IFN1Ympl Y3Q6IFJlOiBbZG5zZXh0XSBBbXBsaWZpY2F0aW9uIGF0dGFja3MsIFJGQzM3MDQgZXRjLg0KPj4N Cj4+DQo+Pj4gT24gVHVlLCAxIFNlcCAyMDA5LCBEb3VnIE90aXMgd3JvdGU6DQo+Pj4NCj4+Pj4g V2l0aCBodW5kcmVkcyBvZiBtaWxsaW9ucyBvZiBjb21wcm9taXNlZCBzeXN0ZW1zDQo+Pj4NCj4+ PiBZb3UgaGF2ZSBubyBuZWVkIG9mIGFtcGxpZmljYXRpb24uLi4uLi4NCj4+DQo+PiBSZWZsZWN0 aXZlIGF0dGFja3MgYXJlIGhhcmQgdG8gdGFrZSBkb3duLg0KPj4gVGhlIDQwMDAgYnl0ZSBUWFQg YXR0YWNrIGhhZCBhIHdlYWtuZXNzLCBpdCBjb3VsZCBiZSBzdG9wcGVkIGJ5ICANCj4+IHRha2lu ZyBkb3duIHRoZSBUWFQgcmVjb3JkLg0KPj4gQnV0IGF0dGFja3MgdXNpbmcgb3BlbiByZXNvbHZl cnMgdG8gZmV0Y2ggc2F5IEFOWSBTRSBjYW5ub3QgYmUgIA0KPj4gc3RvcHBlZCBpbiB0aGlzIHdh eS4NCj4+IFNvIHlvdSBoYXZlIHRvIHRha2UgdGhlIGNvbXByb21pc2VkIHN5c3RlbXMgZG93biBv bmUgYnkgb25lLCBhIHZlcnkgIA0KPj4gZGlmZmljdWx0IHRhc2ssDQo+PiBhbmQgbmV3IG1hY2hp bmVzIG1heSBiZSBiZWluZyBjb21wcm9taXNlZCBhcyBmYXN0IGFzIHlvdSB0YWtlIG90aGVycyAg DQo+PiBkb3duLg0KPiANCj4gSXQgZG9lc24ndCBoYXZlIHRvIGJlIDQwMDBCIHR4dCByZWNvcmRz LiAgRUcsIGl0IGNvdWxkIGJlIDQwMDBCIHdvcnRoICANCj4gb2YgImxlZ2l0aW1hdGUiIGEgcmVj b3JkIGFuc3dlcnMuDQo+IA0KPiBETlNTRUMgZG9lcyBOT1QgbWFrZSBpdCBlYXNpZXIgdG8gY29u ZHVjdCB0aGVzZSBhbXBsaWZpY2F0aW9uIGF0dGFja3MsICANCj4gdW5sZXNzIHlvdSBhc3N1bWUg YSBjb21wbGV0ZSBsYWNrIG9mIGF0dGFja2VyIGltYWdpbmF0aW9uLg0KDQpJdCdzIG1haW5seSBh biBFRE5TIHByb2JsZW0sIGJ1dCBETlNTRUMgbWFrZXMgaXQgd29yc2UgYnkNCnByb3ZpZGluZyBh IHNvdXJjZSBvZiB2YWxpZCBsYXJnZSByZXNwb25zZXMgdGhhdCBjYW5ub3QgYmUgdGFrZW4gZG93 bi4NCg0KPj4gV2hhdCB3aWxsIHByb2JhYmx5IGhhcHBlbiAvIGhhcyBhbHJlYWR5IGhhcHBlbmVk IGlzIHRoYXQgb3BlcmF0b3JzDQo+PiB3aWxsIHN0YXJ0IGZpbHRlcmluZyBETlMgZnJhZ21lbnRz IC8gRE5TIHBhY2tldHMgPiBzb21lIHNpemUuDQo+Pg0KPj4gSSdtIHRoaW5raW5nIHRoYXQgaXQg aXMgdGhpcyB0aGF0IGFjY291bnRzIGZvciBOaWNob2xhcyBXZWF2ZXJzICANCj4+IHN0YXRpc3Rp Y3MuDQo+IA0KPiBOYWguICBJdHMgdGhhdCBmcmFnbWVudHMgYXJlIHN1cHJpc2luZ2x5IEhBUkQg dG8gZGVhbCB3aXRoLg0KPiANCj4gRUcsIGlmIHlvdSBidWlsZCBhIGZpcmV3YWxsIHdpdGggc2lt cGxlIHJ1bGVzIGxpa2UgQUNMcywgeW91IGZhaWwgdG8gIA0KPiBwYXNzIGZyYWdtZW50cyB1bmxl c3MgeW91IGFsc28gc2F5ICJhbGwgZnJhZ21lbnRzIGFmdGVyIHRoZSBmaXJzdCBhcmUgIA0KPiBh bGxvd2VkIi4NCj4gDQo+PiBUaGUgbmV0d29yayBoYXMgcmVhY3RlZCB0byBFRE5TIGxpa2UgeW91 ciBib2R5IHJlYWN0cyB0byBhIHZpcnVzIC0gIA0KPj4gaXQgaGFzIHJlamVjdGVkIGl0Lg0KPiAN Cj4gVGhpcyBpcyBhIHJpZGljdWxvdXMgc3RhdGVtZW50LCBhbmQgdW50cnVlLiAgRUROUyBhbmQg bGFyZ2UgRE5TICANCj4gcmVwbGllcyBhcmUgd2lkZWx5IGFjY2VwdGVkIG91dCB0aGVyZS4gIElU cyBqdXN0IG5vdCBVTklWRVJTQUxMWSAgDQo+IGFjY2VwdGVkLg0KDQpJdCBpcyBzcGVjdWxhdGl2 ZSAoIEkgaG9wZSBJIG1hZGUgdGhhdCBjbGVhciwgIkknbSB0aGlua2luZy4uLiIgKQ0KDQpCdXQg aXQgc2VlbXMgdG8gbWFrZSBzZW5zZS4gU2VlIHBhZ2UgOCBvZg0KDQpodHRwczovL3d3dy5kbnMt b2FyYy5uZXQvZmlsZXMvZG5zb3BzLTIwMDYvTGFyc29uLUF0dGFja3MucGRmDQoNCiJMaW1pdCBE TlMgcGFja2V0IHNpemUgdG8gNTEyIGJ5dGVzLCBicmVha3MgbWFueSB0aGluZ3MhIg0KIkRyb3Ag ZnJhZ21lbnRzIHRvd2FyZCB0aGUgdmljdGltIg0KDQpXZWxsIG9ubHkgZGV0YWlsZWQgaW52ZXN0 aWdhdGlvbiBjYW4gZXN0YWJsaXNoIGZvciBzdXJlIA0Kd2h5IGZyYWdtZW50ZWQgcmVzcG9uc2Vz IGFyZSBiZWluZyBkcm9wcGVkIGJ5IHRoZSBuZXR3b3JrDQooIGFuZCBub3QgYnkgdGhlIGNsaWVu dCBlcXVpcG1lbnQsIGFjY29yZGluZyB0byBSYXkncyByZXBvcnQgKS4NCg== From owner-namedroppers@ops.ietf.org Wed Sep 2 07:24:18 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6B20928C36C; Wed, 2 Sep 2009 07:24:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.308 X-Spam-Level: X-Spam-Status: No, score=-0.308 tagged_above=-999 required=5 tests=[AWL=-0.708, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XKdpiW-0SxMg; Wed, 2 Sep 2009 07:24:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 882443A6AC6; Wed, 2 Sep 2009 07:24:17 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Miqgj-000KlU-Mg for namedroppers-data0@psg.com; Wed, 02 Sep 2009 14:19:53 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Miqgg-000Kkw-Eh for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 14:19:52 +0000 Received: from crankycanuck.ca (76-10-166-247.dsl.teksavvy.com [76.10.166.247]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 96A0E2FE8CB8 for ; Wed, 2 Sep 2009 14:19:48 +0000 (UTC) Date: Wed, 2 Sep 2009 10:19:45 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Cryptographic Algorithm Identifier Allocation for DNSSEC Message-ID: <20090902141945.GG16078@shinkuro.com> References: <934623C28D56444CB073F90BC35244BB05E980@TK5EX14MBXC121.redmond.corp.microsoft.com> <20090827180305.GK7821@shinkuro.com> <200908272358.n7RNwrvr038970@drugs.dv.isc.org> <20090828144512.GT7821@shinkuro.com> <200908282207.n7SM73bf056581@drugs.dv.isc.org> <20090831182103.GQ13987@shinkuro.com> <200909010055.n810tI2W047942@drugs.dv.isc.org> <20090901142514.GB14929@shinkuro.com> <200909020004.n8204MPb057081@drugs.dv.isc.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200909020004.n8204MPb057081@drugs.dv.isc.org> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 02, 2009 at 10:04:22AM +1000, Mark Andrews wrote: > draft-ietf-dnsext-dnssec-bis-updates needs to be revived. Then participants in the WG need to put pressure on the document editors to complete their work, in the form of concrete suggestions or reviews that say, "Please publish this now." If tomorrow we heard a large number of reviews from participants that said, "The document is done, please send it on now," the editors might be persuaded not to make changes they're contemplating. As things stand, the editors have claimed (to me) that they think the document not ready for WGLC. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Wed Sep 2 08:39:40 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 279053A6BA3; Wed, 2 Sep 2009 08:39:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.108 X-Spam-Level: X-Spam-Status: No, score=-5.108 tagged_above=-999 required=5 tests=[AWL=-0.060, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ttUjQXoDkS2s; Wed, 2 Sep 2009 08:39:39 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3E82E3A695D; Wed, 2 Sep 2009 08:39:39 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mirnj-000F8g-E9 for namedroppers-data0@psg.com; Wed, 02 Sep 2009 15:31:11 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mirng-000F5i-6e for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 15:31:09 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n82FUoex023955; Wed, 2 Sep 2009 08:30:51 -0700 (PDT) Cc: Nicholas Weaver , namedroppers@ops.ietf.org, Niclas Rosell Message-Id: <56E21D2C-AAB4-499D-895E-FD6C4A333CDF@icsi.berkeley.edu> From: Nicholas Weaver To: Wayne Beaver In-Reply-To: <9E3740F7-6535-433B-B134-6DAC9078F417@afilias.info> Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] EDNS0 fallback "revisited" Date: Wed, 2 Sep 2009 08:30:50 -0700 References: <200908251744.n7PHiqmI073529@stora.ogud.com> <7D875E0A04BC5DD3AB13F501@nimrod.home> <6C621AF6-CB88-44A9-ABFE-FA4F117D13B1@icsi.berkeley.edu> <55C7E390-6E9B-49AD-B346-6B19935244F1@cisco.com> <3efd34cc0909010021s6a433033tc7d95e373d0607cb@mail.gmail.com> <4437D106-7797-46B4-8ADE-FCE69077C88E@cisco.com> <3efd34cc0909010055sdd6c148u8e3484df6662c6d4@mail.gmail.com> <9E3740F7-6535-433B-B134-6DAC9078F417@afilias.info> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 2, 2009, at 6:31 AM, Wayne Beaver wrote: > On Sep 1, 2009, at 3:55 AM, bert hubert wrote: > >> 2009/9/1 Patrik F=E4ltstr=F6m : >>> I do understand your scenario description, and I do know about =20 >>> Nicholas >>> number. But I do not understand why we have not seen any problems in >>> newspapers in Sweden where we have been running DNSSEC for quite =20 >>> some time. >> >> (to the list) I continued this conversation with Patrik off-list, =20 >> will >> let you know if we've discovered why Sweden sees no problems. >> >>> I am not saying you are wrong. I am just saying I hear different =20 >>> things from >>> two camps. Which makes me confused! > > > The following is shared pursuant to permission obtained from Niclas =20= > at IIS (The Ops for .SE). Sounds like IIS did some outreach and =20 > education to mitigate TCP increase from its operator community. May =20= > not scale for some TLDs > > > Tue, 9 Jun 2009 14:54:17 +0000 (UTC) > > From: Niclas Rosell > > > > Yes we had a increase in TCP when we introduced DNSSEC and it was =20= > due to firewalls not accepting dns-packages greater than 512 byte =20 > and thereby forcing TCP. ("fixup-dns-packages" or something in > =20 > Cisco PIX conf was causing this). We fixed this and TCP/UDP is not =20 > much higher than before. Rougly 0.5% of all traffic. Could you ask the followup question? How many of the responses were =20 >512B but less that 1500B, and how many were more than 1500B? From owner-namedroppers@ops.ietf.org Wed Sep 2 09:16:15 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0962728C62C; Wed, 2 Sep 2009 09:16:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.291 X-Spam-Level: X-Spam-Status: No, score=-0.291 tagged_above=-999 required=5 tests=[AWL=-0.691, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8BQUlE2-00hZ; Wed, 2 Sep 2009 09:16:14 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2B0E03A692A; Wed, 2 Sep 2009 09:16:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MisRK-000Om9-6R for namedroppers-data0@psg.com; Wed, 02 Sep 2009 16:12:06 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MisRG-000OlT-5C for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 16:12:03 +0000 Received: from crankycanuck.ca (76-10-166-247.dsl.teksavvy.com [76.10.166.247]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 3A8552FE8CB8 for ; Wed, 2 Sep 2009 16:11:58 +0000 (UTC) Date: Wed, 2 Sep 2009 12:11:56 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: Fwd: [dnsext] draft-crocker-dnssec-algo-signal-03 -- more time please! Message-ID: <20090902161155.GS16078@shinkuro.com> References: <583565A9-886F-41FB-92EA-B9F3E6741A7C@cisco.com> <434ECD68-79BB-45F1-8A68-A4CD8E4A3E11@cisco.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <434ECD68-79BB-45F1-8A68-A4CD8E4A3E11@cisco.com> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues, On Thu, Aug 27, 2009 at 06:18:29AM +0200, Patrik Fältström wrote: > > - what the impact *really* is on DNSSEC deployment if we have multiple > algorithms > - how an algorithm change is to handled > - how to handle the selection process of preferred (plural) algorithms > (one main, and one secondary that is rolled in or out?) > > Given this, we can talk about how to do the wording in documents that > talk about how to register/signal algorithms. If I read this correctly, then either the candidate draft that Paul Hoffman has offered to the WG, possibly with some additions or changes, or something with the same topic is a necessary condition for adopting draft-crocker-dnssec-algo-signal; and if such a document is adopted and published, then draft-crocker-dnssec-algo-signal would also be a good idea. Am I reading correctly? Best regards, A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Wed Sep 2 15:27:32 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7E0213A687C; Wed, 2 Sep 2009 15:27:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.667 X-Spam-Level: X-Spam-Status: No, score=-6.667 tagged_above=-999 required=5 tests=[AWL=-0.539, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_HI=-8, RCVD_NUMERIC_HELO=2.067, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LfF3CFSgRXMY; Wed, 2 Sep 2009 15:27:31 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 43A753A6B63; Wed, 2 Sep 2009 15:27:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiyBg-0002eG-Ds for namedroppers-data0@psg.com; Wed, 02 Sep 2009 22:20:20 +0000 Received: from [144.254.224.140] (helo=ams-iport-1.cisco.com) by psg.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiyBY-0002cc-PH for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 22:20:17 +0000 X-Files: PGP.sig : 186 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AoEAAG+MnkqQ/uCLe2dsb2JhbACKEJEQHAEBFiQGpzKIQQGQWgWEGw X-IronPort-AV: E=Sophos;i="4.44,320,1249257600"; d="sig'?scan'208";a="48488900" Received: from ams-dkim-2.cisco.com ([144.254.224.139]) by ams-iport-1.cisco.com with ESMTP; 02 Sep 2009 22:20:10 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id n82MKAQt011215; Thu, 3 Sep 2009 00:20:10 +0200 Received: from xbh-ams-101.cisco.com (xbh-ams-101.cisco.com [144.254.74.71]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n82MKA7G025545; Wed, 2 Sep 2009 22:20:10 GMT Received: from xfe-ams-101.cisco.com ([144.254.231.93]) by xbh-ams-101.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 3 Sep 2009 00:20:11 +0200 Received: from 95.209.116.189.bredband.tre.se ([10.61.108.49]) by xfe-ams-101.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 3 Sep 2009 00:20:08 +0200 Cc: namedroppers@ops.ietf.org Message-Id: <577B1F45-F1C0-4024-9B9E-F4849790084F@cisco.com> From: =?ISO-8859-1?Q?Patrik_F=E4ltstr=F6m?= To: Andrew Sullivan In-Reply-To: <20090902161155.GS16078@shinkuro.com> Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Apple-Mail-31-892379926" Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] draft-crocker-dnssec-algo-signal-03 -- more time please! Date: Thu, 3 Sep 2009 00:20:03 +0200 References: <583565A9-886F-41FB-92EA-B9F3E6741A7C@cisco.com> <434ECD68-79BB-45F1-8A68-A4CD8E4A3E11@cisco.com> <20090902161155.GS16078@shinkuro.com> X-Pgp-Agent: GPGMail d55 (v55, Leopard) X-Mailer: Apple Mail (2.936) X-OriginalArrivalTime: 02 Sep 2009 22:20:09.0513 (UTC) FILETIME=[88403990:01CA2C1B] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=2185; t=1251930010; x=1252794010; c=relaxed/simple; s=amsdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=paf@cisco.com; z=From:=20=3D?ISO-8859-1?Q?Patrik_F=3DE4ltstr=3DF6m?=3D=20

|Subject:=20Re=3A=20[dnsext]=20draft-crocker-dnssec-algo-si gnal-03=20--=20more=20time=20please! |Sender:=20; bh=oQTyUrfK0U38bAl8FgHcW7sTbLWoxzXkXGOLiIQnMp8=; b=ihAeLBtrMMJxIjStQ8xDHBWHHn0bZR1teT5UwZGzWvHqhWAWTuoNwUA989 Tm6NvRw/fAgfdnMHCE3GigLlSOzpXR/cSEo95PPBLUy50sqGtBPxWnTdl//9 MPxW4SUQwF; Authentication-Results: ams-dkim-2; header.From=paf@cisco.com; dkim=pass ( sig from cisco.com/amsdkim2001 verified; ); Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --Apple-Mail-31-892379926 Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable On 2 sep 2009, at 18.11, Andrew Sullivan wrote: > On Thu, Aug 27, 2009 at 06:18:29AM +0200, Patrik F=E4ltstr=F6m wrote: >> >> - what the impact *really* is on DNSSEC deployment if we have =20 >> multiple >> algorithms >> - how an algorithm change is to handled >> - how to handle the selection process of preferred (plural) =20 >> algorithms >> (one main, and one secondary that is rolled in or out?) >> >> Given this, we can talk about how to do the wording in documents that >> talk about how to register/signal algorithms. > > If I read this correctly, then either the candidate draft that Paul > Hoffman has offered to the WG, possibly with some additions or > changes, or something with the same topic is a necessary condition for > adopting draft-crocker-dnssec-algo-signal; and if such a document is > adopted and published, then draft-crocker-dnssec-algo-signal would > also be a good idea. Am I reading correctly? Yes, that was my reading of what people told me (~10 people) after the =20= Stockholm meeting. People where nervous that, although it is very good =20= to have registration and signalling of algorithms, having those =20 mechanisms would increase the number of algorithms to a point which it =20= has impact on interoperability (and therefore usability) of DNSSEC. If I am wrong in my findings, or if 10 people actively looking me up =20 is a too small group to impact the work of this wg (I was suprised =20 over such *high* number), let the chairs know. Patrik --Apple-Mail-31-892379926 content-type: application/pgp-signature; x-mac-type=70674453; name=PGP.sig content-description: This is a digitally signed message part content-disposition: inline; filename=PGP.sig content-transfer-encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iD8DBQFKnu+TvHlR2X0luNwRAg8hAKC5bG2py6jrkmkRsxunCfpDCA/rTwCgtjsX jUjFM59ORoQUawvTr1Jr4Jg= =08Tp -----END PGP SIGNATURE----- --Apple-Mail-31-892379926-- From owner-namedroppers@ops.ietf.org Wed Sep 2 15:49:26 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F46D3A6C23; Wed, 2 Sep 2009 15:49:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.403 X-Spam-Level: X-Spam-Status: No, score=-2.403 tagged_above=-999 required=5 tests=[AWL=0.196, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6zmdL7EW9qFB; Wed, 2 Sep 2009 15:49:25 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 747393A6C0C; Wed, 2 Sep 2009 15:49:25 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiyaI-0008zq-Fx for namedroppers-data0@psg.com; Wed, 02 Sep 2009 22:45:46 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MiyaE-0008zE-Qt for namedroppers@ops.ietf.org; Wed, 02 Sep 2009 22:45:44 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 2BE1FE6023; Wed, 2 Sep 2009 22:45:42 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n82MjaPh079609; Thu, 3 Sep 2009 08:45:36 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909022245.n82MjaPh079609@drugs.dv.isc.org> To: Andrew Sullivan Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <934623C28D56444CB073F90BC35244BB05E980@TK5EX14MBXC121.redmond.corp.microsoft.com> <20090827180305.GK7821@shinkuro.com> <200908272358.n7RNwrvr038970@drugs.dv.isc.org> <20090828144512.GT7821@shinkuro.com> <200908282207.n7SM73bf056581@drugs.dv.isc.org> <20090831182103.GQ13987@shinkuro.com> <200909010055.n810tI2W047942@drugs.dv.isc.org> <20090901142514.GB14929@shinkuro.com> <200909020004.n8204MPb057081@drugs.dv.isc.org> <20090902141945.GG16078@shinkuro.com> Subject: Re: [dnsext] Cryptographic Algorithm Identifier Allocation for DNSSEC In-reply-to: Your message of "Wed, 02 Sep 2009 10:19:45 -0400." <20090902141945.GG16078@shinkuro.com> Date: Thu, 03 Sep 2009 08:45:36 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <20090902141945.GG16078@shinkuro.com>, Andrew Sullivan writes: > On Wed, Sep 02, 2009 at 10:04:22AM +1000, Mark Andrews wrote: > > draft-ietf-dnsext-dnssec-bis-updates needs to be revived. > > Then participants in the WG need to put pressure on the document > editors to complete their work, in the form of concrete suggestions or > reviews that say, "Please publish this now." If tomorrow we heard a > large number of reviews from participants that said, "The document is > done, please send it on now," the editors might be persuaded not to > make changes they're contemplating. As things stand, the editors have > claimed (to me) that they think the document not ready for WGLC. Then the document needs to be rev'd. As a chair you need to see that this happens. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Wed Sep 2 17:08:53 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0280E3A69D4; Wed, 2 Sep 2009 17:08:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.583 X-Spam-Level: X-Spam-Status: No, score=-4.583 tagged_above=-999 required=5 tests=[AWL=-0.461, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VIhHrpxS5Woi; Wed, 2 Sep 2009 17:08:51 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4C08F3A63CB; Wed, 2 Sep 2009 17:08:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mizo3-0000I7-Ge for namedroppers-data0@psg.com; Thu, 03 Sep 2009 00:04:03 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Miznx-0000GY-JV for namedroppers@ops.ietf.org; Thu, 03 Sep 2009 00:04:01 +0000 Received: from SJC-Office-NAT-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id DE65CA9444A; Thu, 3 Sep 2009 00:03:56 +0000 (UTC) Message-ID: <4A9F07EC.1040108@mail-abuse.org> Date: Wed, 02 Sep 2009 17:03:56 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: Mark Andrews CC: Doug Otis , namedroppers@ops.ietf.org Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> <200909012338.n81Ncm0S056506@drugs.dv.isc.org> <4A9DD27D.6080507@gmail.com> <200909020238.n822cCCK059837@drugs.dv.isc.org> In-Reply-To: <200909020238.n822cCCK059837@drugs.dv.isc.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/1/09 7:38 PM, Mark Andrews wrote: > In message<4A9DD27D.6080507@gmail.com>, Doug Otis writes: >> On 9/1/09 4:38 PM, Mark Andrews wrote: Mark, Sorry for using the term egress. BCP38 refers to this as ingress (into the router), rather than egress (out of the network). BCP38 drops emitted packets from hosted networks lacking permitted source IP addresses. BCP84 provides an overview of problems created by BCP38 for multi-homing, default, asymmetrical routing, and honey-pots. Some practical strategies lessen the specificity of ingress filtering. >> While implementing BCP38 is highly recommended, reflected attacks >> are not inhibited by egress filtering, since both source and >> destination IP addresses are valid. > > If you have strict BCP38 in place you can only attack the path > between the attacker and the responder. There is NOTHING you can do > to prevent this. It is not clear what is meant by saying "you". Once DNSSEC becomes widely deployed, bad actors can exploit any authoritative server that accepts queries from compromised systems where a source IP address of the victim's network does not cause the query to be dropped. Authoritative servers and compromised systems might exist in foreign networks outside that of the victim's networks. In which case, attack payloads will not be affected by BCP38 filters, nor can payload sources be blocked without causing network bulkanization. Even with BCP38, avenues for ENDS0 attack remain, either within filter CIDRs, network exceptions, or hidden tunnels. Not mandating use of EDNS0 (which introduces an 8x increased DNS related risk), permits lower risk strategies that are not reliant upon the world's adoption of BCP38. > If you have wider filters then the attackers neighbours can be > attacked as well however all traffic will be going through the same > administative entities as is traceable. This clearly ignores two of the three agents involved in a reflective attack that might not be within the attacked network, even an attacked network using strict BCP38. Bad-actor w/spoofed src --------> DNS -------> Victim (no BCP38) (BCP38) >> Based upon the MIT link provided by Nicholas Weaver, half of the IP >> addresses do not have egress filtering, and many use large CIDR >> filters. With hundreds of millions of compromised systems, BCP38 >> should not be considered comprehensive protection from reflected >> attacks. Only a protocol can offer comprehensive protection. > > Which just means that finer grain BCP38 filters are needed. Put > them close to source and they are not expensive. BCP 38 is not > whack-a-mole so applying pressure to get BCP38 deployed is still a > worthwhile effort. BCP38 does not make ENDS0 inherently safe, only safer. With high amplifications, attack vectors can emerge from small avenues. [] >> In other words, your statement that local BCP38 filtering only >> permits direct attacks is not correct. > > If you do BCP38 correctly you can't. Change this to "If everyone does BCP38 correctly, bad actors can't." > ISP's should be putting the BCP 38 filters as close to the customer > edge as possible. This reduces the amount of machines that will be > impacted by non perfect filters to machines that are direct > neighbours of the attacking machine. When address neighbors become problematic, ISPs might decide to block port 53 traffic not directed toward their resolvers. Alternatively, they might impose transparent proxies to mitigate EDNS0 related risks. > If the ISP is not doing this then they are not really doing BCP38. While BCP38 suggests ingress filters be placed at periphery routers, it provides no guidelines for filter sizes. As such, any source IP address filter can be described as implementing BCP38. > If I have a address 1.2.3.4 and my ISP only allows packet with a > source address of 1.2.3.4 to pass from me to them, how can I launch a > reflection attack against 2.3.4.5 using 5.6.7.9 as the reflector? The reflected attack can start outside of your ISP's network. BTW, have you heard of PNRP and RFC 4380? Applications police themselves, while exchanging complex structures mapping pathways between systems that penetrate intervening firewalls. Even firewall rules within the system itself! That's present in a system with a bundled browser connecting the Internet to all application interfaces designated "script safe". > I can cause a lot of traffic between 1.2.3.4 and 5.6.7.9 but all of > that traffic will have 1.2.3.4 and 5.6.7.9 in the IP packet headers. > This is a amplification attack on the path not a reflection attack. Which was not the concern, nor a reflected attack that still remains possible with bot-nets. While bot-nets are indeed numerous and able to to cause direct damage, their activity is less noticeable on the compromised system, and less obviously involved in mischief to the non-attacked ISP when their strategy takes advantage of high gain reflected responses made possible with EDNS0. > There is no protocol change that will help this if you really need > the data to be returned. All you can do is balance out the flows by > making normal operations more bandwidth expensive and that is a bad > tradeoff. Resources used to endure attack scenarios need to be fully considered. More than just the transport state, in-flight traffic buffering will dramatically increase when confronting packet loss and head-of-line blocking. While such buffering growth is a property of TCP or a UDP paging scheme, SCTP is able to avoid in-flight traffic buffering. With SCTP able to eliminate in-flight buffering complexities related to TCP retries, resource limited SOHO firewall devices are then better able to effectively handle DNS traffic at network speeds while having limited amounts of memory. Otherwise, significantly greater resources would be needed to support TCP as an alternative to EDNS0, which is now virtually non-existent, as is ENDS0 support of jumbo frames. A good property obtained by SCTP as a DNS transport is that it makes blind packet spoofing virtually impossible, even at 10 Gb/s rates over a single IP port. It is not just a matter of telling SOHO manufactures to do the right thing, the right thing needs to be both practical, and inherently safe. -Doug From owner-namedroppers@ops.ietf.org Wed Sep 2 18:17:29 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 426653A68CC; Wed, 2 Sep 2009 18:17:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.251 X-Spam-Level: X-Spam-Status: No, score=-2.251 tagged_above=-999 required=5 tests=[AWL=0.033, BAYES_00=-2.599, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UZ6CHCN-mSl3; Wed, 2 Sep 2009 18:17:27 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C101028C1A9; Wed, 2 Sep 2009 18:17:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mj0r5-000Es1-Js for namedroppers-data0@psg.com; Thu, 03 Sep 2009 01:11:15 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mj0qz-000Eqf-TU for namedroppers@ops.ietf.org; Thu, 03 Sep 2009 01:11:12 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id C9FCCE601C; Thu, 3 Sep 2009 01:11:08 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n831AxUR081817; Thu, 3 Sep 2009 11:11:06 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909030111.n831AxUR081817@drugs.dv.isc.org> To: Douglas Otis Cc: Doug Otis , namedroppers@ops.ietf.org From: Mark Andrews References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> <200909012338.n81Ncm0S056506@drugs.dv.isc.org> <4A9DD27D.6080507@gmail.com> <200909020238.n822cCCK059837@drugs.dv.isc.org> <4A9F07EC.1040108@mail-abuse.org> Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. In-reply-to: Your message of "Wed, 02 Sep 2009 17:03:56 MST." <4A9F07EC.1040108@mail-abuse.org> Date: Thu, 03 Sep 2009 11:10:59 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <4A9F07EC.1040108@mail-abuse.org>, Douglas Otis writes: > On 9/1/09 7:38 PM, Mark Andrews wrote: > > In message<4A9DD27D.6080507@gmail.com>, Doug Otis writes: > >> On 9/1/09 4:38 PM, Mark Andrews wrote: > > Mark, > > Sorry for using the term egress. BCP38 refers to this as ingress (into > the router), rather than egress (out of the network). BCP38 drops > emitted packets from hosted networks lacking permitted source IP > addresses. BCP84 provides an overview of problems created by BCP38 for > multi-homing, default, asymmetrical routing, and honey-pots. Some > practical strategies lessen the specificity of ingress filtering. Whether we argue for BCP38 or BCP84 spoofed traffic from most compromised boxes can be filtered out by either one of them. > >> While implementing BCP38 is highly recommended, reflected attacks > >> are not inhibited by egress filtering, since both source and > >> destination IP addresses are valid. > > > > If you have strict BCP38 in place you can only attack the path > > between the attacker and the responder. There is NOTHING you can do > > to prevent this. > > It is not clear what is meant by saying "you". Once DNSSEC becomes > widely deployed, bad actors can exploit any authoritative server that > accepts queries from compromised systems where a source IP address of > the victim's network does not cause the query to be dropped. Please tell me how they get a packet with a source address that matches the victims IP address past the filter. You have yet to show how that is done. > Authoritative servers and compromised systems might exist in foreign > networks outside that of the victim's networks. In which case, attack > payloads will not be affected by BCP38 filters, nor can payload sources > be blocked without causing network bulkanization. > > Even with BCP38, avenues for ENDS0 attack remain, either within filter > CIDRs, network exceptions, or hidden tunnels. Not mandating use of > EDNS0 (which introduces an 8x increased DNS related risk), permits > lower risk strategies that are not reliant upon the world's adoption of > BCP38. CIDR's blocks can be made small enough to not be a practical issue. A bot behind a deliberate exception doesn't pass the laugh test. Hidden tunnels are not a issue. The tunnel end should be doing BCP 38/84 and blocking it there. Logically it's like the compromised box is on the tunnel end point's network. > > If you have wider filters then the attackers neighbours can be > > attacked as well however all traffic will be going through the same > > administative entities as is traceable. > > This clearly ignores two of the three agents involved in a reflective > attack that might not be within the attacked network, even an attacked > network using strict BCP38. > > Bad-actor w/spoofed src --------> DNS -------> Victim > (no BCP38) (BCP38) Which is why we are encouraging all networks to deploy BCP38/84. No one is saying that if you deploy BCP38/84 you will be protected from others. What we are saying is that if you deploy BCP38/84 you protect others (and yourself with tight enough filters) from compromised machines on your network and if enough people do this it is effective. BCP38/84 is enlighted self interest. Leaving EDNS along will encourge more enlighted self interest. There really are very few really bad players. There are lots of lazy player. BCP38/84 is like herd immunity. You need to get enough members of the herd vacinated to prevent the disease speading or to bring it under control. > >> Based upon the MIT link provided by Nicholas Weaver, half of the IP > >> addresses do not have egress filtering, and many use large CIDR > >> filters. With hundreds of millions of compromised systems, BCP38 > >> should not be considered comprehensive protection from reflected > >> attacks. Only a protocol can offer comprehensive protection. > > > > Which just means that finer grain BCP38 filters are needed. Put > > them close to source and they are not expensive. BCP 38 is not > > whack-a-mole so applying pressure to get BCP38 deployed is still a > > worthwhile effort. > > BCP38 does not make ENDS0 inherently safe, only safer. With high > amplifications, attack vectors can emerge from small avenues. > > [] > >> In other words, your statement that local BCP38 filtering only > >> permits direct attacks is not correct. > > > > If you do BCP38 correctly you can't. > > Change this to "If everyone does BCP38 correctly, bad actors can't." If the compromised machine/bad actor is behind a BCP38/84 filter ... > > ISP's should be putting the BCP 38 filters as close to the customer > > edge as possible. This reduces the amount of machines that will be > > impacted by non perfect filters to machines that are direct > > neighbours of the attacking machine. > > When address neighbors become problematic, ISPs might decide to block > port 53 traffic not directed toward their resolvers. Alternatively, > they might impose transparent proxies to mitigate EDNS0 related risks. It's also usually easy to see who is generating the queries unless mac addresses are also being spoofed and you don't have mac address filters in place. > > If the ISP is not doing this then they are not really doing BCP38. > > While BCP38 suggests ingress filters be placed at periphery routers, it > provides no guidelines for filter sizes. As such, any source IP address > filter can be described as implementing BCP38. An ISP's periphery includes customer/isp and isp/isp. In each place there is a logically correct filter to apply. Even internally within a ISP/organisation there are plenty of places where filtering should occur. > > If I have a address 1.2.3.4 and my ISP only allows packet with a > > source address of 1.2.3.4 to pass from me to them, how can I launch a > > reflection attack against 2.3.4.5 using 5.6.7.9 as the reflector? > > The reflected attack can start outside of your ISP's network. BTW, have > you heard of PNRP and RFC 4380? Applications police themselves, while > exchanging complex structures mapping pathways between systems that > penetrate intervening firewalls. Even firewall rules within the system > itself! That's present in a system with a bundled browser connecting the > Internet to all application interfaces designated "script safe". > > > I can cause a lot of traffic between 1.2.3.4 and 5.6.7.9 but all of > > that traffic will have 1.2.3.4 and 5.6.7.9 in the IP packet headers. > > This is a amplification attack on the path not a reflection attack. > > Which was not the concern, nor a reflected attack that still remains > possible with bot-nets. While bot-nets are indeed numerous and able to > to cause direct damage, their activity is less noticeable on the > compromised system, and less obviously involved in mischief to the > non-attacked ISP when their strategy takes advantage of high gain > reflected responses made possible with EDNS0. > > > There is no protocol change that will help this if you really need > > the data to be returned. All you can do is balance out the flows by > > making normal operations more bandwidth expensive and that is a bad > > tradeoff. > > Resources used to endure attack scenarios need to be fully considered. > More than just the transport state, in-flight traffic buffering will > dramatically increase when confronting packet loss and head-of-line > blocking. While such buffering growth is a property of TCP or a UDP > paging scheme, SCTP is able to avoid in-flight traffic buffering. > > With SCTP able to eliminate in-flight buffering complexities related > to TCP retries, resource limited SOHO firewall devices are then better > able to effectively handle DNS traffic at network speeds while having > limited amounts of memory. Otherwise, significantly greater resources > would be needed to support TCP as an alternative to EDNS0, which is now > virtually non-existent, as is ENDS0 support of jumbo frames. > > A good property obtained by SCTP as a DNS transport is that it makes > blind packet spoofing virtually impossible, even at 10 Gb/s rates over a > single IP port. It is not just a matter of telling SOHO manufactures to > do the right thing, the right thing needs to be both practical, and > inherently safe. > > -Doug -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Wed Sep 2 18:27:16 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F96B3A67F0; Wed, 2 Sep 2009 18:27:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.923 X-Spam-Level: X-Spam-Status: No, score=-4.923 tagged_above=-999 required=5 tests=[AWL=-0.428, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4incH1BislTd; Wed, 2 Sep 2009 18:27:14 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 774EF3A6929; Wed, 2 Sep 2009 18:26:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mj12G-000HRj-C3 for namedroppers-data0@psg.com; Thu, 03 Sep 2009 01:22:48 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mj12C-000HPM-LR for namedroppers@ops.ietf.org; Thu, 03 Sep 2009 01:22:46 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n831LYJT002290; Thu, 3 Sep 2009 01:21:37 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n831LYjW002289; Thu, 3 Sep 2009 01:21:34 GMT Date: Thu, 3 Sep 2009 01:21:34 +0000 From: bmanning@vacation.karoshi.com To: William Allen Simpson Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: Signing the root with SHA-1 by Sep 1st Message-ID: <20090903012134.GA1728@vacation.karoshi.com.> References: <4A7DC199.9040700@gmail.com> <4A9D5854.3030105@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4A9D5854.3030105@gmail.com> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 01, 2009 at 01:22:28PM -0400, William Allen Simpson wrote: > William Allen Simpson wrote: > >My rationale is that educational institutions will be started, or ready > >to start shortly thereafter. They are already dealing with new students, > >and help desks will be able to give strong feedback on any problems. > > > >Likewise, many/most businesses will have their staff back from holidays. > > > >Finally, it's a Tuesday. I've always found it best to roll out changes > >on Tuesday, as it gives plenty of customer feedback time during the week. > >Mondays are often consumed with catching up on any operational problems > >over the weekend. Tuesday is better. 02:00 UTC is my favorite, although > >anytime after 00:00 UTC usually works OK. > > > That message was posted August 8th. The root did not begin running DNSsec > today. Does anybody have a fixed date in writing? perhaps the folks responsible did not think yours was the deciding opinion? --bill From owner-namedroppers@ops.ietf.org Thu Sep 3 05:33:50 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 801C13A684C; Thu, 3 Sep 2009 05:33:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.834 X-Spam-Level: X-Spam-Status: No, score=0.834 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_DSL=1.129, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vac8garLIb+t; Thu, 3 Sep 2009 05:33:49 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6FE333A6832; Thu, 3 Sep 2009 05:33:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjBNx-000NVc-GG for namedroppers-data0@psg.com; Thu, 03 Sep 2009 12:25:53 +0000 Received: from [216.194.124.237] (helo=execdsl.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mj5IW-000H34-K8 for namedroppers@ops.ietf.org; Thu, 03 Sep 2009 05:55:52 +0000 Received: from [71.142.160.125] (HELO [10.214.7.26]) by execdsl.com (CommuniGate Pro SMTP 4.2.10) with ESMTP-TLS id 17998218; Wed, 02 Sep 2009 23:55:37 -0600 Cc: Steve Crocker , Andrew Sullivan , DNSEXT WG , "Scott W. Rose" Message-Id: <37456F94-B77B-4842-9583-8E56C8B74F83@shinkuro.com> From: Steve Crocker To: =?ISO-8859-1?Q?Patrik_F=E4ltstr=F6m?= In-Reply-To: <577B1F45-F1C0-4024-9B9E-F4849790084F@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] draft-crocker-dnssec-algo-signal-03 -- more time please! Date: Thu, 3 Sep 2009 01:55:48 -0400 References: <583565A9-886F-41FB-92EA-B9F3E6741A7C@cisco.com> <434ECD68-79BB-45F1-8A68-A4CD8E4A3E11@cisco.com> <20090902161155.GS16078@shinkuro.com> <577B1F45-F1C0-4024-9B9E-F4849790084F@cisco.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Patrik, Thanks for taking on this task. I am a bit confused about what you're =20= reporting. I understand there is controversy about whether the WG =20 should be more or less permissive in the admission of new algorithms, =20= but our proposal is neutral with respect to that issue. We propose to =20= include signalling in the query in order to facilitate the phase out =20 of old algorithms when newer ones are being fielded. It some are arguing that the very existence of the signalling =20 mechanism may open the door to too many algorithms, I want to push =20 back vigorously. We did not create this proposal in order to =20 facilitate the adoption of more algorithms. At least some new =20 algorithms are clearly coming, e.g. SHA256 and ECC, so there's no =20 question that we will face one or more transitions. If there is to be =20= a linkage between our proposal and Paul Hoffman's, it should be in the =20= other direction. Our proposal should be adopted in all cases. His =20 proposal should not be adopted unless ours is too. The only detail that might be affected by future policy is how many =20 algorithm identifiers to anticipate. I believe we can signal which of =20= 256 different algorithms are known to the requester. If this is =20 insufficient, then the field that encodes that subset needs to be =20 adjusted. But I sincerely hope we're not going to come anywhere close =20= to that number in the foreseeable future. So, can you clarify if you really did get input that tended to push =20 against our proposal because it might be seen as permissive toward =20 admitting new algorithms? Thanks, Steve On Sep 2, 2009, at 6:20 PM, Patrik F=E4ltstr=F6m wrote: > On 2 sep 2009, at 18.11, Andrew Sullivan wrote: > >> On Thu, Aug 27, 2009 at 06:18:29AM +0200, Patrik F=E4ltstr=F6m wrote: >>> >>> - what the impact *really* is on DNSSEC deployment if we have =20 >>> multiple >>> algorithms >>> - how an algorithm change is to handled >>> - how to handle the selection process of preferred (plural) =20 >>> algorithms >>> (one main, and one secondary that is rolled in or out?) >>> >>> Given this, we can talk about how to do the wording in documents =20 >>> that >>> talk about how to register/signal algorithms. >> >> If I read this correctly, then either the candidate draft that Paul >> Hoffman has offered to the WG, possibly with some additions or >> changes, or something with the same topic is a necessary condition =20= >> for >> adopting draft-crocker-dnssec-algo-signal; and if such a document is >> adopted and published, then draft-crocker-dnssec-algo-signal would >> also be a good idea. Am I reading correctly? > > Yes, that was my reading of what people told me (~10 people) after =20 > the Stockholm meeting. People where nervous that, although it is =20 > very good to have registration and signalling of algorithms, having =20= > those mechanisms would increase the number of algorithms to a point =20= > which it has impact on interoperability (and therefore usability) of =20= > DNSSEC. > > If I am wrong in my findings, or if 10 people actively looking me up =20= > is a too small group to impact the work of this wg (I was suprised =20 > over such *high* number), let the chairs know. > > Patrik > From owner-namedroppers@ops.ietf.org Thu Sep 3 06:08:24 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1B63828C170; Thu, 3 Sep 2009 06:08:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.724 X-Spam-Level: X-Spam-Status: No, score=-4.724 tagged_above=-999 required=5 tests=[AWL=-0.287, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xDbzRb-tuzGc; Thu, 3 Sep 2009 06:08:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E5A1528C144; Thu, 3 Sep 2009 06:07:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjBwP-000G2h-MJ for namedroppers-data0@psg.com; Thu, 03 Sep 2009 13:01:29 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mj4bY-000EK5-Uo for namedroppers@ops.ietf.org; Thu, 03 Sep 2009 05:11:29 +0000 Received: from sjc-office-nat-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 621B9A9443B; Thu, 3 Sep 2009 05:11:28 +0000 (UTC) Message-ID: <4A9F4FFF.3090308@mail-abuse.org> Date: Wed, 02 Sep 2009 22:11:27 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: Mark Andrews CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> <200909012338.n81Ncm0S056506@drugs.dv.isc.org> <4A9DD27D.6080507@gmail.com> <200909020238.n822cCCK059837@drugs.dv.isc.org> <4A9F07EC.1040108@mail-abuse.org> <200909030111.n831AxUR081817@drugs.dv.isc.org> In-Reply-To: <200909030111.n831AxUR081817@drugs.dv.isc.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/2/09 6:10 PM, Mark Andrews wrote: > In message<4A9F07EC.1040108@mail-abuse.org>, Douglas Otis writes: >> On 9/1/09 7:38 PM, Mark Andrews wrote: >> >> It is not clear what is meant by saying "you". Once DNSSEC becomes >> widely deployed, bad actors can exploit any authoritative server that >> accepts queries from compromised systems where a source IP address of >> the victim's network does not cause the query to be dropped. > > Please tell me how they get a packet with a source address that > matches the victims IP address past the filter. You have yet to > show how that is done. When a bad-actor's compromised system and the DNS server acting as a reflector is outside the network being attacked, then packets representing the reflected attack carry the source IP address of the DNS server and the destination IP address of the victim. Since bad-actor's compromised systems are everywhere by the hundreds of millions, finding unfiltered paths to some DNS server supporting EDNS0 willing to emit large UDP packets is likely to become increasingly easier, and not harder. >> Even with BCP38, avenues for ENDS0 attack remain, either within filter >> CIDRs, network exceptions, or hidden tunnels. Not mandating use of >> EDNS0 (which introduces an 8x increased DNS related risk), permits >> lower risk strategies that are not reliant upon the world's adoption of >> BCP38. > > CIDR's blocks can be made small enough to not be a practical issue. These filters represent both added cost and added maintenance. Typical ingress filter CIDRs are /8, /16, or /24 with a mean at about /22. The density of compromised systems today can inundate any of these networks with reflected attacks. > A bot behind a deliberate exception doesn't pass the laugh test. This would depend upon whether the exceptions represent fat inter-ISP links, for example. > Hidden tunnels are not a issue. The tunnel end should be doing BCP > 38/84 and blocking it there. Tunnels are being setup by the bad-actors as a common ploy. > Logically it's like the compromised box is on the tunnel end point's network. Perhaps one might view this as colanders placed over ingress CIDRs, where every leak is bolstered eight fold by ENDS0. ;^) >> This clearly ignores two of the three agents involved in a reflective >> attack that might not be within the attacked network, even an attacked >> network using strict BCP38. >> >> Bad-actor w/spoofed src --------> DNS -------> Victim >> (no BCP38) (BCP38) > > Which is why we are encouraging all networks to deploy BCP38/84. > No one is saying that if you deploy BCP38/84 you will be protected > from others. What we are saying is that if you deploy BCP38/84 you > protect others (and yourself with tight enough filters) from > compromised machines on your network and if enough people do this > it is effective. Today, about half of the IP address remain unprotected. When a source IP addresses is not filtered by the first router, chances of this being filtered grows slim. > BCP38/84 is enlightened self interest. Leaving EDNS along will > encourage more enlightened self interest. There really are very few > really bad players. There are lots of lazy players. > > BCP38/84 is like herd immunity. You need to get enough members of > the herd vaccinated to prevent the disease spreading or to bring it > under control. Or it might take a few DDoS events before enlightened self interest filters EDNS0 packets and UDP fragments. What you describe as lazy players, might be actions aimed at minimizing issues when dealing with complex mobile, multi-homing, or asymmetrical routes. [] >>>> In other words, your statement that local BCP38 filtering only >>>> permits direct attacks is not correct. >>> >>> If you do BCP38 correctly you can't. >> >> Change this to "If everyone does BCP38 correctly, bad actors can't." > > If the compromised machine/bad actor is behind a BCP38/84 filter ... This really needs to be stated as being behind a sufficiently narrow ingress filter. I agree. BCP38 represent a good goal. Do you really think it is reasonable to suggest EDNS0, after 10 years of little use, will soon provide significant motivation to implement BCP38 everywhere? Or will it's potential for harm provide significant motivation to abandon EDNS0? There is another issue that should be considered. SCTP can be implemented in a manner supportable by SOHO devices without demanding extensive memory requirements. SCTP can also protect non-DNSSEC transactions from blind spoofing, and prevent reflected attacks without waiting for what you have described as the proper adoption of BCP38. -Doug From owner-namedroppers@ops.ietf.org Thu Sep 3 06:34:09 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 68E2D3A67C1; Thu, 3 Sep 2009 06:34:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.687 X-Spam-Level: X-Spam-Status: No, score=-7.687 tagged_above=-999 required=5 tests=[AWL=0.508, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_HI=-8, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b3FDEYUdMfFz; Thu, 3 Sep 2009 06:34:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 145013A6781; Thu, 3 Sep 2009 06:34:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjCM4-0007wo-HM for namedroppers-data0@psg.com; Thu, 03 Sep 2009 13:28:00 +0000 Received: from [144.254.224.140] (helo=ams-iport-1.cisco.com) by psg.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mj8HV-0006tB-90 for namedroppers@ops.ietf.org; Thu, 03 Sep 2009 09:07:02 +0000 X-Files: PGP.sig : 186 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AoMAAJsjn0qQ/uCKe2dsb2JhbACbPAEBFiQGpViIQQGQMAWEG4Fc X-IronPort-AV: E=Sophos;i="4.44,324,1249257600"; d="sig'?scan'208";a="48520124" Received: from ams-dkim-1.cisco.com ([144.254.224.138]) by ams-iport-1.cisco.com with ESMTP; 03 Sep 2009 09:06:59 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n8396x4W018838; Thu, 3 Sep 2009 11:06:59 +0200 Received: from xbh-ams-101.cisco.com (xbh-ams-101.cisco.com [144.254.74.71]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n8396xJv009358; Thu, 3 Sep 2009 09:06:59 GMT Received: from xfe-ams-101.cisco.com ([144.254.231.93]) by xbh-ams-101.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 3 Sep 2009 11:06:59 +0200 Received: from [192.168.1.129] ([10.61.83.40]) by xfe-ams-101.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 3 Sep 2009 11:06:58 +0200 Cc: Andrew Sullivan , DNSEXT WG , "Scott W. Rose" Message-Id: From: =?ISO-8859-1?Q?Patrik_F=E4ltstr=F6m?= To: Steve Crocker In-Reply-To: <37456F94-B77B-4842-9583-8E56C8B74F83@shinkuro.com> Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Apple-Mail-4-931194733" Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] draft-crocker-dnssec-algo-signal-03 -- more time please! Date: Thu, 3 Sep 2009 11:06:57 +0200 References: <583565A9-886F-41FB-92EA-B9F3E6741A7C@cisco.com> <434ECD68-79BB-45F1-8A68-A4CD8E4A3E11@cisco.com> <20090902161155.GS16078@shinkuro.com> <577B1F45-F1C0-4024-9B9E-F4849790084F@cisco.com> <37456F94-B77B-4842-9583-8E56C8B74F83@shinkuro.com> X-Pgp-Agent: GPGMail d55 (v55, Leopard) X-Mailer: Apple Mail (2.936) X-OriginalArrivalTime: 03 Sep 2009 09:06:58.0822 (UTC) FILETIME=[E466D260:01CA2C75] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=2962; t=1251968819; x=1252832819; c=relaxed/simple; s=amsdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=paf@cisco.com; z=From:=20=3D?ISO-8859-1?Q?Patrik_F=3DE4ltstr=3DF6m?=3D=20

|Subject:=20Re=3A=20[dnsext]=20draft-crocker-dnssec-algo-si gnal-03=20--=20more=20time=20please! |Sender:=20; bh=Ad/SdmY0DKt2j5Pbpovyhmh2avsnoIG5cCrWf2QY+Qg=; b=j5eN/O72qhPrj2oUnCURhcM/rSFoVjc5e9DcysypWjFCW5cQg4rXSVASR8 qdhgaB3/HNrmyN03oD6e2uXcZ6FrOwXGeNPpc+JtOMWF94nqh/W5dlCBDMC9 5EGLiBoDba; Authentication-Results: ams-dkim-1; header.From=paf@cisco.com; dkim=pass ( sig from cisco.com/amsdkim1002 verified; ); Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --Apple-Mail-4-931194733 Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit On 3 sep 2009, at 07.55, Steve Crocker wrote: > Thanks for taking on this task. I am a bit confused about what > you're reporting. I understand there is controversy about whether > the WG should be more or less permissive in the admission of new > algorithms, but our proposal is neutral with respect to that issue. > We propose to include signalling in the query in order to facilitate > the phase out of old algorithms when newer ones are being fielded. > > It some are arguing that the very existence of the signalling > mechanism may open the door to too many algorithms, I want to push > back vigorously. We did not create this proposal in order to > facilitate the adoption of more algorithms. At least some new > algorithms are clearly coming, e.g. SHA256 and ECC, so there's no > question that we will face one or more transitions. If there is to > be a linkage between our proposal and Paul Hoffman's, it should be > in the other direction. Our proposal should be adopted in all > cases. His proposal should not be adopted unless ours is too. > > The only detail that might be affected by future policy is how many > algorithm identifiers to anticipate. I believe we can signal which > of 256 different algorithms are known to the requester. If this is > insufficient, then the field that encodes that subset needs to be > adjusted. But I sincerely hope we're not going to come anywhere > close to that number in the foreseeable future. > > So, can you clarify if you really did get input that tended to push > against our proposal because it might be seen as permissive toward > admitting new algorithms? Well, I do not want to use the wording "push back", more that people very much wanted more clear text about the fact one such registration mechanism (that is good) is NOT opening the flood gates. Having a registration mechanism does of course not by itself imply any changes in how easy or hard it is to start using a new algorithm. So, my feeling was that people to feel more comfortable would like to see a companion document that clarify this thing, and looks at "interoperability issues with multiple encryption algorithms". They where not against your document per se. More clear? Patrik --Apple-Mail-4-931194733 content-type: application/pgp-signature; x-mac-type=70674453; name=PGP.sig content-description: This is a digitally signed message part content-disposition: inline; filename=PGP.sig content-transfer-encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iD8DBQFKn4cxvHlR2X0luNwRAvVAAKDZ8dcnCIHHuYCFM2/f+i4RqVu3uQCfamXy ol1CG3gW4JuLkVoj2ZoXBBU= =EXrH -----END PGP SIGNATURE----- --Apple-Mail-4-931194733-- From owner-namedroppers@ops.ietf.org Thu Sep 3 07:58:49 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 369B63A6911; Thu, 3 Sep 2009 07:58:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.275 X-Spam-Level: X-Spam-Status: No, score=-0.275 tagged_above=-999 required=5 tests=[AWL=-0.675, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lu9chNBHktuP; Thu, 3 Sep 2009 07:58:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 61D223A68FA; Thu, 3 Sep 2009 07:58:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjDfw-0002Ln-JO for namedroppers-data0@psg.com; Thu, 03 Sep 2009 14:52:36 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjDfv-0002LD-Sy for namedroppers@ops.ietf.org; Thu, 03 Sep 2009 14:52:36 +0000 Received: from crankycanuck.ca (76-10-166-247.dsl.teksavvy.com [76.10.166.247]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id D97DB2FE8CE0 for ; Thu, 3 Sep 2009 14:52:33 +0000 (UTC) Date: Thu, 3 Sep 2009 10:52:31 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: dnssec-bis-updates (was: [dnsext] Cryptographic Algorithm Identifier Allocation for DNSSEC) Message-ID: <20090903145231.GF17258@shinkuro.com> References: <20090827180305.GK7821@shinkuro.com> <200908272358.n7RNwrvr038970@drugs.dv.isc.org> <20090828144512.GT7821@shinkuro.com> <200908282207.n7SM73bf056581@drugs.dv.isc.org> <20090831182103.GQ13987@shinkuro.com> <200909010055.n810tI2W047942@drugs.dv.isc.org> <20090901142514.GB14929@shinkuro.com> <200909020004.n8204MPb057081@drugs.dv.isc.org> <20090902141945.GG16078@shinkuro.com> <200909022245.n82MjaPh079609@drugs.dv.isc.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200909022245.n82MjaPh079609@drugs.dv.isc.org> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, Sep 03, 2009 at 08:45:36AM +1000, Mark Andrews wrote: > Then the document needs to be rev'd. As a chair you need to see that > this happens. I guess I wasn't clear, but as Chair I'm asking participants to post _specific text_ that they want changed, or else to post a review stating explicitly that the document is ready for publication. We'll never get movement with the slow pace of review we've had on this document so far. At one point, the WG decided to leave it as a "living draft". I usually think that's a bad idea anyway, but in this case it's been fatal because there's been little urgency to finish it up and put it to bed. If there's clear interest in changes, then that will be helpful in delivering a revision. If there's clear interest in publication as is, that will be a reason to go through WGLC and finish this off. But no chair can make any determination without evidence of the intent of the WG, and that's what's missing at the moment. Best, A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Thu Sep 3 11:59:07 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 582F03A683A; Thu, 3 Sep 2009 11:59:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.714 X-Spam-Level: X-Spam-Status: No, score=-4.714 tagged_above=-999 required=5 tests=[AWL=-0.277, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VMTFZ2y+Kep0; Thu, 3 Sep 2009 11:59:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E4F723A67FB; Thu, 3 Sep 2009 11:58:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjGzX-000FrT-BG for namedroppers-data0@psg.com; Thu, 03 Sep 2009 18:25:03 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjGZ4-000AAd-U1 for namedroppers@ops.ietf.org; Thu, 03 Sep 2009 18:01:42 +0000 Received: from sjc-office-nat-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 682DAA94442; Thu, 3 Sep 2009 17:57:42 +0000 (UTC) Message-ID: <4AA00396.3010105@mail-abuse.org> Date: Thu, 03 Sep 2009 10:57:42 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: Paul Wouters CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] Amplification attacks, RFC3704 etc. References: <741D2CE589EF45F48343B6B970D856AD@localhost> <50109C23-B610-47C9-8C60-6176078B6E82@icsi.berkeley.edu> <8BE80AE8D80C4D49B836D72C399D05DA@localhost> <4382E5FE-81A1-494A-AA75-916CB19C3D3F@rfc1035.com> <34182.1251825180@nsa.vix.com> <200909012338.n81Ncm0S056506@drugs.dv.isc.org> <4A9DD27D.6080507@gmail.com> <200909020238.n822cCCK059837@drugs.dv.isc.org> <4A9F07EC.1040108@mail-abuse.org> <200909030111.n831AxUR081817@drugs.dv.isc.org> <4A9F4FFF.3090308@mail-abuse.org> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/3/09 8:57 AM, Paul Wouters wrote: > On Wed, 2 Sep 2009, Douglas Otis wrote: > >> This really needs to be stated as being behind a sufficiently narrow >> ingress filter. I agree. BCP38 represent a good goal. Do you really >> think it is reasonable to suggest EDNS0, after 10 years of little use, >> will soon provide significant motivation to implement BCP38 >> everywhere? Or will it's potential for harm provide significant >> motivation to abandon EDNS0? > > You mean to lay UDP to rest. No. UDP with jumbo frames should only be sent after the source of a small request has been verified, likely as part of an association setup as found with SCTP over UDP, for example. > Because with DNS gone, there will be another "best amplification attack" using UDP. IKE amplification? RFC 4306 section 2 has a requirement for handling packets as large as 1280 bytes and MAY shorten messages by leaving out some certificates or cryptographic suite proposals if that will keep messages below the maximum. It also cautions that fragmentation of oversize UDP packets opens the implementation to DoS attack. IKE will also benefit from the use of SCTP. SIP amplification? See RFC 5393 that addresses SIP amplification vulnerabilities. For SIP RFC 3261, section 18.1.1 requires packets larger than 1300 bytes MUST be sent over a transport having congestion control. SIP can also run over SCTP. :^) -Doug From owner-namedroppers@ops.ietf.org Thu Sep 3 15:29:12 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C4D073A69B2; Thu, 3 Sep 2009 15:29:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.488 X-Spam-Level: X-Spam-Status: No, score=-0.488 tagged_above=-999 required=5 tests=[AWL=0.007, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BEO6NcfqWTI6; Thu, 3 Sep 2009 15:29:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DD9573A69AF; Thu, 3 Sep 2009 15:29:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjJVv-000NHo-TN for namedroppers-data0@psg.com; Thu, 03 Sep 2009 21:06:39 +0000 Received: from [193.110.157.143] (helo=newtla.xelerance.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjIv2-000Fnn-Os for namedroppers@ops.ietf.org; Thu, 03 Sep 2009 20:30:33 +0000 Received: from tla.xelerance.com (tla.xelerance.com [193.110.157.130]) by newtla.xelerance.com (Postfix) with ESMTP id CE8435709E; Thu, 3 Sep 2009 16:28:31 -0400 (EDT) Date: Thu, 3 Sep 2009 16:28:31 -0400 (EDT) From: Paul Wouters To: George Barwood cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Fwd: New Version Notification for draft-dempsky-dnscurve-00 In-Reply-To: Message-ID: References: <20090826195944.87ECD3A6CB3@core3.amsl.com> User-Agent: Alpine 1.10 (LFD 962 2008-03-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, 3 Sep 2009, George Barwood wrote: >>> The TTL should be at least the TTL of the address record(s), and >>> caches should not discard a DPCK record before the corresponding address record. >> >> That seems like a bad idea and very contrary to normal DNS operations. If they >> really cannot be cached individually, then the protocol should not send them >> as individual items with individual TTL's. > > That's DNS for you. Nameservers that cache records until TTL expiry don't > have to take any special action. It's quite straight-forward. But you wouldn't need/use the glue. It would be verified later at the child where the authoritative data for that A record really exists? Now if you have multiple domains with a DPCK record going to the same nameserver IP, the A record and the DPCK record TTL's would not be "in sync" as you state is required. > Ok, I will give an example. For simplicity I will assume each domain has > just 1 name server, and each name server has just 1 address ( A record ). Thanks. That did clarify things. Paul From owner-namedroppers@ops.ietf.org Thu Sep 3 20:59:18 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 448B43A6827; Thu, 3 Sep 2009 20:59:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.394 X-Spam-Level: X-Spam-Status: No, score=-2.394 tagged_above=-999 required=5 tests=[AWL=0.161, BAYES_00=-2.599, DATE_IN_PAST_03_06=0.044] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 92FWn+giHt4Q; Thu, 3 Sep 2009 20:59:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5D5043A67A8; Thu, 3 Sep 2009 20:59:16 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjPql-000HcI-Sm for namedroppers-data0@psg.com; Fri, 04 Sep 2009 03:52:35 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjPhZ-000G6s-8c for namedroppers@ops.ietf.org; Fri, 04 Sep 2009 03:47:05 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 1C0CFE601C for ; Fri, 4 Sep 2009 03:43:01 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n843grwG009420 for ; Fri, 4 Sep 2009 13:42:59 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909040342.n843grwG009420@drugs.dv.isc.org> To: Andrew Sullivan Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <20090827180305.GK7821@shinkuro.com> <200908272358.n7RNwrvr038970@drugs.dv.isc.org> <20090828144512.GT7821@shinkuro.com> <200908282207.n7SM73bf056581@drugs.dv.isc.org> <20090831182103.GQ13987@shinkuro.com> <200909010055.n810tI2W047942@drugs.dv.isc.org> <20090901142514.GB14929@shinkuro.com> <200909020004.n8204MPb057081@drugs.dv.isc.org> <20090902141945.GG16078@shinkuro.com> <200909022245.n82MjaPh079609@drugs.dv.isc.org> <20090903145231.GF17258@shinkuro.com> Subject: Re: dnssec-bis-updates (was: [dnsext] Cryptographic Algorithm Identifier Allocation for DNSSEC) In-reply-to: Your message of "Thu, 03 Sep 2009 10:52:31 -0400." <20090903145231.GF17258@shinkuro.com> Date: Fri, 04 Sep 2009 08:05:27 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: I can cope with it still being a living document. However that requires that it be kept alive. I'm also happy if we decide it is time to say we have caught most of the problems and publish as a RFC. One of the DNS vendors is still currently in the process of adding DNSSEC support. This would be a good time for feedback on what we got wrong so I would wait a little while more. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Thu Sep 3 22:23:10 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4CEB03A6924; Thu, 3 Sep 2009 22:23:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.076 X-Spam-Level: **** X-Spam-Status: No, score=4.076 tagged_above=-999 required=5 tests=[AWL=0.181, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z7C9tT0d0tZd; Thu, 3 Sep 2009 22:23:07 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D58683A68FA; Thu, 3 Sep 2009 22:23:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjRBG-00085i-76 for namedroppers-data0@psg.com; Fri, 04 Sep 2009 05:17:50 +0000 Received: from [195.188.213.5] (helo=smtp-out2.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjRAs-00083E-IE for namedroppers@ops.ietf.org; Fri, 04 Sep 2009 05:17:43 +0000 Received: from [172.23.170.146] (helo=anti-virus03-09) by smtp-out2.blueyonder.co.uk with smtp (Exim 4.52) id 1MjRAp-0003UY-Od; Fri, 04 Sep 2009 06:17:23 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out6.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MjRAp-0005YE-7V; Fri, 04 Sep 2009 06:17:23 +0100 Message-ID: From: "George Barwood" To: "Paul Wouters" Cc: References: <20090826195944.87ECD3A6CB3@core3.amsl.com> Subject: Re: [dnsext] Fwd: New Version Notification for draft-dempsky-dnscurve-00 Date: Fri, 4 Sep 2009 06:17:06 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIlBhdWwgV291dGVycyIgPHBh dWxAeGVsZXJhbmNlLmNvbT4NClRvOiAiR2VvcmdlIEJhcndvb2QiIDxnZW9yZ2UuYmFyd29vZEBi bHVleW9uZGVyLmNvLnVrPg0KQ2M6IDxuYW1lZHJvcHBlcnNAb3BzLmlldGYub3JnPg0KU2VudDog VGh1cnNkYXksIFNlcHRlbWJlciAwMywgMjAwOSA5OjI4IFBNDQpTdWJqZWN0OiBSZTogW2Ruc2V4 dF0gRndkOiBOZXcgVmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIGRyYWZ0LWRlbXBza3ktZG5zY3Vy dmUtMDANCg0KDQo+IE9uIFRodSwgMyBTZXAgMjAwOSwgR2VvcmdlIEJhcndvb2Qgd3JvdGU6DQo+ IA0KPj4+PiBUaGUgVFRMIHNob3VsZCBiZSBhdCBsZWFzdCB0aGUgVFRMIG9mIHRoZSBhZGRyZXNz IHJlY29yZChzKSwgYW5kDQo+Pj4+IGNhY2hlcyBzaG91bGQgbm90IGRpc2NhcmQgYSBEUENLIHJl Y29yZCBiZWZvcmUgdGhlIGNvcnJlc3BvbmRpbmcgYWRkcmVzcyByZWNvcmQuDQo+Pj4NCj4+PiBU aGF0IHNlZW1zIGxpa2UgYSBiYWQgaWRlYSBhbmQgdmVyeSBjb250cmFyeSB0byBub3JtYWwgRE5T IG9wZXJhdGlvbnMuIElmIHRoZXkNCj4+PiByZWFsbHkgY2Fubm90IGJlIGNhY2hlZCBpbmRpdmlk dWFsbHksIHRoZW4gdGhlIHByb3RvY29sIHNob3VsZCBub3Qgc2VuZCB0aGVtDQo+Pj4gYXMgaW5k aXZpZHVhbCBpdGVtcyB3aXRoIGluZGl2aWR1YWwgVFRMJ3MuDQo+Pg0KPj4gVGhhdCdzIEROUyBm b3IgeW91LiBOYW1lc2VydmVycyB0aGF0IGNhY2hlIHJlY29yZHMgdW50aWwgVFRMIGV4cGlyeSBk b24ndA0KPj4gaGF2ZSB0byB0YWtlIGFueSBzcGVjaWFsIGFjdGlvbi4gSXQncyBxdWl0ZSBzdHJh aWdodC1mb3J3YXJkLg0KPiANCj4gQnV0IHlvdSB3b3VsZG4ndCBuZWVkL3VzZSB0aGUgZ2x1ZS4g SXQgd291bGQgYmUgdmVyaWZpZWQgbGF0ZXIgYXQgdGhlIGNoaWxkIHdoZXJlDQo+IHRoZSBhdXRo b3JpdGF0aXZlIGRhdGEgZm9yIHRoYXQgQSByZWNvcmQgcmVhbGx5IGV4aXN0cz8gTm93IGlmIHlv dSBoYXZlIG11bHRpcGxlDQo+IGRvbWFpbnMgd2l0aCBhIERQQ0sgcmVjb3JkIGdvaW5nIHRvIHRo ZSBzYW1lIG5hbWVzZXJ2ZXIgSVAsIHRoZSBBIHJlY29yZCBhbmQgdGhlDQo+IERQQ0sgcmVjb3Jk IFRUTCdzIHdvdWxkIG5vdCBiZSAiaW4gc3luYyIgYXMgeW91IHN0YXRlIGlzIHJlcXVpcmVkLg0K DQpObywgYmVjYXVzZSBpdCdzIHRoZSBMSFMgb2YgdGhlIEEgcmVjb3JkIHRoYXQgY291bnRzLCBu b3QgdGhlIFJIUy4gVGhvc2UgYXJlIGRpc3RpbmN0IHJlY29yZHMuDQoNCkluIG15IGV4YW1wbGUN Cg0KQS5OUy5CSUctUkVHLk5FVCBBICA1LjYuNy44DQpBLk5TLkJJRy1SRUcuTkVUIERDUEsgV0JK NTFXRDI3S0xTWDYzV1YwUFIySjM1UjRHUDdSMDZSSzNYSFVMQlpZUFJLMlQ1VTZDDQoNCm5lZWRz IHRvIGJlIHRob3VnaHQgb2YgYXMgYSBzaW5nbGUgUlJzZXQsIHdpdGggaW50ZWdyaXR5IC8gaW5k aXZpc2liaWxpdHkuDQoNClRoZSB6b25lIEJJRy1SRUcuTkVUIGhhcyBhIGNvcHksIGFuZCB0aGUg cGFyZW50IHpvbmUgYWxzbyBoYXMgYSBnbHVlIGNvcHksDQpzaW5jZSB0aGUgbmFtZSBzZXJ2ZXIg aXMgaW4tem9uZS4NCg0KSWYgdGhlcmUgd2FzIGEgQUFBQSByZWNvcmQsIHRoYXQgd291bGQgYWxz byBmb3JtIHBhcnQgb2YgdGhlICJsb2dpY2FsIiBSUnNldC4gDQpJbiBhIGNsZWFuIGRlc2lnbiB5 b3Ugd291bGQgaGF2ZSBhIHNpbmdsZSBleHRlbnNpYmxlIHJlc291cmNlIHJlY29yZCB0aGF0IGNv dWxkDQpzdG9yZSBhbnkgYWRkcmVzcyBvciB0cmFuc3BvcnQgaW5mb3JtYXRpb24sIGJ1dCB0aGF0 J3MgYW5vdGhlciBpc3N1ZS4gSXQgbWlnaHQgbG9vayANCmxpa2UNCg0KQS5OUy5CSUctUkVHLk5F VCBUUkFOU1BPUlQoIEEgNS42LjcuOCwgQUFBQSA4Ojo5OjoxLCBEQ1BLIFdCSi4uLi5VNkMgKQ0K DQpvciBzb21lc3VjaC4gQnV0IHRoYXQncyBhbm90aGVyIGlzc3VlLCBhbmQgb25lIEkgY2VydGFp bmx5IGRvbid0IHdhbnQgdG8gZ2V0IGludG8hDQoNCkdlb3JnZQ0KDQo+PiBPaywgSSB3aWxsIGdp dmUgYW4gZXhhbXBsZS4gRm9yIHNpbXBsaWNpdHkgSSB3aWxsIGFzc3VtZSBlYWNoIGRvbWFpbiBo YXMNCj4+IGp1c3QgMSBuYW1lIHNlcnZlciwgYW5kIGVhY2ggbmFtZSBzZXJ2ZXIgaGFzIGp1c3Qg MSBhZGRyZXNzICggQSByZWNvcmQgKS4NCj4gDQo+IFRoYW5rcy4gVGhhdCBkaWQgY2xhcmlmeSB0 aGluZ3MuDQo+IA0KPiBQYXVsDQo+IA0KPg== From owner-namedroppers@ops.ietf.org Fri Sep 4 05:08:15 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D74083A69D9; Fri, 4 Sep 2009 05:08:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.911 X-Spam-Level: X-Spam-Status: No, score=-105.911 tagged_above=-999 required=5 tests=[AWL=0.338, BAYES_00=-2.599, HELO_EQ_FR=0.35, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SfgtjPsBF5t0; Fri, 4 Sep 2009 05:08:15 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 027413A69D8; Fri, 4 Sep 2009 05:08:15 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjXTo-0002Kr-Ka for namedroppers-data0@psg.com; Fri, 04 Sep 2009 12:01:24 +0000 Received: from [2001:660:3003:2::4:11] (helo=mx2.nic.fr) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjXR2-0001g5-Nl for namedroppers@ops.ietf.org; Fri, 04 Sep 2009 11:59:36 +0000 Received: from mx2.nic.fr (localhost [127.0.0.1]) by mx2.nic.fr (Postfix) with SMTP id 153941C011D; Fri, 4 Sep 2009 13:58:31 +0200 (CEST) Received: from relay1.nic.fr (relay1.nic.fr [192.134.4.162]) by mx2.nic.fr (Postfix) with ESMTP id 10B6F1C002A; Fri, 4 Sep 2009 13:58:31 +0200 (CEST) Received: from bortzmeyer.nic.fr (batilda.nic.fr [192.134.4.69]) by relay1.nic.fr (Postfix) with ESMTP id 0E1D3A1DB4B; Fri, 4 Sep 2009 13:58:31 +0200 (CEST) Date: Fri, 4 Sep 2009 13:58:31 +0200 From: Stephane Bortzmeyer To: Mark Andrews Cc: bert hubert , "namedroppers@ops.ietf.org namedroppers@ops.ietf.org" Subject: [dnsext] Re: NSEC3 confusion (in .org) Message-ID: <20090904115831.GA24230@nic.fr> References: <3efd34cc0908100952j442b7650t3231553004c21dd5@mail.gmail.com> <200908110010.n7B0AvDR060945@drugs.dv.isc.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200908110010.n7B0AvDR060945@drugs.dv.isc.org> X-Operating-System: Debian GNU/Linux 5.0.2 X-Kernel: Linux 2.6.26-2-686 i686 Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Aug 11, 2009 at 10:10:57AM +1000, Mark Andrews wrote a message of 66 lines which said: > The same thing happens in COM, NET and I presume all other > zones with a registry/registrar model. The registrars really > should be pulling the glue records as well. It's up to the > registry enforce this however. For the record, after a check in .FR (because it was a new and unusual problem), we publish the glue only if the domain itself is published. (And so the question of "promoting" the glue does not apply.) A domain cannot be deleted if there are nameservers beneath it, but it can still be unpublished (potentially leaving dangling references to name servers in it.) From owner-namedroppers@ops.ietf.org Fri Sep 4 05:13:00 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 34D513A68D2; Fri, 4 Sep 2009 05:13:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.225 X-Spam-Level: X-Spam-Status: No, score=-1.225 tagged_above=-999 required=5 tests=[AWL=-0.730, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rQHL+oOELPzQ; Fri, 4 Sep 2009 05:12:59 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 346923A680F; Fri, 4 Sep 2009 05:12:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjXbv-0004Ar-7s for namedroppers-data0@psg.com; Fri, 04 Sep 2009 12:09:47 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjXal-0003ys-N4 for namedroppers@ops.ietf.org; Fri, 04 Sep 2009 12:09:13 +0000 Received: from Puki.ogud.com (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n84C8Xpg001263 for ; Fri, 4 Sep 2009 08:08:33 -0400 (EDT) (envelope-from ogud@ogud.com) Message-Id: <200909041208.n84C8Xpg001263@stora.ogud.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Fri, 04 Sep 2009 08:04:29 -0400 To: namedroppers@ops.ietf.org From: Olafur Gudmundsson/DNSEXT chair Subject: [dnsext] WG List Policy Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Periodic posting, updated 03/Sep/2009 List Purpose: namedroppers at ops.ietf.org is the mailing list for the IETF DNSEXT (DNS EXTensions) working group. See < http://www.ietf.org/html.charters/dnsext-charter.html> for the WG charter. Messages should be on topics appropriate to the DNSEXT WG, which are various discussion of the DNS protocols or administrivia of the WG itself. - Specific items that are not appropriate for posting Calls for papers, announcements of events not directly relevant to the DNS protocols, etc. are not appropriate. Discussion of problems with particular implementations, announcements of releases, sites' misconfiguration, pleas for help with specific implementations, etc. should be done on mailing lists for the particular implementations. There is a working group for DNS operational practice, DNSOP, whose charter can be found at < http://www.ietf.org/html.charters/dnsop-charter.html>. Items relevant to the DNSOP charter are to be discussed on the DNSOP mailing list. Discussion about the quality of implementations is outside the scope of this list. Moderation: Moderator: DNSEXT chair(s) unless otherwise announced on mailing list. Moderation is based on "subscriber-only with spam filter". To counter a certain class of spam mails, messages over 20000 characters, originating from list subscribers, will be held for moderations. Questions or concerns related to the acceptance or rejection of specific messages to the namedroppers mailing list should first be discussed with the WG chair, with follow up appeals using the normal appeals process of RFC 2026 (i.e. follow up with area directors, then IESG, etc.). Any submission to the IETF intended by the Contributor for publication as all or part of an IETF Internet-Draft or RFC and any statement made within the context of an IETF activity is considered an "IETF Contribution". Such statements include oral statements in IETF sessions, as well as written and electronic communications made at any time or place, which are addressed to: - The IETF plenary session - The IESG, or any member thereof on behalf of the IESG - Any IETF mailing list, including the IETF list itself, any working group or design team list, or any other list functioning under IETF auspices - Any IETF working group or portion thereof - The IAB or any member thereof on behalf of the IAB - The RFC Editor or the Internet-Drafts function All IETF Contributions are subject to the rules of RFC 5378 and RFC 3979 updated by RFC 4879). Statements made outside of an IETF session, mailing list or other function, that are clearly not intended to be input to an IETF activity, group or function, are not IETF Contributions in the context of this notice. Please consult RFC 5378 and RFC 3979 for details. A participant in any IETF activity is deemed to accept all IETF rules of process, as documented in Best Current Practices RFCs and IESG Statements. A participant in any IETF activity acknowledges that written, audio and video records of meetings may be made and may be available to the public. From owner-namedroppers@ops.ietf.org Fri Sep 4 12:59:13 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0A1E83A6A60; Fri, 4 Sep 2009 12:59:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.21 X-Spam-Level: X-Spam-Status: No, score=0.21 tagged_above=-999 required=5 tests=[AWL=0.083, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n8INwBE0Lkqi; Fri, 4 Sep 2009 12:59:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4E4783A6784; Fri, 4 Sep 2009 12:59:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjeSK-00038d-6C for namedroppers-data0@psg.com; Fri, 04 Sep 2009 19:28:20 +0000 Received: from [209.85.222.174] (helo=mail-pz0-f174.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjdgM-000IXk-Og for namedroppers@ops.ietf.org; Fri, 04 Sep 2009 18:38:46 +0000 Received: by pzk4 with SMTP id 4so959643pzk.29 for ; Fri, 04 Sep 2009 11:38:46 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.4.25 with SMTP id 25mr10396003wad.164.1252089526175; Fri, 04 Sep 2009 11:38:46 -0700 (PDT) In-Reply-To: References: <20090826195944.87ECD3A6CB3@core3.amsl.com> Date: Fri, 4 Sep 2009 11:38:46 -0700 Message-ID: Subject: Re: [dnsext] Fwd: New Version Notification for draft-dempsky-dnscurve-00 From: Matthew Dempsky To: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, Sep 3, 2009 at 8:21 AM, George Barwood wrote: > When responding to query over DNSCurve, if an address record ( A or AAAA ) is sent, > the corresponding DPCK record for the domain is also sent ( if it exists ), in the > authority section. I think the additional records section would make more sense than the authority section. From owner-namedroppers@ops.ietf.org Sat Sep 5 07:36:25 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4628E3A6820; Sat, 5 Sep 2009 07:36:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.206 X-Spam-Level: X-Spam-Status: No, score=0.206 tagged_above=-999 required=5 tests=[AWL=0.079, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hxKoWudnoO9u; Sat, 5 Sep 2009 07:36:24 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 592B43A67C1; Sat, 5 Sep 2009 07:36:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjwFy-000MUB-GC for namedroppers-data0@psg.com; Sat, 05 Sep 2009 14:28:46 +0000 Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjeSK-00038d-6C for namedroppers-data0@psg.com; Fri, 04 Sep 2009 19:28:20 +0000 Received: from [209.85.222.174] (helo=mail-pz0-f174.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MjdgM-000IXk-Og for namedroppers@ops.ietf.org; Fri, 04 Sep 2009 18:38:46 +0000 Received: by pzk4 with SMTP id 4so959643pzk.29 for ; Fri, 04 Sep 2009 11:38:46 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.4.25 with SMTP id 25mr10396003wad.164.1252089526175; Fri, 04 Sep 2009 11:38:46 -0700 (PDT) In-Reply-To: References: <20090826195944.87ECD3A6CB3@core3.amsl.com> Date: Fri, 4 Sep 2009 11:38:46 -0700 Message-ID: Subject: Re: [dnsext] Fwd: New Version Notification for draft-dempsky-dnscurve-00 From: Matthew Dempsky To: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, Sep 3, 2009 at 8:21 AM, George Barwood wrote: > When responding to query over DNSCurve, if an address record ( A or AAAA ) is sent, > the corresponding DPCK record for the domain is also sent ( if it exists ), in the > authority section. I think the additional records section would make more sense than the authority section. From monologuesb8@192.Red-83-49-130.dynamicIP.rima-tde.net Sat Sep 5 08:50:01 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 49CA53A68F6 for ; Sat, 5 Sep 2009 08:50:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -68.835 X-Spam-Level: X-Spam-Status: No, score=-68.835 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_ALMOST_IP=5.417, FH_HOST_ALMOST_IP=1.889, FH_HOST_EQ_DYNAMICIP=2.177, FM_SCHOOLING=5.657, HELO_DYNAMIC_SPLIT_IP=3.493, HELO_EQ_DYNAMIC=1.144, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, USER_IN_WHITELIST=-100, XMAILER_MIMEOLE_OL_7533E=0.513] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4+Edn8EsNONO for ; Sat, 5 Sep 2009 08:50:00 -0700 (PDT) Received: from 192.Red-83-49-130.dynamicIP.rima-tde.net (192.Red-83-49-130.dynamicIP.rima-tde.net [83.49.130.192]) by core3.amsl.com (Postfix) with ESMTP id 68AF13A6821 for ; Sat, 5 Sep 2009 08:49:58 -0700 (PDT) Received: from 83.49.130.192 by arthur.icomme.tm.fr; Sat, 5 Sep 2009 16:50:23 +0100 Message-ID: <01ca2e48$f5e2b980$c0823153@monologuesb8> From: "August T. Draeger" To: Subject: Now you will earn more Date: Sat, 5 Sep 2009 16:50:23 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4963.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4963.1700 Now you will easily get legal degree in only 4-5 weeks on base of your professional experience We will get your self a verifiable degree of: Masters, Bachelors and PhD Ring right now +1-213-403-0133 Leave your msg, with your full name and number and we will get back to you shortly. From owner-namedroppers@ops.ietf.org Sat Sep 5 14:37:28 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4BDB83A6839; Sat, 5 Sep 2009 14:37:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.286 X-Spam-Level: X-Spam-Status: No, score=-102.286 tagged_above=-999 required=5 tests=[AWL=0.314, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4XUrLznASsS4; Sat, 5 Sep 2009 14:37:27 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4C6023A67B4; Sat, 5 Sep 2009 14:37:27 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mk2qf-000F8X-Bq for namedroppers-data0@psg.com; Sat, 05 Sep 2009 21:31:05 +0000 Received: from [2001:1890:1112:1::20] (helo=mail.ietf.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mk2qJ-000F5y-RO for namedroppers@ops.ietf.org; Sat, 05 Sep 2009 21:30:58 +0000 Received: by core3.amsl.com (Postfix, from userid 0) id 5F3763A6818; Sat, 5 Sep 2009 14:30:03 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Cc: namedroppers@ops.ietf.org Subject: [dnsext] I-D Action:draft-ietf-dnsext-dnssec-bis-updates-09.txt Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20090905213004.5F3763A6818@core3.amsl.com> Date: Sat, 5 Sep 2009 14:30:04 -0700 (PDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Extensions Working Group of the IETF. Title : Clarifications and Implementation Notes for DNSSECbis Author(s) : S. Weiler, D. Blacka Filename : draft-ietf-dnsext-dnssec-bis-updates-09.txt Pages : 12 Date : 2009-09-05 This document is a collection of technical clarifications to the DNSSECbis document set. It is meant to serve as a resource to implementors as well as a repository of DNSSECbis errata. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-bis-updates-09.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-dnsext-dnssec-bis-updates-09.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2009-09-05142918.I-D@ietf.org> --NextPart-- From blarel23@host144-134-dynamic.23-79-r.retail.telecomitalia.it Sun Sep 6 01:37:21 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE3F43A685C; Sun, 6 Sep 2009 01:37:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -79.261 X-Spam-Level: X-Spam-Status: No, score=-79.261 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_FAKE_RCVD_LINE_B=5.777, FM_SCHOOLING=5.657, HELO_EQ_DYNAMIC=1.144, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RDNS_DYNAMIC=0.1, SARE_SUB_GET_PAID=0.899, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XejwK5T1XrJp; Sun, 6 Sep 2009 01:37:21 -0700 (PDT) Received: from host144-134-dynamic.23-79-r.retail.telecomitalia.it (host144-134-dynamic.23-79-r.retail.telecomitalia.it [79.23.134.144]) by core3.amsl.com (Postfix) with ESMTP id 6F37E3A6784; Sun, 6 Sep 2009 01:37:20 -0700 (PDT) Received: from 79.23.134.144 by mailstore1.secureserver.net; Sun, 6 Sep 2009 09:37:46 +0100 Message-ID: <01ca2ed5$b137db20$9086174f@blarel23> From: "Erasmo K. Cullins" To: Subject: Less work get paid more. Date: Sun, 6 Sep 2009 09:37:46 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Now you will easily get legal degree in only 4-5 weeks on the base of your professional career We are here serving you with these programs.:- PhD, Bachelors and Masters Call us right now 1.213-403-0133 Drop us your msg, with your full name and contact number so we can call you back. From dnsezkx@ats-water.com Sun Sep 6 03:08:36 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED1433A6950 for ; Sun, 6 Sep 2009 03:08:36 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER, Non-encoded 8-bit data (char AE hex): From: VIAGRA \256 Official Site [...] X-Spam-Flag: NO X-Spam-Score: -11.961 X-Spam-Level: X-Spam-Status: No, score=-11.961 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FAKE_HELO_MAIL_COM=1.317, FAKE_HELO_MAIL_COM_DOM=3.199, HELO_MISMATCH_COM=0.553, HOST_EQ_PL=1.95, HTML_IMAGE_ONLY_20=1.546, HTML_IMAGE_RATIO_02=0.383, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_3=0.001, MANGLED_OFF=2.3, MIME_8BIT_HEADER=0.3, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, SARE_FROM_DRUGS=1.666, SARE_UNI=0.591, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XKemlXXsn0W8 for ; Sun, 6 Sep 2009 03:08:30 -0700 (PDT) Received: from mx54.mail.com (acwz184.neoplus.adsl.tpnet.pl [83.11.157.184]) by core3.amsl.com (Postfix) with SMTP id 322D83A6954 for ; Sun, 6 Sep 2009 03:08:26 -0700 (PDT) From: VIAGRA ® Official Site To: dnsext-archive@ietf.org Subject: Dear dnsext-archive@ietf.org 88% 0FF on Pfizer ! MIME-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <20090906100827.322D83A6954@core3.amsl.com> Date: Sun, 6 Sep 2009 03:08:26 -0700 (PDT) News
Click here to view as a web page.

View image in browser now
Unsubscribe | Change e-mail address | Privacy Policy | About Us

Copyright © 2009 scnsw Inc. All rights reserved.
From owner-namedroppers@ops.ietf.org Mon Sep 7 01:21:44 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 785083A681F; Mon, 7 Sep 2009 01:21:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.3 X-Spam-Level: X-Spam-Status: No, score=-102.3 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, J_CHICKENPOX_47=0.6, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id robAHFwZ9FGw; Mon, 7 Sep 2009 01:21:43 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5CAC03A6964; Mon, 7 Sep 2009 01:21:43 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MkZMc-0005sq-Vv for namedroppers-data0@psg.com; Mon, 07 Sep 2009 08:14:14 +0000 Received: from [2001:7b8:206:1::1] (helo=open.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MkZME-0005pi-A2 for namedroppers@ops.ietf.org; Mon, 07 Sep 2009 08:14:07 +0000 Received: from gary.nlnetlabs.nl (gary.nlnetlabs.nl [IPv6:2001:7b8:206:1:216:76ff:feb8:1853]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.3/8.14.3) with ESMTP id n878DjVQ036918 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 7 Sep 2009 10:13:45 +0200 (CEST) (envelope-from wouter@nlnetlabs.nl) Message-ID: <4AA4C0B9.1020201@nlnetlabs.nl> Date: Mon, 07 Sep 2009 10:13:45 +0200 From: "W.C.A. Wijngaards" User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.1) Gecko/20090814 Fedora/3.0-2.6.b3.fc11 Thunderbird/3.0b3 MIME-Version: 1.0 To: namedroppers@ops.ietf.org Subject: Re: [dnsext] I-D Action:draft-ietf-dnsext-dnssec-bis-updates-09.txt References: <20090905213004.5F3763A6818@core3.amsl.com> In-Reply-To: <20090905213004.5F3763A6818@core3.amsl.com> X-Enigmail-Version: 0.96a Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (open.nlnetlabs.nl [IPv6:2001:7b8:206:1::53]); Mon, 07 Sep 2009 10:13:45 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 09/05/2009 11:30 PM, Internet-Drafts@ietf.org wrote: > Title : Clarifications and Implementation Notes for DNSSECbis > Author(s) : S. Weiler, D. Blacka > Filename : draft-ietf-dnsext-dnssec-bis-updates-09.txt There is still this text: 4.9. Nested Trust Anchors A DNSSEC validator may be configured such that, for a given response, more than one trust anchor could be used to validate the chain of trust to the response zone. For example, imagine a validator configured with trust anchors for "example." and "zone.example." When the validator is asked to validate a response to "www.sub.zone.example.", either trust anchor could apply. When presented with this situation, DNSSEC validators SHOULD try all applicable trust anchors until one succeeds. There are some scenarios where different behaviors, such as choosing the trust anchor closest to the QNAME of the response, may be desired. A DNSSEC validator MAY enable such behaviors as configurable overrides. Proposed text by me: When presented with this situation, DNSSEC validators SHOULD try all applicable trust anchors until one succeeds. If a higher trust anchor is used, the chain of trust MUST pass the name of the lowest trust anchor securely (or the answer becomes bogus). In the example, the name zone.example. must be signed even if the example. trust anchor is used. So example. provides a signed DS towards zone.example. that makes the zone.example. keys validate securely. This defeats a downgrade attack by poisoning the zone.example. DNSKEY answer if example. has an unsigned delegation to zone.example. The reason I want this is if everyone has a root trust anchor, but many TLDs are not signed. Then some people will configure lower trust anchors, say for example.com. If someone now poisons the example.com DNSKEY record so it fails, then going back to the root key and unsigned .com is a downgrade on the security of example.com. Therefore the 'try all trust anchors' is a security problem. This can be common if SLDs deploy DNSSEC before TLDs. Of course this is the reason for the override discussion already in the draft, since some people may not trust their parents with security. This concern is similar, but deals with unsigned TLDs. Of course I could loosely interpret the existing text and by default enable those configurable overrides ... Best regards, Wouter -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkqkwLkACgkQkDLqNwOhpPizJQCeKm4ZI+8UpJUdKVBCT8AdMg6O H6QAn2eMJ2aadKra5AH8Q9iZFBInqrg3 =rqXc -----END PGP SIGNATURE----- From jettisonsdbv2@cable-62-117-8-192.cust.blue-cable.de Mon Sep 7 14:55:08 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D1F103A6927 for ; Mon, 7 Sep 2009 14:55:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -67.02 X-Spam-Level: X-Spam-Status: No, score=-67.02 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, FM_SCHOOLING=5.657, HELO_DYNAMIC_DHCP=1.398, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_DE=0.35, HELO_EQ_MODEMCABLE=0.768, HOST_EQ_MODEMCABLE=1.368, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xckrj6F3rDSy for ; Mon, 7 Sep 2009 14:55:08 -0700 (PDT) Received: from cable-62-117-8-192.cust.blue-cable.de (cable-62-117-8-192.cust.blue-cable.de [62.117.8.192]) by core3.amsl.com (Postfix) with ESMTP id 02E2F3A6ACA for ; Mon, 7 Sep 2009 14:55:07 -0700 (PDT) Received: from 62.117.8.192 by p.nsm.ctmail.com; Mon, 7 Sep 2009 22:55:36 +0100 Date: Mon, 7 Sep 2009 22:55:36 +0100 From: "Bobbi Landwehr" X-Mailer: The Bat! (v2.00.18) Educational Reply-To: jettisonsdbv2@cable-62-117-8-192.cust.blue-cable.de X-Priority: 3 (Normal) Message-ID: <267709424.78961378132725@cable-62-117-8-192.cust.blue-cable.de> To: dnsext-archive@ietf.org Subject: Need Promotion MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Now you will easily get legal degree in only 4-5 weeks on base of your professional experience We will help you get a Degree:- Bachelors, Masters and PhD Call us right now (1-213-403-0133) Drop us your msg, with your full name and contact number so we can call you back. From paddiesov@126.115.70-86.rev.gaoland.net Mon Sep 7 15:01:37 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5D9123A6AD0 for ; Mon, 7 Sep 2009 15:01:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -69.996 X-Spam-Level: X-Spam-Status: No, score=-69.996 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_SCHOOLING=5.657, HELO_DYNAMIC_IPADDR2=4.395, HELO_DYNAMIC_SPLIT_IP=3.493, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XUvHKJbCSzAJ for ; Mon, 7 Sep 2009 15:01:36 -0700 (PDT) Received: from 126.115.70-86.rev.gaoland.net (126.115.70-86.rev.gaoland.net [86.70.115.126]) by core3.amsl.com (Postfix) with ESMTP id DC1013A68FE for ; Mon, 7 Sep 2009 15:01:35 -0700 (PDT) Received: from 86.70.115.126 by mail.darklite.ie; Mon, 7 Sep 2009 23:02:04 +0100 Message-ID: <01ca300f$37646710$7e734656@paddiesov> From: "Denny Vandeventer" To: Subject: New job Date: Mon, 7 Sep 2009 23:02:04 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Now you can get verifiable degree in 4-5 weeks on the base of your professional career We are here serving you with these programs.:- Bachelors, Masters and PhD Ring right now 1-213-403-0133 Drop us your msg, with your full name and contact number so we can call you back. From owner-namedroppers@ops.ietf.org Mon Sep 7 16:58:51 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0BB473A6A27; Mon, 7 Sep 2009 16:58:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.477 X-Spam-Level: X-Spam-Status: No, score=-1.477 tagged_above=-999 required=5 tests=[AWL=-0.770, BAYES_00=-2.599, J_CHICKENPOX_47=0.6, MISSING_HEADERS=1.292] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NvYS53UKmLH5; Mon, 7 Sep 2009 16:58:50 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E025B3A688A; Mon, 7 Sep 2009 16:58:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mkn9F-000DYy-IE for namedroppers-data0@psg.com; Mon, 07 Sep 2009 22:57:21 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mkmef-000BBy-DP for namedroppers@ops.ietf.org; Mon, 07 Sep 2009 22:29:45 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id B9A0BE601C for ; Mon, 7 Sep 2009 22:25:43 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n87MPbrp066141 for ; Tue, 8 Sep 2009 08:25:41 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909072225.n87MPbrp066141@drugs.dv.isc.org> Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <20090905213004.5F3763A6818@core3.amsl.com> <4AA4C0B9.1020201@nlnetlabs.nl> Subject: Re: [dnsext] I-D Action:draft-ietf-dnsext-dnssec-bis-updates-09.txt In-reply-to: Your message of "Mon, 07 Sep 2009 10:13:45 +0200." <4AA4C0B9.1020201@nlnetlabs.nl> Date: Tue, 08 Sep 2009 08:25:37 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <4AA4C0B9.1020201@nlnetlabs.nl>, "W.C.A. Wijngaards" writes: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 09/05/2009 11:30 PM, Internet-Drafts@ietf.org wrote: > > Title : Clarifications and Implementation Notes for DNSSECbis > > Author(s) : S. Weiler, D. Blacka > > Filename : draft-ietf-dnsext-dnssec-bis-updates-09.txt > > There is still this text: > 4.9. Nested Trust Anchors > > A DNSSEC validator may be configured such that, for a given response, > more than one trust anchor could be used to validate the chain of > trust to the response zone. For example, imagine a validator > configured with trust anchors for "example." and "zone.example." > When the validator is asked to validate a response to > "www.sub.zone.example.", either trust anchor could apply. > > When presented with this situation, DNSSEC validators SHOULD try all > applicable trust anchors until one succeeds. > > There are some scenarios where different behaviors, such as choosing > the trust anchor closest to the QNAME of the response, may be > desired. A DNSSEC validator MAY enable such behaviors as > configurable overrides. > > Proposed text by me: > > When presented with this situation, DNSSEC validators SHOULD try all > applicable trust anchors until one succeeds. If a higher trust > anchor is used, the chain of trust MUST pass the name of the > lowest trust anchor securely (or the answer becomes bogus). > In the example, the name zone.example. must be signed even if > the example. trust anchor is used. So example. provides a signed > DS towards zone.example. that makes the zone.example. keys > validate securely. This defeats a downgrade attack by poisoning the > zone.example. DNSKEY answer if example. has an unsigned delegation > to zone.example. > > The reason I want this is if everyone has a root trust anchor, but > many TLDs are not signed. Then some people will configure lower > trust anchors, say for example.com. If someone now poisons the > example.com DNSKEY record so it fails, then going back to the > root key and unsigned .com is a downgrade on the security of > example.com. Therefore the 'try all trust anchors' is a security > problem. > > This can be common if SLDs deploy DNSSEC before TLDs. > > Of course this is the reason for the override discussion already > in the draft, since some people may not trust their parents with > security. This concern is similar, but deals with unsigned TLDs. > Of course I could loosely interpret the existing text and by > default enable those configurable overrides ... > > Best regards, > Wouter > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.9 (GNU/Linux) > Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ > > iEYEARECAAYFAkqkwLkACgkQkDLqNwOhpPizJQCeKm4ZI+8UpJUdKVBCT8AdMg6O > H6QAn2eMJ2aadKra5AH8Q9iZFBInqrg3 > =rqXc > -----END PGP SIGNATURE----- Neither text is right. You want to choose any trust anchor at the deepest level and only move past a trust anchor if explicity configured to do so This is the only default secure policy that is possible. Even if you do move past you still need to remember that you got a bogus result from a deeper trust anchor and you can't accept insecure from the upper validation. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon Sep 7 21:58:44 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0EAAE3A67D2; Mon, 7 Sep 2009 21:58:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.892 X-Spam-Level: X-Spam-Status: No, score=-4.892 tagged_above=-999 required=5 tests=[AWL=-0.397, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G8RRIkSo-Bjg; Mon, 7 Sep 2009 21:58:43 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1DDD53A685B; Mon, 7 Sep 2009 21:58:43 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mksh1-000LGT-Um for namedroppers-data0@psg.com; Tue, 08 Sep 2009 04:52:35 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mksgm-000LDR-Nm; Tue, 08 Sep 2009 04:52:30 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n884owJT025191; Tue, 8 Sep 2009 04:50:58 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n884ooGm025190; Tue, 8 Sep 2009 04:50:50 GMT Date: Tue, 8 Sep 2009 04:50:50 +0000 From: bmanning@vacation.karoshi.com To: Ray.Bellis@nominet.org.uk Cc: Alex Bligh , Andrew Sullivan , bmanning@vacation.karoshi.com, namedroppers@ops.ietf.org, owner-namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed Message-ID: <20090908045050.GD25060@vacation.karoshi.com.> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <50F285E5AB4C3B727FD6395E@nimrod.home> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, Aug 28, 2009 at 11:29:01PM +0200, Ray.Bellis@nominet.org.uk wrote: > > "DNS Servers MUST support all mandatory standards track transports, > > which at the date of publication of this RFC means both UDP and > > TCP, though this list may be added to (or subtracted from) in the > > future." > > > > then let's say that, else it is no more clear than it was before. > > TCP support is NOT currently mandatory. > > See '6.1.3.2 of RFC 1123: > > "DNS resolvers and recursive servers MUST support UDP, and SHOULD > support TCP" > > We had significant discussion with the IESG when RFC 5625 was in last call > over this question. > > Ultimately 5625 says "MUST support TCP" for proxies, on the basis that if > your client supports TCP, and the recursor supports TCP, it's damned rude > of the middle-box sat in the path to sit their refusing to talk to either. > > Ray and what is said about authoriatiative servers? or did the august IESG folks forget about them? --bill From owner-namedroppers@ops.ietf.org Mon Sep 7 22:46:03 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E87A93A6863; Mon, 7 Sep 2009 22:46:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.409 X-Spam-Level: X-Spam-Status: No, score=-2.409 tagged_above=-999 required=5 tests=[AWL=0.190, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9gogX--zrupu; Mon, 7 Sep 2009 22:46:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CE8393A67D3; Mon, 7 Sep 2009 22:46:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MktSt-0000om-FQ for namedroppers-data0@psg.com; Tue, 08 Sep 2009 05:42:03 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MktSc-0000nB-D0 for namedroppers@ops.ietf.org; Tue, 08 Sep 2009 05:41:57 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 2B37EE6024; Tue, 8 Sep 2009 05:41:43 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n885fdum025668; Tue, 8 Sep 2009 15:41:39 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909080541.n885fdum025668@drugs.dv.isc.org> To: bmanning@vacation.karoshi.com Cc: Ray.Bellis@nominet.org.uk, Alex Bligh , Andrew Sullivan , namedroppers@ops.ietf.org From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <50F285E5AB4C3B727FD6395E@nimrod.home> <20090908045050.GD25060@vacation.karoshi.com.> Subject: Re: [dnsext] Editor needed In-reply-to: Your message of "Tue, 08 Sep 2009 04:50:50 GMT." <20090908045050.GD25060@vacation.karoshi.com.> Date: Tue, 08 Sep 2009 15:41:39 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <20090908045050.GD25060@vacation.karoshi.com.>, bmanning@vacation.ka roshi.com writes: > On Fri, Aug 28, 2009 at 11:29:01PM +0200, Ray.Bellis@nominet.org.uk wrote: > > > "DNS Servers MUST support all mandatory standards track transports, > > > which at the date of publication of this RFC means both UDP and > > > TCP, though this list may be added to (or subtracted from) in the > > > future." > > > > > > then let's say that, else it is no more clear than it was before. > > > > TCP support is NOT currently mandatory. > > > > See '6.1.3.2 of RFC 1123: > > > > "DNS resolvers and recursive servers MUST support UDP, and SHOULD > > support TCP" > > > > We had significant discussion with the IESG when RFC 5625 was in last call > > over this question. > > > > Ultimately 5625 says "MUST support TCP" for proxies, on the basis that if > > your client supports TCP, and the recursor supports TCP, it's damned rude > > of the middle-box sat in the path to sit their refusing to talk to either. > > > > Ray > > and what is said about authoriatiative servers? > or did the august IESG folks forget about them? Bill stop trolling. > --bill -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon Sep 7 22:56:04 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 914E63A6863; Mon, 7 Sep 2009 22:56:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.407 X-Spam-Level: X-Spam-Status: No, score=0.407 tagged_above=-999 required=5 tests=[AWL=-1.562, BAYES_00=-2.599, DATE_IN_PAST_24_48=1.219, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 35q5TVVqdooW; Mon, 7 Sep 2009 22:56:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 601413A679C; Mon, 7 Sep 2009 22:56:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MktdI-0001vE-49 for namedroppers-data0@psg.com; Tue, 08 Sep 2009 05:52:48 +0000 Received: from [212.9.189.167] (helo=mail.enyo.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mktd3-0001tL-Tc for namedroppers@ops.ietf.org; Tue, 08 Sep 2009 05:52:42 +0000 Received: from deneb.vpn.enyo.de ([212.9.189.177] helo=deneb.enyo.de) by mail.enyo.de with esmtp id 1Mktd1-000298-3h for namedroppers@ops.ietf.org; Tue, 08 Sep 2009 07:52:31 +0200 Received: from fw by deneb.enyo.de with local (Exim 4.69) (envelope-from ) id 1Mktd0-0001uL-P6 for namedroppers@ops.ietf.org; Tue, 08 Sep 2009 05:52:30 +0000 From: Florian Weimer To: namedroppers@ops.ietf.org Subject: [dnsext] Comments on draft-ietf-dnsext-dnssec-bis-updates-09 Date: Sun, 06 Sep 2009 14:35:56 +0000 Message-ID: <87tyzgqgxf.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Lines: 11 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Section 4.8 doesn't make sense to me. In practice, it's not observable if a caching resolver sets the CD bit on upstream queries because the need for upstream queries is not predictable. If the purpose of this section is to mandate distinct caches for CD=0 and CD=1 (or turn of caching completely for CD=1), then it needs to be clarified. I would like to see a permission to synthesize negative answers from NSEC/NSEC3 replies. This could be used to stop certain in-protocol reflective denial-of-service attacks, at least for small zones. (Such attacks already seem to happen.) From owner-namedroppers@ops.ietf.org Tue Sep 8 00:34:02 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2BC133A6931; Tue, 8 Sep 2009 00:34:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.413 X-Spam-Level: X-Spam-Status: No, score=-2.413 tagged_above=-999 required=5 tests=[AWL=0.186, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GlB7BAyqnSU3; Tue, 8 Sep 2009 00:34:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2D1DA3A68F0; Tue, 8 Sep 2009 00:34:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mkv8g-000BjI-3W for namedroppers-data0@psg.com; Tue, 08 Sep 2009 07:29:18 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mkv8U-000Bij-KD for namedroppers@ops.ietf.org; Tue, 08 Sep 2009 07:29:12 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id BCC1CE6024; Tue, 8 Sep 2009 07:29:05 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n887T3AX026714; Tue, 8 Sep 2009 17:29:03 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909080729.n887T3AX026714@drugs.dv.isc.org> To: Florian Weimer Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <87tyzgqgxf.fsf@mid.deneb.enyo.de> Subject: Re: [dnsext] Comments on draft-ietf-dnsext-dnssec-bis-updates-09 In-reply-to: Your message of "Sun, 06 Sep 2009 14:35:56 GMT." <87tyzgqgxf.fsf@mid.deneb.enyo.de> Date: Tue, 08 Sep 2009 17:29:03 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <87tyzgqgxf.fsf@mid.deneb.enyo.de>, Florian Weimer writes: > Section 4.8 doesn't make sense to me. In practice, it's not > observable if a caching resolver sets the CD bit on upstream queries > because the need for upstream queries is not predictable. If the > purpose of this section is to mandate distinct caches for CD=0 and > CD=1 (or turn of caching completely for CD=1), then it needs to be > clarified. The point is to be able to get answers which would normally be blocked by validating recursive servers regardless of the number of validating recursive servers are in the path. > I would like to see a permission to synthesize negative answers from > NSEC/NSEC3 replies. This could be used to stop certain in-protocol > reflective denial-of-service attacks, at least for small zones. (Such > attacks already seem to happen.) Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 8 07:04:49 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 04E893A699E; Tue, 8 Sep 2009 07:04:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RWrp83yhUubS; Tue, 8 Sep 2009 07:04:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EDCE03A67F7; Tue, 8 Sep 2009 07:04:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ml17z-000GyG-QP for namedroppers-data0@psg.com; Tue, 08 Sep 2009 13:52:59 +0000 Received: from [2001:1890:1112:1::20] (helo=mail.ietf.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ml15c-000GVE-OF for namedroppers@ops.ietf.org; Tue, 08 Sep 2009 13:51:42 +0000 Received: by core3.amsl.com (Postfix, from userid 30) id 4507228C136; Tue, 8 Sep 2009 06:49:59 -0700 (PDT) X-idtracker: yes To: IETF-Announce From: The IESG Reply-to: ietf@ietf.org CC: Subject: [dnsext] Last Call: draft-ietf-dnsext-dnssec-rsasha256 (Use of SHA-2 algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC) to Proposed Standard Message-Id: <20090908135000.4507228C136@core3.amsl.com> Date: Tue, 8 Sep 2009 06:50:00 -0700 (PDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: The IESG has received a request from the DNS Extensions WG (dnsext) to consider the following document: - 'Use of SHA-2 algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC ' as a Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2009-09-22. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. The file can be obtained via http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-rsasha256-14.txt IESG discussion can be tracked via https://datatracker.ietf.org/public/pidtracker.cgi?command=view_id&dTag=14237&rfc_flag=0 From owner-namedroppers@ops.ietf.org Tue Sep 8 08:41:51 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F21C3A685D; Tue, 8 Sep 2009 08:41:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.208 X-Spam-Level: X-Spam-Status: No, score=-1.208 tagged_above=-999 required=5 tests=[AWL=-0.713, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9xCJIuhfZK30; Tue, 8 Sep 2009 08:41:50 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3DBC53A67B3; Tue, 8 Sep 2009 08:41:50 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ml2h7-0003Mp-0f for namedroppers-data0@psg.com; Tue, 08 Sep 2009 15:33:21 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ml2gv-0003LA-CD for namedroppers@ops.ietf.org; Tue, 08 Sep 2009 15:33:17 +0000 Received: from Puki.ogud.com (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n88FX7et035590 for ; Tue, 8 Sep 2009 11:33:07 -0400 (EDT) (envelope-from ogud@ogud.com) Message-Id: <200909081533.n88FX7et035590@stora.ogud.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Tue, 08 Sep 2009 11:29:43 -0400 To: namedroppers@ops.ietf.org From: Olafur Gudmundsson Subject: [dnsext] Intermittent posting errors Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues over the last few days the mailing list has on occasion been rejecting messages posted, this is supposed to be fixed. Please report any messages that have been rejected, if you still have problems send me the bounces. thanks Olafur From owner-namedroppers@ops.ietf.org Tue Sep 8 12:28:24 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F9B43A68C9; Tue, 8 Sep 2009 12:28:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.008 X-Spam-Level: X-Spam-Status: No, score=-0.008 tagged_above=-999 required=5 tests=[AWL=-0.758, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sReI2UfvjD3d; Tue, 8 Sep 2009 12:28:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 44DBA3A6B0C; Tue, 8 Sep 2009 12:28:17 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ml6Gs-000EhO-0O for namedroppers-data0@psg.com; Tue, 08 Sep 2009 19:22:30 +0000 Received: from [212.9.189.167] (helo=mail.enyo.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ml6GX-000Ed1-B2 for namedroppers@ops.ietf.org; Tue, 08 Sep 2009 19:22:20 +0000 Received: from deneb.vpn.enyo.de ([212.9.189.177] helo=deneb.enyo.de) by mail.enyo.de with esmtp id 1Ml6GU-0003m0-Hy; Tue, 08 Sep 2009 21:22:06 +0200 Received: from fw by deneb.enyo.de with local (Exim 4.69) (envelope-from ) id 1Ml6GU-0000I3-2s; Tue, 08 Sep 2009 19:22:06 +0000 From: Florian Weimer To: Mark Andrews Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Comments on draft-ietf-dnsext-dnssec-bis-updates-09 References: <87tyzgqgxf.fsf@mid.deneb.enyo.de> <200909080729.n887T3AX026714@drugs.dv.isc.org> Date: Tue, 08 Sep 2009 19:22:06 +0000 In-Reply-To: <200909080729.n887T3AX026714@drugs.dv.isc.org> (Mark Andrews's message of "Tue, 08 Sep 2009 17:29:03 +1000") Message-ID: <87bpllmech.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: * Mark Andrews: > In message <87tyzgqgxf.fsf@mid.deneb.enyo.de>, Florian Weimer writes: >> Section 4.8 doesn't make sense to me. In practice, it's not >> observable if a caching resolver sets the CD bit on upstream queries >> because the need for upstream queries is not predictable. If the >> purpose of this section is to mandate distinct caches for CD=0 and >> CD=1 (or turn of caching completely for CD=1), then it needs to be >> clarified. > > The point is to be able to get answers which would normally be > blocked by validating recursive servers regardless of the number > of validating recursive servers are in the path. But RFC 4035 says this in section 3.2.2: | If the resolver side implements a BAD cache (see Section 4.7) and the | name server side receives a query that matches an entry in the | resolver side's BAD cache, the name server side's response depends on | the state of the CD bit in the original query. If the CD bit is set, | the name server side SHOULD return the data from the BAD cache; if | the CD bit is not set, the name server side MUST return RCODE 2 | (server failure). The latter case appears to be the relevant one to me, so I still don't see how the advice in section 4.8 of the draft matters in practice. If you want to achieve what you said, you need CD-specific caching (or uncached processing of CD=1 queries). From owner-namedroppers@ops.ietf.org Tue Sep 8 19:42:23 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 04EA93A6A06; Tue, 8 Sep 2009 19:42:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.407 X-Spam-Level: X-Spam-Status: No, score=-2.407 tagged_above=-999 required=5 tests=[AWL=0.192, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EHwrx+qdqdgA; Tue, 8 Sep 2009 19:42:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 10E6F3A67ED; Tue, 8 Sep 2009 19:42:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MlD44-000L6J-39 for namedroppers-data0@psg.com; Wed, 09 Sep 2009 02:37:44 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MlD3s-000L5P-JV for namedroppers@ops.ietf.org; Wed, 09 Sep 2009 02:37:42 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id A2665E6023; Wed, 9 Sep 2009 02:37:31 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n892bQ7V042388; Wed, 9 Sep 2009 12:37:27 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909090237.n892bQ7V042388@drugs.dv.isc.org> To: Florian Weimer Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <87tyzgqgxf.fsf@mid.deneb.enyo.de> <200909080729.n887T3AX026714@drugs.dv.isc.org> <87bpllmech.fsf@mid.deneb.enyo.de> Subject: Re: [dnsext] Comments on draft-ietf-dnsext-dnssec-bis-updates-09 In-reply-to: Your message of "Tue, 08 Sep 2009 19:22:06 GMT." <87bpllmech.fsf@mid.deneb.enyo.de> Date: Wed, 09 Sep 2009 12:37:26 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <87bpllmech.fsf@mid.deneb.enyo.de>, Florian Weimer writes: > * Mark Andrews: > > > In message <87tyzgqgxf.fsf@mid.deneb.enyo.de>, Florian Weimer writes: > >> Section 4.8 doesn't make sense to me. In practice, it's not > >> observable if a caching resolver sets the CD bit on upstream queries > >> because the need for upstream queries is not predictable. If the > >> purpose of this section is to mandate distinct caches for CD=0 and > >> CD=1 (or turn of caching completely for CD=1), then it needs to be > >> clarified. > > > > The point is to be able to get answers which would normally be > > blocked by validating recursive servers regardless of the number > > of validating recursive servers are in the path. > > But RFC 4035 says this in section 3.2.2: > > | If the resolver side implements a BAD cache (see Section 4.7) and the > | name server side receives a query that matches an entry in the > | resolver side's BAD cache, the name server side's response depends on > | the state of the CD bit in the original query. If the CD bit is set, > | the name server side SHOULD return the data from the BAD cache; if > | the CD bit is not set, the name server side MUST return RCODE 2 > | (server failure). > > The latter case appears to be the relevant one to me, so I still don't > see how the advice in section 4.8 of the draft matters in practice. You still need to make upstream queries to populate either the normal cache or a BAD cache (assuming you have one). Anything in a BAD cache would have had CD=1 on the upstream query because to enter the BAD cache it had to fail validation and to validate you make CD=1 queries. > If you want to achieve what you said, you need CD-specific caching (or > uncached processing of CD=1 queries). -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From konifoundation@amac.com Thu Sep 10 11:41:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CC7E93A6869 for ; Thu, 10 Sep 2009 11:41:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.326 X-Spam-Level: X-Spam-Status: No, score=-15.326 tagged_above=-999 required=5 tests=[BAYES_60=1, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_DHCP=1.398, HELO_DYNAMIC_IPADDR=2.426, HTML_IMAGE_ONLY_04=2.041, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_HTML_A_BODY=0.742, SARE_HTML_IMG_ONLY=1.666, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NMzD-gg5W5lD for ; Thu, 10 Sep 2009 11:41:14 -0700 (PDT) Received: from cust-210-126.on4.ontelecoms.gr (cust-210-126.on4.ontelecoms.gr [92.118.210.126]) by core3.amsl.com (Postfix) with SMTP id 7F6DF3A69AD for ; Thu, 10 Sep 2009 11:41:11 -0700 (PDT) To: Subject: Your order From: MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20090910184112.7F6DF3A69AD@core3.amsl.com> Date: Thu, 10 Sep 2009 11:41:11 -0700 (PDT) Having trouble viewing this email? Click here to view as a webpage. From owner-namedroppers@ops.ietf.org Thu Sep 10 23:11:35 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7ED3B3A689E; Thu, 10 Sep 2009 23:11:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.105 X-Spam-Level: X-Spam-Status: No, score=0.105 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_43=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KOVPVi6Qwd0e; Thu, 10 Sep 2009 23:11:34 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 86C283A683D; Thu, 10 Sep 2009 23:11:31 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MlzFV-000OsQ-Oj for namedroppers-data0@psg.com; Fri, 11 Sep 2009 06:04:45 +0000 Received: from [75.102.55.14] (helo=m1.sjc1.everydns.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MlzFL-000Oqx-E6 for namedroppers@ops.ietf.org; Fri, 11 Sep 2009 06:04:43 +0000 Received: from mail.perfectemail.net ([71.6.170.56] helo=ellie.everybox.com) by m1.sjc1.everydns.com with esmtp (Exim 4.63) (envelope-from ) id 1MlzFG-0006rE-OI for namedroppers@ops.ietf.org; Fri, 11 Sep 2009 06:04:30 +0000 Received: (qmail 7846 invoked by uid 112); 11 Sep 2009 06:04:30 -0000 Received: from 67-215-69-5.ip.opendns.com by ellie.everybox.com (envelope-from , uid 105) with qmail-scanner-2.05 (spamassassin: 3.2.5. Clear:RC:1(67.215.69.5):. Processed in 0.012017 secs); 11 Sep 2009 06:04:30 -0000 Received: from 67-215-69-5.ip.opendns.com (HELO Davids-MacBook-Pro.local) (67.215.69.5) by ellie.everybox.com with SMTP; 11 Sep 2009 06:04:30 -0000 Message-ID: <4AA9E86C.10302@everydns.net> Date: Thu, 10 Sep 2009 23:04:28 -0700 From: David Ulevitch User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.4pre) Gecko/20090908 Shredder/3.0b4pre MIME-Version: 1.0 To: Paul Hoffman CC: George Barwood , bmanning@vacation.karoshi.com, Alex Bligh , Andrew Sullivan , namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 8/28/09 7:36 AM, Paul Hoffman wrote: > At 1:40 PM +0100 8/28/09, George Barwood wrote: >> Actually I think Andrews suggestion is too strong. >> >> I think TCP should be mandatory only for authorities that generate >> responses in excess of 512 bytes. > > Does this make sense from an operational standpoint? That is, assume > that I am an authority who today doesn't emit responses in excess of > 512 bytes, and I set up a system that will *only* do UDP, and a later > improvement to DNS (like DNSSEC, but there could be others) would > cause me to emit responses that are now longer. I will then have a > broken system. I should now update the system to also, but I don't > actually have to (the problems are for other people, not me), and so > I now have an operationally broken system that looks OK to me. > > We may be better off telling people that they need to support UDP and > TCP from the beginning. There is no connection between this statement and the scenario offered. MUST'ing TCP is unnecessary and will cause more people to continue to violate the RFCs as the RFCs diverge further and further away from operational realities. -David From rewires7@ramezanirugs.com Fri Sep 11 02:45:21 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 100FE3A6A49; Fri, 11 Sep 2009 02:45:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.458 X-Spam-Level: X-Spam-Status: No, score=-6.458 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, GB_I_LETTER=-2, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_UNI=0.591, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SC_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HHD5G-6RdM-f; Fri, 11 Sep 2009 02:45:18 -0700 (PDT) Received: from 93-47-43-16.ip111.fastwebnet.it (93-47-43-16.ip111.fastwebnet.it [93.47.43.16]) by core3.amsl.com (Postfix) with ESMTP id 18CBF3A6B4E; Fri, 11 Sep 2009 02:45:17 -0700 (PDT) Received: from 93.47.43.16 by smtp.localonline.co.uk; Fri, 11 Sep 2009 11:45:31 +0100 Date: Fri, 11 Sep 2009 11:45:31 +0100 From: "Katheryn Roberson" X-Mailer: The Bat! (v3.80.03) Professional Reply-To: rewires7@ramezanirugs.com X-Priority: 3 (Normal) Message-ID: <616569677.37760708293737@ramezanirugs.com> To: dccp-owner@ietf.org Subject: Vitaminize your desire! MIME-Version: 1.0 Content-Type: text/html; charset=Windows-1252 Content-Transfer-Encoding: 7bit

DAILY NEWSLETTER
  
Friday, September 11
Top News
For frequent
Good-shagging potion!

Your manhood is not the enemy to you, just give it the right boost. Blue pilules with 30% discounts. Its analogs that act for about 48 hours (comparing to usual 4-5 hours). ULTRA Fast shipping. Reliable information on contra-indications and principles of pilules' work presented on our site.
You are currently subscribed as: dccp-owner@ietf.org
Add us to your email address book to ensure delivery
Forward to a Friend | Manage Subscription | Subscribe | Unsubscribe
From owner-namedroppers@ops.ietf.org Sun Sep 13 22:00:42 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 99CF628C0E7; Sun, 13 Sep 2009 22:00:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.1 X-Spam-Level: X-Spam-Status: No, score=-1.1 tagged_above=-999 required=5 tests=[AWL=-1.500, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id afbV1Wtux18y; Sun, 13 Sep 2009 22:00:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CAEAF28C0E6; Sun, 13 Sep 2009 22:00:41 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mn3ab-0001Xn-MG for namedroppers-data0@psg.com; Mon, 14 Sep 2009 04:54:57 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mn3aR-0001WH-9S for namedroppers@ops.ietf.org; Mon, 14 Sep 2009 04:54:54 +0000 Received: from crankycanuck.ca (unknown [59.163.69.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 28EDF2FE8CE2 for ; Mon, 14 Sep 2009 04:54:44 +0000 (UTC) Date: Mon, 14 Sep 2009 00:54:37 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: [dnsext] Meeting at IETF 76 Message-ID: <20090914045435.GA781@shinkuro.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues, The Chairs believe there were sufficient open issues at the end of the Stockholm meeting, and little enough progress on those issues since, to warrant another meeting in Hiroshima. Accordingly, we have requested a 2 hour slot in Hiroshima. As our new charter has been approved by the IESG, we can add a number of new work items. If you have concern about this plan, please speak up as soon as possible. Best regards, Olafur & Andrew -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon Sep 14 10:22:30 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D4903A6A6B; Mon, 14 Sep 2009 10:22:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.219 X-Spam-Level: X-Spam-Status: No, score=-1.219 tagged_above=-999 required=5 tests=[AWL=-0.724, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8lbVGnCUKFU0; Mon, 14 Sep 2009 10:22:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3B1AC3A68D1; Mon, 14 Sep 2009 10:22:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnFBx-00003t-Fh for namedroppers-data0@psg.com; Mon, 14 Sep 2009 17:18:17 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnFBn-00001y-BO for namedroppers@ops.ietf.org; Mon, 14 Sep 2009 17:18:15 +0000 Received: from Puki.ogud.com (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n8EHI5U4004295 for ; Mon, 14 Sep 2009 13:18:05 -0400 (EDT) (envelope-from ogud@ogud.com) Message-Id: <200909141718.n8EHI5U4004295@stora.ogud.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 14 Sep 2009 13:18:01 -0400 To: namedroppers@ops.ietf.org From: Olafur Gudmundsson/DNSEXT chair Subject: [dnsext] GOST DNSSEC implementations? Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Has anyone thought about/attempted to implement the algorithms proposed in: http://tools.ietf.org/id/draft-dolmatov-dnsext-dnssec-gost-01.txt As more than 5 people volunteered to review, the next version of the draft will be an official WG document: draft-ietf-dnsext-dnssec-gost-00.txt The draft needs feedback on its quality and presentation, before we can start WGLC. Editor has asked for feedback the draft, please take a look at the draft and send in comments, including "looks fine". It would be nice to have 2+ implementations of tools inter operating by the time working group does LC this document, scheduled for later this year. Actions that need to be performed are: DS calculation GOST key generation GOST Signature generation /verification Olafur will coordinate with implementors test algorithm numbers (will be different from the ones that IANA will allocate). Documents describing the GOST algorithms are available in English: http://tools.ietf.org/html/draft-dolmatov-cryptocom-gost341194-01 http://tools.ietf.org/html/draft-dolmatov-cryptocom-gost34102001-03 Olafur & Andrew From owner-namedroppers@ops.ietf.org Mon Sep 14 12:19:03 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 056CD3A6A8A; Mon, 14 Sep 2009 12:19:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.645 X-Spam-Level: X-Spam-Status: No, score=-3.645 tagged_above=-999 required=5 tests=[AWL=-0.346, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aim5DN5mFSeF; Mon, 14 Sep 2009 12:19:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1F6D43A6925; Mon, 14 Sep 2009 12:18:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnGzK-000BhA-TP for namedroppers-data0@psg.com; Mon, 14 Sep 2009 19:13:22 +0000 Received: from [131.111.8.135] (helo=ppsw-5.csi.cam.ac.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnGz7-000Bg6-Oh for namedroppers@ops.ietf.org; Mon, 14 Sep 2009 19:13:20 +0000 X-Cam-AntiVirus: no malware found X-Cam-SpamDetails: not scanned X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Received: from hermes-1.csi.cam.ac.uk ([131.111.8.51]:41584) by ppsw-5.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.155]:25) with esmtpa (EXTERNAL:fanf2) id 1MnGz6-0006ej-H5 (Exim 4.70) (return-path ); Mon, 14 Sep 2009 20:13:08 +0100 Received: from fanf2 (helo=localhost) by hermes-1.csi.cam.ac.uk (hermes.cam.ac.uk) with local-esmtp id 1MnGz6-0006Rh-9B (Exim 4.67) (return-path ); Mon, 14 Sep 2009 20:13:08 +0100 Date: Mon, 14 Sep 2009 20:13:08 +0100 From: Tony Finch X-X-Sender: fanf2@hermes-1.csi.cam.ac.uk To: George Barwood cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] DNS transport In-Reply-To: <173630D6EBA14713879E7942DE630AA3@localhost> Message-ID: References: <173630D6EBA14713879E7942DE630AA3@localhost> User-Agent: Alpine 2.00 (LSU 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, 14 Sep 2009, George Barwood wrote: > > (1) One objection to TCP that the handshake increases latency. > > I think it might be possible to get round this by servers using long-life > SYN-cookies, and clients retaining and re-using the SYN-cookie when > a new connection is needed. Sounds like TCP for Transactions (RFC 1644). See http://tcp-impl.grc.nasa.gov/tcp-impl/list/archive/1292.html Tony. -- f.anthony.n.finch http://dotat.at/ GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS. MODERATE OR GOOD. From owner-namedroppers@ops.ietf.org Mon Sep 14 13:34:27 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1C93C3A6984; Mon, 14 Sep 2009 13:34:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.203 X-Spam-Level: X-Spam-Status: No, score=0.203 tagged_above=-999 required=5 tests=[AWL=0.076, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 90AYOJn+-rt5; Mon, 14 Sep 2009 13:34:26 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F075B3A67D3; Mon, 14 Sep 2009 13:34:25 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnIBP-000J3T-4r for namedroppers-data0@psg.com; Mon, 14 Sep 2009 20:29:55 +0000 Received: from [209.85.216.185] (helo=mail-px0-f185.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnIBF-000J15-4d for namedroppers@ops.ietf.org; Mon, 14 Sep 2009 20:29:52 +0000 Received: by pxi15 with SMTP id 15so2637669pxi.25 for ; Mon, 14 Sep 2009 13:29:44 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.68.14 with SMTP id q14mr12118295waa.103.1252960183190; Mon, 14 Sep 2009 13:29:43 -0700 (PDT) Date: Mon, 14 Sep 2009 13:29:43 -0700 Message-ID: Subject: [dnsext] Nominum doing something DNSCurve-y? From: Matthew Dempsky To: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: A coworker discovered this earlier today: $ dig +short -t ns skyebynominum.com zq708vote6hqo5uvbi2pult2dutvjq0u5evd075o9n214m3e15fltha0.skyedns.com. zq70nmpntigu1dusbi446et0l8lb4c172rkrqnchm1i635nr058ovkvg.skyedns.com. zq70rdqlv91r6t7lu5vk527cjhn3ha7qgtqoo24tsrikbt8fdvurjhi0.skyedns.com. zq70sn1287vcrbj1hgvihec8rgisjok385rrptc45magateh14409gtg.skyedns.com. It looks similar to DNSCurve, except with the magic string "zq70" instead of "uz5" and using RFC 4648's base32hex instead of DNSCurve's base-32 encoding. When decoded, this yields a 32 byte string, and the high bit of the last byte of each string is cleared: just like a Curve25519 public key. (Of course, this could also be coincidental.) I tried sending a DNSCurve streamlined query to one of the name servers, but it was rejected with a FORMERR. Does anyone know more about this? Maybe not actually DNSCurve-y at all? From owner-namedroppers@ops.ietf.org Mon Sep 14 16:05:52 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 88DC93A6897; Mon, 14 Sep 2009 16:05:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.714 X-Spam-Level: X-Spam-Status: No, score=-4.714 tagged_above=-999 required=5 tests=[AWL=-0.277, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aVQYDXpHUMOf; Mon, 14 Sep 2009 16:05:51 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 800843A683D; Mon, 14 Sep 2009 16:05:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnKXS-000BCh-5p for namedroppers-data0@psg.com; Mon, 14 Sep 2009 23:00:50 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnKXI-000BC2-0t for namedroppers@ops.ietf.org; Mon, 14 Sep 2009 23:00:47 +0000 Received: from SJC-Office-NAT-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 8E84AA9443B; Mon, 14 Sep 2009 23:00:38 +0000 (UTC) Message-ID: <4AAECB16.6050507@mail-abuse.org> Date: Mon, 14 Sep 2009 16:00:38 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: George Barwood CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] DNS transport References: <173630D6EBA14713879E7942DE630AA3@localhost> In-Reply-To: <173630D6EBA14713879E7942DE630AA3@localhost> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/14/09 8:04 AM, George Barwood wrote: > Some wild thoughts I have had recently. > > (1) One objection to TCP that the handshake increases latency. > > I think it might be possible to get round this by servers using long-life > SYN-cookies, and clients retaining and re-using the SYN-cookie when > a new connection is needed. Perhaps this is suggesting a scheme to establish a long-lived client credentials based upon objects received from servers as a method to mitigate reflected attack. T/TCP, as another alternative, but it creates several security vulnerabilities. > (2) Another objection is that the server will need large amounts of buffer > space for un-acknowledged data, enabling denial-of-service attacks on > this buffering. > > I think a possible solution to this is to implement a TCP Send primitive > that takes an Object rather than an array of bytes. SCTP provides message fragmentation where DNS messages would map to Chunks. SCTP also permits out-of-order and unreliable delivery to avoid server's retention of unacknowledged data. SCTP first exchanges cookie and verification tags to avoid blind spoofing and reflected attack. When associations are retained over a burst of transactions, SCTP would provide overall low latency exchanges that would not suffer from head-of-line blocking. > The Object would have a method > > Read( buffer, offset, count ) > > to allow the TCP layer to obtain bytes as required. SCTP can also tunnel over UDP and adapt to existing firewall constraints. > This should reduce the memory requirements considerably, since > a very compact representation of the response should be possible, > except for queries for non-existent domains, where up to 256 bytes > are required to store the non-existent domain name. Possibly DO=1 > NXDOMAIN response packets could be amended to not return > a copy of the question, when server memory is low. > > This may upset resolvers which expect a copy of the question to be returned, > however since NXDOMAIN conditions are not entirely normal, this might > be ok. SCTP's Verification Tag can safely replace missing questions and still avoid blind spoofing. However, over UDP or TCP transports, DNS responses missing DNS questions might be re-attempted. > (3) Should servers be able to terminate TCP connections that are not > making timely progress. TCP should not be expected to function when resources are low. > (4) It's not clear if servers are allowed to truncate UDP responses > unilaterally. That is can a server choose to truncate a UDP response > at say 512 bytes, even though the client has requested EDNS @4096? > I think this should be allowed, and in fact encouraged, since it > limits amplification attacks. This suggests that clients should only > bother with UDP for unsigned zones, with TCP being the standard > transport for signed zones. SCTP better handles multiple questions over a single association as a means to avoid setup latency. SCTP also automates Auto-Close after the lapse of a programmable number of seconds. It seems DNSSEC support could be constrained to just the SCTP transport. -Doug From owner-namedroppers@ops.ietf.org Tue Sep 15 01:59:57 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D51DF3A6895; Tue, 15 Sep 2009 01:59:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.577 X-Spam-Level: X-Spam-Status: No, score=-102.577 tagged_above=-999 required=5 tests=[AWL=0.023, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KK0MqL1nbQ0S; Tue, 15 Sep 2009 01:59:56 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AED4F3A67B8; Tue, 15 Sep 2009 01:59:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnTqR-000HfU-UF for namedroppers-data0@psg.com; Tue, 15 Sep 2009 08:57:03 +0000 Received: from [2001:7b8:206:1::1] (helo=open.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnTqE-000Hbj-Hz for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 08:56:59 +0000 Received: from gary.nlnetlabs.nl (gary.nlnetlabs.nl [IPv6:2001:7b8:206:1:216:76ff:feb8:1853]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.3/8.14.3) with ESMTP id n8F8ujdZ028085 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 15 Sep 2009 10:56:46 +0200 (CEST) (envelope-from wouter@nlnetlabs.nl) Message-ID: <4AAF56CD.6060401@nlnetlabs.nl> Date: Tue, 15 Sep 2009 10:56:45 +0200 From: "W.C.A. Wijngaards" User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.1) Gecko/20090814 Fedora/3.0-2.6.b3.fc11 Thunderbird/3.0b3 MIME-Version: 1.0 To: Olafur Gudmundsson/DNSEXT chair CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? References: <200909141718.n8EHI5U4004295@stora.ogud.com> In-Reply-To: <200909141718.n8EHI5U4004295@stora.ogud.com> X-Enigmail-Version: 0.96a Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (open.nlnetlabs.nl [IPv6:2001:7b8:206:1::1]); Tue, 15 Sep 2009 10:56:46 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 09/14/2009 07:18 PM, Olafur Gudmundsson/DNSEXT chair wrote: > Has anyone thought about/attempted to implement the algorithms proposed > in: > http://tools.ietf.org/id/draft-dolmatov-dnsext-dnssec-gost-01.txt Yes, I have experimental implementations: ldns and unbound (with - --enable-gost and ssl 1.0). Comments on draft: fine with me, nit points: * I would like examples of a DS record, DNSKEY record and signature with GOST (with a long expiration date). This can be done once algorithm numbers exist, of course. * The file format for the GOST private key. I chose to put a base64 blurb of the DER encoded private key on one line into a text file after the usual Private-Key-Format: and Algorithm: lines. For example in the file Kexample.com.+XXX+41891.private: Private-key-format: v1.2 Algorithm: XXX (GOST) MEUCAQAwHAY[[...more...]]v0QKoL3p/wOX/3kySQ3Q= For RSASHA256 this was not an issue, since the private key for RSA does not change if you use SHA256. Best regards, Wouter -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkqvVs0ACgkQkDLqNwOhpPh1IQCcDMeAa/qtVv/zKgrUOzctRoc7 g8IAnRi+iGIx1fjrX9yEhAsMcdSmPdQC =4AUK -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Tue Sep 15 04:27:03 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6ECDC28C0F8; Tue, 15 Sep 2009 04:27:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.614 X-Spam-Level: X-Spam-Status: No, score=-3.614 tagged_above=-999 required=5 tests=[AWL=-0.315, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 14xpFbcbOd98; Tue, 15 Sep 2009 04:27:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 505FC28C0F3; Tue, 15 Sep 2009 04:27:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnW7J-0006z0-HE for namedroppers-data0@psg.com; Tue, 15 Sep 2009 11:22:37 +0000 Received: from [131.111.8.130] (helo=ppsw-0.csi.cam.ac.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnW77-0006xp-DZ for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 11:22:34 +0000 X-Cam-AntiVirus: no malware found X-Cam-SpamDetails: not scanned X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Received: from hermes-1.csi.cam.ac.uk ([131.111.8.51]:53101) by ppsw-0.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.150]:25) with esmtpa (EXTERNAL:fanf2) id 1MnW76-0000gE-0T (Exim 4.70) for namedroppers@ops.ietf.org (return-path ); Tue, 15 Sep 2009 12:22:24 +0100 Received: from fanf2 (helo=localhost) by hermes-1.csi.cam.ac.uk (hermes.cam.ac.uk) with local-esmtp id 1MnW76-0004ny-4D (Exim 4.67) for namedroppers@ops.ietf.org (return-path ); Tue, 15 Sep 2009 12:22:24 +0100 Date: Tue, 15 Sep 2009 12:22:24 +0100 From: Tony Finch X-X-Sender: fanf2@hermes-1.csi.cam.ac.uk To: namedroppers@ops.ietf.org Subject: Re: [dnsext] DNS transport In-Reply-To: Message-ID: References: <173630D6EBA14713879E7942DE630AA3@localhost> User-Agent: Alpine 2.00 (LSU 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, 14 Sep 2009, Tony Finch wrote: > > Sounds like TCP for Transactions (RFC 1644). See > http://tcp-impl.grc.nasa.gov/tcp-impl/list/archive/1292.html Er, sorry about the broken link. Looks like some time in the last seven years it moved to http://roland.grc.nasa.gov/tcp-impl/list/archive/1292.html Tony. -- f.anthony.n.finch http://dotat.at/ GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS. MODERATE OR GOOD. From owner-namedroppers@ops.ietf.org Tue Sep 15 06:37:39 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A4A1C3A691B; Tue, 15 Sep 2009 06:37:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.905 X-Spam-Level: **** X-Spam-Status: No, score=4.905 tagged_above=-999 required=5 tests=[AWL=-0.479, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LG5R4GdBU3U0; Tue, 15 Sep 2009 06:37:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 63C1E3A681F; Tue, 15 Sep 2009 06:37:38 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnY8u-000O66-NC for namedroppers-data0@psg.com; Tue, 15 Sep 2009 13:32:24 +0000 Received: from [195.188.213.8] (helo=smtp-out5.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnY8i-000O4y-Fz for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 13:32:22 +0000 Received: from [172.23.170.144] (helo=anti-virus03-07) by smtp-out5.blueyonder.co.uk with smtp (Exim 4.52) id 1MnY8h-0004zU-7x; Tue, 15 Sep 2009 14:32:11 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out1.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MnY8g-0001gb-6V; Tue, 15 Sep 2009 14:32:10 +0100 Message-ID: From: "George Barwood" To: "Tony Finch" , References: <173630D6EBA14713879E7942DE630AA3@localhost> Subject: Re: [dnsext] DNS transport Date: Tue, 15 Sep 2009 14:32:07 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: LS0tLS0gT3JpZ2luYWwgTWVzc2FnZSAtLS0tLSANCkZyb206ICJUb255IEZpbmNoIiA8ZG90QGRv dGF0LmF0Pg0KVG86IDxuYW1lZHJvcHBlcnNAb3BzLmlldGYub3JnPg0KU2VudDogVHVlc2RheSwg U2VwdGVtYmVyIDE1LCAyMDA5IDEyOjIyIFBNDQpTdWJqZWN0OiBSZTogW2Ruc2V4dF0gRE5TIHRy YW5zcG9ydA0KDQoNCj4gT24gTW9uLCAxNCBTZXAgMjAwOSwgVG9ueSBGaW5jaCB3cm90ZToNCj4+ DQo+PiBTb3VuZHMgbGlrZSBUQ1AgZm9yIFRyYW5zYWN0aW9ucyAoUkZDIDE2NDQpLiBTZWUNCj4+ IGh0dHA6Ly90Y3AtaW1wbC5ncmMubmFzYS5nb3YvdGNwLWltcGwvbGlzdC9hcmNoaXZlLzEyOTIu aHRtbA0KPiANCj4gRXIsIHNvcnJ5IGFib3V0IHRoZSBicm9rZW4gbGluay4gTG9va3MgbGlrZSBz b21lIHRpbWUgaW4gdGhlIGxhc3Qgc2V2ZW4NCj4geWVhcnMgaXQgbW92ZWQgdG8gaHR0cDovL3Jv bGFuZC5ncmMubmFzYS5nb3YvdGNwLWltcGwvbGlzdC9hcmNoaXZlLzEyOTIuaHRtbA0KDQpUaGF0 IGRvY3VtZW50IGNvbnRhaW5zIHRoZSBmb2xsb3dpbmcgc3RhdGVtZW50LCB3aGljaCBzZWVtcyB3 cm9uZzoNCg0KIiAgVGhlcmUgaGF2ZSBiZWVuIHNldmVyYWwgc3VnZ2VzdGlvbnMgb24gbWV0aG9k cyBmb3IgY3JlYXRpbmcgSVNTZXMgDQogICB0aGF0IG1pZ2h0IHByZXZlbnQgZ3Vlc3NpbmcsIG9y IGF0IGxlYXN0IG1ha2UgaXQgbW9yZSBkaWZmaWN1bHQuIA0KICAgTW9zdCBvZiB0aGVzZSBpbnZv bHZlIHNpbXBseSB1c2luZyBhIHJhbmRvbSBudW1iZXIgZm9yIHRoZSBJU1MsIG9yIA0KICAgcmFu ZG9taXppbmcgdGhlIHBlcmlvZGljIGluY3JlbWVudCwgaW4gYSB3YXkgdGhhdCB3b3VsZCBicmVh ayBUQ1AncyANCiAgIGFiaWxpdHkgdG8gcmVjb2duaXplIGRhdGEgZnJvbSBhbiBvbGQgaW5zdGFu Y2Ugb2YgYSBjb25uZWN0aW9uLiANCiAgIFRoZXNlIG1ldGhvZHMgY2FuIGJlIGRpc2NhcmRlZC4g Ig0KDQpNeSB1bmRlcnN0YW5kaW5nIGlzIHRoYXQgdGhlIFRDUCBUSU1FX1dBSVQgc3RhdGUgcHJv dGVjdHMgYWdhaW5zdA0Kb2xkIHBhY2tldHMgKCB3aXRoIG9sZCBzZXF1ZW5jZSBudW1iZXJzICkg YmVpbmcgYSBwcm9ibGVtLg0KVGhhdCBpcywgYSBzb3VyY2UgcG9ydCBjYW5ub3QgYmUgc2FmZWx5 IHJlLXVzZWQgZm9yIGEgZ2l2ZW4gVENQIGRlc3RpbmF0aW9uDQp1bnRpbCBhIHN1aXRhYmxlIHRp bWUgaGFzIGVsYXBzZWQuIFRoaXMgZG9lcyBub3Qgc2VlbSB0byBiZSBhIHNldmVyZSByZXN0cmlj dGlvbiwNCmlmIGl0IHdlcmUsIGFuIGV4dGVuZGVkIHNvdXJjZSBwb3J0IG9wdGlvbiB3b3VsZCBh cHBlYXIgdG8gYmUgYSBzb2x1dGlvbi4NCg0KVGhlIG1lY2hhbmlzbSBJIGVudmlzYWdlIHdvdWxk IGJlIGZvciB0aGUgc2VydmVyIHRvIGNvbXB1dGUgYW4gaW5pdGlhbA0Kc2VxdWVuY2UgbnVtYmVy IHRoYXQgaXMgYSAoc2VjdXJlKSBoYXNoIG9mIHRoZSBjbGllbnQgSVAgYWRkcmVzcyBhbmQgYSAN CmZpeGVkIHNlcnZlciBzZWNyZXQsIGFuZCBmb3IgdGhlIHNlcnZlciB0byBhbGxvdyB0aGUgbm9y bWFsIGhhbmRzaGFrZSANCnRvIGJlIGJ5LXBhc3NlZCBvbiBzdWJzZXF1ZW50IGNvbm5lY3Rpb25z LCBwcm92aWRlZCB0aGUgc2VxdWVuY2UNCm51bWJlciBpcyB2YWxpZC4NCg0KSSBleHBlY3Qgc29t ZSBraW5kIG9mIG9wdGlvbiBzaWduYWxsaW5nIG1heSBiZSBkZXNpcmFibGUgdG8gYWxsb3cgdGhl IHNlcnZlcg0KdG8gc2lnbmFsIHN1cHBvcnQgdG8gdGhlIGNsaWVudC4gSSBoYXZlbid0IGxvb2tl ZCBpbnRvIHRoZSBwcmVjaXNlIGRldGFpbCBvZiBob3cNCnRoYXQgc2hvdWxkIHdvcmsgeWV0Lg0K DQpUaGVyZSBtaWdodCBiZSBwcm9ibGVtcyB3aXRoIGZpcmV3YWxscy9taWRkbGVib3hlcywgaW4g dGhhdCBjYXNlIGEgbm9ybWFsDQpUQ1AgaGFuZHNoYWtlIHdvdWxkIGJlIG5lZWRlZCB1bnRpbCBz dWNoIGJveGVzIGNvdWxkIGJlIHVwZGF0ZWQuDQoNCkdlb3JnZQ== From owner-namedroppers@ops.ietf.org Tue Sep 15 08:48:02 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA6B73A6BC0; Tue, 15 Sep 2009 08:48:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.195 X-Spam-Level: X-Spam-Status: No, score=-1.195 tagged_above=-999 required=5 tests=[AWL=-0.700, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m68HI+wFGd3m; Tue, 15 Sep 2009 08:48:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CCF7E3A6BBE; Tue, 15 Sep 2009 08:48:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnaC2-000CF6-Eq for namedroppers-data0@psg.com; Tue, 15 Sep 2009 15:43:46 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnaBP-000CA6-9u for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 15:43:31 +0000 Received: from Puki.ogud.com (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n8FFgGhr005086; Tue, 15 Sep 2009 11:42:16 -0400 (EDT) (envelope-from ogud@ogud.com) Message-Id: <200909151542.n8FFgGhr005086@stora.ogud.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Tue, 15 Sep 2009 11:42:08 -0400 To: "W.C.A. Wijngaards" From: Olafur Gudmundsson Subject: Re: [dnsext] GOST DNSSEC implementations? Cc: namedroppers@ops.ietf.org In-Reply-To: <4AAF56CD.6060401@nlnetlabs.nl> References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 04:56 15/09/2009, W.C.A. Wijngaards wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >On 09/14/2009 07:18 PM, Olafur Gudmundsson/DNSEXT chair wrote: > > Has anyone thought about/attempted to implement the algorithms proposed > > in: > > http://tools.ietf.org/id/draft-dolmatov-dnsext-dnssec-gost-01.txt > >Yes, I have experimental implementations: ldns and unbound (with >- --enable-gost and ssl 1.0). > >Comments on draft: fine with me, nit points: >* I would like examples of a DS record, DNSKEY record and signature with >GOST (with a long expiration date). This can be done once algorithm >numbers exist, of course. ---> OG Wouter, Having dummy DS, DNSKEY and RRSIG records inserted into the document at this point is a good idea. Once IANA assigns the numbers we can use the real algorithm numbers and real values. Dummy ==> all correct but algorithm numbers random. >* The file format for the GOST private key. I chose to put a base64 >blurb of the DER encoded private key on one line into a text file after >the usual Private-Key-Format: and Algorithm: lines. For example in the >file Kexample.com.+XXX+41891.private: > >Private-key-format: v1.2 >Algorithm: XXX (GOST) >MEUCAQAwHAY[[...more...]]v0QKoL3p/wOX/3kySQ3Q= ----> OG None of the other RFC's specifies private key format and as this never shows up "on-the-wire" it is out-side the scope of the working group. >For RSASHA256 this was not an issue, since the private key for RSA does >not change if you use SHA256. > >Best regards, > Wouter ---> OG Thank you for your report anyone else have implementations? Olafur From owner-namedroppers@ops.ietf.org Tue Sep 15 10:02:20 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9C08A3A68A5; Tue, 15 Sep 2009 10:02:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.267 X-Spam-Level: X-Spam-Status: No, score=-1.267 tagged_above=-999 required=5 tests=[AWL=1.021, BAYES_00=-2.599, HOST_MISMATCH_NET=0.311] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZsS1HxXinunI; Tue, 15 Sep 2009 10:02:19 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 985B83A6A7F; Tue, 15 Sep 2009 10:02:19 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnbLW-000LDC-6x for namedroppers-data0@psg.com; Tue, 15 Sep 2009 16:57:38 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnbLK-000LC6-0q for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 16:57:35 +0000 Received: from [192.168.8.11] (vhe-520087.sshn.net [195.169.221.157]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by farside.isc.org (Postfix) with ESMTP id 15B4DE6059 for ; Tue, 15 Sep 2009 16:57:24 +0000 (UTC) (envelope-from jelte@isc.org) Message-ID: <4AAFC772.9050909@isc.org> Date: Tue, 15 Sep 2009 18:57:22 +0200 From: Jelte Jansen User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> In-Reply-To: <200909151542.n8FFgGhr005086@stora.ogud.com> X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Olafur Gudmundsson wrote: > At 04:56 15/09/2009, W.C.A. Wijngaards wrote: >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> On 09/14/2009 07:18 PM, Olafur Gudmundsson/DNSEXT chair wrote: >> > Has anyone thought about/attempted to implement the algorithms proposed >> > in: >> > http://tools.ietf.org/id/draft-dolmatov-dnsext-dnssec-gost-01.txt >> >> Yes, I have experimental implementations: ldns and unbound (with >> - --enable-gost and ssl 1.0). >> >> Comments on draft: fine with me, nit points: >> * I would like examples of a DS record, DNSKEY record and signature with >> GOST (with a long expiration date). This can be done once algorithm >> numbers exist, of course. > ---> OG > Wouter, > > Having dummy DS, DNSKEY and RRSIG records inserted into the document at > this point is a good idea. Once IANA assigns the numbers we can > use the real algorithm numbers and real values. > Dummy ==> all correct but algorithm numbers random. > this is why i want a few numbers assigned for testing purposes; the cynical me wants to propose to just pick any number as long as it's not in the range 0-255. but perhaps one could overload 253/254 'for now', or pick a high number and hope that if they do get out into the wild that by the time it would matter those implementations have been replaced. Jelte -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkqvx2kACgkQ4nZCKsdOncVdzwCg2PfcZZNa8yXfY3p2C8k66KW6 eUYAnjdoV5q8YGPPrNUqKm26wJYetfqV =CulK -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Tue Sep 15 10:08:48 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8B0093A6811; Tue, 15 Sep 2009 10:08:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.57 X-Spam-Level: X-Spam-Status: No, score=-2.57 tagged_above=-999 required=5 tests=[AWL=0.029, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HXNMiBGmHR-n; Tue, 15 Sep 2009 10:08:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F17BD3A6A7F; Tue, 15 Sep 2009 10:08:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnbTl-000Mc1-V1 for namedroppers-data0@psg.com; Tue, 15 Sep 2009 17:06:09 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnbTa-000MZ3-84 for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 17:06:05 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id C3FA2B6773; Tue, 15 Sep 2009 17:05:57 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: "George Barwood" cc: "Douglas Otis" , namedroppers@ops.ietf.org Subject: Re: [dnsext] DNS transport In-Reply-To: Your message of "Tue, 15 Sep 2009 09:43:58 +0100." References: <173630D6EBA14713879E7942DE630AA3@localhost> <4AAECB16.6050507@mail-abuse.org> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Tue, 15 Sep 2009 17:05:57 +0000 Message-ID: <58200.1253034357@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: "George Barwood" > Date: Tue, 15 Sep 2009 09:43:58 +0100 > > If in fact TCP is good enough (possibly with some re-engineering/an > extra TCP option), there is no need to consider alternatives. some of us are working on that approach, offline. draft to come. From owner-namedroppers@ops.ietf.org Tue Sep 15 10:32:00 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8AC3B3A6A24; Tue, 15 Sep 2009 10:32:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.455 X-Spam-Level: *** X-Spam-Status: No, score=3.455 tagged_above=-999 required=5 tests=[AWL=-0.650, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_RU=0.595, HELO_MISMATCH_RU=3.1, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2dck4ZYt-Hh7; Tue, 15 Sep 2009 10:31:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 63D713A6B46; Tue, 15 Sep 2009 10:31:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnbpY-0000YQ-Qe for namedroppers-data0@psg.com; Tue, 15 Sep 2009 17:28:40 +0000 Received: from [87.245.158.60] (helo=mx.cryptocom.ru) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnbpN-0000Vn-8U for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 17:28:38 +0000 Received: from localhost (localhost [127.0.0.1]) by mx.cryptocom.ru (Postfix) with ESMTP id CE9343EC26; Tue, 15 Sep 2009 21:28:26 +0400 (MSD) X-Virus-Scanned: Debian amavisd-new at cryptocom.ru Received: from mx.cryptocom.ru ([127.0.0.1]) by localhost (mx.cryptocom.ru [127.0.0.1]) (amavisd-new, port 10024) with LMTP id NYWE17Lwr50G; Tue, 15 Sep 2009 21:28:26 +0400 (MSD) Received: from [192.168.63.201] (unknown [91.78.23.121]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.cryptocom.ru (Postfix) with ESMTP id 7248C3EC24; Tue, 15 Sep 2009 21:28:26 +0400 (MSD) Message-ID: <4AAFCEB9.9070305@cryptocom.ru> Date: Tue, 15 Sep 2009 21:28:25 +0400 From: Basil Dolmatov User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: Jelte Jansen CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> In-Reply-To: <4AAFC772.9050909@isc.org> Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Jelte Jansen пишет: 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Olafur Gudmundsson wrote:
  
At 04:56 15/09/2009, W.C.A. Wijngaards wrote:
    
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/14/2009 07:18 PM, Olafur Gudmundsson/DNSEXT chair wrote:
      
Has anyone thought about/attempted to implement the algorithms proposed
in:
    http://tools.ietf.org/id/draft-dolmatov-dnsext-dnssec-gost-01.txt
        
Yes, I have experimental implementations: ldns and unbound (with
- --enable-gost and ssl 1.0).

Comments on draft: fine with me, nit points:
* I would like examples of a DS record, DNSKEY record and signature with
GOST (with a long expiration date).  This can be done once algorithm
numbers exist, of course.
      
---> OG
Wouter,

Having dummy DS, DNSKEY and RRSIG records inserted into the document at
this point is a good idea. Once IANA assigns the numbers we can
use the real algorithm numbers and real values.
Dummy ==> all correct but algorithm numbers random.
Implementators from "Garant-Park" have taken "random" protocol number - 8.
Funny enough, all lower numbers have been occupied already in the bind code.

dol@


From owner-namedroppers@ops.ietf.org Tue Sep 15 11:05:53 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 853C328C145; Tue, 15 Sep 2009 11:05:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.706 X-Spam-Level: X-Spam-Status: No, score=-4.706 tagged_above=-999 required=5 tests=[AWL=-0.269, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z5Vs9KvOkhLi; Tue, 15 Sep 2009 11:05:52 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8E8163A6A82; Tue, 15 Sep 2009 11:05:52 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MncKl-00081m-OX for namedroppers-data0@psg.com; Tue, 15 Sep 2009 18:00:55 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MncK8-0007sV-Aq for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 18:00:36 +0000 Received: from SJC-Office-NAT-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id AD9F7A94446; Tue, 15 Sep 2009 18:00:15 +0000 (UTC) Message-ID: <4AAFD62F.9080704@mail-abuse.org> Date: Tue, 15 Sep 2009 11:00:15 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: George Barwood CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] DNS transport References: <173630D6EBA14713879E7942DE630AA3@localhost> <4AAECB16.6050507@mail-abuse.org> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/15/09 1:43 AM, George Barwood wrote: > ----- Original Message ----- > From: "Douglas Otis" > > [SCTP discussion snipped] > > Doug, > > It's clear that one can define alternative transports, as you know, > I have also made a proposal here > > http://tools.ietf.org/html/draft-barwood-dnsext-dns-transport > > What I mainly wanted to examine in this thread was whether the > objections to TCP can be overcome. > > If in fact TCP is good enough (possibly with some re-engineering/an > extra TCP option), there is no need to consider alternatives. Use of SCTP would not change the DNS protocol from the perspective of message content, nor alter the transport protocol. Instead, you propose changing DNS protocol message content AND the transport protocol. Transport related changes should be discussed on an appropriate list, such as TSVWG. -Doug From owner-namedroppers@ops.ietf.org Tue Sep 15 11:40:24 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 673A13A6B97; Tue, 15 Sep 2009 11:40:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.107 X-Spam-Level: X-Spam-Status: No, score=-5.107 tagged_above=-999 required=5 tests=[AWL=-0.059, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xzebaWopHJ04; Tue, 15 Sep 2009 11:40:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 411583A6812; Tue, 15 Sep 2009 11:40:23 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnctp-000D5r-Jq for namedroppers-data0@psg.com; Tue, 15 Sep 2009 18:37:09 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnctZ-000D3M-VC for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 18:37:06 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n8FIapuV007940; Tue, 15 Sep 2009 11:36:51 -0700 (PDT) Cc: Nicholas Weaver , George Barwood , namedroppers@ops.ietf.org Message-Id: From: Nicholas Weaver To: Douglas Otis In-Reply-To: <4AAFD62F.9080704@mail-abuse.org> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] DNS transport Date: Tue, 15 Sep 2009 11:36:51 -0700 References: <173630D6EBA14713879E7942DE630AA3@localhost> <4AAECB16.6050507@mail-abuse.org> <4AAFD62F.9080704@mail-abuse.org> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 15, 2009, at 11:00 AM, Douglas Otis wrote: > On 9/15/09 1:43 AM, George Barwood wrote: >> ----- Original Message ----- >> From: "Douglas Otis" >> >> [SCTP discussion snipped] >> >> Doug, >> >> It's clear that one can define alternative transports, as you know, >> I have also made a proposal here >> >> http://tools.ietf.org/html/draft-barwood-dnsext-dns-transport >> >> What I mainly wanted to examine in this thread was whether the >> objections to TCP can be overcome. >> >> If in fact TCP is good enough (possibly with some re-engineering/an >> extra TCP option), there is no need to consider alternatives. > > Use of SCTP would not change the DNS protocol from the perspective > of message content, nor alter the transport protocol. > > Instead, you propose changing DNS protocol message content AND the > transport protocol. Transport related changes should be discussed > on an appropriate list, such as TSVWG. Actually, you don't need to change the transport protocol, you just need to change the user side API for the transport protocol. As long as your authority is deterministic, you only need to save the query, not the reply, until you get the reply ACKed if you are doing a sure level TCP. From owner-namedroppers@ops.ietf.org Tue Sep 15 12:34:30 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D05EB3A682E; Tue, 15 Sep 2009 12:34:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.571 X-Spam-Level: X-Spam-Status: No, score=-2.571 tagged_above=-999 required=5 tests=[AWL=0.028, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EMWch5Xa8LRf; Tue, 15 Sep 2009 12:34:30 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D2DA428C1B1; Tue, 15 Sep 2009 12:34:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mndj8-000JR0-Ou for namedroppers-data0@psg.com; Tue, 15 Sep 2009 19:30:10 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mndiy-000JQJ-2T for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 19:30:07 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id B5237B676C for ; Tue, 15 Sep 2009 19:29:59 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] DNS transport In-Reply-To: Your message of "Tue, 15 Sep 2009 11:36:51 MST." References: <173630D6EBA14713879E7942DE630AA3@localhost> <4AAECB16.6050507@mail-abuse.org> <4AAFD62F.9080704@mail-abuse.org> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Tue, 15 Sep 2009 19:29:59 +0000 Message-ID: <64283.1253042999@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Nicholas Weaver > Date: Tue, 15 Sep 2009 11:36:51 -0700 > ... > As long as your authority is deterministic, you only need to save the > query, not the reply, until you get the reply ACKed if you are doing a > sure level TCP. alas, until we have ubiquitous dnssec, authorities will not be deterministic. From owner-namedroppers@ops.ietf.org Tue Sep 15 12:54:54 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7E83328C211; Tue, 15 Sep 2009 12:54:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.106 X-Spam-Level: X-Spam-Status: No, score=-5.106 tagged_above=-999 required=5 tests=[AWL=-0.058, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kyr8R1DeHlHI; Tue, 15 Sep 2009 12:54:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9C8453A6920; Tue, 15 Sep 2009 12:54:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mne44-000M3h-PQ for namedroppers-data0@psg.com; Tue, 15 Sep 2009 19:51:48 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mne3t-000M1V-TZ for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 19:51:45 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n8FJpXD9015808; Tue, 15 Sep 2009 12:51:33 -0700 (PDT) Cc: Nicholas Weaver , namedroppers@ops.ietf.org Message-Id: From: Nicholas Weaver To: Paul Vixie In-Reply-To: <64283.1253042999@nsa.vix.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] DNS transport Date: Tue, 15 Sep 2009 12:51:33 -0700 References: <173630D6EBA14713879E7942DE630AA3@localhost> <4AAECB16.6050507@mail-abuse.org> <4AAFD62F.9080704@mail-abuse.org> <64283.1253042999@nsa.vix.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 15, 2009, at 12:29 PM, Paul Vixie wrote: >> From: Nicholas Weaver >> Date: Tue, 15 Sep 2009 11:36:51 -0700 >> ... >> As long as your authority is deterministic, you only need to save the >> query, not the reply, until you get the reply ACKed if you are >> doing a >> sure level TCP. > > alas, until we have ubiquitous dnssec, authorities will not be > deterministic. Even with ubiquitous DNSSEC, you won't be "deterministic": you can easily return different subsets/different order for loadbalancing etc. Those games should still work, no? But you CAN be deterministic without being "deterministic": just make sure the process is deterministic based on a random seed and the TCP 4- tuple. From owner-namedroppers@ops.ietf.org Tue Sep 15 14:43:02 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C34D63A6A62; Tue, 15 Sep 2009 14:43:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.517 X-Spam-Level: X-Spam-Status: No, score=-0.517 tagged_above=-999 required=5 tests=[AWL=-0.022, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rSXd4TUWTBPR; Tue, 15 Sep 2009 14:43:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F20713A68EC; Tue, 15 Sep 2009 14:43:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnfj8-000C9k-CT for namedroppers-data0@psg.com; Tue, 15 Sep 2009 21:38:18 +0000 Received: from [209.85.219.215] (helo=mail-ew0-f215.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnfil-000C8V-8g for namedroppers@ops.ietf.org; Tue, 15 Sep 2009 21:38:10 +0000 Received: by ewy11 with SMTP id 11so3979174ewy.11 for ; Tue, 15 Sep 2009 14:37:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=uILkMkakz1MTtfo1xuzWRzkG6qUck8LSafmXdnpzoIc=; b=CJl9CNcEmuWjntCGNLoF99lRsKhwfg50ndKJr7Axs69y1DJfuysKUcF7llW64zweCc ZJ4LHuZEH3LscRqWrGBQaGRcb8OjZoowlw3yleU4lwgPeNoj+N5nKODQ6uhk5p6lBbs4 PBFvzpG8sntsdump6dHMlGKvrzWalIut3V5Fo= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=U5XwHoIJ8WH6T9NLNUiAiCTVLNQiofXzhH9g4KYb3XHwGtlJRcdBB77NwIBN9z4mDJ L1ilduP8ZI15w0Pabdd9pEuXrtjdWNB22VK82mBj2BsZ3LDDyY11SPoVLcaJA+JZlZpq JOVrxVkH9HQQHndr/ZvaHy6ljYl9/PMmHHoKQ= MIME-Version: 1.0 Received: by 10.211.132.3 with SMTP id j3mr4296253ebn.81.1253050673193; Tue, 15 Sep 2009 14:37:53 -0700 (PDT) In-Reply-To: References: <173630D6EBA14713879E7942DE630AA3@localhost> <4AAECB16.6050507@mail-abuse.org> <4AAFD62F.9080704@mail-abuse.org> <64283.1253042999@nsa.vix.com> From: bert hubert Date: Tue, 15 Sep 2009 23:37:33 +0200 Message-ID: <3efd34cc0909151437w1e25792ay20616a9d3331d5cf@mail.gmail.com> Subject: Re: [dnsext] DNS transport To: Nicholas Weaver Cc: Paul Vixie , namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 15, 2009 at 9:51 PM, Nicholas Weaver wrote: > Even with ubiquitous DNSSEC, you won't be "deterministic": you can easily > return different subsets/different order for loadbalancing etc. =A0Those = games > should still work, no? Not if you expect things to work reliably. While pondering implementing DNSSEC, I've been thinking a lot about RRSIG lifetimes (TTL & fuzz) versus the lifetimes of the covered RRSET. To say the least, I worry if everyone will get this right. Bert From owner-namedroppers@ops.ietf.org Wed Sep 16 00:58:11 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7D6A23A6992; Wed, 16 Sep 2009 00:58:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.523 X-Spam-Level: X-Spam-Status: No, score=-1.523 tagged_above=-999 required=5 tests=[AWL=0.765, BAYES_00=-2.599, HOST_MISMATCH_NET=0.311] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2cOZsIya721l; Wed, 16 Sep 2009 00:58:10 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 215E83A69BD; Wed, 16 Sep 2009 00:58:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnpJ6-0004dS-V3 for namedroppers-data0@psg.com; Wed, 16 Sep 2009 07:52:04 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnpIt-0004bK-RT for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 07:52:02 +0000 Received: from [192.168.8.11] (vhe-520087.sshn.net [195.169.221.157]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by farside.isc.org (Postfix) with ESMTP id C2058E6026; Wed, 16 Sep 2009 07:51:50 +0000 (UTC) (envelope-from jelte@isc.org) Message-ID: <4AB09915.2010801@isc.org> Date: Wed, 16 Sep 2009 09:51:49 +0200 From: Jelte Jansen User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: Basil Dolmatov CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> In-Reply-To: <4AAFCEB9.9070305@cryptocom.ru> X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Basil Dolmatov wrote: >>> >>> Having dummy DS, DNSKEY and RRSIG records inserted into the document at >>> this point is a good idea. Once IANA assigns the numbers we can >>> use the real algorithm numbers and real values. >>> Dummy ==> all correct but algorithm numbers random. >>> > > Implementators from "Garant-Park" have taken "random" protocol number - 8. > which I also happened to have chosen for my implementation of RSA/SHA2 in ldns (as well as 9, 10 and 11, back when the first last call was done and the draft had 4 different algorithms). Those have 'escaped' through a nice combination of expecting the draft to become an rfc as it was, and some communication errors, so now there might be validators out there that expect algorithm 8 to mean RSA/SHA256, even if the actual algorithm id turns out to be something else (or even if the draft is completely turned down). Which now means that if we want to be sure that nobody gets unexpected failures, IANA should assign numbers 8 and 10 to RSA/SHA256 and RSA/SHA512, and 9 and 11 should be marked as don't-use-in-the-forseeable-future... and we need to figure out a way to prevent people like me from making the same mistake :) Of course those validators are probably replaced by newer versions by now which don't have that part of the code anymore, but one can't really be sure. > > Funny enough, all lower numbers have been occupied already in the bind code. i don't understand what you're saying here, all assigned low numbers there are straight out of rfcs afaict. Jelte -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkqwmRUACgkQ4nZCKsdOncW/hQCdHLJYKh1AtwE8khAEw2AKDSfd cvcAnRAdweZS29MKQGdsopOnPrSoK8TS =nNTZ -----END PGP SIGNATURE----- From owner-namedroppers@ops.ietf.org Wed Sep 16 01:27:01 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A12FE3A69F1; Wed, 16 Sep 2009 01:27:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.392 X-Spam-Level: * X-Spam-Status: No, score=1.392 tagged_above=-999 required=5 tests=[AWL=-1.255, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_RU=0.595, HELO_MISMATCH_RU=3.1, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m6bsYPC0HFab; Wed, 16 Sep 2009 01:27:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C64F93A69D2; Wed, 16 Sep 2009 01:27:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnpo2-0008VF-7u for namedroppers-data0@psg.com; Wed, 16 Sep 2009 08:24:02 +0000 Received: from [87.245.158.60] (helo=mx.cryptocom.ru) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnpnm-0008SF-Lv for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 08:23:57 +0000 Received: from localhost (localhost [127.0.0.1]) by mx.cryptocom.ru (Postfix) with ESMTP id 0045D3EC28; Wed, 16 Sep 2009 12:23:43 +0400 (MSD) X-Virus-Scanned: Debian amavisd-new at cryptocom.ru Received: from mx.cryptocom.ru ([127.0.0.1]) by localhost (mx.cryptocom.ru [127.0.0.1]) (amavisd-new, port 10024) with LMTP id M1WXdzO+hTA7; Wed, 16 Sep 2009 12:23:43 +0400 (MSD) Received: from [10.51.22.241] (reedcat.lan.cryptocom.ru [10.51.22.241]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.cryptocom.ru (Postfix) with ESMTP id C52453EC25; Wed, 16 Sep 2009 12:23:43 +0400 (MSD) Message-ID: <4AB0A08F.8040305@cryptocom.ru> Date: Wed, 16 Sep 2009 12:23:43 +0400 From: Basil Dolmatov User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: Jelte Jansen CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> In-Reply-To: <4AB09915.2010801@isc.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > >> Funny enough, all lower numbers have been occupied already in the bind code. > > i don't understand what you're saying here, all assigned low numbers there are > straight out of rfcs afaict. Right you are. Sorry. dol@ From owner-namedroppers@ops.ietf.org Wed Sep 16 01:43:09 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 67D913A6A09; Wed, 16 Sep 2009 01:43:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.409 X-Spam-Level: X-Spam-Status: No, score=0.409 tagged_above=-999 required=5 tests=[AWL=-0.341, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iPA7P4gaG4F0; Wed, 16 Sep 2009 01:43:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 626813A68CD; Wed, 16 Sep 2009 01:43:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnq4C-000ARn-0a for namedroppers-data0@psg.com; Wed, 16 Sep 2009 08:40:44 +0000 Received: from [193.227.124.2] (helo=mx01.bfk.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnq3w-000AOH-7A for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 08:40:41 +0000 Received: from mx00.int.bfk.de ([10.119.110.2]) by mx01.bfk.de with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) id 1Mnq3q-0005iQ-Ti; Wed, 16 Sep 2009 10:40:22 +0200 Received: by bfk.de with local id 1Mnq3q-0003M8-Pz; Wed, 16 Sep 2009 08:40:22 +0000 To: Douglas Otis Cc: George Barwood , namedroppers@ops.ietf.org Subject: Re: [dnsext] DNS transport References: <173630D6EBA14713879E7942DE630AA3@localhost> <4AAECB16.6050507@mail-abuse.org> <4AAFD62F.9080704@mail-abuse.org> From: Florian Weimer Date: Wed, 16 Sep 2009 08:40:22 +0000 In-Reply-To: <4AAFD62F.9080704@mail-abuse.org> (Douglas Otis's message of "Tue\, 15 Sep 2009 11\:00\:15 -0700") Message-ID: <82d45re0zt.fsf@mid.bfk.de> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: * Douglas Otis: > Use of SCTP would not change the DNS protocol from the perspective of > message content, nor alter the transport protocol. You'd still have to add negotation for SCTP parameters which can't be negotiated at the SCTP layer, wouldn't you? --=20 Florian Weimer BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstra=DFe 100 tel: +49-721-96201-1 D-76133 Karlsruhe fax: +49-721-96201-99 From owner-namedroppers@ops.ietf.org Wed Sep 16 07:51:42 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D90C43A677C; Wed, 16 Sep 2009 07:51:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.817 X-Spam-Level: X-Spam-Status: No, score=-3.817 tagged_above=-999 required=5 tests=[AWL=0.078, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_43=0.6, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nxguSvjbScL4; Wed, 16 Sep 2009 07:51:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E950B3A6986; Wed, 16 Sep 2009 07:51:41 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnvkZ-0004P8-JK for namedroppers-data0@psg.com; Wed, 16 Sep 2009 14:44:51 +0000 Received: from [192.245.12.227] (helo=balder-227.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnvkO-0004NK-4j for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 14:44:48 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n8GEiUqr001763 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 16 Sep 2009 07:44:31 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <4AA9E86C.10302@everydns.net> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> Date: Wed, 16 Sep 2009 07:44:28 -0700 To: David Ulevitch From: Paul Hoffman Subject: Re: [dnsext] Editor needed Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 11:04 PM -0700 9/10/09, David Ulevitch wrote: >On 8/28/09 7:36 AM, Paul Hoffman wrote: >>At 1:40 PM +0100 8/28/09, George Barwood wrote: >>>Actually I think Andrews suggestion is too strong. >>> >>>I think TCP should be mandatory only for authorities that generate >>>responses in excess of 512 bytes. >> >>Does this make sense from an operational standpoint? That is, assume >>that I am an authority who today doesn't emit responses in excess of >>512 bytes, and I set up a system that will *only* do UDP, and a later >>improvement to DNS (like DNSSEC, but there could be others) would >>cause me to emit responses that are now longer. I will then have a >>broken system. I should now update the system to also, but I don't >>actually have to (the problems are for other people, not me), and so >>I now have an operationally broken system that looks OK to me. > > >>We may be better off telling people that they need to support UDP and >>TCP from the beginning. > >There is no connection between this statement and the scenario offered. MUST'ing TCP is unnecessary and will cause more people to continue to violate the RFCs as the RFCs diverge further and further away from operational realities. This is silly. The purpose of standards is to tell people what they need to do. The fact that some implementations don't do something doesn't mean that we can't fix the standard if we need to. There is disagreement about whether or not TCP is a MUST here, but it feels like most people who have commented think that it is. We should change the standard to match what the WG feels. --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Wed Sep 16 08:19:06 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 32A593A68D5; Wed, 16 Sep 2009 08:19:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.158 X-Spam-Level: X-Spam-Status: No, score=-4.158 tagged_above=-999 required=5 tests=[AWL=0.337, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GDT4Xj-I7iFF; Wed, 16 Sep 2009 08:19:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C927428C13B; Wed, 16 Sep 2009 08:18:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnwEV-0007oK-Qe for namedroppers-data0@psg.com; Wed, 16 Sep 2009 15:15:47 +0000 Received: from [192.245.12.227] (helo=balder-227.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnwDz-0007lE-3r for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 15:15:29 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n8GFF9a7003480 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 16 Sep 2009 08:15:11 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <4AAFC772.9050909@isc.org> References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> Date: Wed, 16 Sep 2009 07:47:27 -0700 To: Jelte Jansen , namedroppers@ops.ietf.org From: Paul Hoffman Subject: Re: [dnsext] GOST DNSSEC implementations? Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 6:57 PM +0200 9/15/09, Jelte Jansen wrote: >but perhaps one could overload 253/254 'for now', Please don't. > or pick a high number and hope >that if they do get out into the wild that by the time it would matter those >implementations have been replaced. That seems better. Maybe use 249 for the drafts, but note in the drafts that 249 will *not* be assigned by IANA when the RFC is published. --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Wed Sep 16 09:42:12 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2E82028C1C7; Wed, 16 Sep 2009 09:42:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.2 X-Spam-Level: X-Spam-Status: No, score=0.2 tagged_above=-999 required=5 tests=[AWL=0.073, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hIU6WXRq2bNz; Wed, 16 Sep 2009 09:42:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DC17F28C1D2; Wed, 16 Sep 2009 09:42:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnxW0-000JgE-7v for namedroppers-data0@psg.com; Wed, 16 Sep 2009 16:37:56 +0000 Received: from [209.85.216.195] (helo=mail-px0-f195.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnxVf-000JcX-HU for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 16:37:54 +0000 Received: by pxi33 with SMTP id 33so4288918pxi.11 for ; Wed, 16 Sep 2009 09:37:34 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.10.4 with SMTP id 4mr16494875waj.105.1253119053993; Wed, 16 Sep 2009 09:37:33 -0700 (PDT) In-Reply-To: References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> Date: Wed, 16 Sep 2009 09:37:33 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 16, 2009 at 7:44 AM, Paul Hoffman wrote: > There is disagreement about whether or not TCP is a MUST here, but it feels like most people who have commented think that it is. We should change the standard to match what the WG feels. Looking through this email thread, here's my count of people who have weighed in on their stance on whether TCP support should be unilaterally mandatory: For: Bill Manning, Mark Andrews, Andrew Sullivan(?), Paul Hoffman(?) Against: Dean Anderson(?), George Barwood, Paul Vixie, Ray Bellis, David Ulevitch, myself. Unclear: Alex Bligh, Florian Weimer From owner-namedroppers@ops.ietf.org Wed Sep 16 10:14:06 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3741B3A6ABE; Wed, 16 Sep 2009 10:14:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.331 X-Spam-Level: X-Spam-Status: No, score=-5.331 tagged_above=-999 required=5 tests=[AWL=-0.894, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PdeZEMOl7nbM; Wed, 16 Sep 2009 10:14:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5475A3A69B1; Wed, 16 Sep 2009 10:14:05 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mny27-000N7S-Aw for namedroppers-data0@psg.com; Wed, 16 Sep 2009 17:11:07 +0000 Received: from [204.152.189.190] (helo=virtualized.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mny1x-000N6Z-In for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 17:11:04 +0000 Received: from localhost (localhost [127.0.0.1]) by virtualized.org (Postfix) with ESMTP id 2AF627D9D91; Wed, 16 Sep 2009 10:10:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at virtualized.org Received: from virtualized.org ([127.0.0.1]) by localhost (trantor.virtualized.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ae6DobStEAK; Wed, 16 Sep 2009 10:10:55 -0700 (PDT) Received: from wlan39-146.mdr.icann.org (wlan39-146.mdr.icann.org [192.0.39.146]) by virtualized.org (Postfix) with ESMTP id 5610F7D9D7D; Wed, 16 Sep 2009 10:10:55 -0700 (PDT) Cc: namedroppers@ops.ietf.org Message-Id: <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> From: David Conrad To: Matthew Dempsky In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] Editor needed Date: Wed, 16 Sep 2009 10:10:55 -0700 References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 16, 2009, at 9:37 AM, Matthew Dempsky wrote: > On Wed, Sep 16, 2009 at 7:44 AM, Paul Hoffman > wrote: >> There is disagreement about whether or not TCP is a MUST here, but >> it feels like most people who have commented think that it is. We >> should change the standard to match what the WG feels. > > Looking through this email thread, here's my count of people who have > weighed in on their stance on whether TCP support should be > unilaterally mandatory: Not sure what 'unilaterally' means in this context, but I believe TCP support should be mandatory. Regards, -drc From owner-namedroppers@ops.ietf.org Wed Sep 16 10:29:59 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0BD293A688B; Wed, 16 Sep 2009 10:29:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.571 X-Spam-Level: X-Spam-Status: No, score=-2.571 tagged_above=-999 required=5 tests=[AWL=0.028, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XZoZYKtP8ZIh; Wed, 16 Sep 2009 10:29:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 458823A6403; Wed, 16 Sep 2009 10:29:58 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnyHW-000OQC-Rs for namedroppers-data0@psg.com; Wed, 16 Sep 2009 17:27:02 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnyHN-000OPO-9g for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 17:27:00 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id D0945B6936 for ; Wed, 16 Sep 2009 17:26:52 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed In-Reply-To: Your message of "Wed, 16 Sep 2009 10:10:55 MST." <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Wed, 16 Sep 2009 17:26:52 +0000 Message-ID: <17253.1253122012@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: David Conrad > Date: Wed, 16 Sep 2009 10:10:55 -0700 > > Not sure what 'unilaterally' means in this context, but I believe TCP > support should be mandatory. several of us think TCP support should be coupled to a server's ability to generate UDP replies with the TC bit turned on. in the absence of any TC=1 responses on UDP, i think that TCP should be optional. in the presence of any TC=1 responses on UDP, i think that TCP should be mandatory. note that if we end up with an improved semistateless TCP, i'll say that it ought to be mandatory and that it ought to be the first transport tried. i am answering the current TCP question using only the current TCP technology. david, in that context and on that spectrum, where do you sit? From owner-namedroppers@ops.ietf.org Wed Sep 16 10:31:34 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 229083A688B; Wed, 16 Sep 2009 10:31:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.197 X-Spam-Level: X-Spam-Status: No, score=0.197 tagged_above=-999 required=5 tests=[AWL=0.070, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M-GJ1gkBE7ZT; Wed, 16 Sep 2009 10:31:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5DA073A6B6C; Wed, 16 Sep 2009 10:31:33 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnyK8-000OeI-GZ for namedroppers-data0@psg.com; Wed, 16 Sep 2009 17:29:44 +0000 Received: from [209.85.216.195] (helo=mail-px0-f195.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnyJz-000Ock-DN for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 17:29:42 +0000 Received: by pxi33 with SMTP id 33so4323778pxi.11 for ; Wed, 16 Sep 2009 10:29:34 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.133.16 with SMTP id k16mr16564448wan.151.1253122174387; Wed, 16 Sep 2009 10:29:34 -0700 (PDT) In-Reply-To: <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> Date: Wed, 16 Sep 2009 10:29:34 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 16, 2009 at 10:10 AM, David Conrad wrote: > Not sure what 'unilaterally' means in this context, but I believe TCP > support should be mandatory. As opposed to TCP should only be mandatory for servers that send UDP responses with the TC flag set. From owner-namedroppers@ops.ietf.org Wed Sep 16 10:52:43 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 93B233A693D; Wed, 16 Sep 2009 10:52:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.495 X-Spam-Level: X-Spam-Status: No, score=0.495 tagged_above=-999 required=5 tests=[AWL=-0.232, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_33=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vE-HtS-+1EJZ; Wed, 16 Sep 2009 10:52:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7E1CF3A6B9B; Wed, 16 Sep 2009 10:52:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnyci-0000iQ-IX for namedroppers-data0@psg.com; Wed, 16 Sep 2009 17:48:56 +0000 Received: from [209.85.222.199] (helo=mail-pz0-f199.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnycZ-0000hq-NB for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 17:48:54 +0000 Received: by pzk37 with SMTP id 37so1729194pzk.25 for ; Wed, 16 Sep 2009 10:48:46 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.243.8 with SMTP id q8mr16576079wah.211.1253122909878; Wed, 16 Sep 2009 10:41:49 -0700 (PDT) In-Reply-To: <734C2256-F563-4B12-B51A-D951946634A6@icsi.berkeley.edu> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <734C2256-F563-4B12-B51A-D951946634A6@icsi.berkeley.edu> Date: Wed, 16 Sep 2009 10:41:49 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 16, 2009 at 10:36 AM, Nicholas Weaver wrote: > The problems have generally been solved for all other sever communities, and > even if they do seem to be a problem, I see methods where a > quasi-deterministic authority (deterministically based on seed and 4-tuple, > but looks random to everyone else) with a user-level TCP stack doesn't need > to save the unacknowledged response, only the unacknowledged query, and can, > if the response will fit in a packet, have a single unacknowledged query > with NO state (by only ACK'ing the query in the response packet). I agree that this method should be a theoretically possible solution, and I think it would be cool to see someone implement it, but as a matter of principle, I'd like to see at least a functioning proof-of-concept implementation before the idea is used to justify standards body action. From owner-namedroppers@ops.ietf.org Wed Sep 16 10:52:44 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BCBE63A6B9B; Wed, 16 Sep 2009 10:52:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.779 X-Spam-Level: X-Spam-Status: No, score=-105.779 tagged_above=-999 required=5 tests=[AWL=0.820, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tW5hauWTCp70; Wed, 16 Sep 2009 10:52:42 -0700 (PDT) Received: from psg.com (psg.com [147.28.0.62]) by core3.amsl.com (Postfix) with ESMTP id 201283A6A83; Wed, 16 Sep 2009 10:52:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnycK-0000fK-9T for namedroppers-data0@psg.com; Wed, 16 Sep 2009 17:48:32 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnycA-0000eW-La for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 17:48:29 +0000 Received: from SJC-Office-NAT-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 0F6C6A9443E; Wed, 16 Sep 2009 17:48:22 +0000 (UTC) Message-ID: <4AB124E5.2070906@mail-abuse.org> Date: Wed, 16 Sep 2009 10:48:21 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: Florian Weimer CC: George Barwood , namedroppers@ops.ietf.org, Michael Tuexen Subject: Re: [dnsext] DNS transport References: <173630D6EBA14713879E7942DE630AA3@localhost> <4AAECB16.6050507@mail-abuse.org> <4AAFD62F.9080704@mail-abuse.org> <82d45re0zt.fsf@mid.bfk.de> In-Reply-To: <82d45re0zt.fsf@mid.bfk.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/16/09 1:40 AM, Florian Weimer wrote: > * Douglas Otis: > >> Use of SCTP would not change the DNS protocol from the perspective of >> message content, nor alter the transport protocol. > > You'd still have to add negotation for SCTP parameters which can't be > negotiated at the SCTP layer, wouldn't you? The SCTP transport handles negotiations related to options useful for DNS. SCTP supports Unordered and Unreliable delivery negotiation. These modes allow DNS queries or their response not to be retained by servers. Clients could retry lost messages over the same association. Rather than attempting to kludge yet another API option and operational modes for TCP, these features are implemented, tested, and released with SCTP. Abrupt timeouts abandoning TCP buffers and connections will likely defeat congestion avoidance and require additional state and delays to restore congestion avoidance. SCTP handles low latency, multi-path, error detection, concurrency, framing, and importantly security far better than TCP can. DNSSEC over SCTP offers a means to ensure safe and reliable operation, providing clear guidelines for introducing DNSSEC. Safety first. -Doug From owner-namedroppers@ops.ietf.org Wed Sep 16 10:53:12 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F0A3528C0DE; Wed, 16 Sep 2009 10:53:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.424 X-Spam-Level: X-Spam-Status: No, score=-0.424 tagged_above=-999 required=5 tests=[AWL=0.071, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GB5KXXG2Ojwz; Wed, 16 Sep 2009 10:53:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 24D2F3A6A83; Wed, 16 Sep 2009 10:53:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnyf8-0000wT-RA for namedroppers-data0@psg.com; Wed, 16 Sep 2009 17:51:27 +0000 Received: from [217.147.82.63] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnyew-0000v4-QM for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 17:51:24 +0000 Received: from [192.168.100.15] (shed [217.147.82.63]) by mail.avalus.com (Postfix) with ESMTPA id 72C93C2DA3; Wed, 16 Sep 2009 18:51:13 +0100 (BST) Date: Wed, 16 Sep 2009 18:50:51 +0100 From: Alex Bligh Reply-To: Alex Bligh To: Matthew Dempsky , namedroppers@ops.ietf.org cc: Alex Bligh Subject: Re: [dnsext] Editor needed Message-ID: <960F45758CA2ED442B3F6972@Ximines.local> In-Reply-To: References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --On 16 September 2009 09:37:33 -0700 Matthew Dempsky wrote: > For: Bill Manning, Mark Andrews, Andrew Sullivan(?), Paul Hoffman(?) > > Against: Dean Anderson(?), George Barwood, Paul Vixie, Ray Bellis, > David Ulevitch, myself. > > Unclear: Alex Bligh, Florian Weimer What I've posted to the list so far was merely a statement that Bill's draft did not, in my view, achieve the purported aim, i.e. making TCP mandatory (which I think is what you are calling unilaterally mandatory). My view, for what it is worth, is that if the server is ever going to produce a response > 512 bytes (irrespective of EDNS support), TCP support should be mandatory (IE it can't rely on clients supporting EDNS to get out of it). I think it should also be mandatory for any server supporting DNSSEC; given that it is difficult to imagine a useful DNSSEC server where no responses would ever be >512 bytes, the benefit of the client being permitted to rely on TCP support outweighs the loss of some peculiar edge cases. As a random data point, some time back in 1999, I was pressed to produce a DNS server which could cope with a constantly changing zone file and several hundred thousand domains (with mail and web hosting). Short of time, we merely hacked it up to return a quickly constructed UDP packet with an A record for www. and an MX for whatever was sent to it (the A and MX being the same for every domain) as no queries should have reached the server bar those for domains on it. Naughty I know, but it worked. Even in back then, we had a noticeable number of complaints about not supporting TCP queries, which surprised me. -- Alex Bligh From owner-namedroppers@ops.ietf.org Wed Sep 16 11:29:23 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 38D1D3A691B; Wed, 16 Sep 2009 11:29:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.242 X-Spam-Level: X-Spam-Status: No, score=-5.242 tagged_above=-999 required=5 tests=[AWL=-0.805, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7ox980IVwEku; Wed, 16 Sep 2009 11:29:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 55FFE3A6820; Wed, 16 Sep 2009 11:29:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzCZ-0004qN-58 for namedroppers-data0@psg.com; Wed, 16 Sep 2009 18:25:59 +0000 Received: from [204.152.189.190] (helo=virtualized.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzCP-0004pl-8w for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 18:25:56 +0000 Received: from localhost (localhost [127.0.0.1]) by virtualized.org (Postfix) with ESMTP id 187977DA20E; Wed, 16 Sep 2009 11:25:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at virtualized.org Received: from virtualized.org ([127.0.0.1]) by localhost (trantor.virtualized.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pCKAK95hFPGW; Wed, 16 Sep 2009 11:25:47 -0700 (PDT) Received: from wlan39-146.mdr.icann.org (wlan39-146.mdr.icann.org [192.0.39.146]) by virtualized.org (Postfix) with ESMTP id 38CD37DA1FB; Wed, 16 Sep 2009 11:25:47 -0700 (PDT) Cc: IETF DNSEXT WG Message-Id: <227EC4F2-C00C-48B4-8C4B-E2DE05A01FEA@virtualized.org> From: David Conrad To: Alex Bligh In-Reply-To: <960F45758CA2ED442B3F6972@Ximines.local> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Historical insanity (ignorable) Re: [dnsext] Editor needed Date: Wed, 16 Sep 2009 11:25:45 -0700 References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <960F45758CA2ED442B3F6972@Ximines.local> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 16, 2009, at 10:50 AM, Alex Bligh wrote: > As a random data point, some time back in 1999, I was pressed to > produce a DNS server which could cope with a constantly changing > zone file and several hundred thousand domains (with mail and web > hosting). ... > Even in back then, we had a noticeable number of complaints about > not supporting TCP queries, which surprised me. If you want to talk about offenses against man and nature, back in the mid-80s, there was once a caching resolver that did not support UDP (the network stack for the system (a Univac 1100-series mainframe) apparently made datagram support quite challenging). No idea when that server was put out of its misery. Regards, -drc From owner-namedroppers@ops.ietf.org Wed Sep 16 11:32:46 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C98D23A6986; Wed, 16 Sep 2009 11:32:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.169 X-Spam-Level: X-Spam-Status: No, score=-5.169 tagged_above=-999 required=5 tests=[AWL=-0.732, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tdemHPvRJrrZ; Wed, 16 Sep 2009 11:32:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E71943A6820; Wed, 16 Sep 2009 11:32:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzGj-0005IW-Ba for namedroppers-data0@psg.com; Wed, 16 Sep 2009 18:30:17 +0000 Received: from [204.152.189.190] (helo=virtualized.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzGV-0005Gx-Lj for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 18:30:11 +0000 Received: from localhost (localhost [127.0.0.1]) by virtualized.org (Postfix) with ESMTP id 76A007DA2A0; Wed, 16 Sep 2009 11:30:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at virtualized.org Received: from virtualized.org ([127.0.0.1]) by localhost (trantor.virtualized.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S1M9FItS5tHa; Wed, 16 Sep 2009 11:30:02 -0700 (PDT) Received: from wlan39-146.mdr.icann.org (wlan39-146.mdr.icann.org [192.0.39.146]) by virtualized.org (Postfix) with ESMTP id 1E8CA7DA28B; Wed, 16 Sep 2009 11:30:01 -0700 (PDT) Cc: namedroppers@ops.ietf.org Message-Id: <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> From: David Conrad To: Paul Vixie In-Reply-To: <17253.1253122012@nsa.vix.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] Editor needed Date: Wed, 16 Sep 2009 11:29:59 -0700 References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 16, 2009, at 10:26 AM, Paul Vixie wrote: > several of us think TCP support should be coupled to a server's > ability to > generate UDP replies with the TC bit turned on. in the absence of > any TC=1 > responses on UDP, i think that TCP should be optional. in the > presence of > any TC=1 responses on UDP, i think that TCP should be mandatory. Given I believe that all servers need to be able to deal with large responses without fragmentation, the caveat here brings no value and instead, leads folks to come up with servers that can't deal with the Internet as it continues to evolve and call those servers "standards compliant". > david, in that context and on that spectrum, where do you sit? Same place. Support of TCP should be mandatory. Regards, -drc From owner-namedroppers@ops.ietf.org Wed Sep 16 11:40:13 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C59F3A6A25; Wed, 16 Sep 2009 11:40:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.572 X-Spam-Level: X-Spam-Status: No, score=-2.572 tagged_above=-999 required=5 tests=[AWL=0.027, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VWUiigYlrTqc; Wed, 16 Sep 2009 11:40:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4D7A03A68FA; Wed, 16 Sep 2009 11:40:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzOK-0006SM-Bn for namedroppers-data0@psg.com; Wed, 16 Sep 2009 18:38:08 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzOB-0006Qi-00 for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 18:38:06 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 58499B696C for ; Wed, 16 Sep 2009 18:37:58 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed In-Reply-To: Your message of "Wed, 16 Sep 2009 11:29:59 MST." <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Wed, 16 Sep 2009 18:37:58 +0000 Message-ID: <20322.1253126278@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: David Conrad > Date: Wed, 16 Sep 2009 11:29:59 -0700 > > Given I believe that all servers need to be able to deal with large > responses without fragmentation, the caveat here brings no value and > instead, leads folks to come up with servers that can't deal with the > Internet as it continues to evolve and call those servers "standards > compliant". there's a Very important corner case here, which is embedded servers tightly coupled with distributed applications, where the entire system design calls for nontruncated responses. the question before the WG is whether such a server should be allowed to exclude TCP altogether on the basis that it will never truncate its UDP output. i think, "yes." > > david, in that context and on that spectrum, where do you sit? > > Same place. Support of TCP should be mandatory. even in the above circumstance? you seem to be allowing for TCP-first client behaviour, which surprises me. From owner-namedroppers@ops.ietf.org Wed Sep 16 11:48:23 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 213BD3A69FA; Wed, 16 Sep 2009 11:48:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.164 X-Spam-Level: X-Spam-Status: No, score=-4.164 tagged_above=-999 required=5 tests=[AWL=0.331, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uXKNigXIL9EG; Wed, 16 Sep 2009 11:48:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 39FF63A6AE0; Wed, 16 Sep 2009 11:48:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzVl-0007WZ-WE for namedroppers-data0@psg.com; Wed, 16 Sep 2009 18:45:50 +0000 Received: from [192.245.12.227] (helo=balder-227.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzVc-0007VR-KV for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 18:45:47 +0000 Received: from [10.20.30.158] (sn87.proper.com [75.101.18.87]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n8GIjZxx017531 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 16 Sep 2009 11:45:37 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <17253.1253122012@nsa.vix.com> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> Date: Wed, 16 Sep 2009 11:45:33 -0700 To: Paul Vixie , namedroppers@ops.ietf.org From: Paul Hoffman Subject: Where TCP might be required (Was: [dnsext] Editor needed) Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 5:26 PM +0000 9/16/09, Paul Vixie wrote: > > From: David Conrad >> Date: Wed, 16 Sep 2009 10:10:55 -0700 >> >> Not sure what 'unilaterally' means in this context, but I believe TCP >> support should be mandatory. > >several of us think TCP support should be coupled to a server's ability to >generate UDP replies with the TC bit turned on. in the absence of any TC=1 >responses on UDP, i think that TCP should be optional. in the presence of >any TC=1 responses on UDP, i think that TCP should be mandatory. That sounds reasonable. Under this logic, TCP is mandatory to implement and support, but not mandatory to use except in the case given. Note that DNS implementation cannot predict whether or not a TC=1 response will be received, so implementing TCP is mandatory. Similarly, a middlebox cannot predict whether or not a TC=1 response will be received, so implementing TCP is mandatory. --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Wed Sep 16 11:51:55 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 289123A6AF7; Wed, 16 Sep 2009 11:51:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.105 X-Spam-Level: X-Spam-Status: No, score=-5.105 tagged_above=-999 required=5 tests=[AWL=-0.057, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eM9sAi1odxM4; Wed, 16 Sep 2009 11:51:54 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4AA4F3A6A1B; Wed, 16 Sep 2009 11:51:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzYu-0007wt-SM for namedroppers-data0@psg.com; Wed, 16 Sep 2009 18:49:04 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzYX-0007sj-56 for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 18:49:02 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n8GImOVS011905; Wed, 16 Sep 2009 11:48:24 -0700 (PDT) Subject: Re: [dnsext] Editor needed Mime-Version: 1.0 (Apple Message framework v1076) Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes From: Nicholas Weaver In-Reply-To: <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> Date: Wed, 16 Sep 2009 11:48:23 -0700 Cc: Nicholas Weaver , "namedroppers@ops.ietf.org WG" Content-Transfer-Encoding: 7bit Message-Id: References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> To: Paul Vixie X-Mailer: Apple Mail (2.1076) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 16, 2009, at 10:26 AM, Paul Vixie wrote: > several of us think TCP support should be coupled to a server's > ability to > generate UDP replies with the TC bit turned on. in the absence of > any TC=1 > responses on UDP, i think that TCP should be optional. in the > presence of > any TC=1 responses on UDP, i think that TCP should be mandatory. Is there really any DNS authority codebase where you can make the statement "all responses will ALWAYS fit into 512B"? Because thats what this statement implies is necessary for not supporting TCP. From owner-namedroppers@ops.ietf.org Wed Sep 16 11:57:38 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BE2073A68E0; Wed, 16 Sep 2009 11:57:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.573 X-Spam-Level: X-Spam-Status: No, score=-2.573 tagged_above=-999 required=5 tests=[AWL=0.026, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PAB+gOU-K-I7; Wed, 16 Sep 2009 11:57:38 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F09033A6942; Wed, 16 Sep 2009 11:57:37 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnzee-0008mU-O4 for namedroppers-data0@psg.com; Wed, 16 Sep 2009 18:55:00 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzeT-0008kk-3r for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 18:54:56 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id CED95B6979; Wed, 16 Sep 2009 18:54:48 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: Nicholas Weaver cc: "namedroppers@ops.ietf.org WG" Subject: Re: [dnsext] Editor needed In-Reply-To: Your message of "Wed, 16 Sep 2009 11:48:23 MST." References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Wed, 16 Sep 2009 18:54:48 +0000 Message-ID: <21181.1253127288@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Nicholas Weaver > Date: Wed, 16 Sep 2009 11:48:23 -0700 > > Is there really any DNS authority codebase where you can make the > statement "all responses will ALWAYS fit into 512B"? yes. > Because thats what this statement implies is necessary for not supporting > TCP. right. From owner-namedroppers@ops.ietf.org Wed Sep 16 12:10:34 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 658483A6824; Wed, 16 Sep 2009 12:10:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.558 X-Spam-Level: X-Spam-Status: No, score=-102.558 tagged_above=-999 required=5 tests=[AWL=0.041, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u9jO2nIBpPKf; Wed, 16 Sep 2009 12:10:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 769F63A6B12; Wed, 16 Sep 2009 12:10:33 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnzqg-000AcM-Cp for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:07:26 +0000 Received: from [2001:470:1f00:ffff::af] (helo=mail.hardakers.net) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzqR-000Aav-19 for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 19:07:21 +0000 Received: from localhost (wjh.hardakers.net [10.0.0.2]) by mail.hardakers.net (Postfix) with ESMTPSA id B4BEF98177; Wed, 16 Sep 2009 12:07:10 -0700 (PDT) From: Wes Hardaker To: Matthew Dempsky Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed Organization: Sparta References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> Date: Wed, 16 Sep 2009 12:07:10 -0700 In-Reply-To: (Matthew Dempsky's message of "Wed, 16 Sep 2009 09:37:33 -0700") Message-ID: User-Agent: Gnus/5.110011 (No Gnus v0.11) XEmacs/21.4.22 (linux, no MULE) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: >>>>> On Wed, 16 Sep 2009 09:37:33 -0700, Matthew Dempsky said: MD> For: Bill Manning, Mark Andrews, Andrew Sullivan(?), Paul Hoffman(?) I think you can add my name to the list. The problem is that your list doesn't break down easily, as has been discussed. When it comes down to it, large packets > 512 bytes simply are the way of the future. Both because of DNSSEC as well as IPv6 explosions, etc. Would I care if some DNS server out there couldn't handle TCP or packets above a certain size but it wasn't serving data above a certain size? Probably not if that could be assured. But in the end this data size explosion isn't going to stop, and lets be honest: implementing TCP in a DNS stack is not that expensive (it's in the noise compared to everything else). Right now, the only alternatives to supporting much of that is either EDNS0 or TCP. Eventually SCTP (which I agree might be a better transport for DNS) may be a better alternative but I doubt it is now though I understand it's deployment is catching up. The important thing is that putting a implementation requirement doesn't mean that operators have to use it, that manuals have to say "you should use it" or even that it has to default to on (unless that wording is added as well). The important thing is that you have to give the operators the tools they need to use the protocol, and I do believe we're heading for a point where the impact of TCP is low and the need for it is higher. Thus, I think requiring implementations to support it is simply the correct thing to do. -- Wes Hardaker Cobham Analytic Solutions From owner-namedroppers@ops.ietf.org Wed Sep 16 12:11:58 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 07FAB28C13A; Wed, 16 Sep 2009 12:11:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.203 X-Spam-Level: X-Spam-Status: No, score=0.203 tagged_above=-999 required=5 tests=[AWL=0.076, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3q-Ibxxo+9a4; Wed, 16 Sep 2009 12:11:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 407D028C12A; Wed, 16 Sep 2009 12:11:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnztD-000B8Z-QS for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:10:03 +0000 Received: from [209.85.216.195] (helo=mail-px0-f195.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnzt4-000B6R-9a for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 19:10:01 +0000 Received: by pxi33 with SMTP id 33so4385674pxi.11 for ; Wed, 16 Sep 2009 12:09:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.243.8 with SMTP id q8mr16734595wah.211.1253128194009; Wed, 16 Sep 2009 12:09:54 -0700 (PDT) In-Reply-To: References: <20090825224731.GJ4142@shinkuro.com> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> Date: Wed, 16 Sep 2009 12:09:53 -0700 Message-ID: Subject: Re: Where TCP might be required (Was: [dnsext] Editor needed) From: Matthew Dempsky To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 16, 2009 at 11:45 AM, Paul Hoffman wrote: > That sounds reasonable. Under this logic, TCP is mandatory to implement and support, but not mandatory to use except in the case given. My only concern with this is that I think it's overstepping the jurisdiction of a protocol standard to dictate what software is required to implement and support if it's not required to have it enabled. Supporting TCP but having it disabled is externally indistinguishable from not supporting TCP, so it seems silly to allow one and forbid the other. > Note that DNS implementation cannot predict whether or not a TC=1 response will be received, so implementing TCP is mandatory. Similarly, a middlebox cannot predict whether or not a TC=1 response will be received, so implementing TCP is mandatory. I mostly agree with this. On the general Internet, there's certainly the possibility of large responses requiring TC=1. If a client somehow knew that a response would not set TC=1, then I don't see a reason to support TCP. However, as there's no RFC standardizing a way for clients to be sure of this, I don't see a reason to worry about it. From owner-namedroppers@ops.ietf.org Wed Sep 16 12:14:06 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 938073A6904; Wed, 16 Sep 2009 12:14:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.796 X-Spam-Level: X-Spam-Status: No, score=-0.796 tagged_above=-999 required=5 tests=[AWL=-0.301, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id begkDC3uyXS0; Wed, 16 Sep 2009 12:14:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C37863A6804; Wed, 16 Sep 2009 12:14:05 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnzv3-000BTG-EP for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:11:57 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnzuu-000BRI-07 for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 19:11:55 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id C15D91542060; Wed, 16 Sep 2009 20:11:44 +0100 (BST) Cc: Paul Vixie , "namedroppers@ops.ietf.org WG" Message-Id: <6B4B3A93-BB9D-413D-BA95-FB760D32DF33@rfc1035.com> From: Jim Reid To: Nicholas Weaver In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: [dnsext] TCP and 512+ byte responses Date: Wed, 16 Sep 2009 20:11:44 +0100 References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 16 Sep 2009, at 19:48, Nicholas Weaver wrote: > Is there really any DNS authority codebase where you can make the > statement "all responses will ALWAYS fit into 512B"? IIUC djbdns is designed that way. It doesn't support TCP. Or EDNS. The author's view is that zone owners have to organise their DNS data to ensure it can never exceed a 512 byte response. From owner-namedroppers@ops.ietf.org Wed Sep 16 12:15:31 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EC46B28C12A; Wed, 16 Sep 2009 12:15:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.146 X-Spam-Level: X-Spam-Status: No, score=-4.146 tagged_above=-999 required=5 tests=[AWL=-0.848, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uub6syfMqIgZ; Wed, 16 Sep 2009 12:15:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3915328C0CE; Wed, 16 Sep 2009 12:15:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzwL-000Bmp-Q3 for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:13:17 +0000 Received: from [213.248.199.24] (helo=mx4.nominet.org.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnzvt-000Bem-R3; Wed, 16 Sep 2009 19:13:10 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:In-Reply-To:References:To:Cc: Subject:MIME-Version:X-Mailer:Message-ID:From:Date: X-MIMETrack:Content-Type; b=daa25T4rWBxATwbUiz3zCnzCaufJjX1Bpb1O3ATxwrsf36JPZnEdYeXj 10BpK87uwJelpqcTYCJjMp9xdY5XT/x0wXOL7aS29Ri5HqawT9XwY0YqN hg4cS9bRWUHVUI5; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=Ray.Bellis@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1253128369; x=1284664369; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20Ray.Bellis@nominet.org.uk|Subject:=20Re:=20[dnse xt]=20Editor=20needed|Date:=20Wed,=2016=20Sep=202009=2020 :12:44=20+0100|Message-ID:=20|To:=20Matt hew=20Dempsky=20|Cc:=20namedroppers@ ops.ietf.org,=0D=0A=09owner-namedroppers@ops.ietf.org |MIME-Version:=201.0|In-Reply-To:=20|References:=20<2 0090825224731.GJ4142@shinkuro.com>=09=20<20090827142630.G A14431@vacation.karoshi.com.>=0D=0A=09=20<49FE02E45D12846 B1BE861E2@nimrod.home>=09=20<20090828112706.GA6056@vacati on.karoshi.com.>=0D=0A=09=20=09=20 =20<4AA9E86C.10302@everydns.net>=0D=0A=09=20=20; bh=qeeGoY0dHycJF9+4Ks9Kb5geoEbr/eqlXeNyor4OVmA=; b=PvPXpLPDUizKTgLXZo+PR/icrbCka5i+uJqsxVNa5d/F+dIOhd6yDENx cs3M3ayzR4RBhHXKQISZrNjWYtTk+wMFg4JIRuDWK0E6vlal6hn+03SFy S5JPyYUlWO/te+E; X-IronPort-AV: E=Sophos;i="4.44,399,1249254000"; d="scan'208";a="12961387" Received: from notes1.nominet.org.uk ([213.248.197.128]) by mx4.nominet.org.uk with ESMTP; 16 Sep 2009 20:12:46 +0100 In-Reply-To: References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> To: Matthew Dempsky Cc: namedroppers@ops.ietf.org, owner-namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed MIME-Version: 1.0 X-Mailer: Lotus Notes Release 8.5 December 05, 2008 Message-ID: From: Ray.Bellis@nominet.org.uk Date: Wed, 16 Sep 2009 20:12:44 +0100 X-MIMETrack: Serialize by Router on notes1/Nominet(Release 7.0.1FP1 | May 25, 2006) at 16/09/2009 08:12:46 PM, Serialize complete at 16/09/2009 08:12:46 PM Content-Type: multipart/alternative; boundary="=_alternative 0069896D80257633_=" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is a multipart message in MIME format. --=_alternative 0069896D80257633_= Content-Type: text/plain; charset="US-ASCII" > Against: Dean Anderson(?), George Barwood, Paul Vixie, Ray Bellis, > David Ulevitch, myself. I don't recall making that assertion. I _did_ say that the RFCs don't currently mandate it. Ray --=_alternative 0069896D80257633_= Content-Type: text/html; charset="US-ASCII"  
>   Against: Dean Anderson(?), George Barwood, Paul Vixie, Ray Bellis,
> David Ulevitch, myself.
I don't recall making that assertion.

I _did_ say that the RFCs don't currently mandate it.

Ray
--=_alternative 0069896D80257633_=-- From owner-namedroppers@ops.ietf.org Wed Sep 16 12:17:16 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 03A243A6BAC; Wed, 16 Sep 2009 12:17:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.721 X-Spam-Level: X-Spam-Status: No, score=-4.721 tagged_above=-999 required=5 tests=[AWL=-0.284, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uDj2AlwghS6o; Wed, 16 Sep 2009 12:17:15 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C7CF33A6B9B; Wed, 16 Sep 2009 12:17:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mnzyf-000CEf-Ei for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:15:41 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnzyV-000CCh-PY for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 19:15:39 +0000 Received: from SJC-Office-NAT-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 6ABB9A9443B; Wed, 16 Sep 2009 19:15:31 +0000 (UTC) Message-ID: <4AB13953.9020007@mail-abuse.org> Date: Wed, 16 Sep 2009 12:15:31 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: Paul Vixie CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> <20322.1253126278@nsa.vix.com> In-Reply-To: <20322.1253126278@nsa.vix.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/16/09 11:37 AM, Paul Vixie wrote: >> From: David Conrad >> Date: Wed, 16 Sep 2009 11:29:59 -0700 >> >> Given I believe that all servers need to be able to deal with large >> responses without fragmentation, the caveat here brings no value and >> instead, leads folks to come up with servers that can't deal with the >> Internet as it continues to evolve and call those servers "standards >> compliant". > > there's a Very important corner case here, which is embedded servers > tightly coupled with distributed applications, where the entire system > design calls for nontruncated responses. the question before the WG is > whether such a server should be allowed to exclude TCP altogether on > the basis that it will never truncate its UDP output. i think, "yes." Insisting upon TCP support within typical SOHO equipment is unrealistic, as demonstrated in the market already. On the other hand, SCTP with unreliable unordered delivery demands fewer resources to support flows altering PMTUs or those causing packet loss. Should these environments also benefit from DNSSEC? >>> david, in that context and on that spectrum, where do you sit? >> >> Same place. Support of TCP should be mandatory. > > even in the above circumstance? you seem to be allowing for TCP-first > client behaviour, which surprises me. This should be SCTP first. -Doug From owner-namedroppers@ops.ietf.org Wed Sep 16 12:35:46 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA2A73A6B6E; Wed, 16 Sep 2009 12:35:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.219 X-Spam-Level: X-Spam-Status: No, score=-0.219 tagged_above=-999 required=5 tests=[AWL=0.218, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7blPOEoEQUe3; Wed, 16 Sep 2009 12:35:46 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CC2983A686E; Wed, 16 Sep 2009 12:35:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0F4-000Em1-Cr for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:32:38 +0000 Received: from [192.36.115.43] (helo=paka.besserwisser.org) by psg.com with esmtps (TLSv1:DES-CBC3-SHA:168) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0Eg-000EgS-6A for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 19:32:29 +0000 Received: from paka.besserwisser.org (localhost [127.0.0.1]) by paka.besserwisser.org (8.13.8+Sun/8.13.7) with ESMTP id n8GJW9Ct002253; Wed, 16 Sep 2009 21:32:09 +0200 (CEST) Received: (from mansaxel@localhost) by paka.besserwisser.org (8.13.8+Sun/8.13.7/Submit) id n8GJW9Ah002252; Wed, 16 Sep 2009 21:32:09 +0200 (CEST) Date: Wed, 16 Sep 2009 21:32:08 +0200 From: Mans Nilsson To: Matthew Dempsky Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed Message-ID: <20090916193208.GH10287@besserwisser.org> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-URL: http://vvv.besserwisser.org X-Purpose: More of everything NOW! X-happyness: Life is good. User-Agent: Mutt/1.5.19 (2009-01-05) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Subject: Re: [dnsext] Editor needed Date: Wed, Sep 16, 2009 at 09:37:33AM -0700 Quoting Matthew Dempsky (matthew@dempsky.org): > On Wed, Sep 16, 2009 at 7:44 AM, Paul Hoffman wrote: > > There is disagreement about whether or not TCP is a MUST here, but it feels like most people who have commented think that it is. We should change the standard to match what the WG feels. I'm with drc here. TCP will be needed because sometimes large UDP packets either aren't enough or are frowned upon by more-broken-than-most devices. I think and teach that TCP is a MUST, but tell my students that that MUST is a matter of operationally based opinion. I'd like to have that opinion replaced by a solid MUST. -- MÃ¥ns From owner-namedroppers@ops.ietf.org Wed Sep 16 12:36:12 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7E2593A6905; Wed, 16 Sep 2009 12:36:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.124 X-Spam-Level: X-Spam-Status: No, score=-4.124 tagged_above=-999 required=5 tests=[AWL=-0.826, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hoQ6D7f5cdN2; Wed, 16 Sep 2009 12:36:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4D66E3A6866; Wed, 16 Sep 2009 12:36:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0Ge-000F3P-CW for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:34:16 +0000 Received: from [213.248.199.24] (helo=mx4.nominet.org.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0GS-000F1Z-A0 for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 19:34:11 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:In-Reply-To:References:To:Cc: Subject:MIME-Version:X-Mailer:Message-ID:From:Date: X-MIMETrack:Content-Type; b=3gWZ2F9xV08VZ9u7jvfbnvB6GjCS83Vnqe0kNmT/Q/qx5p+3XBSpR9Fq RBWfRV/1oG9t+m1OFoZxWVLHgkjS4gDXllftjAsEAoOjrZ3j08Xd2v+av 4NDp3E/MYRlHEZK; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=Ray.Bellis@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1253129644; x=1284665644; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20Ray.Bellis@nominet.org.uk|Subject:=20Re:=20[dnse xt]=20Editor=20needed|Date:=20Wed,=2016=20Sep=202009=2020 :33:59=20+0100|Message-ID:=20|To:=20Doug las=20Otis=20|Cc:=20namedroppers@op s.ietf.org|MIME-Version:=201.0|In-Reply-To:=20<4AB13953.9 020007@mail-abuse.org>|References:=20<20090825224731.GJ41 42@shinkuro.com>=20<20090827142630.GA14431@vacation.karos hi.com.>=20<49FE02E45D12846B1BE861E2@nimrod.home>=20<2009 0828112706.GA6056@vacation.karoshi.com.>=20=20=20<4AA9E86C.10302@everydns.net>=20=20=20<75F6BD4D-83D2-4E3F-9 669-B998BD132CE7@virtualized.org>=20<17253.1253122012@nsa .vix.com>=20=20<39E10514-C93C-4778-98AD-D4068597437D@virt ualized.org>=20<20322.1253126278@nsa.vix.com>=20<4AB13953 .9020007@mail-abuse.org>; bh=mAwFq39lEJBc6ycYIYISV6Dnd/BNtGaQI3iTJDe2PA8=; b=ThcgoGlB/l4NrEk73i2NzQcWo6kL+Nd+U5YqIcJmV7lEbcKZCKdTSbkT B8KilXz6YuzCg3OEhFDsA/TJeFacM7NodsqZlfRk872rQoMqez9DNWAUC 7g+1eCRIl+hvfeY; X-IronPort-AV: E=Sophos;i="4.44,399,1249254000"; d="scan'208";a="12961843" Received: from notes1.nominet.org.uk ([213.248.197.128]) by mx4.nominet.org.uk with ESMTP; 16 Sep 2009 20:34:01 +0100 In-Reply-To: <4AB13953.9020007@mail-abuse.org> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> <20322.1253126278@nsa.vix.com> <4AB13953.9020007@mail-abuse.org> To: Douglas Otis Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed MIME-Version: 1.0 X-Mailer: Lotus Notes Release 8.5 December 05, 2008 Message-ID: From: Ray.Bellis@nominet.org.uk Date: Wed, 16 Sep 2009 20:33:59 +0100 X-MIMETrack: Serialize by Router on notes1/Nominet(Release 7.0.1FP1 | May 25, 2006) at 16/09/2009 08:34:02 PM, Serialize complete at 16/09/2009 08:34:02 PM Content-Type: multipart/alternative; boundary="=_alternative 006B7BA580257633_=" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is a multipart message in MIME format. --=_alternative 006B7BA580257633_= Content-Type: text/plain; charset="US-ASCII" > Insisting upon TCP support within typical SOHO equipment is unrealistic, > as demonstrated in the market already. Not at all. Some manufacturers are now supporting TCP (via use of dnsmasq etc in their firmware). Proxying DNS over TCP is far simpler than the content blocking features that many SOHO routers have. The number of concurrent TCP sessions is also unlikely to cause any significant problems. That seems to be the biggest argument against mandatory TCP support on authoritative servers. SCTP support on the other hand, is probably a _very_ long way away. Ray --=_alternative 006B7BA580257633_= Content-Type: text/html; charset="US-ASCII"
> Insisting upon TCP support within typical SOHO equipment is unrealistic,
> as demonstrated in the market already.

Not at all.

Some manufacturers are now supporting TCP (via use of dnsmasq etc in their firmware).  Proxying DNS over TCP is far simpler than the content blocking features that many SOHO routers have.

The number of concurrent TCP sessions is also unlikely to cause any significant problems.  That seems to be the biggest argument against mandatory TCP support on authoritative servers.

SCTP support on the other hand, is probably a _very_ long way away.

Ray
--=_alternative 006B7BA580257633_=-- From owner-namedroppers@ops.ietf.org Wed Sep 16 12:39:20 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F2E03A6A2A; Wed, 16 Sep 2009 12:39:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.17 X-Spam-Level: **** X-Spam-Status: No, score=4.17 tagged_above=-999 required=5 tests=[AWL=0.275, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OQYYt2BSg2kL; Wed, 16 Sep 2009 12:39:19 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 83F193A6986; Wed, 16 Sep 2009 12:39:19 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0Jd-000FX6-A2 for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:37:21 +0000 Received: from [195.188.213.8] (helo=smtp-out5.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0JO-000FSz-1C for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 19:37:19 +0000 Received: from [172.23.170.143] (helo=anti-virus02-10) by smtp-out5.blueyonder.co.uk with smtp (Exim 4.52) id 1Mo0JJ-0007IX-27; Wed, 16 Sep 2009 20:37:01 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out1.blueyonder.co.uk with esmtpa (Exim 4.52) id 1Mo0JI-0005lH-FP; Wed, 16 Sep 2009 20:37:00 +0100 Message-ID: <94A6C73E649C435BA7E2C0A29E955F9D@localhost> From: "George Barwood" To: "Matthew Dempsky" , References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> Subject: Re: [dnsext] Editor needed Date: Wed, 16 Sep 2009 20:36:56 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIk1hdHRoZXcgRGVtcHNreSIg PG1hdHRoZXdAZGVtcHNreS5vcmc+DQpUbzogPG5hbWVkcm9wcGVyc0BvcHMuaWV0Zi5vcmc+DQpT ZW50OiBXZWRuZXNkYXksIFNlcHRlbWJlciAxNiwgMjAwOSA1OjM3IFBNDQpTdWJqZWN0OiBSZTog W2Ruc2V4dF0gRWRpdG9yIG5lZWRlZA0KDQoNCj4gT24gV2VkLCBTZXAgMTYsIDIwMDkgYXQgNzo0 NCBBTSwgUGF1bCBIb2ZmbWFuIDxwYXVsLmhvZmZtYW5AdnBuYy5vcmc+IHdyb3RlOg0KPj4gVGhl cmUgaXMgZGlzYWdyZWVtZW50IGFib3V0IHdoZXRoZXIgb3Igbm90IFRDUCBpcyBhIE1VU1QgaGVy ZSwgYnV0IGl0IGZlZWxzIGxpa2UgbW9zdCBwZW9wbGUgd2hvIGhhdmUgY29tbWVudGVkIHRoaW5r IHRoYXQgaXQgaXMuIFdlIHNob3VsZCBjaGFuZ2UgdGhlIHN0YW5kYXJkIHRvIG1hdGNoIHdoYXQg dGhlIFdHIGZlZWxzLg0KPiANCj4gTG9va2luZyB0aHJvdWdoIHRoaXMgZW1haWwgdGhyZWFkLCBo ZXJlJ3MgbXkgY291bnQgb2YgcGVvcGxlIHdobyBoYXZlDQo+IHdlaWdoZWQgaW4gb24gdGhlaXIg c3RhbmNlIG9uIHdoZXRoZXIgVENQIHN1cHBvcnQgc2hvdWxkIGJlDQo+IHVuaWxhdGVyYWxseSBt YW5kYXRvcnk6DQo+IA0KPiAgRm9yOiBCaWxsIE1hbm5pbmcsIE1hcmsgQW5kcmV3cywgQW5kcmV3 IFN1bGxpdmFuKD8pLCBQYXVsIEhvZmZtYW4oPykNCj4gDQo+ICBBZ2FpbnN0OiBEZWFuIEFuZGVy c29uKD8pLCBHZW9yZ2UgQmFyd29vZCwgUGF1bCBWaXhpZSwgUmF5IEJlbGxpcywNCj4gRGF2aWQg VWxldml0Y2gsIG15c2VsZi4NCg0KSnVzdCB0byBjbGFyaWZ5LCBJIHRoaW5rIHNlcnZlciBUQ1Ag c3VwcG9ydCBzaG91bGQgYmUgbWFuZGF0b3J5IA0KKGEpIElmIHJlc3BvbnNlcyA+IDUxMiBieXRl cyBhcmUgcG9zc2libGUuDQooYikgQWxzbyBmb3Igc2VjdXJlIHpvbmVzICgganVzdCB0byBjb3Zl ciB0aGUgcG9zc2liaWxpdHkgb2YgRE5TU0VDIHNxdWVha2luZyB1bmRlciA1MTIgYnl0ZXMgc29t ZWhvdyApLg0KKGMpIEZvciBhbGwgbm9uLWF1dGhvcml0YXRpdmUgY2FzZXMgKCBzbyBjYWNoZXMg YW5kIHByb3hpZXMgTVVTVCBzdXBwb3J0IFRDUCwgcmVnYXJkbGVzcyApLg0KDQpTbyB0aGUgb25s eSBleGNlcHRpb24gaXMgYXV0aG9yaXRhdGl2ZSBzZXJ2ZXJzIHdpdGggbm8gc2VjdXJlIHpvbmVz IHRoYXQgbmV2ZXIgc2V0IFRDLiANCkkgZG9uJ3Qgc2VlIGFueSBuZWVkIHRvIGZvcmNlIHRob3Nl IHNlcnZlcnMgdG8gYmUgdXBncmFkZWQuDQoNClRoZXJlIGlzIGFsc28gdGhlIGNsaWVudCBzaWRl LiBJIHRoaW5rIEROU1NFQyBjbGllbnRzIE1VU1Qgc3VwcG9ydCBUQ1AsDQp0aGF0IGlzIHRoZXkg bXVzdCBiZSBhYmxlIHRvIGZhbGwgYmFjayB0byBUQ1AgYWZ0ZXIgZ2V0dGluZyBhIHRydW5jYXRl ZCByZXNwb25zZS4NCg0KTm9uLUROU1NFQyBjbGllbnRzIG5lZWQgbm90IHN1cHBvcnQgVENQLg0K DQpGaW5hbGx5LCB0aGUgcnVsZXMgZm9yIFVEUCBzdXBwb3J0Og0KKDEpIFNlcnZlcnMgTVVTVCBz dXBwb3J0IFVEUCAoIGJ1dCBtYXkgdHJ1bmNhdGUgcmVzcG9uc2VzIGNhdXNpbmcgVENQIGZhbGxi YWNrICkuDQooMikgU3R1YiBjbGllbnRzIG5lZWQgbm90IHN1cHBvcnQgVURQICggYnV0IG1heSBl eHBlcmllbmNlIHByb2JsZW1zIGlmIHRoZXkgZG8gbm90LCBmb3IgaGlzdG9yaWNhbCByZWFzb25z ICkuDQooMykgT3RoZXIgY2xpZW50cyBtdXN0IHN1cHBvcnQgVURQLg0KDQpHZW9yZ2UNCg0KPiAg VW5jbGVhcjogQWxleCBCbGlnaCwgRmxvcmlhbiBXZWltZXINCj4gDQo+ From owner-namedroppers@ops.ietf.org Wed Sep 16 12:44:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F12E23A6805; Wed, 16 Sep 2009 12:44:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.2 X-Spam-Level: X-Spam-Status: No, score=0.2 tagged_above=-999 required=5 tests=[AWL=0.073, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vsV8jRdRIXGs; Wed, 16 Sep 2009 12:44:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0FE3228C0CE; Wed, 16 Sep 2009 12:44:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0NO-000G7m-9y for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:41:14 +0000 Received: from [209.85.222.199] (helo=mail-pz0-f199.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0N8-000G5U-BN for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 19:41:10 +0000 Received: by pzk37 with SMTP id 37so1802408pzk.25 for ; Wed, 16 Sep 2009 12:40:57 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.33.18 with SMTP id g18mr14538916wag.228.1253130056126; Wed, 16 Sep 2009 12:40:56 -0700 (PDT) In-Reply-To: <6B4B3A93-BB9D-413D-BA95-FB760D32DF33@rfc1035.com> References: <20090825224731.GJ4142@shinkuro.com> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> <6B4B3A93-BB9D-413D-BA95-FB760D32DF33@rfc1035.com> Date: Wed, 16 Sep 2009 12:40:56 -0700 Message-ID: Subject: Re: [dnsext] TCP and 512+ byte responses From: Matthew Dempsky To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 16, 2009 at 12:11 PM, Jim Reid wrote: > IIUC djbdns is designed that way. It doesn't support TCP. djbdns supports TCP, it's just not enabled by default for authoritative servers. From owner-namedroppers@ops.ietf.org Wed Sep 16 12:53:34 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E80E83A695E; Wed, 16 Sep 2009 12:53:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.048 X-Spam-Level: X-Spam-Status: No, score=-1.048 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pm6jYP4q5V6u; Wed, 16 Sep 2009 12:53:34 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0541928C12A; Wed, 16 Sep 2009 12:53:34 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0Vl-000H7X-BE for namedroppers-data0@psg.com; Wed, 16 Sep 2009 19:49:53 +0000 Received: from [83.145.227.89] (helo=gusev.araneus.fi) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0Vb-000H6d-0L for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 19:49:50 +0000 Received: from guava.gson.org (guava.gson.org [83.145.227.105]) by gusev.araneus.fi (Postfix) with ESMTP id EB42891C09; Wed, 16 Sep 2009 22:49:34 +0300 (EEST) Received: by guava.gson.org (Postfix, from userid 101) id 84AE175F38; Wed, 16 Sep 2009 22:49:40 +0300 (EEST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <19121.16724.4888.612984@guava.gson.org> Date: Wed, 16 Sep 2009 22:49:40 +0300 To: Matthew Dempsky Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed In-Reply-To: References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> X-Mailer: VM 7.19 under Emacs 21.4.1 From: Andreas Gustafsson Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Matthew Dempsky wrote: > Looking through this email thread, here's my count of people who > have weighed in on their stance on whether TCP support should be > unilaterally mandatory I think TCP support should be mandatory, or at the very least strongly encouraged even in the case where no TC=1 responses are being sent, for the reason that careful use of TCP can be quite useful as a part of a resolver's anti-spoofing strategy, and is being used for that purpose in production resolvers. To those who say that TCP based spoofing defenses can't work because TCP support in authoritative servers is not universal, or because it is possible to DoS TCP, I will note that the goal of such defense mechanisms is not to make the resolution succeed, but to make the spoofing attack fail. In this respect, they are no different from DNSSEC. If a resolver detects an attempted spoofing attack, switches to TCP, and TCP fails, it has still succeeded in thwarting the attack. But when TCP does work, it can do even better and provide a correct response instead of just a SERVFAIL. -- Andreas Gustafsson, gson@araneus.fi From owner-namedroppers@ops.ietf.org Wed Sep 16 13:15:09 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3267228C17F; Wed, 16 Sep 2009 13:15:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.529 X-Spam-Level: X-Spam-Status: No, score=-1.529 tagged_above=-999 required=5 tests=[AWL=-1.034, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BOL+myUbYGDN; Wed, 16 Sep 2009 13:15:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 616E23A6805; Wed, 16 Sep 2009 13:15:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0qf-000JDp-9N for namedroppers-data0@psg.com; Wed, 16 Sep 2009 20:11:29 +0000 Received: from [209.85.219.215] (helo=mail-ew0-f215.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo0qW-000JDB-6K for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 20:11:27 +0000 Received: by ewy11 with SMTP id 11so4809332ewy.11 for ; Wed, 16 Sep 2009 13:11:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:content-type; bh=aER6gAE1KW77zf90nuBwMqHd0zpM09Rpqnd95QQiIQE=; b=RGNBVYyjQisAMSoMeaE7itiBWDJcD98XDPcADlby/kmO9x4o8rS1YP1szm/LUaxEel f0DgEzmGbtFnyckh/OSVFcGUKovSizyl5G6o5IbW6GtHmyPpcRIQmu2xURSPb8QKcL0Z vV95DlxHbd67wWYVrKMFVtXFkbHmelc9fHC5E= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=JGGmVzbtYOOjNHgpqOEGmHI3S9lD4q0p8m7hsEmHvQhShBzHPg3Je1Fosd98QrUqxG YijANYpHaDJVw8nCrSwU7JHr+7yYPJ9yrNlMN7gRHAkvqtegOBg+ZJkhqhQ5iPllYGQT 1LH95N88bjAeczZ76EdQZKwkE8n03/DZdwTz0= MIME-Version: 1.0 Received: by 10.216.8.148 with SMTP id 20mr1721272wer.112.1253131878307; Wed, 16 Sep 2009 13:11:18 -0700 (PDT) In-Reply-To: <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> References: <20090825224731.GJ4142@shinkuro.com> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> Date: Wed, 16 Sep 2009 16:11:18 -0400 Message-ID: <1028365c0909161311i599eb030o4558227d7e5f1386@mail.gmail.com> Subject: Re: [dnsext] Editor needed From: Donald Eastlake To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Count me for making TCP mandatory to implement. Donald ============================= Donald E. Eastlake 3rd +1-508-634-2066 (home) 155 Beaver Street Milford, MA 01757 USA d3e3e3@gmail.com From owner-namedroppers@ops.ietf.org Wed Sep 16 13:24:37 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5C27F3A68D5; Wed, 16 Sep 2009 13:24:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.776 X-Spam-Level: X-Spam-Status: No, score=-0.776 tagged_above=-999 required=5 tests=[AWL=-0.281, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b09o7hXx1q0q; Wed, 16 Sep 2009 13:24:36 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 532E03A681D; Wed, 16 Sep 2009 13:24:36 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo10z-000K8F-1s for namedroppers-data0@psg.com; Wed, 16 Sep 2009 20:22:09 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo10p-000K7T-O1 for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 20:22:07 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id D1A381542060; Wed, 16 Sep 2009 21:21:57 +0100 (BST) From: Jim Reid To: George Barwood In-Reply-To: <94A6C73E649C435BA7E2C0A29E955F9D@localhost> Subject: [dnsext] making TCP a MUST X-Priority: 3 References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> Message-Id: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Wed, 16 Sep 2009 21:21:57 +0100 Cc: "Matthew Dempsky" , X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 16 Sep 2009, at 20:36, George Barwood wrote: > Just to clarify, I think server TCP support should be mandatory > (a) If responses > 512 bytes are possible. > .... > (c) For all non-authoritative cases ( so caches and proxies MUST > support TCP, regardless ). > .... > Non-DNSSEC clients need not support TCP. This statement contradicts (a) and (c). What if an unsigned response doesn't fit into 512 bytes? The rough consensus here seems to be that there are corner cases with fragmentation that mean EDNS can't always be relied upon for these responses. So that pretty much leaves TCP as the only tool left in the box. BTW, since a server (implementation) has no a priori knowledge of the data it will serve, the "if" in (a) above is redundant. Responses larger than 512 bytes are definitely possible, even without DNSSEC. All it takes is 500 bytes or so of RDATA in a TXT record. IMO, let's make TCP a MUST and move on. This isn't going to break anything and may actually do some good. Of course, that change will mean some chunk of the installed base will violate the new spec. But those implementations will be doomed if/when DNS responses exceed 512 bytes anyway. They're already failing to handle truncated responses properly, so where's the actual operational problem? Why worry about preserving backwards compatibility for them when they have no hope of doing something sensible with a truncated response? I am of course worried about the impact on busy name servers of lots of short-lived TCP connections, particularly in their kernel network stacks. However that's a different problem from making TCP support for DNS clients and servers mandatory. One way to minimise that could be for the draft to say something like "try EDNS first, then fall back to classic UDP/512 and if that fails, then try TCP". From owner-namedroppers@ops.ietf.org Wed Sep 16 13:40:51 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 33B373A69EF; Wed, 16 Sep 2009 13:40:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.077 X-Spam-Level: X-Spam-Status: No, score=0.077 tagged_above=-999 required=5 tests=[AWL=-0.673, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zhncoqlydkva; Wed, 16 Sep 2009 13:40:50 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4C50F28C11E; Wed, 16 Sep 2009 13:40:50 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo1Do-000LG0-5H for namedroppers-data0@psg.com; Wed, 16 Sep 2009 20:35:24 +0000 Received: from [212.9.189.167] (helo=mail.enyo.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo1DX-000LDy-Ol for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 20:35:15 +0000 Received: from deneb.vpn.enyo.de ([212.9.189.177] helo=deneb.enyo.de) by mail.enyo.de with esmtp id 1Mo1DU-00063k-3I; Wed, 16 Sep 2009 22:35:04 +0200 Received: from fw by deneb.enyo.de with local (Exim 4.69) (envelope-from ) id 1Mo1DT-0007bd-JI; Wed, 16 Sep 2009 20:35:03 +0000 From: Florian Weimer To: Matthew Dempsky Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> Date: Wed, 16 Sep 2009 20:35:03 +0000 In-Reply-To: (Matthew Dempsky's message of "Wed, 16 Sep 2009 09:37:33 -0700") Message-ID: <87fxamk4qw.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: * Matthew Dempsky: > Looking through this email thread, here's my count of people who have > weighed in on their stance on whether TCP support should be > unilaterally mandatory: > Unclear: Alex Bligh, Florian Weimer I think that TCP support already is mandatory. But given that this is debatable, I support making it mandatory (hopefully unambiguously this time). From owner-namedroppers@ops.ietf.org Wed Sep 16 13:46:59 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 343513A6AD9; Wed, 16 Sep 2009 13:46:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.144 X-Spam-Level: X-Spam-Status: No, score=0.144 tagged_above=-999 required=5 tests=[AWL=-0.606, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BHCE82pnjj8P; Wed, 16 Sep 2009 13:46:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6E9B73A6AEA; Wed, 16 Sep 2009 13:46:58 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo1Mz-000MHH-PU for namedroppers-data0@psg.com; Wed, 16 Sep 2009 20:44:53 +0000 Received: from [212.9.189.167] (helo=mail.enyo.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo1Mj-000MDb-Op for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 20:44:51 +0000 Received: from deneb.vpn.enyo.de ([212.9.189.177] helo=deneb.enyo.de) by mail.enyo.de with esmtp id 1Mo1Mh-0006DA-FN; Wed, 16 Sep 2009 22:44:35 +0200 Received: from fw by deneb.enyo.de with local (Exim 4.69) (envelope-from ) id 1Mo1Mh-0007eu-1D; Wed, 16 Sep 2009 20:44:35 +0000 From: Florian Weimer To: Paul Vixie Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> <20322.1253126278@nsa.vix.com> Date: Wed, 16 Sep 2009 20:44:34 +0000 In-Reply-To: <20322.1253126278@nsa.vix.com> (Paul Vixie's message of "Wed, 16 Sep 2009 18:37:58 +0000") Message-ID: <87zl8uipql.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: * Paul Vixie: > there's a Very important corner case here, which is embedded servers > tightly coupled with distributed applications, where the entire system > design calls for nontruncated responses. the question before the WG is > whether such a server should be allowed to exclude TCP altogether on > the basis that it will never truncate its UDP output. i think, "yes." Even if the server implements EDNS0? A TCP-less server might not be able to implement certain EDNS0 options due to size constraints. If those servers are taken seriously, there's yet another obstacle to protocol evolution. From owner-namedroppers@ops.ietf.org Wed Sep 16 13:58:15 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7E2EF3A6A26; Wed, 16 Sep 2009 13:58:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.108 X-Spam-Level: X-Spam-Status: No, score=-5.108 tagged_above=-999 required=5 tests=[AWL=-0.671, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kgWTC1v3ndBe; Wed, 16 Sep 2009 13:58:14 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A475F3A682E; Wed, 16 Sep 2009 13:58:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo1W5-000NMA-U0 for namedroppers-data0@psg.com; Wed, 16 Sep 2009 20:54:17 +0000 Received: from [204.152.189.190] (helo=virtualized.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo1Vv-000NKe-31 for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 20:54:14 +0000 Received: from localhost (localhost [127.0.0.1]) by virtualized.org (Postfix) with ESMTP id BA8D57DAC69; Wed, 16 Sep 2009 13:54:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at virtualized.org Received: from virtualized.org ([127.0.0.1]) by localhost (trantor.virtualized.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hrbOt+C2qReE; Wed, 16 Sep 2009 13:54:04 -0700 (PDT) Received: from wlan39-146.mdr.icann.org (wlan39-146.mdr.icann.org [192.0.39.146]) by virtualized.org (Postfix) with ESMTP id E39907DAC55; Wed, 16 Sep 2009 13:54:03 -0700 (PDT) Cc: namedroppers@ops.ietf.org Message-Id: <03270DB9-44D7-4A4C-B533-66B2A950407F@virtualized.org> From: David Conrad To: Paul Vixie In-Reply-To: <20322.1253126278@nsa.vix.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] Editor needed Date: Wed, 16 Sep 2009 13:54:03 -0700 References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> <20322.1253126278@nsa.vix.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 16, 2009, at 11:37 AM, Paul Vixie wrote: > there's a Very important corner case here, which is embedded servers > tightly coupled with distributed applications, where the entire system > design calls for nontruncated responses. the question before the WG > is > whether such a server should be allowed to exclude TCP altogether on > the basis that it will never truncate its UDP output. i think, "yes." I guess I wouldn't see this as a full DNS server, but rather a subset of the DNS tailored for a specific use. Pragmatically speaking, folks who do stuff like this will do whatever makes business sense. However, it doesn't make sense to me that such an implementation can be called standards compliant because it wouldn't be able to support new 'stupid DNS tricks'. > you seem to be allowing for TCP-first client behaviour, which > surprises me. Not a goal. I'm trying to improve the future-proofing of the DNS protocol. Regards, -drc From owner-namedroppers@ops.ietf.org Wed Sep 16 14:47:45 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6DF943A6833; Wed, 16 Sep 2009 14:47:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.758 X-Spam-Level: X-Spam-Status: No, score=-0.758 tagged_above=-999 required=5 tests=[AWL=-0.263, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ePCCtP1f+36I; Wed, 16 Sep 2009 14:47:44 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 986723A6A11; Wed, 16 Sep 2009 14:47:44 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo2Ia-0002Uq-MW for namedroppers-data0@psg.com; Wed, 16 Sep 2009 21:44:24 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo2IO-0002Sq-VC for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 21:44:21 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id 040411542060; Wed, 16 Sep 2009 22:44:11 +0100 (BST) From: Jim Reid To: "George Barwood" In-Reply-To: <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> Subject: Re: [dnsext] Re: making TCP a MUST X-Priority: 3 References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> Message-Id: <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Wed, 16 Sep 2009 22:44:10 +0100 Cc: "Matthew Dempsky" , X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 16 Sep 2009, at 22:15, George Barwood wrote: > But many stub clients only need to fetch a single A/AAAA record. That might (or might not) be true. But it's irrelevant. The client making this A or AAAA query *cannot* guarantee the response will be less than 512 bytes. If the client or application makes that assumption, it is broken. The protocol makes no promises that responses must always fit in a 512 byte UDP payload. > They do not need to implement TCP. Nonsense! See above. > Think of a simple device with a single UDP application. > It does not need DNS/TCP, or indeed TCP at all. Nope. Even in this hypothetical (and IMO contrived) scenario, the client cannot assume the query will never, ever get a response that exceeds 512 bytes. So it'll need some way of handling truncated responses. EDNS might be enough, but that can't be assumed either. Your reasoning here is like designing a ship without lifeboats because it'll never sink. From owner-namedroppers@ops.ietf.org Wed Sep 16 14:48:08 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D64E43A6805; Wed, 16 Sep 2009 14:48:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.908 X-Spam-Level: X-Spam-Status: No, score=-4.908 tagged_above=-999 required=5 tests=[AWL=-0.413, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ejc1yicZVIUr; Wed, 16 Sep 2009 14:48:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EF4513A6833; Wed, 16 Sep 2009 14:48:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo2Jg-0002aH-Lj for namedroppers-data0@psg.com; Wed, 16 Sep 2009 21:45:32 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo2JT-0002ZR-VE for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 21:45:29 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n8GLhmrb030786; Wed, 16 Sep 2009 21:43:50 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n8GLhlvn030785; Wed, 16 Sep 2009 21:43:47 GMT Date: Wed, 16 Sep 2009 21:43:47 +0000 From: bmanning@vacation.karoshi.com To: David Conrad Cc: Alex Bligh , IETF DNSEXT WG Subject: Re: Historical insanity (ignorable) Re: [dnsext] Editor needed Message-ID: <20090916214347.GB30677@vacation.karoshi.com.> References: <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <960F45758CA2ED442B3F6972@Ximines.local> <227EC4F2-C00C-48B4-8C4B-E2DE05A01FEA@virtualized.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <227EC4F2-C00C-48B4-8C4B-E2DE05A01FEA@virtualized.org> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 16, 2009 at 11:25:45AM -0700, David Conrad wrote: > On Sep 16, 2009, at 10:50 AM, Alex Bligh wrote: > >As a random data point, some time back in 1999, I was pressed to > >produce a DNS server which could cope with a constantly changing > >zone file and several hundred thousand domains (with mail and web > >hosting). > ... > >Even in back then, we had a noticeable number of complaints about > >not supporting TCP queries, which surprised me. > > If you want to talk about offenses against man and nature, back in the > mid-80s, there was once a caching resolver that did not support UDP > (the network stack for the system (a Univac 1100-series mainframe) > apparently made datagram support quite challenging). No idea when > that server was put out of its misery. > > Regards, > -drc > I was a happy boy back then. IBM supported discontigious subnet masks too... --bill From owner-namedroppers@ops.ietf.org Wed Sep 16 14:52:22 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 34BC328C1C2; Wed, 16 Sep 2009 14:52:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.884 X-Spam-Level: X-Spam-Status: No, score=-4.884 tagged_above=-999 required=5 tests=[AWL=-0.389, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 16sriosl4WRz; Wed, 16 Sep 2009 14:52:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4FCA228C1B9; Wed, 16 Sep 2009 14:52:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo2ND-0002vg-8d for namedroppers-data0@psg.com; Wed, 16 Sep 2009 21:49:11 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo2N1-0002um-VT for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 21:49:07 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n8GLlorb030802; Wed, 16 Sep 2009 21:47:50 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n8GLloIC030801; Wed, 16 Sep 2009 21:47:50 GMT Date: Wed, 16 Sep 2009 21:47:50 +0000 From: bmanning@vacation.karoshi.com To: Matthew Dempsky Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed Message-ID: <20090916214750.GC30677@vacation.karoshi.com.> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 16, 2009 at 09:37:33AM -0700, Matthew Dempsky wrote: > On Wed, Sep 16, 2009 at 7:44 AM, Paul Hoffman wrote: > > There is disagreement about whether or not TCP is a MUST here, but it feels like most people who have commented think that it is. We should change the standard to match what the WG feels. > > Looking through this email thread, here's my count of people who have > weighed in on their stance on whether TCP support should be > unilaterally mandatory: > > For: Bill Manning, Mark Andrews, Andrew Sullivan(?), Paul Hoffman(?) > > Against: Dean Anderson(?), George Barwood, Paul Vixie, Ray Bellis, > David Ulevitch, myself. > > Unclear: Alex Bligh, Florian Weimer let me be clear. I beleive there are multiple defined transports for DNS now and more will come. the text of my draft is simply to indicate that DNS should not be considered to be treated uniformly in the event of divergent transports. An operator may favor one transport option over another. It was not and will not be in the scope of my current draft to define mandatory to implement transports for DNS. --bill From owner-namedroppers@ops.ietf.org Wed Sep 16 15:07:22 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A1C5D3A6981; Wed, 16 Sep 2009 15:07:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.198 X-Spam-Level: X-Spam-Status: No, score=0.198 tagged_above=-999 required=5 tests=[AWL=0.071, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tacYTfUMQQdW; Wed, 16 Sep 2009 15:07:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D84003A680E; Wed, 16 Sep 2009 15:07:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo2bo-0004fD-Gk for namedroppers-data0@psg.com; Wed, 16 Sep 2009 22:04:16 +0000 Received: from [209.85.222.178] (helo=mail-pz0-f178.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo2be-0004e6-ES for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 22:04:13 +0000 Received: by pzk8 with SMTP id 8so1141409pzk.8 for ; Wed, 16 Sep 2009 15:04:04 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.103.23 with SMTP id f23mr8614319wam.226.1253138643205; Wed, 16 Sep 2009 15:04:03 -0700 (PDT) In-Reply-To: <20090916214750.GC30677@vacation.karoshi.com.> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <20090916214750.GC30677@vacation.karoshi.com.> Date: Wed, 16 Sep 2009 15:04:03 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 16, 2009 at 2:47 PM, wrote: > =A0 =A0 =A0 =A0It was not and will not be in the scope of my current draf= t to > =A0 =A0 =A0 =A0define mandatory to implement transports for DNS. That's not how I understand "all transport options MUST/need to be supported" from your draft. Would you mind clarifying if you don't think your statements are at odds with one another? From owner-namedroppers@ops.ietf.org Wed Sep 16 16:04:58 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE94528C1D1; Wed, 16 Sep 2009 16:04:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wI31nkErEq40; Wed, 16 Sep 2009 16:04:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D789E28C1C5; Wed, 16 Sep 2009 16:04:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo3Up-0009m0-U4 for namedroppers-data0@psg.com; Wed, 16 Sep 2009 23:01:07 +0000 Received: from [2001:1890:1112:1::20] (helo=mail.ietf.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo3Ub-0009lE-I7 for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 23:01:05 +0000 Received: by core3.amsl.com (Postfix, from userid 0) id D654628C186; Wed, 16 Sep 2009 16:00:01 -0700 (PDT) From: IESG Secretary To: ietf-announce@ietf.org Cc: ogud@ogud.com, ajs@shinkuro.com, namedroppers@ops.ietf.org Subject: [dnsext] WG Action: RECHARTER: DNS Extensions Working group (dnsext) Content-Type: text/plain; charset="utf-8" Mime-Version: 1.0 Message-Id: <20090916230001.D654628C186@core3.amsl.com> Date: Wed, 16 Sep 2009 16:00:01 -0700 (PDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: The charter of the DNS Extensions Working group (dnsext) working group in the Internet Area of the IETF has been updated. For additional information, please contact the Area Directors or the working group Chairs. DNS Extensions Working group (dnsext) ---------------------------------------- Last Modified: 2009-09-05 Current Status: Active Working Group Chair(s): Olafur Gudmundsson Andrew Sullivan Internet Area Director(s): Ralph Droms Jari Arkko Internet Area Advisor: Ralph Droms Mailing Lists: General Discussion: namedroppers@ops.ietf.org To Subscribe: namedroppers-request@ops.ietf.org Archive: http://ops.ietf.org/lists/namedroppers/ Description of Working Group: The DNS has a large installed base and repertoire of protocol specifications. The DNSEXT WG group will actively advance DNS protocol-related RFCs on the standards track while thoroughly reviewing further proposed extensions. The scope of the DNSEXT WG is confined to the DNS protocol, particularly changes that affect DNS protocols "on the wire" or the internal processing of DNS data. DNS operations are out of scope for the WG. The WG will limit itself to review of proposals for new extensions and clarification to the DNS protocol, including DNSSEC. Adoption of new work targeted for standards track will require changes to this charter. The working group can nevertheless undertake work in following subjects without a charter change: DNSSEC and TSIG/TKEY algorithm maintenance Hardening DNS protocol and providing guidance to implementors Advancing existing Proposed Standard RFCs to Draft/Full Standard Obsoleting RFCs. Maintaining a Wiki containing a guide to DNS protocol RFC's. Improving DNS zone synchronization mechanisms Examining transport protocols, possibly adding new ones. Before formal adoption of any such items at least 5 working group participants must publicly state that the item is within charter and is worthwhile item for further study. The DNSEXT WG will conduct the specified RFC5395 review of RR templates as they are posted, and EDNS0 Option templates if EDNS0-bis updates registration requirements. The WG will review DNS protocol related work which may originate elsewhere in the IETF, including AD-sponsored submissions or drafts in other working group. The WG does not intend to hold face to face meetings, though may do so if deemed necessary for resolution of a specific issue at hand. Milestones: Aug 2009 TSIG/MD5 Obsoleting to IESG. Sep 2009 EDNS0 Ping Option advanced to IESG Oct 2009 Resolver side Forgery Resilience advanced to IESG Oct 2009 DNSSEC Errata document to IESG Nov 2009 GOST DNSKEY and DS support advanced to IESG Dec 2009 EDNS0-bis update advanced to IESG Feb 2010 DNS existing transport protocol recommendations/clarifications to IESG Jan 2010 AXFR Clarify to IESG From owner-namedroppers@ops.ietf.org Wed Sep 16 16:52:29 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7394A3A68AE; Wed, 16 Sep 2009 16:52:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.573 X-Spam-Level: X-Spam-Status: No, score=-2.573 tagged_above=-999 required=5 tests=[AWL=0.026, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9v8+KmXw1XrX; Wed, 16 Sep 2009 16:52:28 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 88F323A6864; Wed, 16 Sep 2009 16:52:28 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo4FY-000DyU-LS for namedroppers-data0@psg.com; Wed, 16 Sep 2009 23:49:24 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo4FO-000Dx8-VK for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 23:49:22 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 59A0EB69DA for ; Wed, 16 Sep 2009 23:49:14 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: making TCP a MUST In-Reply-To: Your message of "Thu, 17 Sep 2009 00:29:20 +0100." <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Wed, 16 Sep 2009 23:49:14 +0000 Message-ID: <35191.1253144954@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: this has been going on way longer than i can hold my breath. enough folks have chimed in saying that tcp should be required for full dns compliance, that i hereby withdraw my opposition to it. if somebody wrote a draft that said udp and tcp are both required, edns is required, clients should try udp first, clients are required to retry with edns on udp truncation, and to retry with tcp on edns failure/unavailability/truncation, i'd support it. but then there's this: > From: "George Barwood" > Date: Thu, 17 Sep 2009 00:29:20 +0100 > > Still, a stub resolver always has the option of just using the truncated > response : it doesn't need to retry over TCP if it just wants the first A > record. there is no standard or published API in unix, dos, apple, or any embedded system with which i'm familiar where the result of gethostbyname() (or any equivilent thereof) can be "here's an address but there was truncation" and the input to a subsequent gethostbyname() (or any equivilent thereof) can be "listen i really want all the addresses so if you get truncation i need you to try harder." truncation occuring between full resolvers and (forwarders or authorities) will cause retry, since a truncated result cannot be cached or forwarded. truncation occuring between stub resolvers and (full resolvers or proxies) will cause retry, since a truncated result cannot be given to an application. From owner-namedroppers@ops.ietf.org Wed Sep 16 17:03:41 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CA46B3A694C; Wed, 16 Sep 2009 17:03:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.436 X-Spam-Level: X-Spam-Status: No, score=-2.436 tagged_above=-999 required=5 tests=[AWL=0.163, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3dqw6fB3iHnT; Wed, 16 Sep 2009 17:03:41 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F346C3A68CF; Wed, 16 Sep 2009 17:03:40 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo4QO-000F3Z-5g for namedroppers-data0@psg.com; Thu, 17 Sep 2009 00:00:36 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo4QE-000F12-DV for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 00:00:33 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id B0F7DE601E; Thu, 17 Sep 2009 00:00:25 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8H00MfO094883; Thu, 17 Sep 2009 10:00:23 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909170000.n8H00MfO094883@drugs.dv.isc.org> To: Paul Hoffman Cc: Jelte Jansen , namedroppers@ops.ietf.org From: Mark Andrews References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> Subject: Re: [dnsext] GOST DNSSEC implementations? In-reply-to: Your message of "Wed, 16 Sep 2009 07:47:27 MST." Date: Thu, 17 Sep 2009 10:00:22 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Paul Hoffman writes: > At 6:57 PM +0200 9/15/09, Jelte Jansen wrote: > >but perhaps one could overload 253/254 'for now', > > Please don't. > > > or pick a high number and hope > >that if they do get out into the wild that by the time it would matter those > >implementations have been replaced. > > That seems better. Maybe use 249 for the drafts, but note in the drafts that > 249 will *not* be assigned by IANA when the RFC is published. You just don't release code to the public until the code point is assigned. You can perform private tests with any unused code point. I've got code that is "#ifdef notyet" out that has been waiting a proto-writeup for two years now. It isn't hard to do the correct thing. #ifdef _GOST_TEST_ #define ALG_GOST 50 /* Not the correct value interop testing only. */ #endif I've seen code points change too many times to trust that the next value will be the one allocated. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Wed Sep 16 17:42:16 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AD6013A68C6; Wed, 16 Sep 2009 17:42:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.17 X-Spam-Level: X-Spam-Status: No, score=-4.17 tagged_above=-999 required=5 tests=[AWL=0.325, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t+OK+9eKfzUq; Wed, 16 Sep 2009 17:42:15 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9F8D43A6804; Wed, 16 Sep 2009 17:42:15 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo50k-000Ig7-IR for namedroppers-data0@psg.com; Thu, 17 Sep 2009 00:38:10 +0000 Received: from [192.245.12.227] (helo=balder-227.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo50b-000IfH-JS for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 00:38:08 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n8H0bt2g035157 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 16 Sep 2009 17:37:57 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <200909170000.n8H00MfO094883@drugs.dv.isc.org> References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <200909170000.n8H00MfO094883@drugs.dv.isc.org> Date: Wed, 16 Sep 2009 17:37:53 -0700 To: Mark Andrews From: Paul Hoffman Subject: Re: [dnsext] GOST DNSSEC implementations? Cc: Jelte Jansen , namedroppers@ops.ietf.org Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 10:00 AM +1000 9/17/09, Mark Andrews wrote: >You just don't release code to the public until the code point is >assigned. You can perform private tests with any unused code point. Good in theory, often fails in practice. But having said that... >I've got code that is "#ifdef notyet" out that has been waiting a >proto-writeup for two years now. It isn't hard to do the correct >thing. > >#ifdef _GOST_TEST_ >#define ALG_GOST 50 /* Not the correct value interop testing only. */ >#endif > >I've seen code points change too many times to trust that the next >value will be the one allocated. That's a good way to remind yourself that you're doing something dangerous. --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Wed Sep 16 18:13:47 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D1B053A6811; Wed, 16 Sep 2009 18:13:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.438 X-Spam-Level: X-Spam-Status: No, score=-2.438 tagged_above=-999 required=5 tests=[AWL=0.161, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gRJK2xCodDGH; Wed, 16 Sep 2009 18:13:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 00A703A6930; Wed, 16 Sep 2009 18:13:46 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo5WD-000LbS-Nh for namedroppers-data0@psg.com; Thu, 17 Sep 2009 01:10:41 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo5W3-000Lat-NZ for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 01:10:39 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id ED7EEE6026; Thu, 17 Sep 2009 01:10:30 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8H1AQSF095960; Thu, 17 Sep 2009 11:10:26 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909170110.n8H1AQSF095960@drugs.dv.isc.org> To: Jim Reid Cc: George Barwood , "Matthew Dempsky" , namedroppers@ops.ietf.org From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> Subject: Re: [dnsext] making TCP a MUST In-reply-to: Your message of "Wed, 16 Sep 2009 21:21:57 +0100." Date: Thu, 17 Sep 2009 11:10:26 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Jim Reid writes: > I am of course worried about the impact on busy name servers of lots > of short-lived TCP connections, particularly in their kernel network > stacks. However that's a different problem from making TCP support for > DNS clients and servers mandatory. And is already covered by requiring QUERYs to be tried over UDP first. > One way to minimise that could be > for the draft to say something like "try EDNS first, then fall back to > classic UDP/512 and if that fails, then try TCP". The correct priority should be get the required answer through minimising the use of TCP. All these people scared of TCP are putting the cart before the horse. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From chances17@islandb.com Wed Sep 16 19:32:44 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DDB553A6AF4; Wed, 16 Sep 2009 19:32:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.258 X-Spam-Level: X-Spam-Status: No, score=-10.258 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_FAKE_RCVD_LINE=10.357, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_VERIZON_P=2.144, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_VERIZON_POOL=1.495, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_DOUBLE_IP_SPAM=3.798, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_RECV_IP_FROMIP1=1.666, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_SBL=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yHmE2ODyQ6qo; Wed, 16 Sep 2009 19:32:44 -0700 (PDT) Received: from pool-173-54-55-159.nwrknj.fios.verizon.net (pool-173-54-55-159.nwrknj.fios.verizon.net [173.54.55.159]) by core3.amsl.com (Postfix) with ESMTP id DE2F03A67DB; Wed, 16 Sep 2009 19:32:43 -0700 (PDT) Received: from 173.54.55.159 by 64.34.178.135; Wed, 16 Sep 2009 22:33:32 -0500 Message-ID: <000d01ca373f$3fe80cc0$6400a8c0@chances17> From: Carlos Emery To: Subject: I am on a mission to better my life lol, click Date: Wed, 16 Sep 2009 22:33:32 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA373F.3FE80CC0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA373F.3FE80CC0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Revolutionary method discovered to help you shed pounds   A chance to enter Antioxidants of acai. Try for free. Take a step to enter =20 best ragards Emery ------=_NextPart_000_0007_01CA373F.3FE80CC0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Revolutionary method discovered to help y= ou shed pounds
 
A chance to enter

Antioxidants of acai. Try for free.


best ragards Emery
------=_NextPart_000_0007_01CA373F.3FE80CC0-- From owner-namedroppers@ops.ietf.org Wed Sep 16 20:58:11 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B902A3A6907; Wed, 16 Sep 2009 20:58:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.6 X-Spam-Level: X-Spam-Status: No, score=-0.6 tagged_above=-999 required=5 tests=[AWL=-1.000, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1d4Dpn9jGBhY; Wed, 16 Sep 2009 20:58:10 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7FDAB3A6950; Wed, 16 Sep 2009 20:58:10 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo82K-000CjL-Be for namedroppers-data0@psg.com; Thu, 17 Sep 2009 03:52:00 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mo829-000CgD-N7 for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 03:51:58 +0000 Received: from crankycanuck.ca (unknown [59.163.69.2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 9EE7D2FE8CE2 for ; Thu, 17 Sep 2009 03:51:44 +0000 (UTC) Date: Wed, 16 Sep 2009 23:51:36 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: [dnsext] [mary.barnes@nortel.com: Nomcom 2009-10: FINAL Call for Nominations, Local Office hours, Nominee Questionnaires] Message-ID: <20090917035134.GA9334@shinkuro.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="jRHKVT23PllUwdXP" Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --jRHKVT23PllUwdXP Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Dear colleagues, A reminder from your friendly NomCom Chair. If you have candidates in mind for this, now is the time to send your nominations. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. --jRHKVT23PllUwdXP Content-Type: message/rfc822 Content-Disposition: inline Return-Path: Received: from mail.ietf.org ([64.170.98.32] verified) by execdsl.com (CommuniGate Pro SMTP 4.2.10) with ESMTP id 18036098 for ajs@shinkuro.com; Wed, 16 Sep 2009 21:07:49 -0600 Received-SPF: pass receiver=execdsl.com; client-ip=64.170.98.32; envelope-from=ietf-bounces@ietf.org Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5D84128C105; Wed, 16 Sep 2009 20:07:05 -0700 (PDT) X-Original-To: ietf@ietf.org Delivered-To: ietf@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 30) id BC7F23A69E9; Wed, 16 Sep 2009 20:07:03 -0700 (PDT) From: Mary Barnes To: IETF Announcement list Subject: Nomcom 2009-10: FINAL Call for Nominations, Local Office hours, Nominee Questionnaires Message-Id: <20090917030703.BC7F23A69E9@core3.amsl.com> Date: Wed, 16 Sep 2009 20:07:03 -0700 (PDT) Cc: ietf@ietf.org X-BeenThere: ietf@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: IETF-Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: ietf-bounces@ietf.org Errors-To: ietf-bounces@ietf.org MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=utf-8 Hi all, This is the Final Call for Nominations - the nominations period ends in two days on Sept 18, 2009. We do not have a sufficient number of nominations for the following AD positions: APP, OPS, RAI and SEC In addition, we have not received responses from almost half of the nominees. I will be sending reminders for all the outstanding nominations. We need Community input and participation!!! We cannot properly execute the task of selecting the best candidates for these positions with so few accepted nominations. So, please consider making nominations for the open positions, in particular those for which we have so few nominations - it takes just a few minutes of your time. Right now, we just need the names/email addresses - we'll be soliciting feedback later. Also, please note that although draft-dawkins-nomcom-openlist-06 has been approved, the 2009-10 Nomcom is NOT operating under these new guidelines. As well as the reminder for the call for nominations, this email also serves as a reminder for: 2) Local Office Hours through Sept. 25, 2009. 3) Questionnaires due from Nominees on Sept. 25, 2009. Best Regards, Mary Barnes nomcom-chair@ietf.org mary.h.barnes@gmail.com mary.barnes@nortel.com ========================================================================= 1) Call for Nominations ------------------------ The nomination period ends in less than 2 days on Sept. 18th, 2009. We appreciate the folks that have taken the time to make nominations thus far. But, we do need more nominations. Please use the online tool to nominate - it's fast, easy and secure: https://wiki.tools.ietf.org/group/nomcom/09/nominate Details on the open positions, as well as other details and options for making nominations are available on the Nomcom homepage: https://wiki.tools.ietf.org/group/nomcom/09/ You will have the opportunity to provide additional feedback later and it's important to consider that not all nominees will be able to accept the nomination. 2) Local office hours ----------------------- In order facilitate additional feedback, the Nomcom has decided to make themselves available for office areas at various geographic locations from September 8th through Sept. 25th. Below please find the list of locations where Nomcom members will be available for these f2f meetings . Unless dates are identified below, the Nomcom member is generally available for part of the day during the weeks of Sept 8-11, Sept 14-18 and Sept 21-25. Also, languages other than English in which the Nomcom member is fluent are identfied. Please contact a Nomcom member in a specific geographic location to arrange a convenient meeting time and place. Most Nomcom members are flexible as to meeting locations - i.e., we can travel to your office, meet at our offices or somewhere in between. As a reminder folks can always contact any Nomcom member to provide feedback at anytime - i.e., you don't need to participate in these f2f sessions to provide feedback. Belgium: Dimitri Papadimitriou - dimitri.papadimitriou@alcatel-lucent.be (Sept 21-25) (Languages: French) Boston, Mass, USA: Stephen Kent - kent@bbn.com (Sept 16-18) Boulder, CO, USA: Wassim Haddad - wmhaddad@gmail.com (Sept 14-18) Dallas/Ft. Worth, TX, USA: Mary Barnes - mary.h.barnes@gmail.com Lucy Yong - lucyyong@huawei.com (Languages: Chinese) Helsinki, Finland: Simo Veikkolainen - simo.veikkolainen@nokia.com (Languages: Finnish) Ithaca, NY, USA: Scott Brim - scott.brim@gmail.com Montevideo, Uruguay: Roque Gagliano - roque@lacnic.net (Sept 14-18, 21-25) (Languages: Spanish, Portuguese) Montreal, Quebec, Canada Wassim Haddad - wmhaddad@gmail.com (Sept 8-11) -- Can also be available in Ottawa if folks are interested Paris, France: Dimitri Papadimitriou - dimitri.papadimitriou@alcatel-lucent.be (Sept 15-18) (Languages: French) San Diego, CA, USA: Randall Gellens - rg+ietf@qualcomm.com Dave Crocker - dcrocker@bbiw.net (Sept 16-18) Silicon Valley/SF Bay, CA, USA: Dave Crocker - dcrocker@bbiw.net (Sept 8-11, Sept 14-15, Sept 21-25) Dorothy Gellert - Dorothy.gellert@gmail.com 3) Questionnaires available for nominees: For folks that have been notified that they have been nominated for any of the positions, the questionnaires are available on the Nomcom09 tools website: https://wiki.tools.ietf.org/group/nomcom/09/iab-questionnaire https://wiki.tools.ietf.org/group/nomcom/09/iaoc-questionnaire https://wiki.tools.ietf.org/group/nomcom/09/iesg-questionnaire The questionnaires are due no later than Sept. 25th, 2009. If you have any questions or concerns with meeting the deadline, please let me know. _______________________________________________ Ietf mailing list Ietf@ietf.org https://www.ietf.org/mailman/listinfo/ietf --jRHKVT23PllUwdXP-- From owner-namedroppers@ops.ietf.org Thu Sep 17 00:03:55 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BBDBE28C133; Thu, 17 Sep 2009 00:03:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.547 X-Spam-Level: X-Spam-Status: No, score=-2.547 tagged_above=-999 required=5 tests=[AWL=0.052, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Px1E8ApaVzk6; Thu, 17 Sep 2009 00:03:54 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1F40B28C1BC; Thu, 17 Sep 2009 00:03:52 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoAuG-0005Fq-JO for namedroppers-data0@psg.com; Thu, 17 Sep 2009 06:55:52 +0000 Received: from [2001:7b8:206:1::1] (helo=open.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoAsz-00056W-81 for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 06:54:41 +0000 Received: from [10.0.1.9] ([93.191.20.2]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.3/8.14.3) with ESMTP id n8H6sMRb065232 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Thu, 17 Sep 2009 08:54:24 +0200 (CEST) (envelope-from olaf@NLnetLabs.nl) Cc: namedroppers@ops.ietf.org Message-Id: <2B22853F-F98F-40A1-8BB7-523ACAA0C9A8@NLnetLabs.nl> From: Olaf Kolkman To: Olafur Gudmundsson/DNSEXT chair In-Reply-To: <200909141718.n8EHI5U4004295@stora.ogud.com> Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Apple-Mail-30--14644306" Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] GOST DNSSEC implementations? Date: Thu, 17 Sep 2009 10:54:22 +0400 References: <200909141718.n8EHI5U4004295@stora.ogud.com> X-Pgp-Agent: GPGMail 1.2.0 (v56) X-Mailer: Apple Mail (2.936) X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.3 (open.nlnetlabs.nl [213.154.224.1]); Thu, 17 Sep 2009 08:54:25 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --Apple-Mail-30--14644306 Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Olafur, > It would be nice to have 2+ implementations of tools > inter operating by the time working group does LC this document, > scheduled for later this year. > > Actions that need to be performed are: > DS calculation > GOST key generation > GOST Signature generation /verification You start your message with "it would be nice". After that your mail reads like a bunch of requirements for submission to the IESG. Are you planning to have the documents submitted and published as draft-standard in one go? I really like the idea of having running code when developing protocols and love to see more (and some early deployment if possible). But, as far as I know there is no requirement in the process. --Olaf ________________________________________________________ Olaf M. Kolkman NLnet Labs Science Park 140, http://www.nlnetlabs.nl/ 1098 XG Amsterdam --Apple-Mail-30--14644306 content-type: application/pgp-signature; x-mac-type=70674453; name=PGP.sig content-description: This is a digitally signed message part content-disposition: inline; filename=PGP.sig content-transfer-encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) Comment: This message is locally signed. iEYEARECAAYFAkqx3R4ACgkQtN/ca3YJIof2pgCfXg59RxZyyYPdTzo1Sru0wLdJ QBgAoMrnq4SUwCRHawOjBWmICzfYCtAe =QD8M -----END PGP SIGNATURE----- --Apple-Mail-30--14644306-- From owner-namedroppers@ops.ietf.org Thu Sep 17 00:11:49 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3BB0C28C176; Thu, 17 Sep 2009 00:11:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.207 X-Spam-Level: **** X-Spam-Status: No, score=4.207 tagged_above=-999 required=5 tests=[AWL=0.312, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JBU6RggGD1PS; Thu, 17 Sep 2009 00:11:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5C6F328C14D; Thu, 17 Sep 2009 00:11:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoB6x-0006ev-1W for namedroppers-data0@psg.com; Thu, 17 Sep 2009 07:08:59 +0000 Received: from [195.188.213.8] (helo=smtp-out5.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoB6l-0006a9-Nd for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 07:08:55 +0000 Received: from [172.23.170.147] (helo=anti-virus03-10) by smtp-out5.blueyonder.co.uk with smtp (Exim 4.52) id 1MoB6Y-0000Wu-2x; Thu, 17 Sep 2009 08:08:34 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out3.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MoB6X-0005Kz-Iu; Thu, 17 Sep 2009 08:08:33 +0100 Message-ID: <6AD638E817834282B430499DF685D784@localhost> From: "George Barwood" To: "Paul Vixie" , References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> Subject: Re: [dnsext] Re: making TCP a MUST Date: Thu, 17 Sep 2009 08:08:28 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIlBhdWwgVml4aWUiIDx2aXhp ZUBpc2Mub3JnPg0KVG86IDxuYW1lZHJvcHBlcnNAb3BzLmlldGYub3JnPg0KU2VudDogVGh1cnNk YXksIFNlcHRlbWJlciAxNywgMjAwOSAxMjo0OSBBTQ0KU3ViamVjdDogUmU6IFtkbnNleHRdIFJl OiBtYWtpbmcgVENQIGEgTVVTVCANCg0KDQo+IHRoaXMgaGFzIGJlZW4gZ29pbmcgb24gd2F5IGxv bmdlciB0aGFuIGkgY2FuIGhvbGQgbXkgYnJlYXRoLiAgZW5vdWdoIGZvbGtzDQo+IGhhdmUgY2hp bWVkIGluIHNheWluZyB0aGF0IHRjcCBzaG91bGQgYmUgcmVxdWlyZWQgZm9yIGZ1bGwgZG5zIGNv bXBsaWFuY2UsDQo+IHRoYXQgaSBoZXJlYnkgd2l0aGRyYXcgbXkgb3Bwb3NpdGlvbiB0byBpdC4g IGlmIHNvbWVib2R5IHdyb3RlIGEgZHJhZnQgdGhhdA0KPiBzYWlkIHVkcCBhbmQgdGNwIGFyZSBi b3RoIHJlcXVpcmVkLCBlZG5zIGlzIHJlcXVpcmVkLCBjbGllbnRzIHNob3VsZCB0cnkgdWRwDQo+ IGZpcnN0LCBjbGllbnRzIGFyZSByZXF1aXJlZCB0byByZXRyeSB3aXRoIGVkbnMgb24gdWRwIHRy dW5jYXRpb24sIGFuZCB0bw0KPiByZXRyeSB3aXRoIHRjcCBvbiBlZG5zIGZhaWx1cmUvdW5hdmFp bGFiaWxpdHkvdHJ1bmNhdGlvbiwgaSdkIHN1cHBvcnQgaXQuDQo+IA0KPiBidXQgdGhlbiB0aGVy ZSdzIHRoaXM6DQo+IA0KPj4gRnJvbTogIkdlb3JnZSBCYXJ3b29kIiA8Z2VvcmdlLmJhcndvb2RA Ymx1ZXlvbmRlci5jby51az4NCj4+IERhdGU6IFRodSwgMTcgU2VwIDIwMDkgMDA6Mjk6MjAgKzAx MDANCj4+IA0KPj4gU3RpbGwsIGEgc3R1YiByZXNvbHZlciBhbHdheXMgaGFzIHRoZSBvcHRpb24g b2YganVzdCB1c2luZyB0aGUgdHJ1bmNhdGVkDQo+PiByZXNwb25zZSA6IGl0IGRvZXNuJ3QgbmVl ZCB0byByZXRyeSBvdmVyIFRDUCBpZiBpdCBqdXN0IHdhbnRzIHRoZSBmaXJzdCBBDQo+PiByZWNv cmQuDQo+IA0KPiB0aGVyZSBpcyBubyBzdGFuZGFyZCBvciBwdWJsaXNoZWQgQVBJIGluIHVuaXgs IGRvcywgYXBwbGUsIG9yIGFueSBlbWJlZGRlZA0KPiBzeXN0ZW0gd2l0aCB3aGljaCBpJ20gZmFt aWxpYXIgd2hlcmUgdGhlIHJlc3VsdCBvZiBnZXRob3N0YnluYW1lKCkgKG9yIGFueQ0KPiBlcXVp dmlsZW50IHRoZXJlb2YpIGNhbiBiZSAiaGVyZSdzIGFuIGFkZHJlc3MgYnV0IHRoZXJlIHdhcyB0 cnVuY2F0aW9uIiBhbmQNCj4gdGhlIGlucHV0IHRvIGEgc3Vic2VxdWVudCBnZXRob3N0YnluYW1l KCkgKG9yIGFueSBlcXVpdmlsZW50IHRoZXJlb2YpIGNhbg0KPiBiZSAibGlzdGVuIGkgcmVhbGx5 IHdhbnQgYWxsIHRoZSBhZGRyZXNzZXMgc28gaWYgeW91IGdldCB0cnVuY2F0aW9uIGkgbmVlZA0K PiB5b3UgdG8gdHJ5IGhhcmRlci4iDQoNCkhvbGQgb24uLiBnZXRob3N0YnluYW1lIGFjdHVhbGx5 IHJldHVybnMgYSBzaW5nbGUgYWRkcmVzcyByZWNvcmQgZG9lc24ndCBpdD8NClNvIHRoZSBzZW1h bnRpY3MgaXMgImdldCBtZSBhbiBhZGRyZXNzIi4NCg0KRXZlbiBpZiBpdCBkaWRuJ3QsIG9yIGlm IHRoZSBpbnRlbmRlZCBzZW1hbnRpY3MgaXMgcm91bmQtcm9iaW4gZm9yIG11bHRpcGxlIGNhbGxz LA0KdGhlIHByYWN0aWNhbCByZWFsaXR5IGlzIHRoYXQgeW91IGhhdmUgbm8gZ3VhcnVudGVlIG9m IG9idGFpbmluZyBhbGwgdGhlIGFkZHJlc3NlcywNCnNpbmNlIGFsbW9zdCBhbGwgcHJveGllcyBz aWxlbnRseSBjbGVhciB0aGUgVEMgYml0LiBUaGlzIGRvZXNuJ3QgbWF0dGVyIGluIHByYWN0aWNl DQpmb3IgQSByZWNvcmRzLCBzaW5jZSAyMCsgaXMgcGxlbnR5IGZvciBhbnkgcmVhc29uYWJsZSBz aXR1YXRpb24uDQoNClNvIG5vbi12YWxpZGF0aW5nIHN0dWIgcmVzb2x2ZXJzIHRoYXQgb25seSBz dXBwb3J0IGdldGhvc3RieW5hbWUgKGFuZCBhcmUNCmhhcHB5IHdpdGggdGhlIHZlcnkgbWlsZCBj b25zZXF1ZW5jZXMpIG5lZWQgbm90IGltcGxlbWVudCBUQ1AuIA0KSSBkb24ndCBzZWUgYW55IHJl YXNvbiBmb3IgdGhlIHN0YW5kYXJkIHRvIGZvcmJpZCB0aGF0Lg0KDQo+IHRydW5jYXRpb24gb2Nj dXJpbmcgYmV0d2VlbiBmdWxsIHJlc29sdmVycyBhbmQgKGZvcndhcmRlcnMgb3IgYXV0aG9yaXRp ZXMpDQo+IHdpbGwgY2F1c2UgcmV0cnksIHNpbmNlIGEgdHJ1bmNhdGVkIHJlc3VsdCBjYW5ub3Qg YmUgY2FjaGVkIG9yIGZvcndhcmRlZC4NCj4gDQo+IHRydW5jYXRpb24gb2NjdXJpbmcgYmV0d2Vl biBzdHViIHJlc29sdmVycyBhbmQgKGZ1bGwgcmVzb2x2ZXJzIG9yIHByb3hpZXMpDQo+IHdpbGwg Y2F1c2UgcmV0cnksIHNpbmNlIGEgdHJ1bmNhdGVkIHJlc3VsdCBjYW5ub3QgYmUgZ2l2ZW4gdG8g YW4gYXBwbGljYXRpb24uDQo+IA== From owner-namedroppers@ops.ietf.org Thu Sep 17 01:05:02 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 91D8D3A69AA; Thu, 17 Sep 2009 01:05:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.743 X-Spam-Level: X-Spam-Status: No, score=-0.743 tagged_above=-999 required=5 tests=[AWL=-0.248, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wuZ0NboFO6e0; Thu, 17 Sep 2009 01:05:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B00F13A6A06; Thu, 17 Sep 2009 01:05:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoBrB-000C9J-2V for namedroppers-data0@psg.com; Thu, 17 Sep 2009 07:56:45 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoBr2-000C87-1S for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 07:56:43 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id F3FE21542060; Thu, 17 Sep 2009 08:56:32 +0100 (BST) From: Jim Reid To: "George Barwood" In-Reply-To: <6AD638E817834282B430499DF685D784@localhost> Subject: [dnsext] gethostbyname() X-Priority: 3 References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6AD638E817834282B430499DF685D784@localhost> Message-Id: <0C6F0C7C-9CC6-4534-8959-39C5F0FCC3C2@rfc1035.com> Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Thu, 17 Sep 2009 08:56:32 +0100 Cc: "namedroppers@ops.ietf.org WG" X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 17 Sep 2009, at 08:08, George Barwood wrote: > gethostbyname actually returns a single address record doesn't it? No. It returns a hostent struct which contains a list of addresses. From owner-namedroppers@ops.ietf.org Thu Sep 17 01:16:56 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8AC7428C0FE; Thu, 17 Sep 2009 01:16:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.992 X-Spam-Level: X-Spam-Status: No, score=-105.992 tagged_above=-999 required=5 tests=[AWL=0.257, BAYES_00=-2.599, HELO_EQ_FR=0.35, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GFkFZyw63U-q; Thu, 17 Sep 2009 01:16:55 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 88B4B28C0F7; Thu, 17 Sep 2009 01:16:55 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoC81-000DnR-1T for namedroppers-data0@psg.com; Thu, 17 Sep 2009 08:14:09 +0000 Received: from [2001:660:3003:2::4:11] (helo=mx2.nic.fr) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoC7r-000DmL-Ck for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 08:14:06 +0000 Received: from mx2.nic.fr (localhost [127.0.0.1]) by mx2.nic.fr (Postfix) with SMTP id 3D8961C011D; Thu, 17 Sep 2009 10:13:58 +0200 (CEST) Received: from relay2.nic.fr (relay2.nic.fr [192.134.4.163]) by mx2.nic.fr (Postfix) with ESMTP id 3913F1C0091; Thu, 17 Sep 2009 10:13:58 +0200 (CEST) Received: from bortzmeyer.nic.fr (batilda.nic.fr [192.134.4.69]) by relay2.nic.fr (Postfix) with ESMTP id 364B47B0034; Thu, 17 Sep 2009 10:13:58 +0200 (CEST) Date: Thu, 17 Sep 2009 10:13:58 +0200 From: Stephane Bortzmeyer To: George Barwood Cc: namedroppers@ops.ietf.org Subject: [dnsext] Re: making TCP a MUST Message-ID: <20090917081358.GA3234@nic.fr> References: <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6AD638E817834282B430499DF685D784@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6AD638E817834282B430499DF685D784@localhost> X-Operating-System: Debian GNU/Linux 5.0.2 X-Kernel: Linux 2.6.26-2-686 i686 Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, Sep 17, 2009 at 08:08:28AM +0100, George Barwood wrote a message of 49 lines which said: > Hold on.. gethostbyname actually returns a single address record > doesn't it? I suggest to read the man page before posting on namedroppers. The gethostbyname() function returns a structure of type hostent for the given host name. ... The hostent structure is defined in as follows: struct hostent { char *h_name; /* official name of host */ char **h_aliases; /* alias list */ int h_addrtype; /* host address type */ int h_length; /* length of address */ char **h_addr_list; /* list of addresses */ } From owner-namedroppers@ops.ietf.org Thu Sep 17 01:18:15 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3A8D128C0CE; Thu, 17 Sep 2009 01:18:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.426 X-Spam-Level: X-Spam-Status: No, score=-0.426 tagged_above=-999 required=5 tests=[AWL=0.069, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i1PTltUtfE2J; Thu, 17 Sep 2009 01:18:14 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6DF7F28B56A; Thu, 17 Sep 2009 01:18:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoC71-000Dey-JM for namedroppers-data0@psg.com; Thu, 17 Sep 2009 08:13:07 +0000 Received: from [217.147.82.63] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoC6s-000Dbl-6u for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 08:13:05 +0000 Received: from [10.49.222.203] (shed [217.147.82.63]) by mail.avalus.com (Postfix) with ESMTPA id 5067EC2DA3; Thu, 17 Sep 2009 09:12:52 +0100 (BST) Date: Thu, 17 Sep 2009 09:12:52 +0100 From: Alex Bligh Reply-To: Alex Bligh To: George Barwood , Paul Vixie , namedroppers@ops.ietf.org cc: Alex Bligh Subject: Re: [dnsext] Re: making TCP a MUST Message-ID: <468C268175A674D29AAD3A59@nimrod.local> In-Reply-To: <6AD638E817834282B430499DF685D784@localhost> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6AD638E817834282B430499DF685D784@localhost> X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --On 17 September 2009 08:08:28 +0100 George Barwood wrote: > since almost all proxies silently clear the TC bit Really? -- Alex Bligh From owner-namedroppers@ops.ietf.org Thu Sep 17 01:28:26 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 466FD3A6A12; Thu, 17 Sep 2009 01:28:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.729 X-Spam-Level: X-Spam-Status: No, score=-0.729 tagged_above=-999 required=5 tests=[AWL=-0.234, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h1Gj9y4IFL0U; Thu, 17 Sep 2009 01:28:25 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3F1083A681B; Thu, 17 Sep 2009 01:28:25 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCIF-000Ey6-J5 for namedroppers-data0@psg.com; Thu, 17 Sep 2009 08:24:43 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCI5-000EwF-Vh for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 08:24:41 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id 020031542060; Thu, 17 Sep 2009 09:24:31 +0100 (BST) Cc: namedroppers@ops.ietf.org Message-Id: <6A105DD4-87E3-4A9D-BE11-E0FF871463B6@rfc1035.com> From: Jim Reid To: Paul Vixie In-Reply-To: <35191.1253144954@nsa.vix.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] Re: making TCP a MUST Date: Thu, 17 Sep 2009 09:24:31 +0100 References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 17 Sep 2009, at 00:49, Paul Vixie wrote: > there is no standard or published API in unix, dos, apple, or any > embedded > system with which i'm familiar where the result of gethostbyname() > (or any > equivilent thereof) can be "here's an address but there was > truncation" and the input to a subsequent gethostbyname() (or any > equivilent thereof) can be "listen i really want all the addresses > so if you get truncation i need you to try harder." Well, I suppose the WG could fix this -- assuming it did APIs -- once a new standard for resolver behaviour was defined. FYI provision for a truncation behaviour control hook is already in libresolv for res_mkquery() and its friends. RES_IGNTC Unused currently (ignore truncation errors, i.e., don't retry with TCP). BTW this API has hooks for TCP and EDNS0 queries. From owner-namedroppers@ops.ietf.org Thu Sep 17 01:33:31 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8D0AE3A67A2; Thu, 17 Sep 2009 01:33:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.104 X-Spam-Level: X-Spam-Status: No, score=-4.104 tagged_above=-999 required=5 tests=[AWL=-0.806, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cXKGefhIJwzL; Thu, 17 Sep 2009 01:33:30 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3E95428C12F; Thu, 17 Sep 2009 01:33:30 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCNS-000FdH-UW for namedroppers-data0@psg.com; Thu, 17 Sep 2009 08:30:06 +0000 Received: from [213.248.199.24] (helo=mx4.nominet.org.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCNJ-000Fbf-5G for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 08:30:04 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:In-Reply-To:References:To:Cc: Subject:MIME-Version:X-Mailer:Message-ID:From:Date: X-MIMETrack:Content-Type; b=L4rrOMBBdl3rbLrMX9+Wq/pJU4FRKDe+SjAKKaEXb64pjSUg0E4RSmBR XJspZo0VpG5NlpYibBu4OFzph9ckvl20qd+ejJPGJWl/jVOQY4TbD5DP4 HPqUdZLYqtz9MPi; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=Ray.Bellis@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1253176197; x=1284712197; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20Ray.Bellis@nominet.org.uk|Subject:=20Re:=20[dnse xt]=20Re:=20making=20TCP=20a=20MUST|Date:=20Thu,=2017=20S ep=202009=2009:29:51=20+0100|Message-ID:=20|To:=20Alex=20Bligh=20|Cc:=20George =20Barwood=20,=0D=0A=09n amedroppers@ops.ietf.org|MIME-Version:=201.0|In-Reply-To: =20<468C268175A674D29AAD3A59@nimrod.local>|References:=20 <20090825224731.GJ4142@shinkuro.com>=20<20090827142630.GA 14431@vacation.karoshi.com.>=20<49FE02E45D12846B1BE861E2@ nimrod.home>=20<20090828112706.GA6056@vacation.karoshi.co m.>=20=20=20<4AA9E86C.10302@everyd ns.net>=20=20=20< 94A6C73E649C435BA7E2C0A29E955F9D@localhost>=20=20<7C05BD8BFCBF4F 77AADE3324945AED2B@localhost>=20<1468AAB2-1449-403C-9001- E3D98F4FC7BA@rfc1035.com>=20=20=20<20AF9D75BC2B4593B4C5B3C8BA6FB009@lo calhost>=20=20<35191.1253144954@nsa.vix.com>=20<6AD638E81 7834282B430499DF685D784@localhost>=20<468C268175A674D29AA D3A59@nimrod.local>; bh=OCKZEK7ir1f/sI7pl8yaI2V63WhwWgYlJLfnJCDl9o4=; b=LSkxqWugJs6+VCY9KcNRTKakW8S1L9QPu25aysfHby73TJIPwdbjzyjj lDsn8bLsIdn5tjWmx7kl3ViF7p/EzEfhI4OPYl4iMxVIoUtsWo70H2yLZ 5ge6ovB1PXPNhtb; X-IronPort-AV: E=Sophos;i="4.44,402,1249254000"; d="scan'208";a="12968192" Received: from notes1.nominet.org.uk ([213.248.197.128]) by mx4.nominet.org.uk with ESMTP; 17 Sep 2009 09:29:52 +0100 In-Reply-To: <468C268175A674D29AAD3A59@nimrod.local> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6AD638E817834282B430499DF685D784@localhost> <468C268175A674D29AAD3A59@nimrod.local> To: Alex Bligh Cc: George Barwood , namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: making TCP a MUST MIME-Version: 1.0 X-Mailer: Lotus Notes Release 8.5 December 05, 2008 Message-ID: From: Ray.Bellis@nominet.org.uk Date: Thu, 17 Sep 2009 09:29:51 +0100 X-MIMETrack: Serialize by Router on notes1/Nominet(Release 7.0.1FP1 | May 25, 2006) at 17/09/2009 09:29:54 AM, Serialize complete at 17/09/2009 09:29:54 AM Content-Type: multipart/alternative; boundary="=_alternative 002EADE480257634_=" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is a multipart message in MIME format. --=_alternative 002EADE480257634_= Content-Type: text/plain; charset="US-ASCII" > > since almost all proxies silently clear the TC bit > > Really? Not quite. I seem to recall seeing one proxy which actually did clear a TC bit that had been correctly set by the upstream recursor. Many SOHO proxies _fail to set_ the TC bit when they truncate a packet. That's not the same thing. Ray --=_alternative 002EADE480257634_= Content-Type: text/html; charset="US-ASCII"
> > since almost all proxies silently clear the TC bit
>
> Really?
Not quite.

I seem to recall seeing one proxy which actually did clear a TC bit that had been correctly set by the upstream recursor.

Many SOHO proxies _fail to set_ the TC bit when they truncate a packet.  That's not the same thing.

Ray


--=_alternative 002EADE480257634_=-- From owner-namedroppers@ops.ietf.org Thu Sep 17 01:48:44 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C307628C12F; Thu, 17 Sep 2009 01:48:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.201 X-Spam-Level: **** X-Spam-Status: No, score=4.201 tagged_above=-999 required=5 tests=[AWL=0.306, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, MIME_BASE64_BLANKS=0.041, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DF4SRmG-Xi0E; Thu, 17 Sep 2009 01:48:44 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E33DC3A69B9; Thu, 17 Sep 2009 01:48:43 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCdF-000HHI-TG for namedroppers-data0@psg.com; Thu, 17 Sep 2009 08:46:25 +0000 Received: from [195.188.213.7] (helo=smtp-out4.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCd6-000HGe-Hi for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 08:46:24 +0000 Received: from [172.23.170.143] (helo=anti-virus02-10) by smtp-out4.blueyonder.co.uk with smtp (Exim 4.52) id 1MoCd5-0000dF-AR; Thu, 17 Sep 2009 09:46:15 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out2.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MoCd4-0007YD-F7; Thu, 17 Sep 2009 09:46:14 +0100 Message-ID: <90DE902DE99742FFB3A71A42F1E02A79@localhost> From: "George Barwood" To: "Jim Reid" Cc: References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6AD638E817834282B430499DF685D784@localhost> <0C6F0C7C-9CC6-4534-8959-39C5F0FCC3C2@rfc1035.com> Subject: [dnsext] Re: gethostbyname() Date: Thu, 17 Sep 2009 09:46:09 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQotLS0tLSBPcmlnaW5hbCBNZXNzYWdlIC0tLS0tIA0KRnJvbTogIkppbSBSZWlkIiA8amltQHJm YzEwMzUuY29tPg0KVG86ICJHZW9yZ2UgQmFyd29vZCIgPGdlb3JnZS5iYXJ3b29kQGJsdWV5b25k ZXIuY28udWs+DQpDYzogPG5hbWVkcm9wcGVyc0BvcHMuaWV0Zi5vcmc+DQpTZW50OiBUaHVyc2Rh eSwgU2VwdGVtYmVyIDE3LCAyMDA5IDg6NTYgQU0NClN1YmplY3Q6IGdldGhvc3RieW5hbWUoKQ0K DQoNCj4gDQo+IE9uIDE3IFNlcCAyMDA5LCBhdCAwODowOCwgR2VvcmdlIEJhcndvb2Qgd3JvdGU6 DQo+IA0KPj4gZ2V0aG9zdGJ5bmFtZSBhY3R1YWxseSByZXR1cm5zIGEgc2luZ2xlIGFkZHJlc3Mg cmVjb3JkIGRvZXNuJ3QgaXQ/DQo+IA0KPiBOby4gSXQgcmV0dXJucyBhIGhvc3RlbnQgc3RydWN0 IHdoaWNoIGNvbnRhaW5zIGEgbGlzdCBvZiBhZGRyZXNzZXMuDQoNClNvcnJ5LCB5ZXMsIEkgd2Fz IGNvbXBsZXRlbHkgd3JvbmcgdGhlcmUuDQoNCkkgbm93IHJlYWxpc2UgdGhhdCBzb21lIHByb3hp ZXMgc2lsZW50bHkgY2xlYXIgdGhlIFRDIGJpdCwNCndoaWNoIGhhcyBzb21lIGxvZ2ljIGdpdmVu IHRoZXkgZG9uJ3Qgc3VwcG9ydCBUQ1AsDQphbmQgb3RoZXJzIGRvbid0LCB3aGljaCByZXN1bHRz IGluIGZhaWx1cmUgd2hlbiBUQ1ANCmZhbGxiYWNrIGZhaWxzLg0KDQpTbyBleGNlZWRpbmcgdGhl IDUxMiBieXRlIGxpbWl0IHdpdGggc2F5IDQwIEEgcmVjb3JkcyB3aWxsDQppbiBwcmFjdGljZSBj YXVzZSBzZXZlcmUgaW50ZXJvcGVyYWJpbGl0eSBwcm9ibGVtcywgYnV0IEkgZG9uJ3QNCmtub3cg dGhlIHBlcmNlbnRhZ2VzLg0KDQpHZW9yZ2UNCg== From owner-namedroppers@ops.ietf.org Thu Sep 17 01:53:45 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F08E33A6972; Thu, 17 Sep 2009 01:53:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.428 X-Spam-Level: X-Spam-Status: No, score=-0.428 tagged_above=-999 required=5 tests=[AWL=0.067, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tsvo0+BYCJjb; Thu, 17 Sep 2009 01:53:44 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 216E63A696D; Thu, 17 Sep 2009 01:53:44 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCi3-000HpP-JS for namedroppers-data0@psg.com; Thu, 17 Sep 2009 08:51:23 +0000 Received: from [217.147.82.63] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCht-000HoR-WA for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 08:51:21 +0000 Received: from [10.49.222.203] (shed [217.147.82.63]) by mail.avalus.com (Postfix) with ESMTPA id B3316C2DA7; Thu, 17 Sep 2009 09:51:11 +0100 (BST) Date: Thu, 17 Sep 2009 09:51:11 +0100 From: Alex Bligh Reply-To: Alex Bligh To: Alex Bligh , Matthew Dempsky , namedroppers@ops.ietf.org cc: Alex Bligh Subject: Re: [dnsext] Editor needed Message-ID: <304466989FD428DDC8C4947F@nimrod.local> In-Reply-To: <960F45758CA2ED442B3F6972@Ximines.local> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <960F45758CA2ED442B3F6972@Ximines.local> X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --On 16 September 2009 18:50:51 +0100 Alex Bligh wrote: > My view, for what it is worth, is that if the server is ever going > to produce a response > 512 bytes (irrespective of EDNS support), > TCP support should be mandatory (IE it can't rely on clients > supporting EDNS to get out of it). I think it should also > be mandatory for any server supporting DNSSEC; given that it > is difficult to imagine a useful DNSSEC server where no responses > would ever be >512 bytes, the benefit of the client being permitted > to rely on TCP support outweighs the loss of some peculiar edge > cases. I should perhaps clarify this. I think TCP should be mandatory to at least the extent above. I would not object to it being mandatory for all servers, and if that's what the w/g wants to do, I would support it. -- Alex Bligh From owner-namedroppers@ops.ietf.org Thu Sep 17 02:02:45 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3FE8C28C12B; Thu, 17 Sep 2009 02:02:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.862 X-Spam-Level: X-Spam-Status: No, score=-4.862 tagged_above=-999 required=5 tests=[AWL=-0.367, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z5zqS62DjX82; Thu, 17 Sep 2009 02:02:44 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 60E9F28C174; Thu, 17 Sep 2009 02:02:44 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCpI-000ImS-1W for namedroppers-data0@psg.com; Thu, 17 Sep 2009 08:58:52 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoCp8-000Ikw-Lg for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 08:58:50 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n8H8vfrb003430; Thu, 17 Sep 2009 08:57:41 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n8H8veDZ003429; Thu, 17 Sep 2009 08:57:40 GMT Date: Thu, 17 Sep 2009 08:57:40 +0000 From: bmanning@vacation.karoshi.com To: Jim Reid Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re: making TCP a MUST Message-ID: <20090917085740.GA3305@vacation.karoshi.com.> References: <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6A105DD4-87E3-4A9D-BE11-E0FF871463B6@rfc1035.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6A105DD4-87E3-4A9D-BE11-E0FF871463B6@rfc1035.com> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, Sep 17, 2009 at 09:24:31AM +0100, Jim Reid wrote: > >there is no standard or published API in unix, dos, apple, or any > >embedded > >system with which i'm familiar where the result of gethostbyname() > >(or any > >equivilent thereof) can be "here's an address but there was > >truncation" and the input to a subsequent gethostbyname() (or any > >equivilent thereof) can be "listen i really want all the addresses > >so if you get truncation i need you to try harder." > > Well, I suppose the WG could fix this -- assuming it did APIs -- once > a new standard for resolver behaviour was defined. > > FYI provision for a truncation behaviour control hook is already in > libresolv for res_mkquery() and its friends. > > RES_IGNTC Unused currently (ignore truncation errors, i.e., > don't > retry with TCP). > > BTW this API has hooks for TCP and EDNS0 queries. So some folk have a particular usage pattern in mind before changing transport protocols. I'm interested in how many folks really believe that TCP should only be tried -after- UDP/TC=1 occurs. I'm pretty sure that for some DNS transactions, TCP is chosen first. SO.. what will the "search" order look like when there are more than just UDP and TCP defined as DNS transports? --bill From owner-namedroppers@ops.ietf.org Thu Sep 17 02:16:06 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 256593A69DD; Thu, 17 Sep 2009 02:16:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.002 X-Spam-Level: X-Spam-Status: No, score=-106.002 tagged_above=-999 required=5 tests=[AWL=0.247, BAYES_00=-2.599, HELO_EQ_FR=0.35, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9534NCVQB3IT; Thu, 17 Sep 2009 02:16:05 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 15AB73A6976; Thu, 17 Sep 2009 02:16:05 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoD3f-000L30-3U for namedroppers-data0@psg.com; Thu, 17 Sep 2009 09:13:43 +0000 Received: from [2001:660:3003:2::4:11] (helo=mx2.nic.fr) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoD3V-000L2L-DK for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 09:13:40 +0000 Received: from mx2.nic.fr (localhost [127.0.0.1]) by mx2.nic.fr (Postfix) with SMTP id B07CE1C011E; Thu, 17 Sep 2009 11:13:32 +0200 (CEST) Received: from relay2.nic.fr (relay2.nic.fr [192.134.4.163]) by mx2.nic.fr (Postfix) with ESMTP id AB9921C0111; Thu, 17 Sep 2009 11:13:32 +0200 (CEST) Received: from bortzmeyer.nic.fr (batilda.nic.fr [192.134.4.69]) by relay2.nic.fr (Postfix) with ESMTP id A95387B0034; Thu, 17 Sep 2009 11:13:32 +0200 (CEST) Date: Thu, 17 Sep 2009 11:13:32 +0200 From: Stephane Bortzmeyer To: Florian Weimer Cc: Paul Vixie , namedroppers@ops.ietf.org Subject: [dnsext] Re: Editor needed Message-ID: <20090917091332.GA9820@nic.fr> References: <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> <20322.1253126278@nsa.vix.com> <87zl8uipql.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87zl8uipql.fsf@mid.deneb.enyo.de> X-Operating-System: Debian GNU/Linux 5.0.2 X-Kernel: Linux 2.6.26-2-686 i686 Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 16, 2009 at 08:44:34PM +0000, Florian Weimer wrote a message of 12 lines which said: > Even if the server implements EDNS0? I have a lot of sympathy for the idea "Every DNS server MUST be able to serve > 512 bytes data, either with TCP or with EDNS0" but I have the feeling that, in the real world, servers without TCP do not have EDNS0 either. >From the field: .FR requires a successful technical test before actual DNS delegation and TCP is mandatory. When servers fail this test and people complain, tests show that they almost always have no possible alternative (such as EDNS0). From owner-namedroppers@ops.ietf.org Thu Sep 17 02:29:41 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5B4703A6976; Thu, 17 Sep 2009 02:29:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.717 X-Spam-Level: X-Spam-Status: No, score=-0.717 tagged_above=-999 required=5 tests=[AWL=-0.222, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uuHgDsq5jEss; Thu, 17 Sep 2009 02:29:40 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 91DE43A68BE; Thu, 17 Sep 2009 02:29:40 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoDEc-000MIu-F2 for namedroppers-data0@psg.com; Thu, 17 Sep 2009 09:25:02 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoDET-000MGl-7a for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 09:25:00 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id 39CCD1542060; Thu, 17 Sep 2009 10:24:51 +0100 (BST) Cc: namedroppers@ops.ietf.org Message-Id: <490BFA57-7736-47FD-8A59-7C9BFF111BA4@rfc1035.com> From: Jim Reid To: bmanning@vacation.karoshi.com In-Reply-To: <20090917085740.GA3305@vacation.karoshi.com.> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: [dnsext] new DNS transports Date: Thu, 17 Sep 2009 10:24:49 +0100 References: <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6A105DD4-87E3-4A9D-BE11-E0FF871463B6@rfc1035.com> <20090917085740.GA3305@vacation.karoshi.com.> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 17 Sep 2009, at 09:57, bmanning@vacation.karoshi.com wrote: > SO.. what will the "search" order look like when there are > more than just UDP and TCP defined as DNS transports? IMO, the time for that discussion is when a viable alternative to UDP and TCP emerges. It's not clear we're at that point. From owner-namedroppers@ops.ietf.org Thu Sep 17 03:30:41 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B0F1028C1EE; Thu, 17 Sep 2009 03:30:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.081 X-Spam-Level: **** X-Spam-Status: No, score=4.081 tagged_above=-999 required=5 tests=[AWL=-0.769, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, J_CHICKENPOX_21=0.6, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J3VgTR3bSl6b; Thu, 17 Sep 2009 03:30:40 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A6C7A28C1EA; Thu, 17 Sep 2009 03:30:37 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoEBo-0002qn-0H for namedroppers-data0@psg.com; Thu, 17 Sep 2009 10:26:12 +0000 Received: from [213.178.172.147] (helo=WOTAN.TR-Sys.de) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoEBd-0002ps-7T for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 10:26:09 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3) id AA072843117; Thu, 17 Sep 2009 12:25:17 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id MAA15356; Thu, 17 Sep 2009 12:25:12 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <200909171025.MAA15356@TR-Sys.de> Subject: [dnsext] draft-dolmatov-dnsext-dnssec-gost-01 technical & editorial issues To: dol@cryptocom.ru, ran@cryptocom.ru, igus@cryptocom.ru, namedroppers@ops.ietf.org Date: Thu, 17 Sep 2009 12:25:12 +0200 (MESZ) X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Folks, I have reviewed draft-dolmatov-dnsext-dnssec-gost-01 and found a number of issues of varying degree of severeness. Items (1)..(3) below are the hard stuff, the nits are in (4). (1) First of all, I'm confused by, and strongly oppose to, the introduction of little-endian encoding for the on-the-wire encoding of specific elements of this proposal, as requested by the last paragraph of Section 2 of this draft. This is incompatible with the Internet architecture and also with the ASN.1 framework quoted by the draft, which makes consistent use of "big-endian" (network) byte order. Unfortunately, the quoted related RFCs 4490 and 4491 (cf. Section 4 of the draft) already have created bad precedents. I have filed Errata Notes for these RFCs (EIDs: 1884 and 1885). As noted there, mixed endianness within one protocol, or even within a sinfle specification for an extension to a protocol is a very likely source of confusion, implementation errors, and, consequentially, interoperability problems. This practice should be avoided consistently. (2) The second inconsistency I found is between Section 6.1, containing a "SHOULD" requirement ... | DNSSEC aware implementations SHOULD be able to support RRSIG and DNSKEY resource records created with the GOST algorithms as defined in this document. ... and the IANA Considerations in Section 8, which presents new registry entries with status "OPTIONAL" : Zone Trans. Value Algorithm Mnemonic Signing Sec. References Status | {TBA1} GOST R 34.10-2001 GOST Y * (this memo) OPTIONAL [snip] Value Algorithm Status | {TBA2} GOST R 34.11-94 OPTIONAL According to RFC 2119, the normative level of "OPTIONAL" is equivalent to that of "MAY". (3) Lack of coverage The WG already has decided, in recognition of expected deployment patterns, that NSEC3 has to be considered as an intrinsic part of the revised DNSSEC specification. Declaring NSEC3 support as out- of-scope for this document seems very inappropriate. Therefore, Section 6.2 should be replaced with positive language. Note: I suspect that the primary target TLD of the draft matter (should it be adopted) will most likely also make use of NSEC3 when deploying DNSSEC, like other 'large' TLDs. (4) Editorials Legend for below: Sn.n : Section n.n Pm : m-th paragraph {old text} --- {revised text} (4a) S1,P4 s/(signatire algorithm)/(signature algorithm)/ ^ ^ (4b) S2.1,P1 Please correct: | Existing GOST-aware cryptographic libraries at time of this document v ^ vvvv | writing are capable to read GOST public keys via generic X509 API if the key is encoded according to RFC 4491 [RFC4491], section 2.3.2. --- | Existing GOST-aware cryptographic libraries at the time of this | document writing are capable to read GOST public keys via a generic | X.509 API if the key is encoded according to RFC 4491 [RFC4491], section 2.3.2. or: | Existing GOST-aware cryptographic libraries at the time of writing | this document are capable to read GOST public keys via a generic | X.509 API if the key is encoded according to RFC 4491 [RFC4491], section 2.3.2. (4c) S3,P1 s/follows the RFC 4490/follows RFC 4490/ (4d) S4,P1 vv vv | GOST R 34.11-94 digest algorithm is denoted in DS RR by the digest type {TBA2}. [...] --- | The GOST R 34.11-94 digest algorithm is denoted in DS RRs by the digest type {TBA2}. [...] (4e) S5.1 vvv | According to RFC4357 [RFC4357] key size of GOST public keys MUST be 512 bits. --- | According to RFC4357 [RFC4357], the key size of GOST public keys MUST be 512 bits. (4f) S5.2 v v v v | According to GOST signature algorithm [GOST3410] size of GOST | signature is 512 bit. --- vvvvv ^ vvvvvvvvvvvvvvv v | According to the GOST signature algorithm specification [GOST3410], | the size of a GOST signature is 512 bits. ^^^ ^ (4g) S5.3 v v | According to GOST R 34.11-94 [GOST3411] size of GOST digest is 256 | bit. --- ^ vvvvvv vvv | According to GOST R 34.11-94 [GOST3411], the size of a GOST digest is | 256 bits. ^ (4h) S7,P1 | Current cryptographic resistance of GOST 34.10-2001 digital signature algorithm is estimated as 2**128 operations of elliptic curve point | computations on simple modulus 2**256. --- | The current cryptographic resistance of the GOST 34.10-2001 digital signature algorithm is estimated as 2**128 operations of elliptic | curve point computations on a modulus 2**256 field. or: | Currently, the cryptographic resistance of the GOST 34.10-2001 digital signature algorithm is estimated as 2**128 operations of | elliptic curve point computations on a modulus 2**256 field. (4i) S7,P1 | Current cryptographic resistance of GOST 34.11-94 hash algorithm is | estimated as 2**128 operations of copmutations of step hash function. [...] --- ^^ | The current cryptographic resistance of the GOST 34.11-94 hash | algorithm is estimated as 2**128 operations of computations of a step hash function. [...] or: | Currently, the cryptographic resistance of the GOST 34.11-94 hash | algorithm is estimated as 2**128 operations of computations of a step hash function. [...] [ Note: I expect you did not envision (bio-chemical) mutation of cops. :-) ] Kind regards, Alfred HÎnes. -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From owner-namedroppers@ops.ietf.org Thu Sep 17 03:47:05 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B736928C1E8; Thu, 17 Sep 2009 03:47:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.843 X-Spam-Level: X-Spam-Status: No, score=-4.843 tagged_above=-999 required=5 tests=[AWL=-0.348, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M-+6h4iG6ikw; Thu, 17 Sep 2009 03:47:04 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A5C0628C1E9; Thu, 17 Sep 2009 03:47:04 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoEQl-0004sq-Hm for namedroppers-data0@psg.com; Thu, 17 Sep 2009 10:41:39 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoEQc-0004rw-B4 for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 10:41:37 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n8HAeTrb004213; Thu, 17 Sep 2009 10:40:29 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n8HAeTgD004212; Thu, 17 Sep 2009 10:40:29 GMT Date: Thu, 17 Sep 2009 10:40:29 +0000 From: bmanning@vacation.karoshi.com To: Jim Reid Cc: bmanning@vacation.karoshi.com, namedroppers@ops.ietf.org Subject: Re: [dnsext] new DNS transports Message-ID: <20090917104029.GA4171@vacation.karoshi.com.> References: <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6A105DD4-87E3-4A9D-BE11-E0FF871463B6@rfc1035.com> <20090917085740.GA3305@vacation.karoshi.com.> <490BFA57-7736-47FD-8A59-7C9BFF111BA4@rfc1035.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <490BFA57-7736-47FD-8A59-7C9BFF111BA4@rfc1035.com> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, Sep 17, 2009 at 10:24:49AM +0100, Jim Reid wrote: > On 17 Sep 2009, at 09:57, bmanning@vacation.karoshi.com wrote: > > > SO.. what will the "search" order look like when there are > > more than just UDP and TCP defined as DNS transports? > > IMO, the time for that discussion is when a viable alternative to UDP > and TCP emerges. It's not clear we're at that point. ok... lets just work with the subset of two, UDP and TCP. when, if ever, is it ok to try TCP first? under what condtions is it ok to flip transports (UDP->TCP, TCP->UDP) is truncation the only requirement to consider changing transports? --bill From owner-namedroppers@ops.ietf.org Thu Sep 17 03:58:54 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 83BB53A6A0E; Thu, 17 Sep 2009 03:58:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.706 X-Spam-Level: X-Spam-Status: No, score=-0.706 tagged_above=-999 required=5 tests=[AWL=-0.211, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TIcJqtYEaGR1; Thu, 17 Sep 2009 03:58:53 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B8BD43A6936; Thu, 17 Sep 2009 03:58:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoEf9-0006eV-U0 for namedroppers-data0@psg.com; Thu, 17 Sep 2009 10:56:31 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoEf0-0006dP-Pc for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 10:56:30 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id 9C30B1542060; Thu, 17 Sep 2009 11:56:20 +0100 (BST) Cc: namedroppers@ops.ietf.org Message-Id: <17B4A336-A641-443A-BC0A-052A26A07D27@rfc1035.com> From: Jim Reid To: bmanning@vacation.karoshi.com In-Reply-To: <20090917104029.GA4171@vacation.karoshi.com.> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: [dnsext] prioritising TCP and UDP queries Date: Thu, 17 Sep 2009 11:56:20 +0100 References: <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6A105DD4-87E3-4A9D-BE11-E0FF871463B6@rfc1035.com> <20090917085740.GA3305@vacation.karoshi.com.> <490BFA57-7736-47FD-8A59-7C9BFF111BA4@rfc1035.com> <20090917104029.GA4171@vacation.karoshi.com.> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 17 Sep 2009, at 11:40, bmanning@vacation.karoshi.com wrote: > when, if ever, is it ok to try TCP first? (a) when the application knows in advance that truncated responses or EDNS fragmentation is highly likely or certain (b) when DNS over TCP is considered "safer": ie less prone to spoofing (c) when an application knows it's going to make lots of queries and a permanent connection to some server is a better choice. IIRC netstat does this because it tends to do loads of reverse lookups. > under what condtions is it ok to flip transports (UDP->TCP, TCP->UDP) Whenever the circumstances change and make the other transport the better choice: for instance when route flapping for an anycast address starts or stops. > is truncation the only requirement to consider changing transports? Nope. From card-shop@c-rom.de Thu Sep 17 05:36:28 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 560D53A6998; Thu, 17 Sep 2009 05:36:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.467 X-Spam-Level: X-Spam-Status: No, score=-10.467 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_SBL=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cRuhZhAwASpe; Thu, 17 Sep 2009 05:36:27 -0700 (PDT) Received: from ip-62-129-179-220.evc.net (ip-62-129-179-220.evc.net [62.129.179.220]) by core3.amsl.com (Postfix) with SMTP id B41233A68B7; Thu, 17 Sep 2009 05:36:21 -0700 (PDT) Date: Thu, 17 Sep 2009 08:37:12 -0500 Subject: Rep watches models from 2010 From: "Summer Swenson" To: "Lindsay Harmon" Message-ID: Content-Type: text/plain; Content-Transfer-Encoding: 7Bit Are you ready for hottest rep watches from 2010? They are here http://tablestuff.com/ From owner-namedroppers@ops.ietf.org Thu Sep 17 06:30:56 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F3ED3A6B54; Thu, 17 Sep 2009 06:30:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.199 X-Spam-Level: X-Spam-Status: No, score=0.199 tagged_above=-999 required=5 tests=[AWL=-0.551, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id paBCEGDqi1U2; Thu, 17 Sep 2009 06:30:55 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 22F0C3A695A; Thu, 17 Sep 2009 06:30:55 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoH0j-000Pjj-KV for namedroppers-data0@psg.com; Thu, 17 Sep 2009 13:26:57 +0000 Received: from [212.9.189.167] (helo=mail.enyo.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoH0a-000Pgj-0e for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 13:26:55 +0000 Received: from deneb.vpn.enyo.de ([212.9.189.177] helo=deneb.enyo.de) by mail.enyo.de with esmtp id 1MoH0W-0001uN-CW; Thu, 17 Sep 2009 15:26:44 +0200 Received: from fw by deneb.enyo.de with local (Exim 4.69) (envelope-from ) id 1MoH0V-0006Ye-OI; Thu, 17 Sep 2009 13:26:43 +0000 From: Florian Weimer To: Stephane Bortzmeyer Cc: Paul Vixie , namedroppers@ops.ietf.org Subject: [dnsext] Re: Editor needed References: <4AA9E86C.10302@everydns.net> <75F6BD4D-83D2-4E3F-9669-B998BD132CE7@virtualized.org> <17253.1253122012@nsa.vix.com> <39E10514-C93C-4778-98AD-D4068597437D@virtualized.org> <20322.1253126278@nsa.vix.com> <87zl8uipql.fsf@mid.deneb.enyo.de> <20090917091332.GA9820@nic.fr> Date: Thu, 17 Sep 2009 13:26:43 +0000 In-Reply-To: <20090917091332.GA9820@nic.fr> (Stephane Bortzmeyer's message of "Thu, 17 Sep 2009 11:13:32 +0200") Message-ID: <87bpl9wvl8.fsf@mid.deneb.enyo.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: * Stephane Bortzmeyer: > On Wed, Sep 16, 2009 at 08:44:34PM +0000, > Florian Weimer wrote > a message of 12 lines which said: > >> Even if the server implements EDNS0? > > I have a lot of sympathy for the idea "Every DNS server MUST be able > to serve > 512 bytes data, either with TCP or with EDNS0" but I have > the feeling that, in the real world, servers without TCP do not have > EDNS0 either. This is fine because it's not an obstacle to EDNS0-based protocol evolution. If servers support EDNS0 and have relatively small packet size limits because they do not support TCP (or EDNS0 with large buffers), adding additional EDNS0 options could mean that they could not implement these extensions. From owner-namedroppers@ops.ietf.org Thu Sep 17 07:21:22 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 94E9B3A6AF7; Thu, 17 Sep 2009 07:21:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.574 X-Spam-Level: X-Spam-Status: No, score=-2.574 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fYN-n3a8KAVO; Thu, 17 Sep 2009 07:21:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C17FF3A6896; Thu, 17 Sep 2009 07:21:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoHlW-0006LE-3V for namedroppers-data0@psg.com; Thu, 17 Sep 2009 14:15:18 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoHlD-0006Ix-II for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 14:15:11 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 0FC51B6AF8 for ; Thu, 17 Sep 2009 14:14:59 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re-ordering of responses over TCP In-Reply-To: Your message of "Thu, 17 Sep 2009 13:44:36 +0100." <5BB224FBD702461FA8FA96EA4A5A876B@localhost> References: <5BB224FBD702461FA8FA96EA4A5A876B@localhost> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Thu, 17 Sep 2009 14:14:59 +0000 Message-ID: <68612.1253196899@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: "George Barwood" > Date: Thu, 17 Sep 2009 13:44:36 +0100 > > It's not clear to me if servers are permitted to re-order responses when > multiple queries are received over a single TCP connection. > > I think this should be permitted, as it allows a stub resolver > to communicate more efficiently with a cache. +1, however: > I think a client submitting multiple queries over a single TCP connection > would probably expect this behavior, but does anyone know of a client > that might fail? named-xfer in bind4 did not check the TXID on the SOA response or the AXFR. > Should this be made clear somewhere in the standard? probably so. right now the standard says use TXID for disambiguation and does not guarantee ordering for any transport. yet reordering is rare enough that there may be stubs out there who successfully presume ordering. From owner-namedroppers@ops.ietf.org Thu Sep 17 07:45:24 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E927D3A68F2; Thu, 17 Sep 2009 07:45:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.172 X-Spam-Level: X-Spam-Status: No, score=-1.172 tagged_above=-999 required=5 tests=[AWL=-0.677, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 38kxwUbrPg8y; Thu, 17 Sep 2009 07:45:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9A8713A6822; Thu, 17 Sep 2009 07:45:23 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoIBd-0009Ig-2n for namedroppers-data0@psg.com; Thu, 17 Sep 2009 14:42:17 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoIBM-0009Gd-IT for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 14:42:12 +0000 Received: from Puki.ogud.com (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n8HEfrTl025316; Thu, 17 Sep 2009 10:41:53 -0400 (EDT) (envelope-from ogud@ogud.com) Message-Id: <200909171441.n8HEfrTl025316@stora.ogud.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Thu, 17 Sep 2009 10:21:33 -0400 To: Olaf Kolkman From: Olafur Gudmundsson/DNSEXT chair Subject: Re: [dnsext] GOST DNSSEC implementations? Cc: namedroppers@ops.ietf.org In-Reply-To: <2B22853F-F98F-40A1-8BB7-523ACAA0C9A8@NLnetLabs.nl> References: <200909141718.n8EHI5U4004295@stora.ogud.com> <2B22853F-F98F-40A1-8BB7-523ACAA0C9A8@NLnetLabs.nl> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Olaf, This was my slightly underhanded way to motivate WG members to pay attention to the draft. Nothing is better to bring out the issues with a draft than having someone actually try to follow it. As you remember at number of times in the past the WG has "required" that there be "test" implementations of various drafts before advancing documents. see for example: http://psg.com/lists/namedroppers/namedroppers.2007/msg00157.html Given this is brand new technology (ECC vs RSA) having people think about implementation implications it seemed like a good idea. So far I have received confirmation of one implementation and hints of two others, plush one great review. WG, members please read the draft, comment on it, and let me know if you are doing/thinking-about implementing it. As for the process question, I will answer with one statistic: no RFC published by dnsext/dnsind has made it to Draft Standard status. Thus applying the Draft Standard rules on any document we send to Proposed Standard, when we can, is good idea IMHO. Olafur At 02:54 17/09/2009, Olaf Kolkman wrote: >Olafur, > > > > >>It would be nice to have 2+ implementations of tools >>inter operating by the time working group does LC this document, >>scheduled for later this year. >> >>Actions that need to be performed are: >> DS calculation >> GOST key generation >> GOST Signature generation /verification > > >You start your message with "it would be nice". After that your mail >reads like a bunch of requirements for submission to the IESG. > >Are you planning to have the documents submitted and published as >draft-standard in one go? I really like the idea of having running >code when developing protocols and love to see more (and some early >deployment if possible). But, as far as I know there is no requirement >in the process. > > > >--Olaf > > > >________________________________________________________ > >Olaf M. Kolkman NLnet Labs > Science Park 140, >http://www.nlnetlabs.nl/ 1098 XG Amsterdam > > > From owner-namedroppers@ops.ietf.org Thu Sep 17 08:00:22 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5856628C0E2; Thu, 17 Sep 2009 08:00:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.421 X-Spam-Level: *** X-Spam-Status: No, score=3.421 tagged_above=-999 required=5 tests=[AWL=-0.829, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NKOrpWnENoVL; Thu, 17 Sep 2009 08:00:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F3D4A3A6810; Thu, 17 Sep 2009 08:00:20 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoIOo-000Aok-EY for namedroppers-data0@psg.com; Thu, 17 Sep 2009 14:55:54 +0000 Received: from [213.178.172.147] (helo=WOTAN.TR-Sys.de) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoIOd-000AnW-BB for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 14:55:52 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3) id AA074209304; Thu, 17 Sep 2009 16:55:04 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id QAA15914; Thu, 17 Sep 2009 16:55:03 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <200909171455.QAA15914@TR-Sys.de> Subject: [dnsext] draft-barwood-dnsext-dns-transport-04 technical comments To: george.barwood@blueyonder.co.uk Date: Thu, 17 Sep 2009 16:55:02 +0200 (MESZ) Cc: namedroppers@ops.ietf.org X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: George, I took the time to take a closer look at your DNS transport proposal in draft-barwood-dnsext-dns-transport-04 . Here are a few technical and procedural considerations, whereby I'd like to help make the proposal more technically sound, independent of its potential political acceptability. (1) Sections 3.2 & 3.3 With respect to RFCs 5507 and 5395, I regard this as an abuse of the TXT record. I suggest that a new RR type should be allocated for this purpose from the 128-255 range (cf. RFC 5395, bottom of page 7) This would also ensure that existing debugging tools (hopefully based on RFC 3597) are able to display the RRDATA in a readable format, and not cause trouble due to binary content of a TXT RR. (2) Section 3.3 The SERVERTOKEN needs more discussion to make sure that Anycast DNS servers operate consistently and can take over a dialogue per request - response(s) transaction. (3) Section 3.5, 1st paragraph The server checks SERVERTOKEN, and divides the DNS payload into equal size pages, so that the size of each IP packet is not greater than | MTU. Servers should use a smaller MTU if the path MTU is less than the MTU supplied by the client. ^^ How does a particular DNS server know what the MTU *is* on the path to an arbitrary client ? In general, it doesnt; it only has local knowledge (interface MTU). Thus, the server in general does not know the PMTU, but only an upper limit to it. So perhaps it would be better to state: The server checks SERVERTOKEN, and divides the DNS payload into equal size pages, so that the size of each IP packet is not greater than | MTU. Servers should use a smaller MTU if the path MTU known to be less than the MTU supplied by the client. ^^^^^^^^^^^ (4) Section 3.6 With respect to Section 3.7, PAGE should be specified more precisely as "the 0-based number of this page". This is assumed below. The proposed packet layout is unnecessarily wasteful: We have 0 <= PAGE < COUNT, COUNT is 8 bits (and might reasonably be restricted even more), so 8 bits should suffice for PAGE as well, and Since TOTAL <= COUNT * PAGESIZE , COUNT is 8-bit and PAGESIZE is 16-bit (unsigned? -- please add precision!), 24 bits are sufficient for TOTAL. Thus, the DNS Transport packet header can be shortened by 4 octets, reducing MTU consumption: Draft: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 3 | COUNT | PAGESIZE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PAGE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | TOTAL | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | COOKIE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | QUERYID | ... more compact: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 3 | COUNT | PAGESIZE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PAGE | TOTAL | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | COOKIE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | QUERYID | ... If you dislike 24-bit numbers, you can even quench out 8 reserved bits for future expandability or flags, since the specification requires all non-last 'pages' to be of equal size, a 16-bit LASTPAGESIZE would, together with COUNT and PAGESIZE, carry the same information as TOTAL: TOTAL = (COUNT - 1) * PAGESIZE + LASTPAGESIZE This way, it would be possible to arrive at: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 3 | COUNT | PAGESIZE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PAGE | RESERVED | LASTPAGESIZE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | COOKIE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | QUERYID | ... NOTE: The encoding in Section 3.5 might be disliked due to the non-alignment to 16-bit boundaries. If the latter proposal for multi-page responses is adopted with a specific future use of the RESERVED field (as FLAGS ?) in mind, a similar octet might be inserted in the single-page response breakdown after the leading typecode (2) octet, restoring 16-bit alignment. Additionally, in 3.6 DATA might better (and more precisely) be specified as: "is the th part (fragment) of the DNS payload" (5) Section 3.7 Based on the elaborations in Section 3.9, it seems reasonable to make more efficient use of the MTU by again containing the PAGE field to 8 bits. Packet loss tends to happen randomly, and not in contiguous blocks. Inspired by the TCP SACK option, I therefore propose another encoding for the follow-up request. Draft: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 4 | COUNT | PAGESIZE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PAGE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | COOKIE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | ... Alternative: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 4 | COUNT | PAGESIZE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | PAGE_1 | PAGE_2 | PAGE_3 | PAGE_4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | COOKIE | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | ... where: COUNT only has 4 valid values: 1..4, specifying the number of PAGE_n fields containing valid page numbers requested; PAGE_i is RESERVED for i > COUNT (i=2,3,4). If the original semantics are deemed indispensable, this can optionally be overlayed by using negative values for COUNT (i.e. COUNT=-{number of contiguous pages requested}), using PAGE_1 as the starting page number; PAGE_2, ..., PAGE_4 are RESERVED fields if COUNT<0. Unless the latter option is adopted, the elaborations in Section 3.9 can be simplified under theis alternative. If the number of pages per response is limited to 128, the protocol and implementations could be simplified even more by also using this packet format for the initial request, because -- if the eventual necessity of follow-up requests is assumed, the DNS request and hence the DATA need be restricted in size to what would be possible in the latter case anyway, a slight reduction by 4 octets not being a real restiction in practical use. Kind regards, Alfred HÎnes. -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From jmsolerr@corgifitter.com Thu Sep 17 09:44:36 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 635363A6A2C; Thu, 17 Sep 2009 09:44:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.366 X-Spam-Level: X-Spam-Status: No, score=-10.366 tagged_above=-999 required=5 tests=[BAYES_95=3, FH_RELAY_NODNS=1.451, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RDNS_NONE=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_SBL=20, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hiUo56MnZUtx; Thu, 17 Sep 2009 09:44:32 -0700 (PDT) Received: from ns.thundernet.co.kr (unknown [211.214.160.39]) by core3.amsl.com (Postfix) with SMTP id AE88F28C2C0; Thu, 17 Sep 2009 09:44:02 -0700 (PDT) Date: Thu, 17 Sep 2009 12:44:57 -0500 Subject: Rep watches models from 2010 From: "Sidney Kenny" To: "Mallory Abraham" Message-ID: Content-Type: text/plain; Content-Transfer-Encoding: 7Bit Are you ready for hottest rep watches from 2010? They are here http://tablestuff.com/ From owner-namedroppers@ops.ietf.org Thu Sep 17 14:22:02 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4BC5E3A68D5; Thu, 17 Sep 2009 14:22:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.44 X-Spam-Level: X-Spam-Status: No, score=-2.44 tagged_above=-999 required=5 tests=[AWL=0.159, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DcUX+sa1Ft9k; Thu, 17 Sep 2009 14:22:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F02CA3A6941; Thu, 17 Sep 2009 14:22:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoOHy-0009WT-4G for namedroppers-data0@psg.com; Thu, 17 Sep 2009 21:13:14 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoOHk-0009UF-Ip for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 21:13:11 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 95166E6063; Thu, 17 Sep 2009 21:12:59 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8HLCroe023812; Fri, 18 Sep 2009 07:12:53 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909172112.n8HLCroe023812@drugs.dv.isc.org> To: bmanning@vacation.karoshi.com Cc: Jim Reid , namedroppers@ops.ietf.org From: Mark Andrews References: <94A6C73E649C435BA7E2C0A29E955F9D@localhost> <7C05BD8BFCBF4F77AADE3324945AED2B@localhost> <1468AAB2-1449-403C-9001-E3D98F4FC7BA@rfc1035.com> <20AF9D75BC2B4593B4C5B3C8BA6FB009@localhost> <35191.1253144954@nsa.vix.com> <6A105DD4-87E3-4A9D-BE11-E0FF871463B6@rfc1035.com> <20090917085740.GA3305@vacation.karoshi.com.> <490BFA57-7736-47FD-8A59-7C9BFF111BA4@rfc1035.com> <20090917104029.GA4171@vacation.karoshi.com.> Subject: Re: [dnsext] new DNS transports In-reply-to: Your message of "Thu, 17 Sep 2009 10:40:29 GMT." <20090917104029.GA4171@vacation.karoshi.com.> Date: Fri, 18 Sep 2009 07:12:53 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <20090917104029.GA4171@vacation.karoshi.com.>, bmanning@vacation.kar oshi.com writes: > On Thu, Sep 17, 2009 at 10:24:49AM +0100, Jim Reid wrote: > > On 17 Sep 2009, at 09:57, bmanning@vacation.karoshi.com wrote: > > > > > SO.. what will the "search" order look like when there are > > > more than just UDP and TCP defined as DNS transports? > > > > IMO, the time for that discussion is when a viable alternative to UDP > > and TCP emerges. It's not clear we're at that point. > > > ok... lets just work with the subset of two, UDP and TCP. > > when, if ever, is it ok to try TCP first? I wouldn't even try a UPDATE that was bigger that 512 over anything other than TCP. I would recommend that all UPDATEs go over TCP especially if you are using IP as the authenticator for allowing the update. > under what condtions is it ok to flip transports (UDP->TCP, TCP->UDP) > > is truncation the only requirement to consider changing transports? > > --bill > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Thu Sep 17 16:35:05 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 067B73A681D; Thu, 17 Sep 2009 16:35:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.048 X-Spam-Level: X-Spam-Status: No, score=-5.048 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4fglsZZNb+-5; Thu, 17 Sep 2009 16:34:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DBC763A68AC; Thu, 17 Sep 2009 16:34:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoQQN-000NE3-Fc for namedroppers-data0@psg.com; Thu, 17 Sep 2009 23:30:03 +0000 Received: from [129.6.16.226] (helo=smtp.nist.gov) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoQQA-000NBt-OB for namedroppers@ops.ietf.org; Thu, 17 Sep 2009 23:29:59 +0000 Received: from WSXGHUB1.xchange.nist.gov (wsxghub1.nist.gov [129.6.18.96]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id n8HNThW7013644 for ; Thu, 17 Sep 2009 19:29:43 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([2002:8106:1260::8106:1260]) with mapi; Thu, 17 Sep 2009 19:29:43 -0400 From: "Rose, Scott W." To: "namedroppers@ops.ietf.org" Date: Thu, 17 Sep 2009 19:29:41 -0400 Subject: Re: [dnsext] Updated: Cryptographic Algorithm Identifier Allocation for DNSSEC Thread-Topic: [dnsext] Updated: Cryptographic Algorithm Identifier Allocation for DNSSEC Thread-Index: AconOQb5Qh3o40t3QqmUfuM/LH4wOwQtbPdn Message-ID: In-Reply-To: Accept-Language: en-US Content-Language: en X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: scott.rose@nist.gov Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: I haven't been following the list like I used to, so I don't know if this has been fully addressed. I think this draft warrants becoming a WG item. With all the talk of new algorithms coming up quickly this idea deserves consideration. I volunteer to review it. =20 Scott On 8/27/09 12:58 PM, "Paul Hoffman" wrote: > I have updated the draft to include clarifications from the recent thread= . The > new version is at: >=20 > http://www.ietf.org/internet-drafts/draft-hoffman-dnssec-alg-allocation-0= 1.txt >=20 > The added text is: >=20 > 3. Expectations For Implementations >=20 > It is important to note that, according to RFC 4034, DNSSEC > implementations are not expected to include all of the algorithms > listed in the IANA registry; in fact, RFC 4034 and the IANA registry > list an algorithm that implementations should not include. This > document does nothing to change the expectation that there will be > items listed in the IANA registry that need not be (and in some > cases, should not be) included in all implementations. >=20 > There are many reasons why a DNSSEC implementation might not include > one or more of the algorithms listed, even those on Standards Track. > In order to be compliant with the RFC 4034, an implementation only > needs to implement the algorithms listed as mandatory to implement in > the that standard, or updates to that standard. This document does > nothing to change the list of mandatory to implement algorithms in > RFC 4034. >=20 I agree that this should be included. Just to reinforce that any new algorithm codes assigned using this process would be OPTIONAL from the star= t unless also set to MANDATORY via a standards track doc. Scott > I hope this helps allay fears and repeat what is already in RFC 4034 that > remains unchanged. I also hope it helps gain interest in this becoming a = WG > document. >=20 > --Paul Hoffman, Director > --VPN Consortium >=20 >=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Scott Rose NIST scottr@nist.gov ph: +1 301-975-8439 http://www-x.antd.nist.gov/dnssec http://www.dnsops.gov/ =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D From owner-namedroppers@ops.ietf.org Thu Sep 17 17:29:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A2DEA3A6952; Thu, 17 Sep 2009 17:29:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.442 X-Spam-Level: X-Spam-Status: No, score=-2.442 tagged_above=-999 required=5 tests=[AWL=0.157, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 00CePH5zXTBU; Thu, 17 Sep 2009 17:29:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BBCA33A6816; Thu, 17 Sep 2009 17:29:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoRIK-0003EF-3p for namedroppers-data0@psg.com; Fri, 18 Sep 2009 00:25:48 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoRIA-0003CF-Ed for namedroppers@ops.ietf.org; Fri, 18 Sep 2009 00:25:45 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 70C53E601E; Fri, 18 Sep 2009 00:25:37 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8I0PXje027446; Fri, 18 Sep 2009 10:25:35 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909180025.n8I0PXje027446@drugs.dv.isc.org> To: "George Barwood" Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <5BB224FBD702461FA8FA96EA4A5A876B@localhost> Subject: Re: [dnsext] Re-ordering of responses over TCP In-reply-to: Your message of "Thu, 17 Sep 2009 13:44:36 +0100." <5BB224FBD702461FA8FA96EA4A5A876B@localhost> Date: Fri, 18 Sep 2009 10:25:33 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <5BB224FBD702461FA8FA96EA4A5A876B@localhost>, "George Barwood" write s: > It's not clear to me if servers are permitted to re-order responses when > multiple queries are received over a single TCP connection. There is nothing that says they MUST preserve the order. > I think this should be permitted, as it allows a stub resolver > to communicate more efficiently with a cache. Its always been permitted. Whether servers implement parrallel processing or not is a seperate question. Either end can serialise the processing. When both end perform parallel processing then the id field is used to seperate responses. > I think a client submitting multiple queries over a single TCP connection > would probably expect this behavior, but does anyone know of a client > that might fail? If the client cares about response order it won't have multiple outstanding questions. > Should this be made clear somewhere in the standard? What's not clear? You were able to work out that it was permitted. The points of standards are to make sure things interoperate, not to point out every possible usage model. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Thu Sep 17 18:02:24 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 89CC53A6804; Thu, 17 Sep 2009 18:02:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.705 X-Spam-Level: X-Spam-Status: No, score=-0.705 tagged_above=-999 required=5 tests=[AWL=-0.210, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1AekhwXQ-SVz; Thu, 17 Sep 2009 18:02:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BC8EE3A681D; Thu, 17 Sep 2009 18:02:23 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoRnt-0006eX-Ou for namedroppers-data0@psg.com; Fri, 18 Sep 2009 00:58:25 +0000 Received: from [193.110.157.143] (helo=newtla.xelerance.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoRnj-0006dk-R0 for namedroppers@ops.ietf.org; Fri, 18 Sep 2009 00:58:23 +0000 Received: from tla.xelerance.com (tla.xelerance.com [193.110.157.130]) by newtla.xelerance.com (Postfix) with ESMTP id CB13A570AB; Thu, 17 Sep 2009 20:58:14 -0400 (EDT) Date: Thu, 17 Sep 2009 20:58:14 -0400 (EDT) From: Paul Wouters To: Paul Hoffman cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Updated: Cryptographic Algorithm Identifier Allocation for DNSSEC In-Reply-To: Message-ID: References: <934623C28D56444CB073F90BC35244BB05325C@TK5EX14MBXC128.redmond.corp.micros oft.com> <4A94EBF6.3030603@connotech.com> <4A958C33.1010009@cryptocom.ru> <200908262126.n7QLQDCl090000@stora.ogud.com> <49DC2C18-6C47-4506-B5C1-C65FAA9E1C7A@cisco.com> <200908270641.n7R6f78T026596@drugs.dv.isc.org> User-Agent: Alpine 1.10 (LFD 962 2008-03-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Thu, 17 Sep 2009, Paul Hoffman wrote: >>> http://www.ietf.org/internet-drafts/draft-hoffman-dnssec-alg-allocation-01.txt >> >> Looks good to me. One minor point I was thinking about. Since we briefly saw a >> proposal that would suggest a crypto preference based on the order/number of the >> algorithm, and saw that most people did not like that implication, perhaps we >> can explicitely state that the order of algorithms in the registry does not >> signify or imply cryptographic strength or preference. >> >> Paul > > Does "looks good to me" mean that you support this as a WG work item? > If so, please say this on the list. Yes. Paul From owner-namedroppers@ops.ietf.org Fri Sep 18 02:44:59 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 985B328C186; Fri, 18 Sep 2009 02:44:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.689 X-Spam-Level: **** X-Spam-Status: No, score=4.689 tagged_above=-999 required=5 tests=[AWL=-1.861, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, MANGLED_LIST=2.3, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OJZGod8r0+1G; Fri, 18 Sep 2009 02:44:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 6A2BC28C0EE; Fri, 18 Sep 2009 02:44:58 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoZuq-000D2S-3D for namedroppers-data0@psg.com; Fri, 18 Sep 2009 09:38:08 +0000 Received: from [213.178.172.147] (helo=TR-Sys.de) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoZud-000D0T-O4 for namedroppers@ops.ietf.org; Fri, 18 Sep 2009 09:38:06 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3.2) id AA079916636; Fri, 18 Sep 2009 11:37:16 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id LAA17243; Fri, 18 Sep 2009 11:37:11 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <200909180937.LAA17243@TR-Sys.de> Subject: [dnsext] draft-ietf-dnsext-rfc2672bis-dname-16 follow-up To: scottr@nist.gov, wouter@nlnetlabs.nl Date: Fri, 18 Sep 2009 11:37:10 +0200 (MESZ) Cc: namedroppers@ops.ietf.org X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Hello again, in an attempt to catch up with the evolution of DNSEXT topics during the months I had almost no cycles available to this end, I now also have tried to closely follow up to the latest revision of the DNAME draft, draft-ietf-dnsext-rfc2672bis-dname-16. The single significant change in that version was the elimination of the previously proposed UD bit allowing resolvers to signal their capability to understand DNAME and thereby allowing servers to omit CNAME synthesis for DNAME RRs -- shortening the response, but at the price of an added dependency on EDNS0. However, this UD bit elimination has been performed imperfectly, and a few nits have also become apparent on studying the draft. The following details should be corrected: (1) Section 3.1, first paragraph The draft currently says: [...]. A CNAME RR with TTL equal to the corresponding DNAME RR is | synthesized and included in the answer section for resolvers that did vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv^^^^^^^^^^^^^^^^^^^^^^^ | not indicate understanding of DNAME in queries. [...] The tagged phrase has become nonsensical by the removal of the UD bit signalling mechanism. Hence, the draft should simply state: [...]. A CNAME RR with TTL equal to the corresponding DNAME RR is | synthesized and included in the answer section. [...] (2) Section 3.4, last (4th) paragraph The draft says: If a recursive caching name server encounters a DNAME RR which contradicts information already in the cache (excluding CNAME records), it SHOULD NOT cache the DNAME RR, but it MAY cache the | CNAME record received along with it or synthesized from the DNAME vvvvvv ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | record, subject to the rules for CNAME caching. IMHO, the tagged clause solely refers to case previously described in the second paragraph of section 3.4 up to the previous draft version and removed with UD bit support in this version: "Recursive caching name servers MUST perform CNAME synthesis on behalf of DNAME-ignotant clients. [...]" I could not find text in the draft that allows CNAME synthesis in a recursive resolver under other circumstances. (My reading of sections 3.1 and 3.2 is that these are applicable to authoritative servers only; it may be that in these sections the term "server" should be ultimatively disambiguated by using "authoritative server", since unfortunately the use of DNS role names diverges in practice. Please correct me if I'm wrong or have overlooked something.) If I'm correct in that there is no other scenario for such 'downstream' CNAME synthesis to be referred here, the "or" clause tagged above needs to be removed from the draft text as well: If a recursive caching name server encounters a DNAME RR which contradicts information already in the cache (excluding CNAME records), it SHOULD NOT cache the DNAME RR, but it MAY cache the | CNAME record received along with it, subject to the rules for CNAME caching. (3) Nits (3a) Section 2.2, 1st para Please fix the grammar; the draft text looks correctly at first glance, but the sentence does no make proper sense: v | [...[. As is the case of finding a CNAME resource record or NS resource record set, the processing of a DNAME will happen prior to finding the desired domain name. --- v | [...[. As in the case of finding a CNAME resource record or NS resource record set, the processing of a DNAME will happen prior to finding the desired domain name. [ Otherwise, s/of finding/when finding/ might be an alternative. ] (3b) Section 3.1, 1st para When preparing an response, [...] --- ^ When preparing a response, [...] (3c) Section 3.4, 2nd para The comma in the first sentence should be removed, in accordance with contemporary RFC Editor style: v | This conflict situation is a transitional phase, that ends when the old data times out. [...] --- | This conflict situation is a transitional phase that ends when the old data times out. [...] Kind regards, Alfred. -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From owner-namedroppers@ops.ietf.org Fri Sep 18 04:47:18 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1A33428C1B9; Fri, 18 Sep 2009 04:47:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.772 X-Spam-Level: *** X-Spam-Status: No, score=3.772 tagged_above=-999 required=5 tests=[AWL=-0.478, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ax+1yckklEuW; Fri, 18 Sep 2009 04:47:16 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 933BA3A69D8; Fri, 18 Sep 2009 04:47:16 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mobrd-0001Yi-2l for namedroppers-data0@psg.com; Fri, 18 Sep 2009 11:42:57 +0000 Received: from [213.178.172.147] (helo=TR-Sys.de) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MobrR-0001Vw-F6 for namedroppers@ops.ietf.org; Fri, 18 Sep 2009 11:42:54 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3.2) id AA080334121; Fri, 18 Sep 2009 13:42:01 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id NAA17386; Fri, 18 Sep 2009 13:42:00 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <200909181142.NAA17386@TR-Sys.de> Subject: [dnsext] draft-hoffman-dnssec-* (DNSSEC algorithm drafts) To: paul.hoffman@vpnc.org, namedroppers@ops.ietf.org Date: Fri, 18 Sep 2009 13:42:00 +0200 (MESZ) X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: For brevity, I refer in a single message to the following recent DNSSEC algorithm related drafts: 1.) draft-hoffman-dnssec-alg-allocation-01 2.) draft-hoffman-dnssec-dsa-sha2-00 3.) draft-hoffman-dnssec-ecdsa-00 I have reviewed these drafts, and I support adopting them all as DNSEXT work items. Set aside the policy direction for #1, there seems to be very little need of technical discussions, so this will not represent a significant contribution to the overall wg workload. [ Refraining from a few extraneous rounds in sustained and/or recurring circular discussions might provide ample wg cycles for dealing with these drafts . :-) ] #1 seems to be overdue and it is editorially already almost done; I noticed a single nit, listed in the appendix of this message. IMHO, what needed to be said regarding the intent and direction of this draft already has been said on the list. IANA reportedly now supports provisional registrations with a timeout set for expiry (unless confirmed by document action), which do not become visible in the published registries. I suggest to adopt these procedures for the benefit of draft authors, abating the need to defer example generation to AUTH48 and thus allowing better review and verification of examples. #2 and #3 are certainly needed in order to let DNSSEC keep pace with the development of crypto-algorithm science and technology, and with related fundamental standards, and to ensure longer term DNSSEC deployment support by significant authorities. An important additional momentum driving the modern algorithms into DNSSEC is the potential savings in DNS response size, as explained in these drafts. Not addressing these issues and broadening the algorithm portfolio in DNSSEC might otherwise turn out as a major obstacle to large scale DNSSEC deployment -- a goal always supported vividly by a majority on this list. I have found only a single issue deserving clarification in #2 and a bunch of minor issues to be addressed for #3 -- see below for the details. Thus, filling in the promised examples seems to be the only significant task left for the author ... :-) ... but that can only be done in a useful way once algorithm numbers have been assigned, hence the urgent need for #1 !! Appendix: review result details (1) draft-hoffman-dnssec-alg-allocation-01 Section 3, 2nd para, contains an extraneous word. Please correct: [...] mandatory to implement in the that standard, [...] --- ^^^^ [...] mandatory to implement in that standard, [...] (2) draft-hoffman-dnssec-dsa-sha2-00 I suggest improving the reasoning in Section 1 by amending its 2nd para, which states: RFC 2536 [RFC2536] describes the KEY and SIG resource records (RRs) for the DSA with SHA-1 signature algorithm. At the time RFC 2536 was written, SHA-1 was the only hash algorithm that was defined for use with DSA, and the only key size allowed was 1024 bits. FIPS 186-3 ([FIPS-186-3]) extends the original DSA definition to permit larger keys. This document neither updates nor replaces RFC 2536. This text reports what had been done in RFC 2536 for the KEY and SIG RRs, and then the recent developments in FIPS 186. The subsequent paragraphs discuss some Pros and Cons of DSA with SHA-2 hashes, and then indicate which additions to the *DNSSECbis* documents (RFC 403x) are needed to support that, thus introducing what will be done in the following sections for the *DNSKEY* and *RRSIG* RRs. I miss a link in the chain: what happened from RFC 2535 to RFC 403*, i.e. the step to the new DNSSEC RRs. Since RFC 2536 already has been obsoleted by DNSSECbis, the last sentence quoted above should be deleted. Hence, I propose to change/amend the 2nd para of Section 1 as follows: vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv v | For the original DNSSEC version, RFC 2536 [RFC2536] described the KEY and SIG resource records (RRs) for the DSA with SHA-1 signature algorithm. At the time RFC 2536 was written, SHA-1 was the only hash algorithm that was defined for use with DSA, and the only key size | allowed was 1024 bits. The DNSSECbis documents listed above have | introduced the DNSKEY and RRSIG RRs replacing these old DNSSEC RR | types, but they have not changed the algorithm portfolio (see in | particular Appendix A of [RFC4034]). FIPS 186-3 ([FIPS-186-3]) extends the original DSA definition to | permit larger keys. ^^^^^ [[ 2nd sentence deleted; perhaps better join this remaining sentence with the subsequent paragraph! ]] (3) draft-hoffman-dnssec-ecdsa-00 There are a couple of editorials to be corrected, and in Section 7, wisdom has to be added. I omit verbous reasoning for the straightforward editorials. (3a) Section 3 | Verifying ECDSA signatures require agreement between the signer and the verifier of the parameters used. FIPS 186-3 [FIPS-186-3] lists some NIST-recommended elliptic curves. These are the same curves listed in RFC 5114 [RFC5114]. The curves used in this document are: --- v | Verifying ECDSA signatures requires agreement between the signer and the verifier of the parameters used. FIPS 186-3 [FIPS-186-3] lists | some NIST-recommended elliptic curves. These are the same curves as listed in RFC 5114 [RFC5114]. The curves used in this document are: [[ better use "... same ... *as* ..." ]] (3b) Section 4, 1st para -- significant word omission ECDSA public keys consist of a single value, called "Q" in FIPS 186-3. In DNSSEC keys, Q is a simple bit string that represents the | uncompressed form of the curve. --- ECDSA public keys consist of a single value, called "Q" in FIPS 186-3. In DNSSEC keys, Q is a simple bit string that represents the | uncompressed form of a curve point. ^ ^^^^^^ Important note for the list: In ECC, the public key is a point on the elliptic curve, and the SEC standards have defined different representations for it. The uncompressed form trades on-the-wire space in favor of reduced processing complexity at the signature verifier. An alternative would be the compressed form that essentially only requires a single bit to represent the y-coordinate of that point, thus cutting the size of the key representation almost to half, but which necessitates additional calculations at the signature verifier (using the equation of the elliptical curve, perhaps making use of clever shortcuts depending on the finite field on which the curve is defined) to recover the entire value of the y-coordinate. Other IETF WGs have favored the uncompressed form, but the restrictions imposed by theoretical and practical DNS response size limitations might call for revisiting this topic for DNSSEC. Can implementors of ECC (outside DNSSEC) quantify the relative cost (in processing time) of using the compressed form? (3c) Section 7, 1st para -- word omission | This document updates the IANA for digest types in DS records, currently called "Delegation Signer Resource Record, Digest Algorithms". The following entry is added: --- vvvvvvvvvv | This document updates the IANA registry for digest types in DS records, currently called "Delegation Signer Resource Record, Digest Algorithms". The following entry is added: (3d) Section 7, new "Algortihm Number" entries To my knowledge, at this point in time there does not exist a formal specification for the use of these algorithms with DNS transaction security (TSIG) -- which now is no more regarded as a component of DNSSEC. I strongly suggest to definitely say in the registration templates that TSIG support is not available, and leave an update to such specification, once it eventually is adopted. Hence I suggest to perform the following change (3 occurrences): Trans. Sec. **** Unknown; will fill in later **** --- Trans. Sec. No (3e) Section 8 -- incomplete sentence [...]. Such an assessment could, of course, change in the future if new attacks that | work better than the ones known today. --- ^ [...]. Such an assessment could, of course, change in the future if new attacks that | work better than the ones known today are discovered. ^^^^^^^^^^^^^^^^ [[ Alternatively, use "found" instead of "discovered", as in the DSA draft. ]] Kind regards, Alfred HÎnes. -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From antti.orava@daniellegroup.com Fri Sep 18 04:51:25 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E8A3D3A68DC; Fri, 18 Sep 2009 04:51:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.275 X-Spam-Level: X-Spam-Status: No, score=-1.275 tagged_above=-999 required=5 tests=[BAYES_99=3.5, HELO_EQ_DIALUP=0.862, HOST_EQ_DIALUP=0.862, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_NJABL_PROXY=1.643, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_SBL=20, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1SjQJGENgGpd; Fri, 18 Sep 2009 04:51:24 -0700 (PDT) Received: from max2-107.dialup.farlep.net (max2-107.dialup.farlep.net [213.130.6.236]) by core3.amsl.com (Postfix) with SMTP id E4F6A28C1A0; Fri, 18 Sep 2009 04:49:13 -0700 (PDT) Date: Fri, 18 Sep 2009 07:50:09 -0500 Subject: Rep watches models from 2010 From: "Fern Bradshaw" To: "Bridgett Rivas" Message-ID: Content-Type: text/plain; Content-Transfer-Encoding: 7Bit Are you ready for hottest rep watches from 2010? They are here http://tablecake.com/ From blanchinggx27@riskiii.com Fri Sep 18 06:09:10 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EB7213A688A; Fri, 18 Sep 2009 06:09:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -16.38 X-Spam-Level: X-Spam-Status: No, score=-16.38 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_FAKE_RCVD_LINE=10.357, GB_I_LETTER=-2, HS_INDEX_PARAM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_DOUBLE_IP_SPAM=3.798, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, SARE_RECV_IP_FROMIP1=1.666, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SBL=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nNSbdQrJv+TR; Fri, 18 Sep 2009 06:09:10 -0700 (PDT) Received: from 208stb10.codetel.net.do (208stb10.codetel.net.do [64.32.80.208]) by core3.amsl.com (Postfix) with ESMTP id C4BC33A67CC; Fri, 18 Sep 2009 06:09:08 -0700 (PDT) Received: from 64.32.80.208 by 216.146.33.2; Fri, 18 Sep 2009 09:09:51 -0400 Message-ID: <000d01ca3861$4edeae00$6400a8c0@blanchinggx27> From: Milford Zuniga To: Subject: My new ambition is to help others try what is making me feel great click Date: Fri, 18 Sep 2009 09:09:51 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3861.4EDEAE00" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE 6.00.2900.2180 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3861.4EDEAE00 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 =20 Email=20 not displaying correctly? View it in=20 your browser. =20 =20 =20 =20 =20 =20 =20 =20 =20   =20 =20 =20 =20 =20 =20 =20 August 2009 =20 Most Popular Last Month =20 More Info =20 Wana look better? =20 More Info =20 =20 =20 Patient=20 Stories =20 =20 You will be rid of that tummy immediatelyI was just= let in on a little secret, you wont believe, click this=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=20 =20 =A0 =A0 Click Here =A0 =A0 =A0 =A0 Read=20 full=20 story.=A0 =20 Newsletter=20 Archive=A0| Subscribe=A0|=20 Contact=20 us =20 Manage=20 My Subscription (including unsubscribe).2009=20 Ellwoo Company. All rights reserved. Terms=20 of=20 Use. ------=_NextPart_000_0007_01CA3861.4EDEAE00 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Email=20 not displaying correctly? View it in=20 your browser.
 
Newsletter= =20 Archive=A0| Subscribe<= /A>=A0|=20 Contact=20 usManage=20 My Subscription (including unsubscribe).
2009=20 Ellwoo Company. All rights reserved. Terms=20 of=20 Use.
August 2009Most Popular Last Month=
More= Info

Wana= look better?

More= Info


Pati= ent=20 Stories

You will be rid of that tummy immediately

I was just let in on a little secret, you wont believe, click this=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=20
=A0
=A0
Clic= k Here
=A0
=A0
=A0
=A0
Read= =20 full=20 story.
=A0
------=_NextPart_000_0007_01CA3861.4EDEAE00-- From owner-namedroppers@ops.ietf.org Fri Sep 18 10:27:07 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0849928C211; Fri, 18 Sep 2009 10:27:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.825 X-Spam-Level: *** X-Spam-Status: No, score=3.825 tagged_above=-999 required=5 tests=[AWL=-0.425, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d88rKjNYT2v9; Fri, 18 Sep 2009 10:27:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1F1E33A6A86; Fri, 18 Sep 2009 10:27:05 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Moh73-000Guu-C9 for namedroppers-data0@psg.com; Fri, 18 Sep 2009 17:19:13 +0000 Received: from [213.178.172.147] (helo=TR-Sys.de) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Moh6r-000Gsi-5w for namedroppers@ops.ietf.org; Fri, 18 Sep 2009 17:19:10 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3.2) id AA081604302; Fri, 18 Sep 2009 19:18:22 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id TAA17834; Fri, 18 Sep 2009 19:18:21 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <200909181718.TAA17834@TR-Sys.de> Subject: Re: [dnsext] Re-ordering of responses over TCP To: george.barwood@blueyonder.co.uk, vixie@isc.org, namedroppers@ops.ietf.org Date: Fri, 18 Sep 2009 19:18:20 +0200 (MESZ) X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In the message archived at , I read: > ... > >> I think a client submitting multiple queries over a single TCP >> connection would probably expect this behavior, but does anyone >> know of a client that might fail? > > named-xfer in bind4 did not check the TXID on the SOA response > or the AXFR. > >> Should this be made clear somewhere in the standard? > > probably so. right now the standard says use TXID for disambiguation > and does not guarantee ordering for any transport. yet reordering is > rare enough that there may be stubs out there who successfully presume > ordering. Please note that this issue (among other legacy ambiguities) is being addressed for AXFR in an ongoing WG effort, currently draft-ietf-dnsext-axfr-clarify-11. Alfred. P.S.: Did the WG forget to further comment on that draft, or did I miss procedural progress for that draft after consensus had been reached? -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From gloria.bacon@bstspclhomess.com Fri Sep 18 10:59:06 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 80B923A68A4; Fri, 18 Sep 2009 10:59:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.118 X-Spam-Level: X-Spam-Status: No, score=-3.118 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_MX=0.535, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_SORBS_DUL=0.877, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_SBL=20, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FqQASynB7Ipm; Fri, 18 Sep 2009 10:59:05 -0700 (PDT) Received: from host-200-94-71-94.block.alestra.net.mx (host-148-244-169-14.block.alestra.net.mx [148.244.169.14]) by core3.amsl.com (Postfix) with SMTP id D9E4B3A63C9; Fri, 18 Sep 2009 10:58:53 -0700 (PDT) Date: Fri, 18 Sep 2009 13:59:51 -0500 Subject: Rep watches models from 2010 From: "Leah Braun" To: "Loretta Preston" Message-ID: <7GNeK71FCX7Nkvud8Ldiscuss-archive@ietf.org> Content-Type: text/plain; Content-Transfer-Encoding: 7Bit Are you ready for hottest rep watches from 2010? They are here http://tablecake.com/ From owner-namedroppers@ops.ietf.org Fri Sep 18 11:54:09 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0CBDA3A68BE; Fri, 18 Sep 2009 11:54:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Peo58kQ15DHD; Fri, 18 Sep 2009 11:54:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id EB6853A68DD; Fri, 18 Sep 2009 11:53:45 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoiWb-0003rL-Ng for namedroppers-data0@psg.com; Fri, 18 Sep 2009 18:49:41 +0000 Received: from [2001:4900:1:392:213:20ff:fe1b:3bfe] (helo=monster.hopcount.ca) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoiWP-0003p5-Uz for namedroppers@ops.ietf.org; Fri, 18 Sep 2009 18:49:39 +0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=monster; d=hopcount.ca; h=Received:Subject:Mime-Version:Content-Type:From:In-Reply-To:Date:Cc:Content-Transfer-Encoding:Message-Id:References:To:X-Mailer; b=l/hWEnj1x9ILXP7uTpOgXYGH0RS2NJc45jjwjeNy6/5kGFa6FWqDJvOL0kWk9EtIv3Zt8MWvn1vyOFz4dmnjO15SlMMSRP78xo7Fp4BB8FTfo8W3qr1bMChAFpw2X/GU; Received: from [64.235.108.48] (helo=[192.168.182.17]) by monster.hopcount.ca with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MoiWG-000Nm5-PA; Fri, 18 Sep 2009 18:49:21 +0000 Subject: Re: [dnsext] Re-ordering of responses over TCP Mime-Version: 1.0 (Apple Message framework v1076) Content-Type: text/plain; charset=iso-8859-1; format=flowed From: Joe Abley In-Reply-To: <200909181718.TAA17834@TR-Sys.de> Date: Fri, 18 Sep 2009 14:49:19 -0400 Cc: george.barwood@blueyonder.co.uk, vixie@isc.org, namedroppers@ops.ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <200909181718.TAA17834@TR-Sys.de> To: =?iso-8859-1?Q?Alfred_H=CEnes?= X-Mailer: Apple Mail (2.1076) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 2009-09-18, at 13:18, Alfred H=CEnes wrote: > Please note that this issue (among other legacy ambiguities) > is being addressed for AXFR in an ongoing WG effort, currently > draft-ietf-dnsext-axfr-clarify-11. Is that draft still alive in any meaningful sense? Joe From owner-namedroppers@ops.ietf.org Fri Sep 18 14:22:54 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BC0BB3A67FF; Fri, 18 Sep 2009 14:22:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.481 X-Spam-Level: X-Spam-Status: No, score=-0.481 tagged_above=-999 required=5 tests=[AWL=-1.499, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RCVD_IN_SORBS_WEB=0.619, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9xxljV5FZ54u; Fri, 18 Sep 2009 14:22:54 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0EF4B3A6844; Fri, 18 Sep 2009 14:22:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mokmx-000J8Y-NM for namedroppers-data0@psg.com; Fri, 18 Sep 2009 21:14:43 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mokmo-000J71-8i for namedroppers@ops.ietf.org; Fri, 18 Sep 2009 21:14:41 +0000 Received: from crankycanuck.ca (unknown [220.227.117.68]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 725EB2FE8CE2 for ; Fri, 18 Sep 2009 21:14:32 +0000 (UTC) Date: Fri, 18 Sep 2009 17:14:29 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Re-ordering of responses over TCP Message-ID: <20090918211428.GH18995@shinkuro.com> References: <200909181718.TAA17834@TR-Sys.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, Sep 18, 2009 at 02:49:19PM -0400, Joe Abley wrote: > > Is that draft still alive in any meaningful sense? The last I heard from the editor, he'd received my comments prior to initiating WGLC and would work on it. He said he intended to finish it, but that it was lower priority than some other items that were hanging around. My opinion is that it's still alive. Perhaps Ed can weigh in about whether he still has it on his TODO? A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From rakish26@rehau.com Fri Sep 18 14:36:11 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9858928C117; Fri, 18 Sep 2009 14:36:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.081 X-Spam-Level: X-Spam-Status: No, score=-11.081 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_FAKE_RCVD_LINE=10.357, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, GB_I_LETTER=-2, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_DSL=1.129, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, HOST_EQ_STATIC=1.172, HS_INDEX_PARAM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_DOUBLE_IP_SPAM=3.798, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, SARE_RECV_IP_FROMIP1=1.666, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_SBL=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id slJix9gDf-UJ; Fri, 18 Sep 2009 14:36:10 -0700 (PDT) Received: from ip24-20-211-87.adsl2.static.versatel.nl (ip24-20-211-87.adsl2.static.versatel.nl [87.211.20.24]) by core3.amsl.com (Postfix) with ESMTP id 3400928C0F2; Fri, 18 Sep 2009 14:36:09 -0700 (PDT) Received: from 87.211.20.24 by 62.225.160.86; Fri, 18 Sep 2009 23:36:59 +0100 Message-ID: <000d01ca38a8$271c55b0$6400a8c0@rakish26> From: Adeline Parra To: Subject: Check this out now, its the new hot thing, and I have seen it on TV Date: Fri, 18 Sep 2009 23:36:59 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA38A8.271C55B0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE 6.00.2800.1409 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA38A8.271C55B0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable =20 =20 Email=20 not displaying correctly? View it in=20 your browser. =20 =20 =20 =20 =20 =20 =20 =20 =20   =20 =20 =20 =20 =20 =20 =20 August 2009 =20 Most Popular Last Month =20 More Info =20 Wana look better? =20 More Info =20 =20 =20 Patient=20 Stories =20 =20 You will be slim in a few monthsSo happy, I got luc= ky and got a free trial.=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=20 =20 =A0 =A0 More=20 Info =A0 =A0 =A0 =A0 Read=20 full=20 story.=A0 =20 Newsletter=20 Archive=A0| Subscribe=A0|=20 Contact=20 us =20 Manage=20 My Subscription (including unsubscribe).2009=20 Ekyvrsnih Company. All rights reserved. Terms=20 of=20 Use. ------=_NextPart_000_0007_01CA38A8.271C55B0 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Email=20 not displaying correctly? View it in=20 your browser.
 
Newslet= ter=20 Archive=A0| Subscri= be=A0|=20 Contact= =20 usManage=20 My Subscription (including unsubscribe).
2009=20 Ekyvrsnih Company. All rights reserved. Terms=20 of=20 Use.
August 2009Most Popular Last Month=
M= ore Info

W= ana look better?

M= ore Info


Pati= ent=20 Stories

You will be slim in a few months

So happy, I got lucky and got a free trial.=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=20
=A0
=A0
M= ore=20 Info
=A0
=A0
=A0
=A0
R= ead=20 full=20 story.
=A0
------=_NextPart_000_0007_01CA38A8.271C55B0-- From steven.schoenfish@jademosaic.com Sun Sep 20 22:07:28 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 468273A68B4; Sun, 20 Sep 2009 22:07:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.584 X-Spam-Level: * X-Spam-Status: No, score=1.584 tagged_above=-999 required=5 tests=[BAYES_95=3, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_EQ_MODEMCABLE=0.768, HELO_EQ_RU=0.595, HOST_EQ_MODEMCABLE=1.368, HOST_EQ_RU=0.875, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_SBL=20, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s058TJYy-JNf; Sun, 20 Sep 2009 22:07:27 -0700 (PDT) Received: from broadband-77-37-132-88.nationalcablenetworks.ru (broadband-77-37-132-88.nationalcablenetworks.ru [77.37.132.88]) by core3.amsl.com (Postfix) with SMTP id 7F6BF3A6765; Sun, 20 Sep 2009 22:07:21 -0700 (PDT) Date: Mon, 21 Sep 2009 01:08:19 -0500 Subject: Rep watches models from 2010 From: "Kerri Merritt" To: "Marshall Crabtree" Message-ID: Content-Type: text/plain; Content-Transfer-Encoding: 7Bit Are you ready for hottest rep watches from 2010? They are here http://tablecake.com/ From tearoomssf02@itameks.com Mon Sep 21 13:06:42 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A39C13A6B02; Mon, 21 Sep 2009 13:06:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -34.225 X-Spam-Level: X-Spam-Status: No, score=-34.225 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DIET_1=0.083, FH_FAKE_RCVD_LINE=10.357, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_DSL=1.129, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RCVD_DOUBLE_IP_SPAM=3.798, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_RECV_IP_FROMIP1=1.666, SARE_SUB_NO=0.669, SARE_SUB_WEIGHTLOSS=0.689, TVD_RCVD_IP=1.931, URIBL_SBL=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KbnlHn1TJAKb; Mon, 21 Sep 2009 13:06:41 -0700 (PDT) Received: from 16-109-20-190.adsl.terra.cl (16-109-20-190.adsl.terra.cl [190.20.109.16]) by core3.amsl.com (Postfix) with ESMTP id 6B0423A69D8; Mon, 21 Sep 2009 13:06:40 -0700 (PDT) Received: from 190.20.109.16 by 212.58.3.43; Mon, 21 Sep 2009 16:07:40 -0400 Message-ID: <000d01ca3af7$2c420de0$6400a8c0@tearoomssf02> From: Alphonso Gilmore To: Subject: No more painful weightloss methods Date: Mon, 21 Sep 2009 16:07:40 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3AF7.2C420DE0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2905 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2905 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3AF7.2C420DE0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Whenever you are feeling down because of your appearance, click and see for= free.   Tell me what you think about this, I have been using is for 4 weeks and its= amazing =A0 Just one move to click ------=_NextPart_000_0007_01CA3AF7.2C420DE0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Whenever you are feeling down because of your appear= ance, click and see for free.
 
Tell me what you think about this, I have be= en using is for 4 weeks and its amazing
=A0
Just one move to click ------=_NextPart_000_0007_01CA3AF7.2C420DE0-- From puppingsa8@mthorogood.fsnet.co.uk Mon Sep 21 17:49:10 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D6453A696C; Mon, 21 Sep 2009 17:49:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.789 X-Spam-Level: X-Spam-Status: No, score=-2.789 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_FAKE_RCVD_LINE=10.357, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, GB_I_LETTER=-2, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_DE=0.35, HS_INDEX_PARAM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_DOUBLE_IP_SPAM=3.798, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_RECV_IP_FROMIP1=1.666, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_SBL=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p4PJzNpqpkry; Mon, 21 Sep 2009 17:49:09 -0700 (PDT) Received: from 77-23-37-88-dynip.superkabel.de (77-23-37-88-dynip.superkabel.de [77.23.37.88]) by core3.amsl.com (Postfix) with ESMTP id F12463A67F9; Mon, 21 Sep 2009 17:49:08 -0700 (PDT) Received: from 77.23.37.88 by 193.252.22.153; Tue, 22 Sep 2009 02:49:13 +0100 Message-ID: <000d01ca3b1e$80dec060$6400a8c0@puppingsa8> From: Winston Grover To: Subject: Hey, I know this is a miracle cure, I have seen it on tv Date: Tue, 22 Sep 2009 02:49:13 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3B1E.80DEC060" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1158 X-MimeOLE: Produced By Microsoft MimeOLE 6.00.2800.1158 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3B1E.80DEC060 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable =20 =20 Email=20 not displaying correctly? View it in=20 your browser. =20 =20 =20 =20 =20 =20 =20 =20 =20   =20 =20 =20 =20 =20 =20 =20 August 2009 =20 Most Popular Last Month =20 More Info =20 Wana look better? =20 More Info =20 =20 =20 Patient=20 Stories =20 =20 Simple solutions for simple problems, free trial fo= r Acai Miracle berry as seen on TVSo many new things to give a test, but th= is one was free!=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=20 =20 =A0 =A0 Click Here =A0 =A0 =A0 =A0 Read=20 full=20 story.=A0 =20 Newsletter=20 Archive=A0| Subscribe=A0|=20 Contact=20 us =20 Manage=20 My Subscription (including unsubscribe).2009=20 Ejnnw Company. All rights reserved. Terms=20 of=20 Use. ------=_NextPart_000_0007_01CA3B1E.80DEC060 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Email=20 not displaying correctly? View it in=20 your browser.
 
Newslet= ter=20 Archive=A0| Subscri= be=A0|=20 Contact= =20 usManage=20 My Subscription (including unsubscribe).
2009=20 Ejnnw Company. All rights reserved. Terms=20 of=20 Use.
August 2009Most Popular Last Month=
M= ore Info

W= ana look better?

M= ore Info


Pati= ent=20 Stories

Simple solutions for simple problems, free trial for Acai Miracle ber= ry as seen on TV

So many new things to give a test, but this one was free!=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=20
=A0
=A0
C= lick Here
=A0
=A0
=A0
=A0
R= ead=20 full=20 story.
=A0
------=_NextPart_000_0007_01CA3B1E.80DEC060-- From k_boucher@agora.bungi.com Tue Sep 22 07:10:26 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 81A803A6A25 for ; Tue, 22 Sep 2009 07:10:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -23.338 X-Spam-Level: X-Spam-Status: No, score=-23.338 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR=2.426, HTML_IMAGE_ONLY_04=2.041, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.001, IP_NOT_FRIENDLY=0.334, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_HTML_IMG_ONLY=1.666, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iYzL5vu+7ecc for ; Tue, 22 Sep 2009 07:10:19 -0700 (PDT) Received: from c-69-249-193-206.hsd1.nj.comcast.net (c-69-249-193-206.hsd1.nj.comcast.net [69.249.193.206]) by core3.amsl.com (Postfix) with SMTP id 216433A697F for ; Tue, 22 Sep 2009 07:10:17 -0700 (PDT) To: Subject: Where are you, man? From: MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20090922141018.216433A697F@core3.amsl.com> Date: Tue, 22 Sep 2009 07:10:17 -0700 (PDT) Improving your lover's characteristics and as a result, your self-respect! Show picture and go to site now! From owner-namedroppers@ops.ietf.org Tue Sep 22 07:34:50 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5EE233A68A7; Tue, 22 Sep 2009 07:34:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.527 X-Spam-Level: X-Spam-Status: No, score=-2.527 tagged_above=-999 required=5 tests=[AWL=-2.632, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_33=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZM0ZX1cyGCCj; Tue, 22 Sep 2009 07:34:49 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9375D28C139; Tue, 22 Sep 2009 07:34:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mq6L0-000Mj2-1D for namedroppers-data0@psg.com; Tue, 22 Sep 2009 14:27:26 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mq6Kp-000MhZ-Hw for namedroppers@ops.ietf.org; Tue, 22 Sep 2009 14:27:23 +0000 Received: from stora.ogud.com (localhost [127.0.0.1]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n8MERDnH032092 for ; Tue, 22 Sep 2009 10:27:13 -0400 (EDT) (envelope-from namedroppers@stora.ogud.com) Received: (from namedroppers@localhost) by stora.ogud.com (8.14.3/8.14.3/Submit) id n8MERD6Z032091 for namedroppers@ops.ietf.org; Tue, 22 Sep 2009 10:27:13 -0400 (EDT) (envelope-from namedroppers) Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MnyQg-000PIn-7L for namedroppers@ops.ietf.org; Wed, 16 Sep 2009 17:36:37 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n8GHaP11004331; Wed, 16 Sep 2009 10:36:26 -0700 (PDT) Subject: Re: [dnsext] Editor needed Mime-Version: 1.0 (Apple Message framework v1076) Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes From: Nicholas Weaver In-Reply-To: Date: Wed, 16 Sep 2009 10:36:25 -0700 Cc: Nicholas Weaver , namedroppers@ops.ietf.org Content-Transfer-Encoding: 7bit Message-Id: <734C2256-F563-4B12-B51A-D951946634A6@icsi.berkeley.edu> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> To: Matthew Dempsky X-Mailer: Apple Mail (2.1076) X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Add me in the "TCP MUST" category. The fear of TCP is, IMO, unjustified. The problems have generally been solved for all other sever communities, and even if they do seem to be a problem, I see methods where a quasi-deterministic authority (deterministically based on seed and 4-tuple, but looks random to everyone else) with a user-level TCP stack doesn't need to save the unacknowledged response, only the unacknowledged query, and can, if the response will fit in a packet, have a single unacknowledged query with NO state (by only ACK'ing the query in the response packet). On Sep 16, 2009, at 9:37 AM, Matthew Dempsky wrote: > On Wed, Sep 16, 2009 at 7:44 AM, Paul Hoffman > wrote: >> There is disagreement about whether or not TCP is a MUST here, but >> it feels like most people who have commented think that it is. We >> should change the standard to match what the WG feels. > > Looking through this email thread, here's my count of people who have > weighed in on their stance on whether TCP support should be > unilaterally mandatory: > > For: Bill Manning, Mark Andrews, Andrew Sullivan(?), Paul Hoffman(?) > > Against: Dean Anderson(?), George Barwood, Paul Vixie, Ray Bellis, > David Ulevitch, myself. > > Unclear: Alex Bligh, Florian Weimer > From owner-namedroppers@ops.ietf.org Tue Sep 22 07:53:36 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E54823A69F6; Tue, 22 Sep 2009 07:53:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.105 X-Spam-Level: X-Spam-Status: No, score=-4.105 tagged_above=-999 required=5 tests=[AWL=-0.807, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4OVLEvD4irfj; Tue, 22 Sep 2009 07:53:35 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BD3813A691C; Tue, 22 Sep 2009 07:53:35 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mq6hX-000P4h-8i for namedroppers-data0@psg.com; Tue, 22 Sep 2009 14:50:43 +0000 Received: from [213.248.199.23] (helo=mx3.nominet.org.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mq6hN-000P3l-DE for namedroppers@ops.ietf.org; Tue, 22 Sep 2009 14:50:40 +0000 DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:In-Reply-To:References:To:Cc: Subject:MIME-Version:X-Mailer:Message-ID:From:Date: X-MIMETrack:Content-Type; b=IXKSEninCiIE48Bj9o6lQ54CBOJ4v9M2Iy36GekxVeHBwU18dlXimtbN nqq56G5rdvdMQqvHVcS/fMDcln9VqMr26l0KW12v+igumQiuT+GUaphqZ Ieq7Acx3wC0BKsA; DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=Ray.Bellis@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1253631033; x=1285167033; h=from:sender:reply-to:subject:date:message-id:to:cc: mime-version:content-transfer-encoding:content-id: content-description:resent-date:resent-from:resent-sender: resent-to:resent-cc:resent-message-id:in-reply-to: references:list-id:list-help:list-unsubscribe: list-subscribe:list-post:list-owner:list-archive; z=From:=20Ray.Bellis@nominet.org.uk|Subject:=20Re:=20[dnse xt]=20Editor=20needed|Date:=20Tue,=2022=20Sep=202009=2015 :50:10=20+0100|Message-ID:=20|To:=20Nich olas=20Weaver=20|Cc:=20Matthew =20Dempsky=20,=0D=0A=09namedroppers@ ops.ietf.org|MIME-Version:=201.0|In-Reply-To:=20<734C2256 -F563-4B12-B51A-D951946634A6@icsi.berkeley.edu> |References:=20<20090825224731.GJ4142@shinkuro.com>=20<20 090827142630.GA14431@vacation.karoshi.com.>=20<49FE02E45D 12846B1BE861E2@nimrod.home>=20<20090828112706.GA6056@vaca tion.karoshi.com.>=20=20=20<4AA9E8 6C.10302@everydns.net>=20=20=20<734C2256-F563-4B12-B51A-D951946634A6@icsi. berkeley.edu>; bh=/eLWnAHp0bcAIlnczWb+Cs9yTxtoksKkp5jJHPCO2x0=; b=cw7FvWeVmyegn8ev1E/T8CnUtKZEfUzJSNw+i8rMg6d6AP9JblaIkIBY aDUwZWWd1xkRdcM/gR2GG2bh6LmIlywyLd9ezFG9hG0sToqKfseqVKmuV RBfc96EqyIAL0w3; X-IronPort-AV: E=Sophos;i="4.44,431,1249254000"; d="scan'208";a="17880032" Received: from notes1.nominet.org.uk ([213.248.197.128]) by mx3.nominet.org.uk with ESMTP; 22 Sep 2009 15:50:22 +0100 In-Reply-To: <734C2256-F563-4B12-B51A-D951946634A6@icsi.berkeley.edu> References: <20090825224731.GJ4142@shinkuro.com> <20090827142630.GA14431@vacation.karoshi.com.> <49FE02E45D12846B1BE861E2@nimrod.home> <20090828112706.GA6056@vacation.karoshi.com.> <4AA9E86C.10302@everydns.net> <734C2256-F563-4B12-B51A-D951946634A6@icsi.berkeley.edu> To: Nicholas Weaver Cc: Matthew Dempsky , namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed MIME-Version: 1.0 X-Mailer: Lotus Notes Release 8.5 December 05, 2008 Message-ID: From: Ray.Bellis@nominet.org.uk Date: Tue, 22 Sep 2009 15:50:10 +0100 X-MIMETrack: Serialize by Router on notes1/Nominet(Release 7.0.1FP1 | May 25, 2006) at 22/09/2009 03:50:26 PM, Serialize complete at 22/09/2009 03:50:26 PM Content-Type: multipart/alternative; boundary="=_alternative 00517F5C80257639_=" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is a multipart message in MIME format. --=_alternative 00517F5C80257639_= Content-Type: text/plain; charset="US-ASCII" Now might be a good time for Matthew to summarise the responses again... Ray --=_alternative 00517F5C80257639_= Content-Type: text/html; charset="US-ASCII" Now might be a good time for Matthew to summarise the responses again...

Ray
--=_alternative 00517F5C80257639_=-- From owner-namedroppers@ops.ietf.org Tue Sep 22 10:55:09 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E98143A68C3; Tue, 22 Sep 2009 10:55:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.1 X-Spam-Level: X-Spam-Status: No, score=-1.1 tagged_above=-999 required=5 tests=[AWL=-1.500, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nF5tp7SFuwjg; Tue, 22 Sep 2009 10:55:09 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D97643A6972; Tue, 22 Sep 2009 10:55:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mq9Uy-000JDM-7T for namedroppers-data0@psg.com; Tue, 22 Sep 2009 17:49:56 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mq9Up-000JBc-46 for namedroppers@ops.ietf.org; Tue, 22 Sep 2009 17:49:54 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id B71CE2FE8CE3 for ; Tue, 22 Sep 2009 17:49:45 +0000 (UTC) Date: Tue, 22 Sep 2009 13:49:42 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: [dnsext] draft-ietf-dnsext-dnssec-alg-allocation-00 Message-ID: <20090922174941.GH4450@shinkuro.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues, In Stockholm your Chairs asked for a volunteer to provide a draft specifying a change to the identifier allocation policy for DNSSEC algorithm numbers. Paul Hoffman volunteered, and accordingly posted a draft. There has been considerable discussion about the merits of the draft, but the standard threshold for WG review has been met: at least five WG participants have said they support adoption and that they will continue to perform review. Therefore, we believe the draft is appropriately adopted as a WG item. That said, we are aware that there are some participants who have strong opposition to any alteration of the rules for assigning DNSSEC algorithm identifiers. Those participants should make their arguments against such changes as part of the WG review process. Best regards, Andrew and Olafur. -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Tue Sep 22 11:50:21 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 788A03A6A56; Tue, 22 Sep 2009 11:50:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.294 X-Spam-Level: X-Spam-Status: No, score=-102.294 tagged_above=-999 required=5 tests=[AWL=0.306, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Io8y9TCxcFPa; Tue, 22 Sep 2009 11:50:19 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F1ECB3A6ACC; Tue, 22 Sep 2009 11:50:18 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqANa-0001Zw-QD for namedroppers-data0@psg.com; Tue, 22 Sep 2009 18:46:22 +0000 Received: from [2001:1890:1112:1::20] (helo=mail.ietf.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqANP-0001Wh-5a for namedroppers@ops.ietf.org; Tue, 22 Sep 2009 18:46:20 +0000 Received: by core3.amsl.com (Postfix, from userid 0) id E827F3A6AC9; Tue, 22 Sep 2009 11:45:03 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Cc: namedroppers@ops.ietf.org Subject: [dnsext] I-D Action:draft-ietf-dnsext-dnssec-alg-allocation-00.txt Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20090922184504.E827F3A6AC9@core3.amsl.com> Date: Tue, 22 Sep 2009 11:45:03 -0700 (PDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Extensions Working Group of the IETF. Title : Cryptographic Algorithm Identifier Allocation for DNSSEC Author(s) : P. Hoffman Filename : draft-ietf-dnsext-dnssec-alg-allocation-00.txt Pages : 5 Date : 2009-09-22 This document specifies how DNSSEC cryptographic algorithm identifiers in the IANA registries are allocated. It changes the rule from "standard required" to "RFC required". It does not change the list of algorithms that are recommended or required for DNSSEC implementations. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-alg-allocation-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-dnsext-dnssec-alg-allocation-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2009-09-22113627.I-D@ietf.org> --NextPart-- From macedo117@93-44-109-99.ip96.fastwebnet.it Tue Sep 22 14:31:11 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 30CC43A6767 for ; Tue, 22 Sep 2009 14:31:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -68.89 X-Spam-Level: X-Spam-Status: No, score=-68.89 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, FM_SCHOOLING=5.657, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XfJVaK9ZAUBq for ; Tue, 22 Sep 2009 14:31:10 -0700 (PDT) Received: from 93-44-109-99.ip96.fastwebnet.it (93-44-109-99.ip96.fastwebnet.it [93.44.109.99]) by core3.amsl.com (Postfix) with ESMTP id 8054E3A672F for ; Tue, 22 Sep 2009 14:31:09 -0700 (PDT) Received: from 93.44.109.99 by mx.rochehome.com; Tue, 22 Sep 2009 22:32:14 +0100 Date: Tue, 22 Sep 2009 22:32:14 +0100 From: "Lucas Burpo" X-Mailer: The Bat! (v2.00.18) Business Reply-To: macedo117@93-44-109-99.ip96.fastwebnet.it X-Priority: 3 (Normal) Message-ID: <649496336.13248236245114@93-44-109-99.ip96.fastwebnet.it> To: dnsext-archive@ietf.org Subject: More paid, less work MIME-Version: 1.0 Content-Type: text/plain; charset=Windows-1252 Content-Transfer-Encoding: 7bit We are here serving you with these programs.:- Bachelors, Masters and PhD Give us a call now. 1-213.403.0133 Drop us your msg, with your full name and contact number so we can call you back. From owner-namedroppers@ops.ietf.org Tue Sep 22 15:10:19 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4B2F33A6870; Tue, 22 Sep 2009 15:10:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.196 X-Spam-Level: X-Spam-Status: No, score=0.196 tagged_above=-999 required=5 tests=[AWL=0.069, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8H9ST4SKnBdj; Tue, 22 Sep 2009 15:10:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 735423A683D; Tue, 22 Sep 2009 15:10:15 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqDTk-000Jzw-HU for namedroppers-data0@psg.com; Tue, 22 Sep 2009 22:04:56 +0000 Received: from [209.85.222.190] (helo=mail-pz0-f190.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqDTa-000Jys-Rb for namedroppers@ops.ietf.org; Tue, 22 Sep 2009 22:04:54 +0000 Received: by pzk28 with SMTP id 28so130909pzk.5 for ; Tue, 22 Sep 2009 15:04:46 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.67.30 with SMTP id u30mr2495487wak.119.1253657085935; Tue, 22 Sep 2009 15:04:45 -0700 (PDT) In-Reply-To: <20090825224731.GJ4142@shinkuro.com> References: <20090825224731.GJ4142@shinkuro.com> Date: Tue, 22 Sep 2009 15:04:44 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: Andrew Sullivan Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Aug 25, 2009 at 3:47 PM, Andrew Sullivan wrote: > One of the milestones on the Charter that we've been waiting to send > to our AD is a document that clarifies that TCP transport is mandatory > for DNS. I think section 6.1.3.2 of RFC 1123 is quite clear that UDP support is required whereas TCP support is only recommended. As such, I think it's inappropriate to publish a document to "clarify" that TCP support is required, when it is unambiguously not. I'm not strongly opposed to requiring support for TCP (or whatever else) in new DNS protocol extensions, but those extensions need to be designed to be interoperable with implementations conforming to existing standards. From owner-namedroppers@ops.ietf.org Tue Sep 22 17:10:26 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 575443A682D; Tue, 22 Sep 2009 17:10:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.444 X-Spam-Level: X-Spam-Status: No, score=-2.444 tagged_above=-999 required=5 tests=[AWL=0.155, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FHfxIoNvNeVk; Tue, 22 Sep 2009 17:10:25 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B10373A67AC; Tue, 22 Sep 2009 17:10:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqFM3-0003mu-3D for namedroppers-data0@psg.com; Wed, 23 Sep 2009 00:05:07 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqFLj-0003kf-D8 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 00:04:55 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 66462E6059; Wed, 23 Sep 2009 00:04:46 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8N04dr1018766; Wed, 23 Sep 2009 10:04:40 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909230004.n8N04dr1018766@drugs.dv.isc.org> To: Matthew Dempsky Cc: Andrew Sullivan , namedroppers@ops.ietf.org From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> Subject: Re: [dnsext] Editor needed In-reply-to: Your message of "Tue, 22 Sep 2009 15:04:44 MST." Date: Wed, 23 Sep 2009 10:04:39 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Matthew Dempsky writes: > On Tue, Aug 25, 2009 at 3:47 PM, Andrew Sullivan wrote: > > One of the milestones on the Charter that we've been waiting to send > > to our AD is a document that clarifies that TCP transport is mandatory > > for DNS. > > I think section 6.1.3.2 of RFC 1123 is quite clear that UDP support is > required whereas TCP support is only recommended. As such, I think > it's inappropriate to publish a document to "clarify" that TCP support > is required, when it is unambiguously not. > > I'm not strongly opposed to requiring support for TCP (or whatever > else) in new DNS protocol extensions, but those extensions need to be > designed to be interoperable with implementations conforming to > existing standards. Did you bother to read past the first paragraph of section 6.1.3.2 of RFC 1123? Do you understand that if you fail to follow a SHOULD then you are in the wrong if it causes operational problems not those following or depending on the SHOULD? You do understand that the DNS is designed to fallback to TCP and that this is NORMAL. I can think of examples, in closed highly controlled envirionments, where not following the SHOULD would be appropriate for a vendor. The Internet however is not such a environment. I can't see a way a vendor of products designed to be used on the Internet could in good concience ship a product that fails to follow the SHOULD in question. That a vendor sell/shipping products intended to be used on the Internet could in good concience say "none of our customers will ever need to send or receive answers bigger than 512 bytes". A vendor doesn't have access to that knowledge. Operators might but vendors don't. Clearly there are vendors which don't care about their customer because they are shipping such products which they have been clearly advised not to ship. I actually think RFC 1123 got it wrong because there were already records that could be larger than 512 bytes (TXT) so the entire rational which allowed the SHOULD rather than MUST was invalid. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 22 17:12:43 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1571E3A6868; Tue, 22 Sep 2009 17:12:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.194 X-Spam-Level: X-Spam-Status: No, score=0.194 tagged_above=-999 required=5 tests=[AWL=0.067, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KVq1vnKwZE1U; Tue, 22 Sep 2009 17:12:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 214043A682D; Tue, 22 Sep 2009 17:12:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqFQn-0004CR-Th for namedroppers-data0@psg.com; Wed, 23 Sep 2009 00:10:01 +0000 Received: from [209.85.216.176] (helo=mail-px0-f176.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqFQe-0004BO-HZ for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 00:09:59 +0000 Received: by pxi6 with SMTP id 6so143745pxi.32 for ; Tue, 22 Sep 2009 17:09:52 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.237.24 with SMTP id k24mr2734426wah.5.1253664592041; Tue, 22 Sep 2009 17:09:52 -0700 (PDT) In-Reply-To: <200909230004.n8N04dr1018766@drugs.dv.isc.org> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> Date: Tue, 22 Sep 2009 17:09:51 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: Mark Andrews Cc: Andrew Sullivan , namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 5:04 PM, Mark Andrews wrote: > Do you understand that if you fail to follow a SHOULD then you are > in the wrong if it causes operational problems not those following > or depending on the SHOULD? And what would those operational problems be? If I don't allow AXFR transfers and don't send truncated responses to queries, what in RFC 1123 permits a client to send a TCP query to my server? > You do understand that the DNS is designed to fallback to TCP and > that this is NORMAL. It's designed to fallback to TCP after a UDP query results in a truncated response or to support AXFR. > I can't see a way a vendor of products designed to be used on the > Internet could in good concience ship a product that fails to follow > the SHOULD in question. =A0That a vendor sell/shipping products > intended to be used on the Internet could in good concience say > "none of our customers will ever need to send or receive answers > bigger than 512 bytes". =A0A vendor doesn't have access to that > knowledge. =A0Operators might but vendors don't. Protocols don't distinguish between vendors and operators. Protocols document how conforming implementations communicate. If it's okay for an operator to run a server without TCP support, it's okay for an implementor to ship an implementation without TCP support. It's the operator's responsibility to ensure his server software fits his requirements. From owner-namedroppers@ops.ietf.org Tue Sep 22 17:31:48 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 704D23A6935; Tue, 22 Sep 2009 17:31:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.367 X-Spam-Level: X-Spam-Status: No, score=-2.367 tagged_above=-999 required=5 tests=[AWL=-2.206, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, IP_NOT_FRIENDLY=0.334, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jATEszFXjAMf; Tue, 22 Sep 2009 17:31:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 35E1F3A68DD; Tue, 22 Sep 2009 17:31:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqFit-0006ZM-SX for namedroppers-data0@psg.com; Wed, 23 Sep 2009 00:28:43 +0000 Received: from [69.89.20.234] (helo=outbound-mail-19.bluehost.com) by psg.com with smtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqFii-0006Yl-Cs for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 00:28:41 +0000 Received: (qmail 18876 invoked by uid 0); 23 Sep 2009 00:28:32 -0000 Received: from unknown (HELO box514.bluehost.com) (74.220.219.114) by outboundproxy1.bluehost.com with SMTP; 23 Sep 2009 00:28:32 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kingsmountain.com; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type:Content-Transfer-Encoding:X-Identified-User; b=QeJ/2fmyohrBFggWbwyZqxa2nS3DPX60g6yaK7Ry3wzWFYHJrF8mBC/P8ikYOELZfRmGNdF2EsjnDtDCVZxmSDaGC3ZYzT/tGd7QGTPBxZ7T7TOwGoPoEinRLRuREAEK; Received: from c-98-207-22-180.hsd1.ca.comcast.net ([98.207.22.180] helo=[192.168.11.10]) by box514.bluehost.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1MqFih-0002Yl-Nh for namedroppers@ops.ietf.org; Tue, 22 Sep 2009 18:28:31 -0600 Message-ID: <4AB96BA8.8000500@KingsMountain.com> Date: Tue, 22 Sep 2009 17:28:24 -0700 From: =JeffH User-Agent: Thunderbird 1.5.0.14ubu (X11/20080306) MIME-Version: 1.0 To: IETF DNSEXT WG Subject: [dnsext] re: Nominum doing something DNSCurve-y? Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Identified-User: {11025:box514.bluehost.com:kingsmou:kingsmountain.com} {sentby:smtp auth 98.207.22.180 authed with jeff.hodges+kingsmountain.com} Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > A coworker discovered this earlier today: > > $ dig +short -t ns skyebynominum.com > zq708vote6hqo5uvbi2pult2dutvjq0u5evd075o9n214m3e15fltha0.skyedns.com. > zq70nmpntigu1dusbi446et0l8lb4c172rkrqnchm1i635nr058ovkvg.skyedns.com. > zq70rdqlv91r6t7lu5vk527cjhn3ha7qgtqoo24tsrikbt8fdvurjhi0.skyedns.com. > zq70sn1287vcrbj1hgvihec8rgisjok385rrptc45magateh14409gtg.skyedns.com. > > It looks similar to DNSCurve, except with the magic string "zq70" > instead of "uz5" and using RFC 4648's base32hex instead of DNSCurve's > base-32 encoding. When decoded, this yields a 32 byte string, and the > high bit of the last byte of each string is cleared: just like a > Curve25519 public key. (Of course, this could also be coincidental.) > > I tried sending a DNSCurve streamlined query to one of the name > servers, but it was rejected with a FORMERR. > > Does anyone know more about this? Maybe not actually DNSCurve-y at all? Huh, innaresting. Note the "skyedns.com" domain -- the records above might have something to do with the announcement nominum made today (which mentions dnssec and security).. Nominum Rolls Out SKYE DNS Cloud Services SKYE offers a suite of cloud-based services to address infrastructure and new service needs http://www.darkreading.com/securityservices/security/showArticle.jhtml?articleID=220100568 =JeffH disclaimer: I have no relationship with Nominum at all, AFAIK. I simply stumbled across Matthew's msg whilst poking about for info wrt skye. From owner-namedroppers@ops.ietf.org Tue Sep 22 19:53:50 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0C9613A6820; Tue, 22 Sep 2009 19:53:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.446 X-Spam-Level: X-Spam-Status: No, score=-2.446 tagged_above=-999 required=5 tests=[AWL=0.153, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KprZprZsS+9H; Tue, 22 Sep 2009 19:53:49 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C523F3A659B; Tue, 22 Sep 2009 19:53:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqHtn-000L0p-0P for namedroppers-data0@psg.com; Wed, 23 Sep 2009 02:48:07 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqHtc-000Kzr-LT for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 02:48:04 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 7F45CE6026; Wed, 23 Sep 2009 02:47:55 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8N2lq8d021037; Wed, 23 Sep 2009 12:47:53 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909230247.n8N2lq8d021037@drugs.dv.isc.org> To: Matthew Dempsky Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> Subject: Re: [dnsext] Editor needed In-reply-to: Your message of "Tue, 22 Sep 2009 17:09:51 MST." Date: Wed, 23 Sep 2009 12:47:52 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Matthe w Dempsky writes: > On Tue, Sep 22, 2009 at 5:04 PM, Mark Andrews wrote: > > Do you understand that if you fail to follow a SHOULD then you are > > in the wrong if it causes operational problems not those following > > or depending on the SHOULD? > > And what would those operational problems be? > > If I don't allow AXFR transfers and don't send truncated responses to > queries, what in RFC 1123 permits a client to send a TCP query to my > server? > > You do understand that the DNS is designed to fallback to TCP and > > that this is NORMAL. > > It's designed to fallback to TCP after a UDP query results in a > truncated response or to support AXFR. > > I can't see a way a vendor of products designed to be used on the > > Internet could in good concience ship a product that fails to follow > > the SHOULD in question. That a vendor sell/shipping products > > intended to be used on the Internet could in good concience say > > "none of our customers will ever need to send or receive answers > > bigger than 512 bytes". A vendor doesn't have access to that > > knowledge. Operators might but vendors don't. > > Protocols don't distinguish between vendors and operators. Protocols > document how conforming implementations communicate. If it's okay for > an operator to run a server without TCP support, it's okay for an > implementor to ship an implementation without TCP support. > It's the operator's responsibility to ensure his server software fits > his requirements. So you expect Mums and Dads to know that they need to workout whether the recursive servers built into SOHO routers (yes they are recursive servers) support TCP/DNS or not. What a ludicrous position to take. Seat belts were not a MUST when car were first built. In fact they hadn't even been designed. They are now. This is a similar change. Get over it. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 22 20:10:34 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D0E443A68AE; Tue, 22 Sep 2009 20:10:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.798 X-Spam-Level: X-Spam-Status: No, score=-4.798 tagged_above=-999 required=5 tests=[AWL=-0.303, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6oWzG4lKf8HM; Tue, 22 Sep 2009 20:10:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A36643A6820; Tue, 22 Sep 2009 20:10:33 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqICU-000NXA-90 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 03:07:26 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqICK-000NVa-Cp for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 03:07:24 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n8N362rb022708; Wed, 23 Sep 2009 03:06:02 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n8N362D9022707; Wed, 23 Sep 2009 03:06:02 GMT Date: Wed, 23 Sep 2009 03:06:02 +0000 From: bmanning@vacation.karoshi.com To: Matthew Dempsky Cc: Andrew Sullivan , namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed Message-ID: <20090923030602.GB22191@vacation.karoshi.com.> References: <20090825224731.GJ4142@shinkuro.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 03:04:44PM -0700, Matthew Dempsky wrote: > On Tue, Aug 25, 2009 at 3:47 PM, Andrew Sullivan wrote: > > One of the milestones on the Charter that we've been waiting to send > > to our AD is a document that clarifies that TCP transport is mandatory > > for DNS. > > I think section 6.1.3.2 of RFC 1123 is quite clear that UDP support is > required whereas TCP support is only recommended. As such, I think > it's inappropriate to publish a document to "clarify" that TCP support > is required, when it is unambiguously not. > > I'm not strongly opposed to requiring support for TCP (or whatever > else) in new DNS protocol extensions, but those extensions need to be > designed to be interoperable with implementations conforming to > existing standards. hum... did you read the whole thing? first off, the use of the terms MUST, SHOULD, MAY pre-date the current usage. this is what RFC 1123 sez: * "MUST" This word or the adjective "REQUIRED" means that the item is an absolute requirement of the specification. * "SHOULD" This word or the adjective "RECOMMENDED" means that there may exist valid reasons in particular circumstances to ignore this item, but the full implications should be understood and the case carefully weighed before choosing a different course. --- However, it is also clear that some new DNS record types defined in the future will contain information exceeding the 512 byte limit that applies to UDP, and hence will require TCP. Thus, resolvers and name servers should implement TCP services as a backup to UDP today, with the knowledge that they will require the TCP service in the future. By private agreement, name servers and resolvers MAY arrange to use TCP for all traffic between themselves. TCP MUST be used for zone transfers. A DNS server MUST have sufficient internal concurrency that it can continue to process UDP queries while awaiting a response or performing a zone transfer on an open TCP connection [DNS:2]. [page 76] --bill From owner-namedroppers@ops.ietf.org Tue Sep 22 20:14:26 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6275F28C0DC; Tue, 22 Sep 2009 20:14:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.192 X-Spam-Level: X-Spam-Status: No, score=0.192 tagged_above=-999 required=5 tests=[AWL=0.065, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A-yZWXPermNA; Tue, 22 Sep 2009 20:14:25 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 657C53A67F2; Tue, 22 Sep 2009 20:14:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqIFb-000O0M-80 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 03:10:39 +0000 Received: from [209.85.222.190] (helo=mail-pz0-f190.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqIFF-000Nwb-0W for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 03:10:31 +0000 Received: by pzk28 with SMTP id 28so293645pzk.5 for ; Tue, 22 Sep 2009 20:10:14 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.237.24 with SMTP id k24mr3044415wah.5.1253675414795; Tue, 22 Sep 2009 20:10:14 -0700 (PDT) In-Reply-To: <200909230247.n8N2lq8d021037@drugs.dv.isc.org> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> Date: Tue, 22 Sep 2009 20:10:14 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: Mark Andrews Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 7:47 PM, Mark Andrews wrote: > So you expect Mums and Dads to know that they need to workout whether > the recursive servers built into SOHO routers (yes they are recursive > servers) support TCP/DNS or not. =A0What a ludicrous position to take. So you expect Mums and Dads to care what the IETF says their home thingamajig should do? No, they're going to buy whatever the nice kid at the local electronics store suggests they buy. Or they're going to buy whatever has high reviews on Amazon. Those aren't going to change if the IETF suddenly changes its mind to state that TCP support is now a MUST. I'm not saying common implementations shouldn't support TCP. They should. That's why RFC 1123 says SHOULD. I'm saying not all implementations need to. That's why it shouldn't be a MUST. From owner-namedroppers@ops.ietf.org Tue Sep 22 20:18:07 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AEC683A67F2; Tue, 22 Sep 2009 20:18:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.19 X-Spam-Level: X-Spam-Status: No, score=0.19 tagged_above=-999 required=5 tests=[AWL=0.063, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZMm0IIjfZ5fi; Tue, 22 Sep 2009 20:18:07 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D99D13A659B; Tue, 22 Sep 2009 20:18:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqIKO-000OXb-B8 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 03:15:36 +0000 Received: from [209.85.222.190] (helo=mail-pz0-f190.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqIKF-000OWT-0K for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 03:15:34 +0000 Received: by pzk28 with SMTP id 28so296672pzk.5 for ; Tue, 22 Sep 2009 20:15:26 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.99.4 with SMTP id b4mr3042723wam.88.1253675724125; Tue, 22 Sep 2009 20:15:24 -0700 (PDT) In-Reply-To: <20090923030602.GB22191@vacation.karoshi.com.> References: <20090825224731.GJ4142@shinkuro.com> <20090923030602.GB22191@vacation.karoshi.com.> Date: Tue, 22 Sep 2009 20:15:23 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: bmanning@vacation.karoshi.com Cc: Andrew Sullivan , namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 8:06 PM, wrote: > =A0 =A0 =A0 =A0hum... =A0did you read the whole thing? I did. Authoritative name servers that don't offer zone transfers, don't send truncated responses over UDP, and don't engage in private agreements with resolvers aren't required to answer queries over TCP. If you understand 6.1.3.2 differently, please elaborate. From owner-namedroppers@ops.ietf.org Tue Sep 22 21:06:09 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 119953A67F1; Tue, 22 Sep 2009 21:06:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[AWL=0.151, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8V+REUOAr4AU; Tue, 22 Sep 2009 21:06:07 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7B8D23A679F; Tue, 22 Sep 2009 21:06:07 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqJ0J-0003oD-M3 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 03:58:55 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqJ0A-0003ms-0e for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 03:58:53 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id E2AD5E6026; Wed, 23 Sep 2009 03:58:44 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8N3weOK021831; Wed, 23 Sep 2009 13:58:42 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909230358.n8N3weOK021831@drugs.dv.isc.org> To: Matthew Dempsky Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> Subject: Re: [dnsext] Editor needed In-reply-to: Your message of "Tue, 22 Sep 2009 20:10:14 MST." Date: Wed, 23 Sep 2009 13:58:40 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Matthe w Dempsky writes: > On Tue, Sep 22, 2009 at 7:47 PM, Mark Andrews wrote: > > So you expect Mums and Dads to know that they need to workout whether > > the recursive servers built into SOHO routers (yes they are recursive > > servers) support TCP/DNS or not. =A0What a ludicrous position to take. > > So you expect Mums and Dads to care what the IETF says their home > thingamajig should do? > > No, they're going to buy whatever the nice kid at the local > electronics store suggests they buy. Or they're going to buy whatever > has high reviews on Amazon. Those aren't going to change if the IETF > suddenly changes its mind to state that TCP support is now a MUST. > > I'm not saying common implementations shouldn't support TCP. They > should. That's why RFC 1123 says SHOULD. I'm saying not all > implementations need to. That's why it shouldn't be a MUST. Then why arn't all common implementations supporting TCP? Either we have not been clear enough or vendors are playing protcol lawyer and using the SHOULD as a way to weasle out of what they should be doing (no insult to weasles, they are crafty). There is no real harm in making TCP a MUST when you already support TCP. There is real harm in continuing to keep TCP a SHOULD as vendors and operators do play protcol lawyer and ship/configure servers to not support TCP when by any sensible reading of RFC 1123 that should be supporting TCP. We have customers that are scared to add records to RRsets because answers will now go over 512 bytes and they may not be accepted everywhere. This is a direct consequence of DNS/TCP being a SHOULD not a MUST. Making TCP a MUST won't fix this straight away but will in time. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 22 21:28:30 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 31B433A68A8; Tue, 22 Sep 2009 21:28:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.188 X-Spam-Level: X-Spam-Status: No, score=0.188 tagged_above=-999 required=5 tests=[AWL=0.061, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YM4PHQUmwWFl; Tue, 22 Sep 2009 21:28:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 48CDC3A683F; Tue, 22 Sep 2009 21:28:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqJQR-0006Lu-J6 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 04:25:55 +0000 Received: from [209.85.216.176] (helo=mail-px0-f176.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqJQI-0006Kb-4E for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 04:25:53 +0000 Received: by pxi6 with SMTP id 6so285176pxi.32 for ; Tue, 22 Sep 2009 21:25:44 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.86.2 with SMTP id j2mr3124438wab.159.1253679944865; Tue, 22 Sep 2009 21:25:44 -0700 (PDT) In-Reply-To: <200909230358.n8N3weOK021831@drugs.dv.isc.org> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> Date: Tue, 22 Sep 2009 21:25:44 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: Mark Andrews Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 8:58 PM, Mark Andrews wrote: > We have customers that are scared to add records to RRsets because > answers will now go over 512 bytes and they may not be accepted > everywhere. =A0This is a direct consequence of DNS/TCP being a SHOULD > not a MUST. =A0Making TCP a MUST won't fix this straight away but > will in time. If you just want to require that clients that receive truncated responses retry their queries over TCP and that servers that send truncated responses answer queries over TCP, I'm not strongly opposed to that. I'd be concerned that you will still need to worry for some time about the deployed software base that doesn't already support this, but if you're going to take on solving that problem, then have at it. However, I still think authoritative servers that don't support zone transfers, don't send truncated responses, and don't engage in private agreements with resolvers should not be required to respond to queries over TCP. From owner-namedroppers@ops.ietf.org Tue Sep 22 22:09:30 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 551A23A68F1; Tue, 22 Sep 2009 22:09:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.437 X-Spam-Level: X-Spam-Status: No, score=-4.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E8fo5dINd+Ij; Tue, 22 Sep 2009 22:09:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9FDB83A681A; Tue, 22 Sep 2009 22:09:23 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqK0N-000A10-6K for namedroppers-data0@psg.com; Wed, 23 Sep 2009 05:03:03 +0000 Received: from [204.152.189.190] (helo=virtualized.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqK0C-0009z1-RV for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 05:03:00 +0000 Received: from localhost (localhost [127.0.0.1]) by virtualized.org (Postfix) with ESMTP id 604277F91BE; Tue, 22 Sep 2009 22:02:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at virtualized.org Received: from virtualized.org ([127.0.0.1]) by localhost (trantor.virtualized.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Tut7vOGTnMh; Tue, 22 Sep 2009 22:02:51 -0700 (PDT) Received: from [10.0.1.2] (cpe-76-168-7-68.socal.res.rr.com [76.168.7.68]) by virtualized.org (Postfix) with ESMTP id 3F1D77F91B3; Tue, 22 Sep 2009 22:02:51 -0700 (PDT) Subject: Re: [dnsext] Editor needed Mime-Version: 1.0 (Apple Message framework v1076) Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes From: David Conrad In-Reply-To: Date: Tue, 22 Sep 2009 22:02:38 -0700 Cc: IETF DNSEXT WG Content-Transfer-Encoding: 7bit Message-Id: <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> To: Matthew Dempsky X-Mailer: Apple Mail (2.1076) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Matthew, On Sep 22, 2009, at 9:25 PM, Matthew Dempsky wrote: > However, I still think authoritative servers that don't support zone > transfers, don't send truncated responses, and don't engage in private > agreements with resolvers should not be required to respond to queries > over TCP. How do you guarantee a server isn't going to send a truncated response without breaking the protocol or placing a non-standard limitation on the amount of data that can be in an RRset (and refuse to correctly implement ANY queries)? Regards, -drc From owner-namedroppers@ops.ietf.org Tue Sep 22 22:28:48 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3EA773A68F1; Tue, 22 Sep 2009 22:28:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.575 X-Spam-Level: X-Spam-Status: No, score=-2.575 tagged_above=-999 required=5 tests=[AWL=0.024, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N3CF5tP3erZs; Tue, 22 Sep 2009 22:28:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 65E493A6899; Tue, 22 Sep 2009 22:28:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqKNv-000D6S-SN for namedroppers-data0@psg.com; Wed, 23 Sep 2009 05:27:23 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqKNi-000D3t-Lf for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 05:27:17 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 3F6FDB7594 for ; Wed, 23 Sep 2009 05:27:10 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed In-Reply-To: Your message of "Tue, 22 Sep 2009 21:25:44 MST." References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Wed, 23 Sep 2009 05:27:10 +0000 Message-ID: <64548.1253683630@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Tue, 22 Sep 2009 21:25:44 -0700 > From: Matthew Dempsky > ... > However, I still think authoritative servers that don't support zone > transfers, don't send truncated responses, and don't engage in private > agreements with resolvers should not be required to respond to queries > over TCP. since clients are required to tru UDP first, i have trouble understanding how a conforming client would ever detect or notice that a server doesn't support TCP unless that server first truncated a UDP response. From owner-namedroppers@ops.ietf.org Tue Sep 22 22:41:01 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA0E33A6851; Tue, 22 Sep 2009 22:40:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.186 X-Spam-Level: X-Spam-Status: No, score=0.186 tagged_above=-999 required=5 tests=[AWL=0.059, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rHvl8-51KoFD; Tue, 22 Sep 2009 22:40:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 250A23A68F9; Tue, 22 Sep 2009 22:40:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqKZ1-000Edp-Nm for namedroppers-data0@psg.com; Wed, 23 Sep 2009 05:38:51 +0000 Received: from [209.85.222.190] (helo=mail-pz0-f190.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqKYr-000Ecb-Ju for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 05:38:48 +0000 Received: by pzk28 with SMTP id 28so380891pzk.5 for ; Tue, 22 Sep 2009 22:38:40 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.151.8 with SMTP id d8mr3194752wao.180.1253684320075; Tue, 22 Sep 2009 22:38:40 -0700 (PDT) In-Reply-To: <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> Date: Tue, 22 Sep 2009 22:38:39 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 10:02 PM, David Conrad wrote: > How do you guarantee a server isn't going to send a truncated response > without breaking the protocol or placing a non-standard limitation on the > amount of data that can be in an RRset (and refuse to correctly implement > ANY queries)? Easy: I don't configure my name server with records that require sending >512B responses. For people that don't know how to ensure this, they need to play it safe and support queries over TCP. But that doesn't mean everyone needs to. From owner-namedroppers@ops.ietf.org Tue Sep 22 22:48:58 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8CFBD3A695D; Tue, 22 Sep 2009 22:48:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.185 X-Spam-Level: X-Spam-Status: No, score=0.185 tagged_above=-999 required=5 tests=[AWL=0.058, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ac5ujfeGKDEN; Tue, 22 Sep 2009 22:48:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AEEB93A691E; Tue, 22 Sep 2009 22:48:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqKh1-000Fbn-Ke for namedroppers-data0@psg.com; Wed, 23 Sep 2009 05:47:07 +0000 Received: from [209.85.222.190] (helo=mail-pz0-f190.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqKgs-000Faw-94 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 05:47:05 +0000 Received: by pzk28 with SMTP id 28so385864pzk.5 for ; Tue, 22 Sep 2009 22:46:57 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.29.4 with SMTP id g4mr3200392waj.175.1253684817851; Tue, 22 Sep 2009 22:46:57 -0700 (PDT) In-Reply-To: <64548.1253683630@nsa.vix.com> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <64548.1253683630@nsa.vix.com> Date: Tue, 22 Sep 2009 22:46:57 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: Paul Vixie Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 10:27 PM, Paul Vixie wrote: > since clients are required to tru UDP first, i have trouble understanding > how a conforming client would ever detect or notice that a server doesn't > support TCP unless that server first truncated a UDP response. Agreed. So why require servers that don't send truncated UDP responses to respond to queries over TCP? From owner-namedroppers@ops.ietf.org Tue Sep 22 23:23:33 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DE79B3A682F; Tue, 22 Sep 2009 23:23:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.45 X-Spam-Level: X-Spam-Status: No, score=-2.45 tagged_above=-999 required=5 tests=[AWL=0.149, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yYY1wLiqLc5X; Tue, 22 Sep 2009 23:23:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 04B4C3A67DF; Tue, 22 Sep 2009 23:23:33 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLCP-000IzG-98 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 06:19:33 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLC7-000IxJ-Rh for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 06:19:30 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 0415FE601E; Wed, 23 Sep 2009 06:19:14 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8N6JBAx024293; Wed, 23 Sep 2009 16:19:12 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909230619.n8N6JBAx024293@drugs.dv.isc.org> To: Matthew Dempsky Cc: IETF DNSEXT WG From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> Subject: Re: [dnsext] Editor needed In-reply-to: Your message of "Tue, 22 Sep 2009 22:38:39 MST." Date: Wed, 23 Sep 2009 16:19:11 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Matthew Dempsky writes: > On Tue, Sep 22, 2009 at 10:02 PM, David Conrad wrote: > > How do you guarantee a server isn't going to send a truncated response > > without breaking the protocol or placing a non-standard limitation on the > > amount of data that can be in an RRset (and refuse to correctly implement > > ANY queries)? > > Easy: I don't configure my name server with records that require > sending >512B responses. Then why do you care if TCP is a MUST or not? Your not going to get queries over TCP by compliant resolvers. However by demanding that TCP remain a SHOULD you leave everyone open to the problems caused by implementations that don't support it and operators that incorrectly turn it off. > For people that don't know how to ensure this, they need to play it > safe and support queries over TCP. But that doesn't mean everyone > needs to. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 22 23:28:05 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1BCE43A6AD7; Tue, 22 Sep 2009 23:28:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.183 X-Spam-Level: X-Spam-Status: No, score=0.183 tagged_above=-999 required=5 tests=[AWL=0.056, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u+w6xr-xWUBB; Tue, 22 Sep 2009 23:28:04 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 505DC3A682F; Tue, 22 Sep 2009 23:28:04 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLIp-000JX7-P1 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 06:26:11 +0000 Received: from [209.85.222.190] (helo=mail-pz0-f190.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLIe-000JWI-Cp for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 06:26:09 +0000 Received: by pzk28 with SMTP id 28so409318pzk.5 for ; Tue, 22 Sep 2009 23:26:00 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.29.4 with SMTP id g4mr3249114waj.175.1253687159749; Tue, 22 Sep 2009 23:25:59 -0700 (PDT) In-Reply-To: <200909230619.n8N6JBAx024293@drugs.dv.isc.org> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> Date: Tue, 22 Sep 2009 23:25:59 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: Mark Andrews Cc: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 11:19 PM, Mark Andrews wrote: > Then why do you care if TCP is a MUST or not? =A0Your not going to > get queries over TCP by compliant resolvers. =A0However by demanding > that TCP remain a SHOULD you leave everyone open to the problems > caused by implementations that don't support it and operators that > incorrectly turn it off. Because then when you later want to propose to further amend the protocol to allow clients to initiate with TCP queries, and I oppose it because my server doesn't respond to queries over TCP, you'll argue that it's non-compliant anyway. Also, I'm only saying TCP support for authoritative servers that don't support zone transfers, don't send truncated UDP responses, and don't establish private agreements with resolvers shouldn't be required. I won't make the same fuss if you limit the requirement for TCP support to servers that send truncated UDP responses. From owner-namedroppers@ops.ietf.org Tue Sep 22 23:30:23 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF0543A67E6; Tue, 22 Sep 2009 23:30:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.452 X-Spam-Level: X-Spam-Status: No, score=-2.452 tagged_above=-999 required=5 tests=[AWL=0.147, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oi4KJo-G2OwG; Tue, 22 Sep 2009 23:30:23 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CEE9C3A67E4; Tue, 22 Sep 2009 23:30:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLLO-000Jn7-W9 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 06:28:51 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLLF-000JmC-Es for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 06:28:48 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id BEBABE601E; Wed, 23 Sep 2009 06:28:40 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8N6ScYC024383; Wed, 23 Sep 2009 16:28:38 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909230628.n8N6ScYC024383@drugs.dv.isc.org> To: Matthew Dempsky Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <64548.1253683630@nsa.vix.com> Subject: Re: [dnsext] Editor needed In-reply-to: Your message of "Tue, 22 Sep 2009 22:46:57 MST." Date: Wed, 23 Sep 2009 16:28:38 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Matthew Dempsky writes: > On Tue, Sep 22, 2009 at 10:27 PM, Paul Vixie wrote: > > since clients are required to tru UDP first, i have trouble understanding > > how a conforming client would ever detect or notice that a server doesn't > > support TCP unless that server first truncated a UDP response. > > Agreed. So why require servers that don't send truncated UDP > responses to respond to queries over TCP? Because people can't rely on TCP being supported when it is needed as it is now subject to the whim of vendors and implementors that have demonstrated that they can't be trusted to make rational decision. Making TCP a MUST won't hurt those that have all their answer set fitting in 512 bytes. Havine TCP as a SHOULD has clearly hurt those that needed TCP to be supported. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 22 23:36:25 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2C5D33A67E6; Tue, 22 Sep 2009 23:36:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.182 X-Spam-Level: X-Spam-Status: No, score=0.182 tagged_above=-999 required=5 tests=[AWL=0.055, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QCR9noAVz1XC; Tue, 22 Sep 2009 23:36:24 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5F3483A67E4; Tue, 22 Sep 2009 23:36:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLQn-000KJf-9A for namedroppers-data0@psg.com; Wed, 23 Sep 2009 06:34:25 +0000 Received: from [209.85.216.176] (helo=mail-px0-f176.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLQd-000KHV-Kf for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 06:34:23 +0000 Received: by pxi6 with SMTP id 6so358719pxi.32 for ; Tue, 22 Sep 2009 23:34:15 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.99.4 with SMTP id b4mr3294674wam.88.1253687655320; Tue, 22 Sep 2009 23:34:15 -0700 (PDT) In-Reply-To: <200909230628.n8N6ScYC024383@drugs.dv.isc.org> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <64548.1253683630@nsa.vix.com> <200909230628.n8N6ScYC024383@drugs.dv.isc.org> Date: Tue, 22 Sep 2009 23:34:15 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: Mark Andrews Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 11:28 PM, Mark Andrews wrote: > Because people can't rely on TCP being supported when it is needed > as it is now subject to the whim of vendors and implementors that > have demonstrated that they can't be trusted to make rational > decision. > > Making TCP a MUST won't hurt those that have all their answer set > fitting in 512 bytes. =A0Havine TCP as a SHOULD has clearly hurt those > that needed TCP to be supported. So you can say "RFC XXXX requires TCP support, and you're not offering it, therefore you're non-compliant" or you can say "your name server is sending truncated responses, and RFC XXXX therefore requires TCP support, and you're not offering it, therefore you're non-compliant". What difference does it make? From owner-namedroppers@ops.ietf.org Tue Sep 22 23:52:32 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51FAF3A682F; Tue, 22 Sep 2009 23:52:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.454 X-Spam-Level: X-Spam-Status: No, score=-2.454 tagged_above=-999 required=5 tests=[AWL=0.145, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jrLrQzZuREzj; Tue, 22 Sep 2009 23:52:31 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 72FDD3A67E4; Tue, 22 Sep 2009 23:52:31 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLgl-000MF7-8z for namedroppers-data0@psg.com; Wed, 23 Sep 2009 06:50:55 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLgb-000MEQ-Pk for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 06:50:53 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id F3F05E601C; Wed, 23 Sep 2009 06:50:44 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8N6ogQJ024846; Wed, 23 Sep 2009 16:50:42 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909230650.n8N6ogQJ024846@drugs.dv.isc.org> To: Matthew Dempsky Cc: IETF DNSEXT WG From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> Subject: Re: [dnsext] Editor needed In-reply-to: Your message of "Tue, 22 Sep 2009 23:25:59 MST." Date: Wed, 23 Sep 2009 16:50:42 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Matthew Dempsky writes: > On Tue, Sep 22, 2009 at 11:19 PM, Mark Andrews wrote: > > Then why do you care if TCP is a MUST or not? =A0Your not going to > > get queries over TCP by compliant resolvers. =A0However by demanding > > that TCP remain a SHOULD you leave everyone open to the problems > > caused by implementations that don't support it and operators that > > incorrectly turn it off. > > Because then when you later want to propose to further amend the > protocol to allow clients to initiate with TCP queries, and I oppose > it because my server doesn't respond to queries over TCP, you'll argue > that it's non-compliant anyway. It's already allowed, see RFC 2136. 2.1 - Transport Issues An update transaction may be carried in a UDP datagram, if the request fits, or in a TCP connection (at the discretion of the requestor). When TCP is used, the message is in the format described in [RFC1035 4.2.2]. > Also, I'm only saying TCP support for authoritative servers that don't > support zone transfers, don't send truncated UDP responses, and don't > establish private agreements with resolvers shouldn't be required. I > won't make the same fuss if you limit the requirement for TCP support > to servers that send truncated UDP responses. Which just goes to show that you have thought through all the implications of making a server UDP only as the DNS is now much more that just queries. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 22 23:53:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 56AD03A67E4; Tue, 22 Sep 2009 23:53:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.576 X-Spam-Level: X-Spam-Status: No, score=-2.576 tagged_above=-999 required=5 tests=[AWL=0.023, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lAxdveJHVY9N; Tue, 22 Sep 2009 23:53:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7CB863A67D9; Tue, 22 Sep 2009 23:53:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLeo-000Lu5-CL for namedroppers-data0@psg.com; Wed, 23 Sep 2009 06:48:54 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLdx-000Lmy-J8 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 06:48:31 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id ECA9DB7591 for ; Wed, 23 Sep 2009 06:48:00 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: IETF DNSEXT WG Subject: Re: [dnsext] Editor needed In-Reply-To: Your message of "Tue, 22 Sep 2009 23:25:59 MST." References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Wed, 23 Sep 2009 06:48:00 +0000 Message-ID: <68241.1253688480@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Tue, 22 Sep 2009 23:25:59 -0700 > From: Matthew Dempsky > ... > Because then when you later want to propose to further amend the > protocol to allow clients to initiate with TCP queries, and I oppose > it because my server doesn't respond to queries over TCP, you'll argue > that it's non-compliant anyway. note that i am in fact going to do the former, but not the latter. that is, if we can come up with a lightweight datagram oriented tcp then we might want to try it first. if the responder doesn't understand the "lightweight option" then the initiator would remember this and go back to UDP first, TCP only as a fallback. but in no case would i say, if you don't support TCP at all, you're out of spec. not supporting TCP at all would just be another way of not supporting the "lightweight option". > Also, I'm only saying TCP support for authoritative servers that don't > support zone transfers, don't send truncated UDP responses, and don't > establish private agreements with resolvers shouldn't be required. I > won't make the same fuss if you limit the requirement for TCP support > to servers that send truncated UDP responses. this sounds to me like the voice of reason. From owner-namedroppers@ops.ietf.org Tue Sep 22 23:59:48 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 88ED23A67E4; Tue, 22 Sep 2009 23:59:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.181 X-Spam-Level: X-Spam-Status: No, score=0.181 tagged_above=-999 required=5 tests=[AWL=0.054, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 87117hFQSG2h; Tue, 22 Sep 2009 23:59:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BD2863A67A2; Tue, 22 Sep 2009 23:59:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLlr-000Mtn-PU for namedroppers-data0@psg.com; Wed, 23 Sep 2009 06:56:11 +0000 Received: from [209.85.216.176] (helo=mail-px0-f176.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLli-000Mt7-Ks for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 06:56:09 +0000 Received: by pxi6 with SMTP id 6so370659pxi.32 for ; Tue, 22 Sep 2009 23:56:01 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.149.10 with SMTP id b10mr3297327wao.157.1253688961587; Tue, 22 Sep 2009 23:56:01 -0700 (PDT) In-Reply-To: <200909230650.n8N6ogQJ024846@drugs.dv.isc.org> References: <20090825224731.GJ4142@shinkuro.com> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <200909230650.n8N6ogQJ024846@drugs.dv.isc.org> Date: Tue, 22 Sep 2009 23:56:01 -0700 Message-ID: Subject: Re: [dnsext] Editor needed From: Matthew Dempsky To: Mark Andrews Cc: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 11:50 PM, Mark Andrews wrote: > It's already allowed, see RFC 2136. By "queries", I meant QUERY queries. My server doesn't accept UPDATE queries, and clients have no reason to send them to my server, so that requirement is irrelevant. From owner-namedroppers@ops.ietf.org Wed Sep 23 00:09:27 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 383B03A682F; Wed, 23 Sep 2009 00:09:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.456 X-Spam-Level: X-Spam-Status: No, score=-2.456 tagged_above=-999 required=5 tests=[AWL=0.143, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1V4EUbRh4c3q; Wed, 23 Sep 2009 00:09:21 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B03663A67A2; Wed, 23 Sep 2009 00:09:21 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLw7-000NvO-EZ for namedroppers-data0@psg.com; Wed, 23 Sep 2009 07:06:47 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqLvx-000NuX-Fj for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 07:06:44 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id BEFB2E601C; Wed, 23 Sep 2009 07:06:36 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8N76YsQ024997; Wed, 23 Sep 2009 17:06:34 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909230706.n8N76YsQ024997@drugs.dv.isc.org> To: Matthew Dempsky Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <64548.1253683630@nsa.vix.com> <200909230628.n8N6ScYC024383@drugs.dv.isc.org> Subject: Re: [dnsext] Editor needed In-reply-to: Your message of "Tue, 22 Sep 2009 23:34:15 MST." Date: Wed, 23 Sep 2009 17:06:34 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Matthew Dempsky writes: > On Tue, Sep 22, 2009 at 11:28 PM, Mark Andrews wrote: > > Because people can't rely on TCP being supported when it is needed > > as it is now subject to the whim of vendors and implementors that > > have demonstrated that they can't be trusted to make rational > > decision. > > > > Making TCP a MUST won't hurt those that have all their answer set > > fitting in 512 bytes. Having TCP as a SHOULD has clearly hurt those > > that needed TCP to be supported. > > So you can say "RFC XXXX requires TCP support, and you're not offering > it, therefore you're non-compliant" or you can say "your name server > is sending truncated responses, and RFC XXXX therefore requires TCP > support, and you're not offering it, therefore you're non-compliant". > What difference does it make? If you set TC and don't answer queries over TCP I'll complain today as you are in the wrong. I've complained to Microsoft when they did exactly that. If you don't support a SHOULD then it is your reponsabilty to correct problems that arise from not supporting the SHOULD. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Wed Sep 23 00:31:25 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9ED4F3A6878; Wed, 23 Sep 2009 00:31:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.048 X-Spam-Level: X-Spam-Status: No, score=-1.048 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t7KyyrYTAR1S; Wed, 23 Sep 2009 00:31:25 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D4F6B3A677D; Wed, 23 Sep 2009 00:31:24 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqMGE-00003D-UC for namedroppers-data0@psg.com; Wed, 23 Sep 2009 07:27:34 +0000 Received: from [80.64.7.196] (helo=mx11.tdc.fi) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqMG5-00001w-O5 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 07:27:33 +0000 X-IronPort-AV: E=Sophos;i="4.44,437,1249246800"; d="scan'208";a="347138" Received: from fi-hel2ex01.nordiclan.net ([194.100.219.27]) by mail-gw2.tdc.fi with ESMTP; 23 Sep 2009 10:27:22 +0300 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 Subject: RE: [dnsext] Editor needed Date: Wed, 23 Sep 2009 10:27:21 +0300 Message-ID: <86048CA3B4B17E459FFD4F3F383AD88F15860A91@fi-hel2ex01.nordiclan.net> In-Reply-To: <68241.1253688480@nsa.vix.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [dnsext] Editor needed Thread-Index: Aco8HJcmVlCHma7CQHWN2NnDk8mwjwAAo9Gg References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <68241.1253688480@nsa.vix.com> From: "Aki Tuomi" To: "IETF DNSEXT WG" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: DQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+IFRvOiBJRVRGIEROU0VYVCBXRw0KPiBT dWJqZWN0OiBSZTogW2Ruc2V4dF0gRWRpdG9yIG5lZWRlZA0KPiANCj4gPiBEYXRlOiBUdWUsIDIy IFNlcCAyMDA5IDIzOjI1OjU5IC0wNzAwDQo+ID4gRnJvbTogTWF0dGhldyBEZW1wc2t5IDxtYXR0 aGV3QGRlbXBza3kub3JnPg0KPiA+IC4uLg0KPiA+IEJlY2F1c2UgdGhlbiB3aGVuIHlvdSBsYXRl ciB3YW50IHRvIHByb3Bvc2UgdG8gZnVydGhlciBhbWVuZCB0aGUNCj4gPiBwcm90b2NvbCB0byBh bGxvdyBjbGllbnRzIHRvIGluaXRpYXRlIHdpdGggVENQIHF1ZXJpZXMsIGFuZCBJIG9wcG9zZQ0K PiA+IGl0IGJlY2F1c2UgbXkgc2VydmVyIGRvZXNuJ3QgcmVzcG9uZCB0byBxdWVyaWVzIG92ZXIg VENQLCB5b3UnbGwNCj4gYXJndWUNCj4gPiB0aGF0IGl0J3Mgbm9uLWNvbXBsaWFudCBhbnl3YXku DQo+IA0KPiBub3RlIHRoYXQgaSBhbSBpbiBmYWN0IGdvaW5nIHRvIGRvIHRoZSBmb3JtZXIsIGJ1 dCBub3QgdGhlIGxhdHRlci4NCj4gdGhhdA0KPiBpcywgaWYgd2UgY2FuIGNvbWUgdXAgd2l0aCBh IGxpZ2h0d2VpZ2h0IGRhdGFncmFtIG9yaWVudGVkIHRjcCB0aGVuIHdlDQo+IG1pZ2h0IHdhbnQg dG8gdHJ5IGl0IGZpcnN0LiAgaWYgdGhlIHJlc3BvbmRlciBkb2Vzbid0IHVuZGVyc3RhbmQgdGhl DQo+ICJsaWdodHdlaWdodCBvcHRpb24iIHRoZW4gdGhlIGluaXRpYXRvciB3b3VsZCByZW1lbWJl ciB0aGlzIGFuZCBnbyBiYWNrDQo+IHRvIFVEUCBmaXJzdCwgVENQIG9ubHkgYXMgYSBmYWxsYmFj ay4NCj4gDQoNClNvdW5kcyBsaWtlIHRoZSBNaWNyb3NvZnQgSUlTIGhhY2ssIHRoYXQgYWxsb3dl ZCBwdW50ZXIgdG8gc2VuZCBkYXRhIHdpdGhvdXQgZ29pbmcgdGhydSB0aGUgY3VtYmVyc29tZSBU Q1AgaGFuZHNoYWtlID0pDQoNCi0tLQ0KQWtpIFR1b21pDQpTeXN0ZW1zIFNwZWNpYWxpc3QNClRE QyBPeQ0KDQo= From owner-namedroppers@ops.ietf.org Wed Sep 23 00:36:04 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0E18D3A677E; Wed, 23 Sep 2009 00:36:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.458 X-Spam-Level: X-Spam-Status: No, score=-2.458 tagged_above=-999 required=5 tests=[AWL=0.141, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id btqnMr27eBwH; Wed, 23 Sep 2009 00:36:03 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 118EB3A677D; Wed, 23 Sep 2009 00:36:03 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqMMh-0000i6-Nv for namedroppers-data0@psg.com; Wed, 23 Sep 2009 07:34:15 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqMMR-0000fs-Mx for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 07:34:07 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 0142BE601E; Wed, 23 Sep 2009 07:33:58 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8N7Xugq025303; Wed, 23 Sep 2009 17:33:56 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909230733.n8N7Xugq025303@drugs.dv.isc.org> To: Paul Vixie Cc: IETF DNSEXT WG From: Mark Andrews References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <68241.1253688480@nsa.vix.com> Subject: Re: [dnsext] Editor needed In-reply-to: Your message of "Wed, 23 Sep 2009 06:48:00 GMT." <68241.1253688480@nsa.vix.com> Date: Wed, 23 Sep 2009 17:33:56 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <68241.1253688480@nsa.vix.com>, Paul Vixie writes: > > Date: Tue, 22 Sep 2009 23:25:59 -0700 > > From: Matthew Dempsky > > ... > > Because then when you later want to propose to further amend the > > protocol to allow clients to initiate with TCP queries, and I oppose > > it because my server doesn't respond to queries over TCP, you'll argue > > that it's non-compliant anyway. > > note that i am in fact going to do the former, but not the latter. that > is, if we can come up with a lightweight datagram oriented tcp then we > might want to try it first. if the responder doesn't understand the > "lightweight option" then the initiator would remember this and go back > to UDP first, TCP only as a fallback. > > but in no case would i say, if you don't support TCP at all, you're out of > spec. not supporting TCP at all would just be another way of not > supporting the "lightweight option". > > > Also, I'm only saying TCP support for authoritative servers that don't > > support zone transfers, don't send truncated UDP responses, and don't > > establish private agreements with resolvers shouldn't be required. I > > won't make the same fuss if you limit the requirement for TCP support > > to servers that send truncated UDP responses. > > this sounds to me like the voice of reason. But that isn't what RFC 1123 says. Even if you were to modify RFC 1123 to say that everything other than a authoritative server MUST support TCP you would still have operational problem because people get it wrong today and will continue to get it wrong. To make serving robust it needs to be a MUST. There is no harm in making it a MUST. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Wed Sep 23 00:43:07 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DAF7B3A689C; Wed, 23 Sep 2009 00:43:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.721 X-Spam-Level: X-Spam-Status: No, score=0.721 tagged_above=-999 required=5 tests=[AWL=-1.084, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MANGLED_MARKET=2.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A8crIWlSLPU1; Wed, 23 Sep 2009 00:43:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7F5273A6783; Wed, 23 Sep 2009 00:43:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqMTV-0001TO-C6 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 07:41:17 +0000 Received: from [217.147.82.63] (helo=mail.avalus.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqMTL-0001R1-SW for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 07:41:15 +0000 Received: from [192.168.100.90] (shed [217.147.82.63]) by mail.avalus.com (Postfix) with ESMTPA id A4477C2DB3; Wed, 23 Sep 2009 08:41:05 +0100 (BST) Date: Wed, 23 Sep 2009 08:41:41 +0100 From: Alex Bligh Reply-To: Alex Bligh To: Matthew Dempsky , Mark Andrews cc: IETF DNSEXT WG , Alex Bligh Subject: Re: [dnsext] Editor needed Message-ID: <35A3605C302E223EB818D77A@nimrod.local> In-Reply-To: References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Matthew, --On 22 September 2009 23:25:59 -0700 Matthew Dempsky wrote: > Also, I'm only saying TCP support for authoritative servers that don't > support zone transfers, don't send truncated UDP responses, and don't > establish private agreements with resolvers shouldn't be required. I > won't make the same fuss if you limit the requirement for TCP support > to servers that send truncated UDP responses. So, in order to fall into the group where (in your view) TCP shouldn't be a MUST, the server has to: a) not be recursive (or an upstream authoritative server could send it a response that wouldn't fit into 512 bytes) b) not support DNSSEC (as if it did, in practical terms, at least one of the records it had to serve would exceed 512 bytes) c) be able to guarantee it has no other records that if served could ever exceed 512 bytes (no matter how the UDP query is formed) d) not support zone transfers; AND e) not have any 'private agreements' with resolvers to TCP queries. I suspect the size of the above set is small. In my earlier response (later clarified), I stated my view that at least for DNS servers outside this 'grey area' set (putting (e) aside), TCP should be a MUST. The question, it seems to me is this: Is it better to just make it a MUST for every server (which is far easier to understand - and there's nothing stopping one running a non-compliant server), or is it better to make it a MUST with a tiny carve-out? What I think we shouldn't do, is carry on with it being unclear. As you point out, the draft says "SHOULD", but as Mark et al point out, other places then go and make this a MUST in either nearly all, or all cases (depending on your interpretation). Given no one has yet suggested a use-case for any server within this 'grey-area set' (I don't think many embedded applications have authoritative nameservers, but what do I know), and the set is necessarily small, I think probably a simple 'MUST' is the thing to do. If your objection to this is one of principle, i.e. that this is a 'clarify' for 99.9% of servers, but at least arguable a new requirement for 0.1%, then perhaps we put that in the notes. -- Alex Bligh From owner-namedroppers@ops.ietf.org Wed Sep 23 01:23:12 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1B10828C100; Wed, 23 Sep 2009 01:23:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.695 X-Spam-Level: X-Spam-Status: No, score=-0.695 tagged_above=-999 required=5 tests=[AWL=-0.200, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DDNWuzdoB1Mn; Wed, 23 Sep 2009 01:23:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2DF9028C0FF; Wed, 23 Sep 2009 01:23:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqN5J-0005VO-PC for namedroppers-data0@psg.com; Wed, 23 Sep 2009 08:20:21 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqN5A-0005T8-K7 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 08:20:20 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id B6B9F1542060; Wed, 23 Sep 2009 09:20:09 +0100 (BST) Cc: Mark Andrews , IETF DNSEXT WG Message-Id: From: Jim Reid To: Matthew Dempsky In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: [dnsext] irrelevant Subject: header Date: Wed, 23 Sep 2009 09:20:09 +0100 References: <20090825224731.GJ4142@shinkuro.com> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <200909230650.n8N6ogQJ024846@drugs.dv.isc.org> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 23 Sep 2009, at 07:56, Matthew Dempsky wrote: > By "queries", I meant QUERY queries. My server doesn't accept UPDATE > queries, and clients have no reason to send them to my server, so that > requirement is irrelevant. You have no way of knowing that. Or enforcing clients to behave in that way. Besides, just because a client has "no reason" to so something does not mean it will never, ever do that. You should be well aware that there is already more than enough unreasonable misbehaviour by DNS clients. They do all sorts of stupid things even though there's no reason for them to do that. Let's stop this endless angels on pinhead debate. Make TCP mandatory. BTW, your server will be accepting UPDATE queries unless you've got a firewall that's doing opcode filtering or something like that. It may well be ignoring or rejecting those queries because your server has no support for DDNS. But they will (or could) be arriving at your server. From owner-namedroppers@ops.ietf.org Wed Sep 23 01:46:42 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6ADE33A6993; Wed, 23 Sep 2009 01:46:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.873 X-Spam-Level: X-Spam-Status: No, score=-102.873 tagged_above=-999 required=5 tests=[AWL=3.104, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PYL+FZWy+J5R; Wed, 23 Sep 2009 01:46:41 -0700 (PDT) Received: from psg.com (psg.com [147.28.0.62]) by core3.amsl.com (Postfix) with ESMTP id B510A3A694D; Wed, 23 Sep 2009 01:46:41 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqNSG-0007kj-UV for namedroppers-data0@psg.com; Wed, 23 Sep 2009 08:44:04 +0000 Received: from [209.85.222.191] (helo=mail-pz0-f191.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqNS7-0007jt-Lt for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 08:44:02 +0000 Received: by pzk29 with SMTP id 29so413543pzk.33 for ; Wed, 23 Sep 2009 01:43:55 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.250.4 with SMTP id x4mr3372073wah.113.1253695435353; Wed, 23 Sep 2009 01:43:55 -0700 (PDT) In-Reply-To: References: <20090825224731.GJ4142@shinkuro.com> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <200909230650.n8N6ogQJ024846@drugs.dv.isc.org> Date: Wed, 23 Sep 2009 01:43:55 -0700 Message-ID: Subject: [dnsext] Re: irrelevant Subject: header From: Matthew Dempsky To: Jim Reid Cc: Mark Andrews , IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 23, 2009 at 1:20 AM, Jim Reid wrote: > You have no way of knowing that. Or enforcing clients to behave in that way. > Besides, just because a client has "no reason" to so something does not mean > it will never, ever do that. You should be well aware that there is already > more than enough unreasonable misbehaviour by DNS clients. They do all sorts > of stupid things even though there's no reason for them to do that. I didn't say my server will crash when someone tries to send it an UPDATE query. I just said it doesn't support UPDATE queries; i.e., I don't promise that a client who incorrectly sends me an UPDATE query will receive a meaningful response. > Let's stop this endless angels on pinhead debate. Make TCP mandatory. Right, do it by fiat. The point of publishing a protocol standard is to document how things work, not how you wish they worked. > BTW, your server will be accepting UPDATE queries unless you've got a > firewall that's doing opcode filtering or something like that. It may well > be ignoring or rejecting those queries because your server has no support > for DDNS. But they will (or could) be arriving at your server. Fine, whatever, we have a difference in terminology. From owner-namedroppers@ops.ietf.org Wed Sep 23 01:46:42 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AD8C73A694D; Wed, 23 Sep 2009 01:46:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qvpPHFCPtuqG; Wed, 23 Sep 2009 01:46:42 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E776E3A6985; Wed, 23 Sep 2009 01:46:41 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqNRG-0007ff-VA for namedroppers-data0@psg.com; Wed, 23 Sep 2009 08:43:02 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqNR7-0007ew-Gm for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 08:43:00 +0000 Received: from [IPv6:2001:610:719:1:221:5dff:fe1e:113a] (unknown [IPv6:2001:610:719:1:221:5dff:fe1e:113a]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by farside.isc.org (Postfix) with ESMTP id BE4E5E601E; Wed, 23 Sep 2009 08:42:51 +0000 (UTC) (envelope-from shane@isc.org) Subject: Re: [dnsext] irrelevant Subject: header From: Shane Kerr To: Jim Reid Cc: IETF DNSEXT WG In-Reply-To: References: <20090825224731.GJ4142@shinkuro.com> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <200909230650.n8N6ogQJ024846@drugs.dv.isc.org> Content-Type: text/plain Organization: ISC Date: Wed, 23 Sep 2009 10:42:48 +0200 Message-Id: <1253695368.6558.76051.camel@shane-asus-laptop> Mime-Version: 1.0 X-Mailer: Evolution 2.26.1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, 2009-09-23 at 09:20 +0100, Jim Reid wrote: > Let's stop this endless angels on pinhead debate. Make TCP mandatory. I tend to agree with Jim. -- Shane From owner-namedroppers@ops.ietf.org Wed Sep 23 02:13:39 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E05633A69AE; Wed, 23 Sep 2009 02:13:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.516 X-Spam-Level: X-Spam-Status: No, score=-0.516 tagged_above=-999 required=5 tests=[AWL=-0.021, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nif+gzkfgS3B; Wed, 23 Sep 2009 02:13:39 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2748D3A6985; Wed, 23 Sep 2009 02:13:39 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqNsW-000ARt-Uy for namedroppers-data0@psg.com; Wed, 23 Sep 2009 09:11:12 +0000 Received: from [209.85.219.211] (helo=mail-ew0-f211.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqNsN-000ARA-90 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 09:11:11 +0000 Received: by ewy7 with SMTP id 7so525938ewy.41 for ; Wed, 23 Sep 2009 02:11:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=GN5XPL3VodkUncj/ruQKzWqBtvcr+myrzfnZMMnV1oI=; b=rxFXL3VeG8cOn9rwiyXTXrdJ9Fx75u7PShj79O6uLA604xDVdraAMtw/S/mV0JOKSi XEv1wXH4OksDTrk/C096Y1UmZ84A5eQqrPFh3QEDPNyQQB1tx/ViwZBDnd/uxi6NcFqG 2TmiR/J6V0bXqnpVWdZiivdl/Zpp9Lbr4N10E= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=Ms1qVRRxnNa0GRHNqUiF8/SuDJ0M2ERQ835r5w47EVq8qWGl7CcnZEsRvJcUFheg3o 0FwZR6jbs4GcqEoAnikcDfWZKvHj+mOGMCGxtF33BDsdkGKdpbMfxtpOVReKi+SjGNWR /eCzFYzWyhbfYnmBIeVHmYa8XERUQipYScWoM= MIME-Version: 1.0 Received: by 10.211.128.9 with SMTP id f9mr2331587ebn.93.1253697062121; Wed, 23 Sep 2009 02:11:02 -0700 (PDT) In-Reply-To: <1253695368.6558.76051.camel@shane-asus-laptop> References: <20090825224731.GJ4142@shinkuro.com> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <200909230650.n8N6ogQJ024846@drugs.dv.isc.org> <1253695368.6558.76051.camel@shane-asus-laptop> From: bert hubert Date: Wed, 23 Sep 2009 11:10:42 +0200 Message-ID: <3efd34cc0909230210l85e1924x9d57034850b30f1b@mail.gmail.com> Subject: Re: [dnsext] irrelevant Subject: header To: Shane Kerr Cc: Jim Reid , IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 23, 2009 at 10:42 AM, Shane Kerr wrote: > On Wed, 2009-09-23 at 09:20 +0100, Jim Reid wrote: >> Let's stop this endless angels on pinhead debate. Make TCP mandatory. > > I tend to agree with Jim. Me too. From owner-namedroppers@ops.ietf.org Wed Sep 23 02:18:48 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 17A973A6923; Wed, 23 Sep 2009 02:18:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.713 X-Spam-Level: X-Spam-Status: No, score=-4.713 tagged_above=-999 required=5 tests=[AWL=-0.276, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K5NkzGQ3LBrg; Wed, 23 Sep 2009 02:18:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 11CC53A68F0; Wed, 23 Sep 2009 02:18:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqNyA-000Axe-D2 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 09:17:02 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqNxf-000Avv-ES for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 09:16:48 +0000 Received: from farside-mini.local (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 2C875A9443B; Wed, 23 Sep 2009 09:16:30 +0000 (UTC) Message-ID: <4AB9E774.4060106@mail-abuse.org> Date: Wed, 23 Sep 2009 02:16:36 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: Paul Vixie CC: IETF DNSEXT WG Subject: Re: [dnsext] Editor needed References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <68241.1253688480@nsa.vix.com> In-Reply-To: <68241.1253688480@nsa.vix.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/22/09 11:48 PM, Paul Vixie wrote: >> Date: Tue, 22 Sep 2009 23:25:59 -0700 >> From: Matthew Dempsky >> ... >> Because then when you later want to propose to further amend the >> protocol to allow clients to initiate with TCP queries, and I oppose >> it because my server doesn't respond to queries over TCP, you'll argue >> that it's non-compliant anyway. > > note that i am in fact going to do the former, but not the latter. that > is, if we can come up with a lightweight datagram oriented tcp then we > might want to try it first. if the responder doesn't understand the > "lightweight option" then the initiator would remember this and go back > to UDP first, TCP only as a fallback. > > but in no case would i say, if you don't support TCP at all, you're out of > spec. not supporting TCP at all would just be another way of not > supporting the "lightweight option". It has taken SCTP nearly a decade to gain its current level of support. SCTP permits unordered delivery of DNS messages. SCTP already allows unreliable message delivery (eliminating a need to buffer unacknowledged data). For security, SCTP starts with a cookie exchange and provides associations validation tags. SCTP also provides an auto close feature supporting persistent exchanges. Many SOHO devices currently don't support DNS exchanges over TCP, as noted in the http://download.nominet.org.uk/dnssec-cpe/ report. The reason for these devices not supporting TCP can be mitigated by unreliable unordered SCTP. SCTP, in this mode, eliminates the complexities imposed by TCP's lack of framing, especially when confronting different PMTUs or a need to alter addressing. There are also problems related to devices that attempt to analyze or buffer TCP data streams, where relationships between frames and DNS messages become obscured. Not only will answers need to be resurrected through some new API, the exact order of these answers will also need to be retained. Whenever a packet is lost, even assuming a replicate answer can be resurrected, acknowledgments may not occur at DNS message boundaries. SCTP offers a clean solution. SCTP is not a byte stream, it is a chunk stream, where chunks can represent DNS messages. Changing TCP to support message framing and unreliable delivery requires sizable modification at the API, to say the least. As such, it would be wrong to describe this protocol as TCP. Initial proposals for SCTP were over UDP. TPTB decided this protocol should be promoted to its own transport, SCTP. The best course having the shortest time horizon would be to embrace SCTP. Perhaps even SCTP over UDP. SCTP's unreliable unordered delivery features makes it practical for SOHO equipment to safely and economically support DNS, DNSSEC, and jumbo frames, while adding their normal tweaks. With or without DNSSEC, blind spoofing and reflected attack issues would also be eliminated. -Doug From owner-namedroppers@ops.ietf.org Wed Sep 23 03:05:12 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B13A53A67B3; Wed, 23 Sep 2009 03:05:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.784 X-Spam-Level: X-Spam-Status: No, score=-4.784 tagged_above=-999 required=5 tests=[AWL=-0.289, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SckIds5j0tyc; Wed, 23 Sep 2009 03:05:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D763D3A6783; Wed, 23 Sep 2009 03:05:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqOeD-000Ge1-Bc for namedroppers-data0@psg.com; Wed, 23 Sep 2009 10:00:29 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqOe3-000GdS-Ba for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 10:00:27 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n8N9w5rb026484; Wed, 23 Sep 2009 09:58:05 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n8N9w5RY026483; Wed, 23 Sep 2009 09:58:05 GMT Date: Wed, 23 Sep 2009 09:58:05 +0000 From: bmanning@vacation.karoshi.com To: Matthew Dempsky Cc: Mark Andrews , IETF DNSEXT WG Subject: Re: [dnsext] Editor needed Message-ID: <20090923095805.GA26326@vacation.karoshi.com.> References: <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <200909230650.n8N6ogQJ024846@drugs.dv.isc.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 11:56:01PM -0700, Matthew Dempsky wrote: > On Tue, Sep 22, 2009 at 11:50 PM, Mark Andrews wrote: > > It's already allowed, see RFC 2136. > > By "queries", I meant QUERY queries. My server doesn't accept UPDATE > queries, and clients have no reason to send them to my server, so that > requirement is irrelevant. selectively "cherry-picking" which parts of the DNS spec you want to implement and which you want to ignore is your choice. And since there are no "interoperability" police, you can even call it a DNS server. --bill From owner-namedroppers@ops.ietf.org Wed Sep 23 03:16:45 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EECEB3A69CC; Wed, 23 Sep 2009 03:16:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.772 X-Spam-Level: X-Spam-Status: No, score=-4.772 tagged_above=-999 required=5 tests=[AWL=-0.277, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tpBYNMWqXtyr; Wed, 23 Sep 2009 03:16:45 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F37B23A69C6; Wed, 23 Sep 2009 03:16:44 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqOs4-000HoT-3o for namedroppers-data0@psg.com; Wed, 23 Sep 2009 10:14:48 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqOru-000Hng-Nb for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 10:14:46 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n8NADYrb026633; Wed, 23 Sep 2009 10:13:34 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n8NADW2u026630; Wed, 23 Sep 2009 10:13:32 GMT Date: Wed, 23 Sep 2009 10:13:32 +0000 From: bmanning@vacation.karoshi.com To: Matthew Dempsky Cc: bmanning@vacation.karoshi.com, Andrew Sullivan , namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed Message-ID: <20090923101332.GB26326@vacation.karoshi.com.> References: <20090825224731.GJ4142@shinkuro.com> <20090923030602.GB22191@vacation.karoshi.com.> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 08:15:23PM -0700, Matthew Dempsky wrote: > On Tue, Sep 22, 2009 at 8:06 PM, wrote: > > hum... did you read the whole thing? > > I did. Authoritative name servers that don't offer zone transfers, > don't send truncated responses over UDP, and don't engage in private > agreements with resolvers aren't required to answer queries over TCP. > > If you understand 6.1.3.2 differently, please elaborate. back when RFC 1123 was written, I might have been firmly in your camp. If RFC 1123 was talking about authoritative servers. But its not. Its clearly talking about RESOLVER IMPLEMENTATIONS. how ever, RFC 1123 authors clearly saw the impending need to require TCP support and said as much in the document. now, 20 years on, I beleive that the advice given in this document is pragmatically the operational realitity for most of the Internet. "However, it is also clear that some new DNS record types defined in the future will contain information exceeding the 512 byte limit that applies to UDP, and hence will require TCP. Thus, resolvers and name servers should implement TCP services as a backup to UDP today, with the knowledge that they will require the TCP service in the future." This was the advice given in 1989. Now is the future that was foreseen back then. If you understand the text differently, please elaborate. Now - based on other parts of this thread - I surmise that you are going to be selective in which parts of the DNS spec you chose to implement. It would help frame this discussion if you were clear on which CLASS, QTYPE, and RRtypes you are going to -not- implement... --bill From owner-namedroppers@ops.ietf.org Wed Sep 23 03:22:16 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 01F7328C0DC; Wed, 23 Sep 2009 03:22:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.586 X-Spam-Level: * X-Spam-Status: No, score=1.586 tagged_above=-999 required=5 tests=[AWL=-1.361, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_RU=0.595, HELO_MISMATCH_RU=3.1, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wJ2VcL44WjsF; Wed, 23 Sep 2009 03:22:15 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 251403A69D9; Wed, 23 Sep 2009 03:22:15 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqOxQ-000ILq-6c for namedroppers-data0@psg.com; Wed, 23 Sep 2009 10:20:20 +0000 Received: from [87.245.158.60] (helo=mx.cryptocom.ru) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqOxE-000IIz-H4 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 10:20:18 +0000 Received: from localhost (localhost [127.0.0.1]) by mx.cryptocom.ru (Postfix) with ESMTP id 40DE03EC1E; Wed, 23 Sep 2009 14:20:07 +0400 (MSD) X-Virus-Scanned: Debian amavisd-new at cryptocom.ru Received: from mx.cryptocom.ru ([127.0.0.1]) by localhost (mx.cryptocom.ru [127.0.0.1]) (amavisd-new, port 10024) with LMTP id MrqznWOzeeCR; Wed, 23 Sep 2009 14:20:07 +0400 (MSD) Received: from [10.51.22.241] (reedcat.lan.cryptocom.ru [10.51.22.241]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.cryptocom.ru (Postfix) with ESMTP id 0EA823EC0A; Wed, 23 Sep 2009 14:20:06 +0400 (MSD) Message-ID: <4AB9F658.6080608@cryptocom.ru> Date: Wed, 23 Sep 2009 14:20:08 +0400 From: Basil Dolmatov User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: =?UTF-8?B?QWxmcmVkIO+/vQ==?= CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-dolmatov-dnsext-dnssec-gost-01 technical & editorial issues References: <200909171025.MAA15356@TR-Sys.de> In-Reply-To: <200909171025.MAA15356@TR-Sys.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Alfred � пишет: > > > (4) Editorials > > Thank you, Alfred. All editorials are applied and draft is resubmitted under the name draft-ietf-dnsext-dnssec-gost-00 After some time I think it will appear in the database. doL@ From owner-namedroppers@ops.ietf.org Wed Sep 23 06:36:55 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A9ACA3A6828; Wed, 23 Sep 2009 06:36:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.423 X-Spam-Level: X-Spam-Status: No, score=-102.423 tagged_above=-999 required=5 tests=[AWL=0.177, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yW47WS+6kyKh; Wed, 23 Sep 2009 06:36:55 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C39403A659A; Wed, 23 Sep 2009 06:36:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqRwK-000Ci7-8j for namedroppers-data0@psg.com; Wed, 23 Sep 2009 13:31:24 +0000 Received: from [2001:1890:1112:1::20] (helo=mail.ietf.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqRw5-000Cez-G5 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 13:31:22 +0000 Received: by core3.amsl.com (Postfix, from userid 0) id C1E7B3A6828; Wed, 23 Sep 2009 06:30:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Cc: namedroppers@ops.ietf.org Subject: [dnsext] I-D Action:draft-ietf-dnsext-dnssec-gost-00.txt Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20090923133001.C1E7B3A6828@core3.amsl.com> Date: Wed, 23 Sep 2009 06:30:01 -0700 (PDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Extensions Working Group of the IETF. Title : Use of GOST signature algorithms in DNSKEY and RRSIG Resource Records for DNSSEC Author(s) : V. Dolmatov, et al. Filename : draft-ietf-dnsext-dnssec-gost-00.txt Pages : 6 Date : 2009-09-23 This document describes how to produce GOST signature and hash algorithms DNSKEY and RRSIG resource records for use in the Domain Name System Security Extensions (DNSSEC, RFC 4033, RFC 4034, and RFC 4035). V.Dolmatov Expires March 24, 2010 [page 1] A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-gost-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-dnsext-dnssec-gost-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2009-09-23062552.I-D@ietf.org> --NextPart-- From owner-namedroppers@ops.ietf.org Wed Sep 23 06:58:13 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 272EF3A6887; Wed, 23 Sep 2009 06:58:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.055 X-Spam-Level: X-Spam-Status: No, score=-5.055 tagged_above=-999 required=5 tests=[AWL=-0.007, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vc62TFFFHuiq; Wed, 23 Sep 2009 06:58:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4FC853A676A; Wed, 23 Sep 2009 06:58:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSKJ-000G0B-Cx for namedroppers-data0@psg.com; Wed, 23 Sep 2009 13:56:11 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSJf-000FxZ-US for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 13:55:45 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n8NDtRXJ021601; Wed, 23 Sep 2009 06:55:27 -0700 (PDT) Subject: [dnsext] Another reason for TCP MUST Mime-Version: 1.0 (Apple Message framework v1076) Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes From: Nicholas Weaver In-Reply-To: Date: Wed, 23 Sep 2009 06:55:27 -0700 Cc: Nicholas Weaver , Paul Vixie , namedroppers@ops.ietf.org Content-Transfer-Encoding: 7bit Message-Id: <6A5E94D4-D778-49BF-9446-744891767071@icsi.berkeley.edu> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <64548.1253683630@nsa.vix.com> To: Matthew Dempsky X-Mailer: Apple Mail (2.1076) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 22, 2009, at 10:46 PM, Matthew Dempsky wrote: > On Tue, Sep 22, 2009 at 10:27 PM, Paul Vixie wrote: >> since clients are required to tru UDP first, i have trouble >> understanding >> how a conforming client would ever detect or notice that a server >> doesn't >> support TCP unless that server first truncated a UDP response. > > Agreed. So why require servers that don't send truncated UDP > responses to respond to queries over TCP? Because you have broken proxies on UDP which don't speak TCP, which means you can bypass the brokenness by querying over TCP. Because using TCP allows you effective security against out of path adversaries in a way UDP doesn't, when you have NATs etc messing up your port randomization. These are both reasons why authorities MUST support TCP, even in the case where the authority can guarentee its responses are 512B or less for all queries. From owner-namedroppers@ops.ietf.org Wed Sep 23 07:01:03 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5ABB83A690F; Wed, 23 Sep 2009 07:01:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.587 X-Spam-Level: X-Spam-Status: No, score=-3.587 tagged_above=-999 required=5 tests=[AWL=-0.288, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LuLlgvYf8QPH; Wed, 23 Sep 2009 07:01:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A7D143A676A; Wed, 23 Sep 2009 07:01:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSNV-000GVE-7b for namedroppers-data0@psg.com; Wed, 23 Sep 2009 13:59:29 +0000 Received: from [131.111.8.136] (helo=ppsw-6.csi.cam.ac.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSNL-000GT0-SA for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 13:59:27 +0000 X-Cam-AntiVirus: no malware found X-Cam-SpamDetails: not scanned X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Received: from hermes-1.csi.cam.ac.uk ([131.111.8.51]:59959) by ppsw-6.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.156]:25) with esmtpa (EXTERNAL:fanf2) id 1MqSNH-0004yn-LV (Exim 4.70) (return-path ); Wed, 23 Sep 2009 14:59:15 +0100 Received: from fanf2 (helo=localhost) by hermes-1.csi.cam.ac.uk (hermes.cam.ac.uk) with local-esmtp id 1MqSNH-0005FN-Kv (Exim 4.67) (return-path ); Wed, 23 Sep 2009 14:59:15 +0100 Date: Wed, 23 Sep 2009 14:59:15 +0100 From: Tony Finch X-X-Sender: fanf2@hermes-1.csi.cam.ac.uk To: Matthew Dempsky cc: Mark Andrews , IETF DNSEXT WG Subject: Re: [dnsext] Editor needed In-Reply-To: Message-ID: References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> User-Agent: Alpine 2.00 (LSU 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, 22 Sep 2009, Matthew Dempsky wrote: > > Also, I'm only saying TCP support for authoritative servers that don't > support zone transfers, don't send truncated UDP responses, and don't > establish private agreements with resolvers shouldn't be required. I > won't make the same fuss if you limit the requirement for TCP support > to servers that send truncated UDP responses. That's an exception for a particular operational environment. RFC requirements are about implementations. When they say an implementation MUST implement something, that doesn't mean an operator can't turn it off. Tony. -- f.anthony.n.finch http://dotat.at/ GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS. MODERATE OR GOOD. From owner-namedroppers@ops.ietf.org Wed Sep 23 07:07:49 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 427613A6960; Wed, 23 Sep 2009 07:07:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.565 X-Spam-Level: X-Spam-Status: No, score=-3.565 tagged_above=-999 required=5 tests=[AWL=-0.266, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_UK=1.749, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BS-ZGibTq9kO; Wed, 23 Sep 2009 07:07:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4B8363A69EB; Wed, 23 Sep 2009 07:07:48 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSTU-000HIv-Oo for namedroppers-data0@psg.com; Wed, 23 Sep 2009 14:05:40 +0000 Received: from [131.111.8.131] (helo=ppsw-1.csi.cam.ac.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSTI-000HHg-D4 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 14:05:38 +0000 X-Cam-AntiVirus: no malware found X-Cam-SpamDetails: not scanned X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Received: from hermes-1.csi.cam.ac.uk ([131.111.8.51]:36597) by ppsw-1.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.151]:25) with esmtpa (EXTERNAL:fanf2) id 1MqSTC-00040t-5E (Exim 4.70) (return-path ); Wed, 23 Sep 2009 15:05:22 +0100 Received: from fanf2 (helo=localhost) by hermes-1.csi.cam.ac.uk (hermes.cam.ac.uk) with local-esmtp id 1MqSTC-0005zP-JQ (Exim 4.67) (return-path ); Wed, 23 Sep 2009 15:05:22 +0100 Date: Wed, 23 Sep 2009 15:05:22 +0100 From: Tony Finch X-X-Sender: fanf2@hermes-1.csi.cam.ac.uk To: Alex Bligh cc: Matthew Dempsky , Mark Andrews , IETF DNSEXT WG Subject: Re: [dnsext] Editor needed In-Reply-To: <35A3605C302E223EB818D77A@nimrod.local> Message-ID: References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <35A3605C302E223EB818D77A@nimrod.local> User-Agent: Alpine 2.00 (LSU 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, 23 Sep 2009, Alex Bligh wrote: > > Given no one has yet suggested a use-case for any server within this > 'grey-area set' DNS blacklist servers. I still think TCP should be mandatory to implement. Tony. -- f.anthony.n.finch http://dotat.at/ GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS. MODERATE OR GOOD. From owner-namedroppers@ops.ietf.org Wed Sep 23 07:22:03 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 60F0F3A6A32; Wed, 23 Sep 2009 07:22:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.75 X-Spam-Level: X-Spam-Status: No, score=-0.75 tagged_above=-999 required=5 tests=[AWL=-1.150, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KbJwGR7a-SIZ; Wed, 23 Sep 2009 07:22:02 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5DFB228C101; Wed, 23 Sep 2009 07:22:02 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSh3-000J29-6H for namedroppers-data0@psg.com; Wed, 23 Sep 2009 14:19:41 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSgt-000J0f-I4 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 14:19:39 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 0C5962FE8CE3 for ; Wed, 23 Sep 2009 14:19:29 +0000 (UTC) Date: Wed, 23 Sep 2009 10:19:28 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Editor needed Message-ID: <20090923141928.GS4450@shinkuro.com> References: <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 22, 2009 at 11:25:59PM -0700, Matthew Dempsky wrote: > Also, I'm only saying TCP support for authoritative servers that don't > support zone transfers, don't send truncated UDP responses, and don't > establish private agreements with resolvers shouldn't be required. I > won't make the same fuss if you limit the requirement for TCP support > to servers that send truncated UDP responses. It would be helpful if, instead of saying, "Don't do this," you could take the text of the draft that is to be come a WG item, and propose an alteration of it that provides the limited exception you propose. Something like, MUST support TCP unless the server can guarantee that it does not support zone transfer, can not send truncated UDP responses, and never otherwise needs TCP. Note that the second of these requirements effectively means that the server MUST NOT start if it could generate a UDP response that would need to be truncated." Or something like that. Best regards, A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Wed Sep 23 07:23:42 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EF3F13A69D0; Wed, 23 Sep 2009 07:23:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.576 X-Spam-Level: X-Spam-Status: No, score=-2.576 tagged_above=-999 required=5 tests=[AWL=0.023, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1DaB1WdYXDgs; Wed, 23 Sep 2009 07:23:41 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id AB4D63A69C8; Wed, 23 Sep 2009 07:23:38 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSjT-000JNJ-EU for namedroppers-data0@psg.com; Wed, 23 Sep 2009 14:22:11 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqSjE-000JLu-Kf for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 14:22:05 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 483E1B75DE for ; Wed, 23 Sep 2009 14:21:56 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: IETF DNSEXT WG Subject: Re: [dnsext] Editor needed In-Reply-To: Your message of "Wed, 23 Sep 2009 17:33:56 +1000." <200909230733.n8N7Xugq025303@drugs.dv.isc.org> References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <68241.1253688480@nsa.vix.com> <200909230733.n8N7Xugq025303@drugs.dv.isc.org> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Wed, 23 Sep 2009 14:21:56 +0000 Message-ID: <86126.1253715716@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Mark Andrews > Date: Wed, 23 Sep 2009 17:33:56 +1000 > > > this sounds to me like the voice of reason. > > But that isn't what RFC 1123 says. Even if you were to modify RFC 1123 > to say that everything other than a authoritative server MUST support TCP > you would still have operational problem because people get it wrong > today and will continue to get it wrong. To make serving robust it needs > to be a MUST. There is no harm in making it a MUST. if a dedicated service operator whose high level architecture does not rely on large messages and cannot support TCP wants to deploy a UDP-only service, then their prospective customers ought not blow them out of the water just because of the TCP thing. or if an equipment or software vendor wants to build some kind of high speed embedded hardware-assisted box that can't hold state and so is only useful if TCP is not used and is therefore only useful to customers who do not need to send large messages, they ought to still be able to call what they're doing "DNS" and check the box for RFC compatibility. some forms of DNS can be deployed successfully without TCP and if some DNS technology pairs want to do it that way then they ought not be penalized by the wording of the RFC's. noone is objecting to making an RFC that says "TCP is required if you want to implement all features and options of DNS", but some are questioning the veracity of an RFC that would say "TCP is required if you want to implement any subset of DNS". can we find a middle ground that doesn't make DNS a "package deal" for vendors and customers? note that no recursive service or operator or implementor would fall under such an exclusion. recursive service requires large message support because many authority servers do. therefore opendns and any similar operator MUST support TCP even if large message support is optional in some other cases. From owner-namedroppers@ops.ietf.org Wed Sep 23 08:36:07 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C6C2C3A6887; Wed, 23 Sep 2009 08:36:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.437 X-Spam-Level: X-Spam-Status: No, score=-4.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5pGVrUrdpYRH; Wed, 23 Sep 2009 08:36:07 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F37473A67A4; Wed, 23 Sep 2009 08:36:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqTpH-0002W1-0V for namedroppers-data0@psg.com; Wed, 23 Sep 2009 15:32:15 +0000 Received: from [204.152.189.190] (helo=virtualized.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqTp7-0002TH-65 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 15:32:12 +0000 Received: from localhost (localhost [127.0.0.1]) by virtualized.org (Postfix) with ESMTP id EF6B77FB95A; Wed, 23 Sep 2009 08:32:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at virtualized.org Received: from virtualized.org ([127.0.0.1]) by localhost (trantor.virtualized.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l+9cpNUm8cQp; Wed, 23 Sep 2009 08:32:01 -0700 (PDT) Received: from [10.0.1.2] (cpe-76-168-7-68.socal.res.rr.com [76.168.7.68]) by virtualized.org (Postfix) with ESMTP id 1F2877FB949; Wed, 23 Sep 2009 08:32:01 -0700 (PDT) Subject: Re: [dnsext] Editor needed Mime-Version: 1.0 (Apple Message framework v1076) Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes From: David Conrad In-Reply-To: <86126.1253715716@nsa.vix.com> Date: Wed, 23 Sep 2009 08:32:00 -0700 Cc: IETF DNSEXT WG Content-Transfer-Encoding: 7bit Message-Id: References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <68241.1253688480@nsa.vix.com> <200909230733.n8N7Xugq025303@drugs.dv.isc.org> <86126.1253715716@nsa.vix.com> To: Paul Vixie X-Mailer: Apple Mail (2.1076) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Sep 23, 2009, at 7:21 AM, Paul Vixie wrote: > if TCP is not used and is therefore only useful > to customers who do not need to send large messages, they ought to > still be > able to call what they're doing "DNS" and check the box for RFC > compatibility. Why? > but some are questioning the veracity of an RFC that would > say "TCP is required if you want to implement any subset of DNS". I don't think so. Some are questioning whether an implementation that does not support TCP can truthfully be called a full, standards compliant implementation of DNS. If you want to call a TCP-less implementation a subset of DNS, I can't see how anyone could complain. Regards, -drc From owner-namedroppers@ops.ietf.org Wed Sep 23 08:36:13 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E6B313A6887; Wed, 23 Sep 2009 08:36:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.373 X-Spam-Level: X-Spam-Status: No, score=-102.373 tagged_above=-999 required=5 tests=[AWL=0.227, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pGI3Qi2Pmvho; Wed, 23 Sep 2009 08:36:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2199F3A67A4; Wed, 23 Sep 2009 08:36:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqToY-0002P5-3y for namedroppers-data0@psg.com; Wed, 23 Sep 2009 15:31:30 +0000 Received: from [2001:1890:1112:1::20] (helo=mail.ietf.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqToF-0002Lt-Ig for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 15:31:27 +0000 Received: by core3.amsl.com (Postfix, from userid 0) id 25E5D3A68B1; Wed, 23 Sep 2009 08:30:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Cc: namedroppers@ops.ietf.org Subject: [dnsext] I-D Action:draft-ietf-dnsext-rfc3597-bis-00.txt Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20090923153002.25E5D3A68B1@core3.amsl.com> Date: Wed, 23 Sep 2009 08:30:02 -0700 (PDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Extensions Working Group of the IETF. Title : Handling of Unknown DNS Resource Record (RR) Types Author(s) : A. Gustafsson Filename : draft-ietf-dnsext-rfc3597-bis-00.txt Pages : 7 Date : 2009-09-23 Extending the Domain Name System (DNS) with new Resource Record (RR) types should not requires changes to name server software. This document specifies how new RR types are transparently handled by DNS software. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-dnsext-rfc3597-bis-00.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-dnsext-rfc3597-bis-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2009-09-23082505.I-D@ietf.org> --NextPart-- From owner-namedroppers@ops.ietf.org Wed Sep 23 09:20:02 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 970AB3A6903; Wed, 23 Sep 2009 09:20:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.345 X-Spam-Level: X-Spam-Status: No, score=-4.345 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YP8C4C8ZP6pH; Wed, 23 Sep 2009 09:20:01 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C3FEF3A6765; Wed, 23 Sep 2009 09:20:01 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqUWN-0009ye-Hh for namedroppers-data0@psg.com; Wed, 23 Sep 2009 16:16:47 +0000 Received: from [192.245.12.227] (helo=balder-227.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqUWD-0009xC-Gz for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 16:16:44 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n8NGGVb8019187 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 23 Sep 2009 09:16:33 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <20090923153002.25E5D3A68B1@core3.amsl.com> References: <20090923153002.25E5D3A68B1@core3.amsl.com> Date: Wed, 23 Sep 2009 09:16:29 -0700 To: Andreas Gustafsson From: Paul Hoffman Subject: [dnsext] Diffs in draft-ietf-dnsext-rfc3597-bis-00? Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Is there a definitive list of the differences between this document and RFC 3597, which it intends to replace? A short bit in the introduction about the purpose of the revision, and a solid appendix with the actual diffs, would be greatly appreciated. --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Wed Sep 23 10:37:57 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C33223A659A; Wed, 23 Sep 2009 10:37:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.048 X-Spam-Level: X-Spam-Status: No, score=-1.048 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hmNqFwM5xDne; Wed, 23 Sep 2009 10:37:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E76793A689D; Wed, 23 Sep 2009 10:37:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqVi1-000JYL-2o for namedroppers-data0@psg.com; Wed, 23 Sep 2009 17:32:53 +0000 Received: from [83.145.227.89] (helo=gusev.araneus.fi) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqVhr-000JXP-EE for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 17:32:50 +0000 Received: from guava.gson.org (guava.gson.org [83.145.227.105]) by gusev.araneus.fi (Postfix) with ESMTP id 618F191C09; Wed, 23 Sep 2009 20:32:29 +0300 (EEST) Received: by guava.gson.org (Postfix, from userid 101) id 8228075E40; Wed, 23 Sep 2009 20:32:38 +0300 (EEST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <19130.23478.495330.108734@guava.gson.org> Date: Wed, 23 Sep 2009 20:32:38 +0300 To: Paul Hoffman Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] Diffs in draft-ietf-dnsext-rfc3597-bis-00? In-Reply-To: References: <20090923153002.25E5D3A68B1@core3.amsl.com> X-Mailer: VM 7.19 under Emacs 21.4.1 From: Andreas Gustafsson Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Paul Hoffman wrote: > Is there a definitive list of the differences between this document > and RFC 3597, which it intends to replace? A short bit in the > introduction about the purpose of the revision, and a solid appendix > with the actual diffs, would be greatly appreciated. The purpose of the revision is to make it possible to advance the specification to Draft Standard. To that end: - The reference to the DNS IANA Considerations BCP (BCP42) has been changed from RFC2929 to the current version, RFC5395 - Downward references have been eliminated; specifically, the document no longer refers to RFC2163 or RFC2535. - IP addresses in examples have been changed to the 192.0.2.0/24 range per RFC3330 - The draft no longer specifies changes to the DNSSEC canonical form and ordering, as those changes have now been incorporated into the base DNSSEC specification. There has also been a number of editorial changes, for example to make the text in the Abstract and Introduction better reflect the current state of implementation. -- Andreas Gustafsson, gson@araneus.fi From owner-namedroppers@ops.ietf.org Wed Sep 23 10:50:17 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A086E3A68AA; Wed, 23 Sep 2009 10:50:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.174 X-Spam-Level: X-Spam-Status: No, score=-1.174 tagged_above=-999 required=5 tests=[AWL=-0.679, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Oa5HjJwEhPS4; Wed, 23 Sep 2009 10:50:14 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A955E3A6845; Wed, 23 Sep 2009 10:50:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqVwG-000LFy-Ox for namedroppers-data0@psg.com; Wed, 23 Sep 2009 17:47:36 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqVvY-000L8j-Dd for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 17:47:03 +0000 Received: from Puki.ogud.com (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n8NHkouX045377 for ; Wed, 23 Sep 2009 13:46:50 -0400 (EDT) (envelope-from ogud@ogud.com) Message-Id: <200909231746.n8NHkouX045377@stora.ogud.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Wed, 23 Sep 2009 11:58:26 -0400 To: IETF DNSEXT WG From: Olafur Gudmundsson Subject: Re: [dnsext] Editor needed In-Reply-To: References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <68241.1253688480@nsa.vix.com> <200909230733.n8N7Xugq025303@drugs.dv.isc.org> <86126.1253715716@nsa.vix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues, The chairs would like the circular arguments on this topic to come to an end. Plan: we will work with the editor to publish a new draft that incorporates the feedback received in this thread. This draft will be posted around before monday next week. Editor is checking on RFC1123 intent and ability to update that document. If you have NEW points that you want considered for the document feel free to post them. The next version of the document will make a clear separations between what is expected of implementations and what sites may (or may not) operationally do. Olafur & Andrew From owner-namedroppers@ops.ietf.org Wed Sep 23 10:54:31 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 782813A68E2; Wed, 23 Sep 2009 10:54:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.347 X-Spam-Level: X-Spam-Status: No, score=-4.347 tagged_above=-999 required=5 tests=[AWL=0.148, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x30RhZrwfsKN; Wed, 23 Sep 2009 10:54:30 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 971163A68AA; Wed, 23 Sep 2009 10:54:30 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqW0z-000Lmp-Hx for namedroppers-data0@psg.com; Wed, 23 Sep 2009 17:52:29 +0000 Received: from [192.245.12.227] (helo=balder-227.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqW0j-000LkT-Vt for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 17:52:27 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n8NHq627025371 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 23 Sep 2009 10:52:07 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <19130.23478.495330.108734@guava.gson.org> References: <20090923153002.25E5D3A68B1@core3.amsl.com> <19130.23478.495330.108734@guava.gson.org> Date: Wed, 23 Sep 2009 10:52:05 -0700 To: Andreas Gustafsson From: Paul Hoffman Subject: Re: [dnsext] Diffs in draft-ietf-dnsext-rfc3597-bis-00? Cc: namedroppers@ops.ietf.org Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 8:32 PM +0300 9/23/09, Andreas Gustafsson wrote: >Paul Hoffman wrote: >> Is there a definitive list of the differences between this document >> and RFC 3597, which it intends to replace? A short bit in the >> introduction about the purpose of the revision, and a solid appendix >> with the actual diffs, would be greatly appreciated. > >The purpose of the revision is to make it possible to advance the >specification to Draft Standard. To that end: > > - The reference to the DNS IANA Considerations BCP (BCP42) has > been changed from RFC2929 to the current version, RFC5395 > > - Downward references have been eliminated; specifically, > the document no longer refers to RFC2163 or RFC2535. > > - IP addresses in examples have been changed to the 192.0.2.0/24 > range per RFC3330 > > - The draft no longer specifies changes to the DNSSEC > canonical form and ordering, as those changes have > now been incorporated into the base DNSSEC specification. > >There has also been a number of editorial changes, for example to >make the text in the Abstract and Introduction better reflect the >current state of implementation. Thank you, but all that really should be in the draft (starting with the -01, of course) so that people reading the document now, or as an RFC, will know that. --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Wed Sep 23 11:22:13 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 57D9D3A698C; Wed, 23 Sep 2009 11:22:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.706 X-Spam-Level: X-Spam-Status: No, score=-4.706 tagged_above=-999 required=5 tests=[AWL=-0.269, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id quR0Qa2FIbfn; Wed, 23 Sep 2009 11:22:12 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2515D3A67AD; Wed, 23 Sep 2009 11:22:12 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqWR1-000PgT-8J for namedroppers-data0@psg.com; Wed, 23 Sep 2009 18:19:23 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqWQj-000Pd0-A0 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 18:19:12 +0000 Received: from sjc-office-nat-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id 94D00A9443E; Wed, 23 Sep 2009 18:19:04 +0000 (UTC) Message-ID: <4ABA6698.9020702@mail-abuse.org> Date: Wed, 23 Sep 2009 11:19:04 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.1) Gecko/20090715 Thunderbird/3.0b3 MIME-Version: 1.0 To: David Conrad CC: Paul Vixie , IETF DNSEXT WG Subject: Re: [dnsext] Editor needed (adopted alternative transport) References: <20090825224731.GJ4142@shinkuro.com> <200909230004.n8N04dr1018766@drugs.dv.isc.org> <200909230247.n8N2lq8d021037@drugs.dv.isc.org> <200909230358.n8N3weOK021831@drugs.dv.isc.org> <8DFF1C2F-884B-4E73-AAF4-4D01DE3C3E8C@virtualized.org> <200909230619.n8N6JBAx024293@drugs.dv.isc.org> <68241.1253688480@nsa.vix.com> <200909230733.n8N7Xugq025303@drugs.dv.isc.org> <86126.1253715716@nsa.vix.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/23/09 8:32 AM, David Conrad wrote: > > I don't think so. Some are questioning whether an implementation > that does not support TCP can truthfully be called a full, standards > compliant implementation of DNS. If you want to call a TCP-less > implementation a subset of DNS, I can't see how anyone could > complain. David, It is conceivable, perhaps to limit the state held at servers or intervening equipment of limited resource, that other alternative transports to TCP might become employed. Rather than being specific about the alternative, just acknowledge a need to handle larger DNS messages without mandating use of TCP, which could forever leave DNS handicapped with a resource hungry transport. RFC1123: 6.1.3.2 Transport Protocols |-- DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP, for sending (non-zone-transfer) queries. Specifically, a DNS resolver or server that is sending a non-zone-transfer query MUST send a UDP query first. If the Answer section of the response is truncated and if the requester supports TCP, it SHOULD try the query again using TCP. |-- Change to: ,--- DNS servers MUST be able to service UDP queries and SHOULD be able to service queries over TCP or an adopted alternative transport. A name server MAY limit the resources it devotes to TCP queries, but it SHOULD NOT refuse to service a TCP query just because it would have succeeded with UDP. Servers supporting DNSSEC MUST be able to handle DNS messages exceeding 1000 bytes over a transport other than UDP. However, a DNS resolver or server sending a non-zone-transfer query MUST send it either over UDP or the adopted alternative transport first. '--- |-- By private agreement, name servers and resolvers MAY arrange to use TCP for all traffic between themselves. TCP MUST be used for zone transfers. A DNS server MUST have sufficient internal concurrency that it can continue to process UDP queries while awaiting a response or performing a zone transfer on an open TCP connection [DNS:2]. |-- Change to: ,--- By private agreement, name servers and resolvers MAY arrange to use TCP or an adopted alternative transports for all traffic between themselves. A transport that supports congestion avoidance MUST be used for zone transfers. A DNS server MUST have sufficient internal concurrency that it can continue to process UDP queries while awaiting a response or performing a zone transfer over TCP or an adopted alternative transport. '--- -Doug From owner-namedroppers@ops.ietf.org Wed Sep 23 12:04:55 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E2D653A69F4; Wed, 23 Sep 2009 12:04:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.107 X-Spam-Level: X-Spam-Status: No, score=0.107 tagged_above=-999 required=5 tests=[AWL=-0.020, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yJC0+vo6qT8O; Wed, 23 Sep 2009 12:04:55 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id ECB863A68C5; Wed, 23 Sep 2009 12:04:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqX5f-0006SP-4f for namedroppers-data0@psg.com; Wed, 23 Sep 2009 19:01:23 +0000 Received: from [209.85.222.191] (helo=mail-pz0-f191.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqX5E-0006Gu-FI for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 19:01:12 +0000 Received: by pzk29 with SMTP id 29so793129pzk.33 for ; Wed, 23 Sep 2009 12:00:55 -0700 (PDT) MIME-Version: 1.0 Received: by 10.115.102.38 with SMTP id e38mr4337738wam.207.1253732455100; Wed, 23 Sep 2009 12:00:55 -0700 (PDT) Date: Wed, 23 Sep 2009 12:00:55 -0700 Message-ID: Subject: [dnsext] Protocol standards and implementations vs. configurations From: Matthew Dempsky To: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 23, 2009 at 6:59 AM, Tony Finch wrote: > That's an exception for a particular operational environment. RFC > requirements are about implementations. When they say an implementation > MUST implement something, that doesn't mean an operator can't turn it off. A few people have expressed this viewpoint, and I'd like to know if this is truly the view of this working group on what an IETF standard means. E.g., if RFC 1123 (or whichever) was to be updated to say "DNS servers MUST respond to queries sent over TCP", would it still be acceptable for a production DNS server to not respond to queries over TCP as long as the software allowed the operator to "turn it back on"? When I read an RFC, I interpret it as how I can expect other software to behave when deployed, not as how that software could theoretically behave if the operator configured it a particular way. As an implementor, the former is much more useful than the latter in ensuring interoperability. From owner-namedroppers@ops.ietf.org Wed Sep 23 12:04:57 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D9A553A69F4; Wed, 23 Sep 2009 12:04:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.69 X-Spam-Level: *** X-Spam-Status: No, score=3.69 tagged_above=-999 required=5 tests=[AWL=-0.560, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0bgerllkXcLl; Wed, 23 Sep 2009 12:04:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id F3A303A68C5; Wed, 23 Sep 2009 12:04:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqX6m-0006ht-LZ for namedroppers-data0@psg.com; Wed, 23 Sep 2009 19:02:32 +0000 Received: from [213.178.172.147] (helo=TR-Sys.de) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqX6R-0006aF-Vq for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 19:02:22 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3.2) id AA108282486; Wed, 23 Sep 2009 21:01:26 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id VAA06003; Wed, 23 Sep 2009 21:01:25 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <200909231901.VAA06003@TR-Sys.de> Subject: [dnsext] draft-ietf-dnsext-rfc3597-bis-00 To: gson@araneus.fi Date: Wed, 23 Sep 2009 21:01:25 +0200 (MESZ) Cc: namedroppers@ops.ietf.org X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Andreas, after a first glance at draft-ietf-dnsext-rfc3597-bis-00 : (1) Could you please add a summary "Differences from RFC 3597" section in the next draft revision? -- the IESG actually has made that mandatory anyway for Standards Track documents. Thanks in advance! (2) In the last para of section 1, I suggest to spell out "RFC 3597" in the prose for enhanced readability; the formal citation in the preceding paragraph should be sufficient. Perhaps, an explanation of the motivation/goal for the draft would be helpful for the reader; for instance: This document is a self-contained revised specification supplanting and obsoleting RFC 3597 in order to allow the specification to advance on the Standards Track. (3) For added precision and clarity, and as a service for the reader, I suggest to give more precise citations for the large Standard RFCs 1034, 1035, and 1123, indicating (where appropriate) the sections being referred to. Kind regards, Alfred. -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From owner-namedroppers@ops.ietf.org Wed Sep 23 13:28:50 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 096FD3A6882; Wed, 23 Sep 2009 13:28:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.166 X-Spam-Level: X-Spam-Status: No, score=-1.166 tagged_above=-999 required=5 tests=[AWL=-0.671, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4pVaboH0j6JJ; Wed, 23 Sep 2009 13:28:49 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 327113A683E; Wed, 23 Sep 2009 13:28:49 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqYMF-000HWT-NC for namedroppers-data0@psg.com; Wed, 23 Sep 2009 20:22:35 +0000 Received: from [66.92.146.20] (helo=stora.ogud.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqYM5-000HVg-PS for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 20:22:33 +0000 Received: from Puki.ogud.com (nyttbox.md.ogud.com [10.20.30.4]) by stora.ogud.com (8.14.3/8.14.3) with ESMTP id n8NKMNJn046614; Wed, 23 Sep 2009 16:22:23 -0400 (EDT) (envelope-from ogud@ogud.com) Message-Id: <200909232022.n8NKMNJn046614@stora.ogud.com> X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Wed, 23 Sep 2009 15:27:31 -0400 To: Matthew Dempsky , IETF DNSEXT WG From: Olafur Gudmundsson Subject: Re: [dnsext] Protocol standards and implementations vs. configurations In-Reply-To: References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed X-Scanned-By: MIMEDefang 2.64 on 66.92.146.20 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 15:00 23/09/2009, Matthew Dempsky wrote: >On Wed, Sep 23, 2009 at 6:59 AM, Tony Finch wrote: > > That's an exception for a particular operational environment. RFC > > requirements are about implementations. When they say an implementation > > MUST implement something, that doesn't mean an operator can't turn it off. > >A few people have expressed this viewpoint, and I'd like to know if >this is truly the view of this working group on what an IETF standard >means. E.g., if RFC 1123 (or whichever) was to be updated to say "DNS >servers MUST respond to queries sent over TCP", would it still be >acceptable for a production DNS server to not respond to queries over >TCP as long as the software allowed the operator to "turn it back on"? Matthew, This is an excellent question, Tony's opinion is close to my personal one. Standards track RFC specify what needs to be implemented. BCP's and Informational RFC's by groups in the OPS area suggest what are acceptable practices. Based on this a DNS authorative server that distributed without TCP support can not claim to be RFC compliant (IMHO). If a DNS resolver that supports TCP is configured by an administrator to not use TCP/53 then that operator is only hurting him/her-self and his/her customers. (I assume the operator has done his/her homework and determined this is safe to do. ) Shipping a non TCP supporting DNS software may hurt users that pick up the product and install it without thinking about the implications. >When I read an RFC, I interpret it as how I can expect other software >to behave when deployed, not as how that software could theoretically >behave if the operator configured it a particular way. As an >implementor, the former is much more useful than the latter in >ensuring interoperability. The way people can figure out how to mis-use tools has never stopped amazing me :-) but the largest group is going to use for the standard default configuration. Olafur From owner-namedroppers@ops.ietf.org Wed Sep 23 13:36:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DAF553A6889; Wed, 23 Sep 2009 13:36:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.585 X-Spam-Level: X-Spam-Status: No, score=-0.585 tagged_above=-999 required=5 tests=[AWL=-0.985, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nCTcnICdxIyK; Wed, 23 Sep 2009 13:36:14 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1F2483A6822; Wed, 23 Sep 2009 13:36:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqYX4-000Ifq-Q1 for namedroppers-data0@psg.com; Wed, 23 Sep 2009 20:33:46 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqYWl-000Ico-91 for namedroppers@ops.ietf.org; Wed, 23 Sep 2009 20:33:36 +0000 Received: from crankycanuck.ca (69-196-144-230.dsl.teksavvy.com [69.196.144.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 0CA0E2FE8CE3 for ; Wed, 23 Sep 2009 20:33:25 +0000 (UTC) Date: Wed, 23 Sep 2009 16:33:24 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] Protocol standards and implementations vs. configurations Message-ID: <20090923203324.GW4450@shinkuro.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 23, 2009 at 12:00:55PM -0700, Matthew Dempsky wrote: > means. E.g., if RFC 1123 (or whichever) was to be updated to say "DNS > servers MUST respond to queries sent over TCP", would it still be > acceptable for a production DNS server to not respond to queries over > TCP as long as the software allowed the operator to "turn it back on"? Please see Olafur's post from the Chairs from earlier. It is of course possible to have items that are mandatory to implement that might still not be used in particular environments. Rather than continuing to debate hypothetical changes to the text, I think it'd be really great if participants waited until the promised draft shows up, and then offered specific changes to that text. Thanks, A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From conservatoriesx@sfrestore.org Thu Sep 24 05:28:58 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4A7D33A69C1 for ; Thu, 24 Sep 2009 05:28:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -20.186 X-Spam-Level: X-Spam-Status: No, score=-20.186 tagged_above=-999 required=5 tests=[AWL=14.872, BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_BR=0.955, HELO_EQ_DSL=1.129, HELO_EQ_TELESP=1.245, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_RECV_SPAM_DOMN02=1.666, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xm8BrxS56qCr for ; Thu, 24 Sep 2009 05:28:57 -0700 (PDT) Received: from 201-43-13-136.dsl.telesp.net.br (201-43-13-136.dsl.telesp.net.br [201.43.13.136]) by core3.amsl.com (Postfix) with ESMTP id 5F6C23A695A for ; Thu, 24 Sep 2009 05:28:54 -0700 (PDT) Received: from 201.43.13.136 by hs1.sfrestore.org; Thu, 24 Sep 2009 09:29:43 -0300 From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Thu, 24 Sep 2009 09:29:43 -0300 Message-ID: <000d01ca3d12$b1b70df0$6400a8c0@conservatoriesx> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01CA3D12.B1B70DF0" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.3416 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527 Importance: Normal This is a multi-part message in MIME format. ------=_NextPart_000_0006_01CA3D12.B1B70DF0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0006_01CA3D12.B1B70DF0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

= review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0006_01CA3D12.B1B70DF0-- From larchesj760@robertspellman.com Thu Sep 24 08:06:17 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 711C33A6816 for ; Thu, 24 Sep 2009 08:06:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -54.597 X-Spam-Level: X-Spam-Status: No, score=-54.597 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_FAKE_RCVD_LINE_B=5.777, HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, URIBL_BLACK=20, URIBL_JP_SURBL=10, USER_IN_WHITELIST=-100, XMAILER_MIMEOLE_OL_7533E=0.513] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OJDAZ0oMQByS for ; Thu, 24 Sep 2009 08:06:16 -0700 (PDT) Received: from provedor.taquari.com (provedor.taquari.com [200.102.248.242]) by core3.amsl.com (Postfix) with ESMTP id 3A3493A67EE for ; Thu, 24 Sep 2009 08:06:16 -0700 (PDT) Received: from 200.102.248.242 by mail.robertspellman.com; Thu, 24 Sep 2009 12:07:21 -0300 Message-ID: <000d01ca3d28$b6fb7740$6400a8c0@larchesj760> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Thu, 24 Sep 2009 12:07:21 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3D28.B6FB7740" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4963.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4963.1700 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3D28.B6FB7740 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3D28.B6FB7740 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

= review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3D28.B6FB7740-- From owner-namedroppers@ops.ietf.org Thu Sep 24 09:20:35 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 597C93A690C; Thu, 24 Sep 2009 09:20:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.501 X-Spam-Level: *** X-Spam-Status: No, score=3.501 tagged_above=-999 required=5 tests=[AWL=-0.749, BAYES_00=-2.599, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5hkjbrV0+2td; Thu, 24 Sep 2009 09:20:34 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5DEAB3A68F1; Thu, 24 Sep 2009 09:20:34 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mqqup-0001EE-QJ for namedroppers-data0@psg.com; Thu, 24 Sep 2009 16:11:31 +0000 Received: from [213.178.172.147] (helo=TR-Sys.de) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mqqu0-00019p-Bd for namedroppers@ops.ietf.org; Thu, 24 Sep 2009 16:11:18 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3.2) id AA115668591; Thu, 24 Sep 2009 18:09:51 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id SAA08097; Thu, 24 Sep 2009 18:09:50 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <200909241609.SAA08097@TR-Sys.de> Subject: [dnsext] Two more details in draft-ietf-dnsext-rfc3597-bis-00 To: gson@araneus.fi, namedroppers@ops.ietf.org Date: Thu, 24 Sep 2009 18:09:50 +0200 (MESZ) X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: I have consulted the notes I had made many years ago on RFC 3597, and after a closer look at the new draft text, I suggest two small changes, which can well be considered as merely editorial: (1) Section 2, last para The draft says: vv | In the case of a type whose RDATA format is class specific, an RR is considered to be of unknown type when the RDATA format for that combination of type and class is not known. An implementation for which a given RR type is "unknown" is unable to verify the precondition in that sentence. As a remedy, I suggest to insert "known to be": vvvvvvvvvvvvvvv | In the case of a type whose RDATA format is known to be class specific, an RR is considered to be of unknown type when the RDATA format for that combination of type and class is not known. (2) Section 4, 3rd para The draft says: Receiving servers MUST decompress domain names in RRs of well-known type, and SHOULD also decompress RRs of type RP, AFSDB, RT, SIG, PX, | NXT, NAPTR, and SRV to ensure interoperability with implementations predating [RFC3597]. A closer look at the RR type registry reveals that the given list of exceptional RR types -- looking weird at first glance -- in fact is ordered by ascending numerical RR type -- with one single exception: NAPTR and SRV ! I guess this was a clerical error in RFC 3597. To achieve systematic list ordering, these two names should be swapped: Receiving servers MUST decompress domain names in RRs of well-known type, and SHOULD also decompress RRs of type RP, AFSDB, RT, SIG, PX, | NXT, SRV, and NAPTR to ensure interoperability with implementations ^^^ ^^^^^ predating [RFC3597]. Kind regards, Alfred. -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From slowseld32@sex.com Thu Sep 24 11:35:09 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A74633A69F5; Thu, 24 Sep 2009 11:35:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -31.106 X-Spam-Level: X-Spam-Status: No, score=-31.106 tagged_above=-999 required=5 tests=[AWL=-4.042, BAYES_95=3, FH_FAKE_RCVD_LINE_B=5.777, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_DYNAMIC_SPLIT_IP=3.493, HELO_EQ_BR=0.955, HELO_EQ_DSL=1.129, HELO_EQ_DYNAMIC=1.144, HELO_EQ_IP_ADDR=1.119, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RCVD_NUMERIC_HELO=2.067, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_JP_SURBL=10, USER_IN_WHITELIST=-100, XMAILER_MIMEOLE_OL_3AC1D=0.688] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RJrq4952Io1t; Thu, 24 Sep 2009 11:35:09 -0700 (PDT) Received: from 189.27.252.98.dynamic.adsl.gvt.net.br (189.27.252.98.dynamic.adsl.gvt.net.br [189.27.252.98]) by core3.amsl.com (Postfix) with ESMTP id 94E203A68C2; Thu, 24 Sep 2009 11:35:08 -0700 (PDT) Received: from 189.27.252.98 by alt2.aspmx.l.google.com; Thu, 24 Sep 2009 15:35:53 -0300 Message-ID: <000d01ca3d45$d8e933c0$6400a8c0@slowseld32> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Thu, 24 Sep 2009 15:35:53 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3D45.D8E933C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3D45.D8E933C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Taxpayer ID: edu-discuss-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: edu-discuss-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3D45.D8E933C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: edu-discuss-000= 00174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax s= tatement for taxpayer id: edu-discuss-00000174073547US<= /p>

Internal Revenue Service

------=_NextPart_000_0007_01CA3D45.D8E933C0-- From owner-namedroppers@ops.ietf.org Thu Sep 24 11:50:36 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 202093A67AF; Thu, 24 Sep 2009 11:50:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.17 X-Spam-Level: X-Spam-Status: No, score=-102.17 tagged_above=-999 required=5 tests=[AWL=0.430, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S5NP7zvyU6Ix; Thu, 24 Sep 2009 11:50:34 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B17433A68A0; Thu, 24 Sep 2009 11:50:34 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqtKx-000H0D-UW for namedroppers-data0@psg.com; Thu, 24 Sep 2009 18:46:39 +0000 Received: from [2001:1890:1112:1::20] (helo=mail.ietf.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MqtKW-000Guv-8S for namedroppers@ops.ietf.org; Thu, 24 Sep 2009 18:46:28 +0000 Received: by core3.amsl.com (Postfix, from userid 0) id E649C3A6838; Thu, 24 Sep 2009 11:45:01 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Cc: namedroppers@ops.ietf.org Subject: [dnsext] I-D Action:draft-ietf-dnsext-rfc2672bis-dname-17.txt Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20090924184501.E649C3A6838@core3.amsl.com> Date: Thu, 24 Sep 2009 11:45:01 -0700 (PDT) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Extensions Working Group of the IETF. Title : Update to DNAME Redirection in the DNS Author(s) : S. Rose, W. Wijngaards Filename : draft-ietf-dnsext-rfc2672bis-dname-17.txt Pages : 17 Date : 2009-09-24 The DNAME record provides redirection for a sub-tree of the domain name tree in the DNS system. That is, all names that end with a particular suffix are redirected to another part of the DNS. This is a revision of the original specification in RFC 2672, also aligning RFC 3363 and RFC 4294 with this revision. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-dnsext-rfc2672bis-dname-17.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-dnsext-rfc2672bis-dname-17.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2009-09-24113455.I-D@ietf.org> --NextPart-- From owner-namedroppers@ops.ietf.org Thu Sep 24 12:17:38 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2E0F23A690D; Thu, 24 Sep 2009 12:17:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.898 X-Spam-Level: X-Spam-Status: No, score=-0.898 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4gRRYNPZLJoh; Thu, 24 Sep 2009 12:17:37 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2D24D3A67CF; Thu, 24 Sep 2009 12:17:37 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mqtls-000L8e-Ke for namedroppers-data0@psg.com; Thu, 24 Sep 2009 19:14:28 +0000 Received: from [83.145.227.89] (helo=gusev.araneus.fi) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mqtli-000L7S-F4 for namedroppers@ops.ietf.org; Thu, 24 Sep 2009 19:14:26 +0000 Received: from guava.gson.org (guava.gson.org [83.145.227.105]) by gusev.araneus.fi (Postfix) with ESMTP id 2C57291C09; Thu, 24 Sep 2009 22:14:03 +0300 (EEST) Received: by guava.gson.org (Postfix, from userid 101) id 54CBC75F44; Thu, 24 Sep 2009 22:14:14 +0300 (EEST) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Message-ID: <19131.50438.280445.497933@guava.gson.org> Date: Thu, 24 Sep 2009 22:14:14 +0300 To: Alfred =?hp-roman8?B?SM5uZXM=?= Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-ietf-dnsext-rfc3597-bis-00 In-Reply-To: <200909231901.VAA06003@TR-Sys.de> References: <200909231901.VAA06003@TR-Sys.de> X-Mailer: VM 7.19 under Emacs 21.4.1 From: Andreas Gustafsson Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Alfred H=CEnes wrote: > Andreas, > after a first glance at draft-ietf-dnsext-rfc3597-bis-00 : >=20 > (1) > Could you please add a summary "Differences from RFC 3597" section > in the next draft revision=3F -- the IESG actually has made that > mandatory anyway for Standards Track documents. Paul Hoffman also requested such a list of changes. I will add one to the next revision. > (2) > In the last para of section 1, I suggest to spell out "RFC 3597" > in the prose for enhanced readability; the formal citation in > the preceding paragraph should be sufficient. > Perhaps, an explanation of the motivation/goal for the draft > would be helpful for the reader; for instance: >=20 > This document is a self-contained revised specification supplantin= g > and obsoleting RFC 3597 in order to allow the specification to > advance on the Standards Track. I will add some text to this effect. > (3) > For added precision and clarity, and as a service for the reader, > I suggest to give more precise citations for the large Standard RFCs > 1034, 1035, and 1123, indicating (where appropriate) the sections > being referred to. I will update the text to clarify that section 3 of the draft is referring to RFC1123 section 6.1.5.3, and that section 5 of the draft is referring to RFC1035 section 5.1. The reference to RFC1034 is not intended to target any specific section. Regards, --=20 Andreas Gustafsson, gson@araneus.fi From machismowjb9567@rossmortgageco.com Thu Sep 24 12:18:24 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 822143A690D; Thu, 24 Sep 2009 12:18:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -73.105 X-Spam-Level: X-Spam-Status: No, score=-73.105 tagged_above=-999 required=5 tests=[BAYES_80=2, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_BR=0.955, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_PH_SURBL=1.787, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tXMLpjQSb3+4; Thu, 24 Sep 2009 12:18:20 -0700 (PDT) Received: from 200-219-91-158.ggs6102.3g.brasiltelecom.net.br (200-219-89-142.ggs6102.3g.brasiltelecom.net.br [200.219.89.142]) by core3.amsl.com (Postfix) with ESMTP id C4A033A67B6; Thu, 24 Sep 2009 12:18:18 -0700 (PDT) Received: from 200.219.89.142 by mail.rossmortgageco.com; Thu, 24 Sep 2009 16:18:59 -0300 Message-ID: <000d01ca3d4b$de2f3e00$6400a8c0@machismowjb9567> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Thu, 24 Sep 2009 16:18:59 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3D4B.DE2F3E00" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3D4B.DE2F3E00 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: esds-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: esds-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3D4B.DE2F3E00 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: esds-0000017407= 3547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for t= axpayer id: esds-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3D4B.DE2F3E00-- From owner-namedroppers@ops.ietf.org Thu Sep 24 12:21:34 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1730B3A67CF; Thu, 24 Sep 2009 12:21:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.861 X-Spam-Level: X-Spam-Status: No, score=-0.861 tagged_above=-999 required=5 tests=[AWL=-0.112, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UdFPMKQ0hv1b; Thu, 24 Sep 2009 12:21:33 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 329D028C113; Thu, 24 Sep 2009 12:21:33 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mqtq9-000Lou-HC for namedroppers-data0@psg.com; Thu, 24 Sep 2009 19:18:53 +0000 Received: from [83.145.227.89] (helo=gusev.araneus.fi) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mqtpw-000Llr-NA for namedroppers@ops.ietf.org; Thu, 24 Sep 2009 19:18:51 +0000 Received: from guava.gson.org (guava.gson.org [83.145.227.105]) by gusev.araneus.fi (Postfix) with ESMTP id 023CD91C0D; Thu, 24 Sep 2009 22:18:26 +0300 (EEST) Received: by guava.gson.org (Postfix, from userid 101) id 850CC75F44; Thu, 24 Sep 2009 22:18:39 +0300 (EEST) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Message-ID: <19131.50703.477211.337538@guava.gson.org> Date: Thu, 24 Sep 2009 22:18:39 +0300 To: Alfred =?hp-roman8?B?SM5uZXM=?= Cc: namedroppers@ops.ietf.org Subject: [dnsext] Re: Two more details in draft-ietf-dnsext-rfc3597-bis-00 In-Reply-To: <200909241609.SAA08097@TR-Sys.de> References: <200909241609.SAA08097@TR-Sys.de> X-Mailer: VM 7.19 under Emacs 21.4.1 From: Andreas Gustafsson Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Alfred H=CEnes wrote: > I have consulted the notes I had made many years ago on RFC 3597, > and after a closer look at the new draft text, I suggest two small > changes, which can well be considered as merely editorial: Both of your suggested changes will be in the next revision of the draft. Thank you for your comments! Regards, --=20 Andreas Gustafsson, gson@araneus.fi From marylou3@rhic.com Thu Sep 24 12:22:10 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 90CF53A6A0E for ; Thu, 24 Sep 2009 12:22:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -75.863 X-Spam-Level: X-Spam-Status: No, score=-75.863 tagged_above=-999 required=5 tests=[BAYES_95=3, FH_FAKE_RCVD_LINE_B=5.777, HELO_EQ_BR=0.955, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, SARE_RECV_VIRTUACOMBR=1.193, SPAMMY_XMAILER=2.337, URIBL_PH_SURBL=1.787, USER_IN_WHITELIST=-100, XMAILER_MIMEOLE_OL_91287=1.894] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gVk5aOXLn5PH for ; Thu, 24 Sep 2009 12:22:09 -0700 (PDT) Received: from c953931b.virtua.com.br (c953931b.virtua.com.br [201.83.147.27]) by core3.amsl.com (Postfix) with ESMTP id 6F5F73A69FD for ; Thu, 24 Sep 2009 12:22:09 -0700 (PDT) Received: from 201.83.147.27 by rhi.s8b2.psmtp.com; Thu, 24 Sep 2009 16:22:07 -0300 Message-ID: <000d01ca3d4c$4e9d2210$6400a8c0@marylou3> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Thu, 24 Sep 2009 16:22:07 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3D4C.4E9D2210" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4807.2300 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.2300 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3D4C.4E9D2210 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3D4C.4E9D2210 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

= review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3D4C.4E9D2210-- From rusticmd68@rc-eville.com Thu Sep 24 14:42:40 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 621A93A6938 for ; Thu, 24 Sep 2009 14:42:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -68.934 X-Spam-Level: X-Spam-Status: No, score=-68.934 tagged_above=-999 required=5 tests=[BAYES_99=3.5, HELO_EQ_BR=0.955, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, URIBL_BLACK=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GFG-al0-yAfi for ; Thu, 24 Sep 2009 14:42:38 -0700 (PDT) Received: from 201009131173.user.veloxzone.com.br (201009131173.user.veloxzone.com.br [201.9.131.173]) by core3.amsl.com (Postfix) with ESMTP id 74DEB28C0F6 for ; Thu, 24 Sep 2009 14:42:33 -0700 (PDT) Received: from 201.9.131.173 by mail.rc-eville.com; Thu, 24 Sep 2009 18:43:34 -0300 From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Thu, 24 Sep 2009 18:43:34 -0300 Message-ID: <000d01ca3d60$10d500b0$6400a8c0@rusticmd68> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01CA3D60.10D500B0" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.3416 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2663 Importance: Normal This is a multi-part message in MIME format. ------=_NextPart_000_0006_01CA3D60.10D500B0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0006_01CA3D60.10D500B0 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0006_01CA3D60.10D500B0-- From jsimon@afterbot.com Thu Sep 24 16:54:02 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51C073A6819 for ; Thu, 24 Sep 2009 16:54:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -38.965 X-Spam-Level: X-Spam-Status: No, score=-38.965 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_RELAY_NODNS=1.451, HELO_EQ_AU=0.377, HTML_IMAGE_ONLY_08=1.787, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.001, MIME_HTML_ONLY=1.457, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_NONE=0.1, SARE_HTML_IMG_ONLY=1.666, URIBL_AB_SURBL=10, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KIOhdTJHshii for ; Thu, 24 Sep 2009 16:53:56 -0700 (PDT) Received: from afic.com.au (unknown [190.190.117.130]) by core3.amsl.com (Postfix) with SMTP id 7846E3A67B1 for ; Thu, 24 Sep 2009 16:53:55 -0700 (PDT) To: Subject: You probably gave wrong number From: MIME-Version: 1.0 Importance: High Content-Type: text/html Message-Id: <20090924235355.7846E3A67B1@core3.amsl.com> Date: Thu, 24 Sep 2009 16:53:55 -0700 (PDT) Improving your lover's characteristics and as a result, your self-respect! Show picture and go to site now! From kamehamehah561@ishikawa-hsp.com Fri Sep 25 01:00:34 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B29DA3A6929; Fri, 25 Sep 2009 01:00:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.748 X-Spam-Level: *** X-Spam-Status: No, score=3.748 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DIET_1=0.083, FH_FAKE_RCVD_LINE=10.357, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, FS_START_LOSE=1.493, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_DOUBLE_IP_SPAM=3.798, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_RECV_IP_FROMIP1=1.666, SUBJECT_DIET=1.466, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_SBL=20, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DjcIEKqsUoJx; Fri, 25 Sep 2009 01:00:34 -0700 (PDT) Received: from 88-134-106-112-dynip.superkabel.de (88-134-106-112-dynip.superkabel.de [88.134.106.112]) by core3.amsl.com (Postfix) with ESMTP id 7A9E93A67AC; Fri, 25 Sep 2009 01:00:33 -0700 (PDT) Received: from 88.134.106.112 by 218.216.66.146; Fri, 25 Sep 2009 10:01:38 +0100 Message-ID: <000d01ca3db6$68badf60$6400a8c0@kamehamehah561> From: Shauna Simon To: Subject: Lose 12lbs in 1 month Date: Fri, 25 Sep 2009 10:01:38 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3DB6.68BADF60" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2741.2600 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2741.2600 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3DB6.68BADF60 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Trouble viewing this email? View it in a web=20 browser.=20 =20 =20 =20 =20 =20 =20 =20 Dear, dnsext-archive, You're=20 Invited=20 =20 =20 Limited amount of free trials left, click and qualify for now.   Ring the bell Know=20 someone else who might be interested? Forward them a copy of=20 this email.=20 =20 About | Manage Account | Unsubscribe | Legal=20 notice =20 ------=_NextPart_000_0007_01CA3DB6.68BADF60 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Trouble viewing this email? View it in a web=20 browser.

Limited amount of free trials left, click and qualify= for now.
 


Know= =20 someone else who might be interested? Forward them a copy of=20 this email.
Dear, dnsext-archive, You= 're=20 Invited
About | Manage Account | Unsubscribe | Legal=20 notice
------=_NextPart_000_0007_01CA3DB6.68BADF60-- From owner-namedroppers@ops.ietf.org Fri Sep 25 02:20:29 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EC48C3A6894; Fri, 25 Sep 2009 02:20:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.421 X-Spam-Level: ** X-Spam-Status: No, score=2.421 tagged_above=-999 required=5 tests=[AWL=-2.015, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_EQ_RU=0.595, HELO_MISMATCH_RU=3.1, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AZA2coTH8JYv; Fri, 25 Sep 2009 02:20:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 14FC03A67F9; Fri, 25 Sep 2009 02:20:28 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mr6sx-000NFt-8D for namedroppers-data0@psg.com; Fri, 25 Sep 2009 09:14:39 +0000 Received: from [87.245.158.60] (helo=mx.cryptocom.ru) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mr6sk-000ND9-LU for namedroppers@ops.ietf.org; Fri, 25 Sep 2009 09:14:36 +0000 Received: from localhost (localhost [127.0.0.1]) by mx.cryptocom.ru (Postfix) with ESMTP id 1A3E43EC24; Fri, 25 Sep 2009 13:14:23 +0400 (MSD) X-Virus-Scanned: Debian amavisd-new at cryptocom.ru Received: from mx.cryptocom.ru ([127.0.0.1]) by localhost (mx.cryptocom.ru [127.0.0.1]) (amavisd-new, port 10024) with LMTP id Shre2xdUTQ8h; Fri, 25 Sep 2009 13:14:22 +0400 (MSD) Received: from [10.51.22.241] (reedcat.lan.cryptocom.ru [10.51.22.241]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.cryptocom.ru (Postfix) with ESMTP id A17333EC08; Fri, 25 Sep 2009 13:14:22 +0400 (MSD) Message-ID: <4ABC89EE.2070002@cryptocom.ru> Date: Fri, 25 Sep 2009 13:14:22 +0400 From: Basil Dolmatov User-Agent: Thunderbird 2.0.0.23 (X11/20090817) MIME-Version: 1.0 To: =?UTF-8?B?QWxmcmVkIO+/vQ==?= CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] draft-dolmatov-dnsext-dnssec-gost-01 technical & editorial issues References: <200909171025.MAA15356@TR-Sys.de> <4AB9F658.6080608@cryptocom.ru> In-Reply-To: <4AB9F658.6080608@cryptocom.ru> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Basil Dolmatov пишет: > > > Alfred � пишет: >> >> >> (4) Editorials >> >> > Thank you, Alfred. > > All editorials are applied and draft is resubmitted under the name > draft-ietf-dnsext-dnssec-gost-00 > > After some time I think it will appear in the database. > The draft is available. http://www.ietf.org/id/draft-ietf-dnsext-dnssec-gost-00.txt dol@ > doL@ > From dates6@sdsmartlogistics.com Fri Sep 25 03:10:32 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8A2A63A6A2A; Fri, 25 Sep 2009 03:10:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -34.878 X-Spam-Level: X-Spam-Status: No, score=-34.878 tagged_above=-999 required=5 tests=[AWL=-5.708, BAYES_60=1, FH_FAKE_RCVD_LINE_B=5.777, FH_HOST_EQ_D_D_D_D=0.765, HELO_DYNAMIC_IPADDR=2.426, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100, XMAILER_MIMEOLE_OL_CAC8F=0.417] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UJSOkOOkh4M6; Fri, 25 Sep 2009 03:10:31 -0700 (PDT) Received: from triband-mum-120.62.0.77.mtnl.net.in (triband-mum-120.62.0.90.mtnl.net.in [120.62.0.90]) by core3.amsl.com (Postfix) with ESMTP id DFF183A6948; Fri, 25 Sep 2009 03:10:30 -0700 (PDT) Received: from 120.62.0.90 by email.sdsmartlogistics.com; Fri, 25 Sep 2009 15:41:19 +0530 Message-ID: <000d01ca3dc8$86cf3340$6400a8c0@dates6> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Fri, 25 Sep 2009 15:41:19 +0530 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3DC8.86CF3340" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.71.1712.3 X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3DC8.86CF3340 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Taxpayer ID: rmt-request-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: rmt-request-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3DC8.86CF3340 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: rmt-request-000= 00174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax= statement for taxpayer id: rmt-request-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3DC8.86CF3340-- From overexposuref9@rock108.com Fri Sep 25 05:25:44 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B2A5F3A67E6; Fri, 25 Sep 2009 05:25:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -43.071 X-Spam-Level: X-Spam-Status: No, score=-43.071 tagged_above=-999 required=5 tests=[AWL=1.940, BAYES_60=1, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787, USER_IN_WHITELIST=-100, XMAILER_MIMEOLE_OL_83BF7=2.069] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3LbUISTjXc9W; Fri, 25 Sep 2009 05:25:44 -0700 (PDT) Received: from st-217-129-72-161.netvisao.pt (st-217-129-72-161.netvisao.pt [217.129.72.161]) by core3.amsl.com (Postfix) with ESMTP id AF6A73A681B; Fri, 25 Sep 2009 05:25:43 -0700 (PDT) Received: from 217.129.72.161 by mail.rock108.com; Fri, 25 Sep 2009 13:26:49 +0000 Message-ID: <000d01ca3ddb$7446a740$6400a8c0@overexposuref9> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Fri, 25 Sep 2009 13:26:49 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3DDB.7446A740" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.3110.3 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3DDB.7446A740 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dhcwg-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dhcwg-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3DDB.7446A740 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dhcwg-000001740= 73547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement fo= r taxpayer id: dhcwg-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3DDB.7446A740-- From featheredk4367@rapphydema.com Fri Sep 25 05:27:32 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 043353A6829 for ; Fri, 25 Sep 2009 05:27:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -40.202 X-Spam-Level: X-Spam-Status: No, score=-40.202 tagged_above=-999 required=5 tests=[AWL=3.065, BAYES_95=3, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_DSL=1.129, HELO_EQ_PL=1.135, HOST_EQ_PL=1.95, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_PH_SURBL=1.787, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5aBbkmEhM0BS for ; Fri, 25 Sep 2009 05:27:31 -0700 (PDT) Received: from 77-253-170-32.adsl.inetia.pl (77-253-170-32.adsl.inetia.pl [77.253.170.32]) by core3.amsl.com (Postfix) with ESMTP id 04E4D3A67E6 for ; Fri, 25 Sep 2009 05:27:27 -0700 (PDT) Received: from 77.253.170.32 by relay.rapphydema.com; Fri, 25 Sep 2009 14:28:34 +0100 From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Fri, 25 Sep 2009 14:28:34 +0100 Message-ID: <000d01ca3ddb$b310df40$6400a8c0@featheredk4367> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01CA3DDB.B310DF40" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2663 Importance: Normal This is a multi-part message in MIME format. ------=_NextPart_000_000E_01CA3DDB.B310DF40 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_000E_01CA3DDB.B310DF40 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_000E_01CA3DDB.B310DF40-- From tootedki65@sequem.fr Fri Sep 25 05:29:54 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1DE593A679C; Fri, 25 Sep 2009 05:29:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -26.791 X-Spam-Level: X-Spam-Status: No, score=-26.791 tagged_above=-999 required=5 tests=[AWL=-15.599, BAYES_80=2, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_BR=0.955, HELO_EQ_DSL=1.129, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9bgfc-fyODV7; Fri, 25 Sep 2009 05:29:53 -0700 (PDT) Received: from 200-163-8-83.bsace705.dsl.brasiltelecom.net.br (200-163-8-83.bsace705.dsl.brasiltelecom.net.br [200.163.8.83]) by core3.amsl.com (Postfix) with ESMTP id F389E3A681B; Fri, 25 Sep 2009 05:29:52 -0700 (PDT) Received: from 200.163.8.83 by smtp1.lerelaisinternet.com; Fri, 25 Sep 2009 09:30:55 -0300 Message-ID: <000d01ca3ddc$071952c0$6400a8c0@tootedki65> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Fri, 25 Sep 2009 09:30:55 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3DDC.071952C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4807.1700 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3DDC.071952C0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3DDC.071952C0 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

revi= ew tax statement for taxpayer id: dnsext-archive-00000174073547US<= /a>

Internal Revenue Service

------=_NextPart_000_0007_01CA3DDC.071952C0-- From again38@sanwapap.co.jp Fri Sep 25 07:56:49 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AEF2128C112 for ; Fri, 25 Sep 2009 07:56:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -35.137 X-Spam-Level: X-Spam-Status: No, score=-35.137 tagged_above=-999 required=5 tests=[AWL=-2.337, BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_BR=0.955, HELO_EQ_DSL=1.129, HELO_EQ_TELESP=1.245, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_RECV_SPAM_DOMN02=1.666, SPAMMY_XMAILER=2.337, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b0IRIpPPPoNp for ; Fri, 25 Sep 2009 07:56:48 -0700 (PDT) Received: from 201-42-167-121.dsl.telesp.net.br (201-42-167-121.dsl.telesp.net.br [201.42.167.121]) by core3.amsl.com (Postfix) with ESMTP id 1E3DB28B56A for ; Fri, 25 Sep 2009 07:56:47 -0700 (PDT) Received: from 201.42.167.121 by rs3.mediawars.ne.jp; Fri, 25 Sep 2009 11:57:50 -0300 Message-ID: <000d01ca3df0$8d33ad60$6400a8c0@again38> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Fri, 25 Sep 2009 11:57:50 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3DF0.8D33AD60" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.2106.4 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3DF0.8D33AD60 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3DF0.8D33AD60 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3DF0.8D33AD60-- From owner-namedroppers@ops.ietf.org Fri Sep 25 21:46:48 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A19B328B23E; Fri, 25 Sep 2009 21:46:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.064 X-Spam-Level: X-Spam-Status: No, score=-0.064 tagged_above=-999 required=5 tests=[AWL=-1.058, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AndLlHPMXcn5; Fri, 25 Sep 2009 21:46:48 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B6C3E3A67F2; Fri, 25 Sep 2009 21:46:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MrP5M-0003Lm-8C for namedroppers-data0@psg.com; Sat, 26 Sep 2009 04:40:40 +0000 Received: from [204.14.89.4] (helo=mail2.fluidhosting.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MrP5C-0003K7-HF for namedroppers@ops.ietf.org; Sat, 26 Sep 2009 04:40:38 +0000 Received: (qmail 10291 invoked by uid 399); 26 Sep 2009 04:40:28 -0000 Received: from localhost (HELO foreign.dougb.net) (dougb@dougbarton.us@127.0.0.1) by localhost with ESMTPAM; 26 Sep 2009 04:40:28 -0000 X-Originating-IP: 127.0.0.1 X-Sender: dougb@dougbarton.us Message-ID: <4ABD9B35.7030101@dougbarton.us> Date: Fri, 25 Sep 2009 21:40:21 -0700 From: Doug Barton User-Agent: Thunderbird 2.0.0.23 (X11/20090822) MIME-Version: 1.0 To: Jelte Jansen CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> In-Reply-To: <4AB09915.2010801@isc.org> X-Enigmail-Version: 0.96.0 OpenPGP: id=D5B2F0FB Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Jelte Jansen wrote: > which I also happened to have chosen for my implementation of RSA/SHA2 in ldns > (as well as 9, 10 and 11, back when the first last call was done and the draft > had 4 different algorithms). Those have 'escaped' through a nice combination of > expecting the draft to become an rfc as it was, and some communication errors, > so now there might be validators out there that expect algorithm 8 to mean > RSA/SHA256, even if the actual algorithm id turns out to be something else (or > even if the draft is completely turned down). > > Which now means that if we want to be sure that nobody gets unexpected failures, > IANA should assign numbers 8 and 10 to RSA/SHA256 and RSA/SHA512, and 9 and 11 > should be marked as don't-use-in-the-forseeable-future... > > and we need to figure out a way to prevent people like me from making the same > mistake :) IANA could kill two birds with one stone by not assigning 8-11 "in the foreseeable future" and assigning something totally different to RSA/SHA{256|512}. There is a special place reserved in hell for people who hijack code points (and port numbers, etc. etc.). Making examples of you (and those who relied on you) should hopefully serve as the "way to prevent people like you from making the same mistake." And yes, I'm serious. Doug From lamarcaeambrog@campinglebalze.com Fri Sep 25 22:43:47 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 317C728B23E; Fri, 25 Sep 2009 22:43:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.723 X-Spam-Level: X-Spam-Status: No, score=-3.723 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_BR=0.955, HELO_EQ_DSL=1.129, HELO_EQ_TELESP=1.245, HOST_EQ_BR=1.295, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, SARE_RECV_SPAM_DOMN02=1.666, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WYbP+I50noZN; Fri, 25 Sep 2009 22:43:39 -0700 (PDT) Received: from 201-95-77-198.dsl.telesp.net.br (201-95-77-198.dsl.telesp.net.br [201.95.77.198]) by core3.amsl.com (Postfix) with SMTP id 9E3963A67F2; Fri, 25 Sep 2009 22:43:31 -0700 (PDT) Date: Sat, 26 Sep 2009 01:44:41 -0500 Subject: Upgraded rep watches models from 2010 From: "Etta Duran" To: "Dewayne May" Message-ID: Content-Type: text/plain; Content-Transfer-Encoding: 7Bit It just came out... rep watches line on 2010... Just see them here http://tablebring.com/ From seabedf66@sfk-kiel.de Sat Sep 26 04:31:23 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BE2403A688B; Sat, 26 Sep 2009 04:31:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -26.134 X-Spam-Level: X-Spam-Status: No, score=-26.134 tagged_above=-999 required=5 tests=[AWL=-7.498, BAYES_80=2, HELO_DYNAMIC_CHELLO_NL=3.595, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100, XMAILER_MIMEOLE_OL_3D61D=0.392] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Js9XmNysOvL; Sat, 26 Sep 2009 04:31:23 -0700 (PDT) Received: from f110246.upc-f.chello.nl (f110246.upc-f.chello.nl [80.56.110.246]) by core3.amsl.com (Postfix) with ESMTP id CA3DB3A6863; Sat, 26 Sep 2009 04:31:21 -0700 (PDT) Received: from 80.56.110.246 by riemann-2.mvv.de; Sat, 26 Sep 2009 07:32:07 -0400 Message-ID: <000d01ca3e9c$fa8a0510$6400a8c0@seabedf66> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sat, 26 Sep 2009 07:32:07 -0400 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3E9C.FA8A0510" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.71.2244.8 X-MimeOLE: Produced By Microsoft MimeOLE V4.71.2244.8 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3E9C.FA8A0510 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: edu-discuss-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: edu-discuss-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3E9C.FA8A0510 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: edu-discuss-000= 00174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax= statement for taxpayer id: edu-discuss-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3E9C.FA8A0510-- From stoppagex066@rocroi.com Sat Sep 26 05:41:39 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A42D23A6358; Sat, 26 Sep 2009 05:41:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -29.11 X-Spam-Level: X-Spam-Status: No, score=-29.11 tagged_above=-999 required=5 tests=[AWL=1.971, BAYES_80=2, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_BR=0.955, HELO_EQ_DSL=1.129, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r5lQUYz1VJPw; Sat, 26 Sep 2009 05:41:38 -0700 (PDT) Received: from 200-138-35-189.ctame705.dsl.brasiltelecom.net.br (200-138-35-189.ctame705.dsl.brasiltelecom.net.br [200.138.35.189]) by core3.amsl.com (Postfix) with ESMTP id 0551F3A685B; Sat, 26 Sep 2009 05:41:37 -0700 (PDT) Received: from 200.138.35.189 by rocroi.com; Sat, 26 Sep 2009 17:11:22 +0430 Message-ID: <000d01ca3ea6$a710cdb0$6400a8c0@stoppagex066> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sat, 26 Sep 2009 17:11:22 +0430 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3EA6.A710CDB0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3EA6.A710CDB0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: esds-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: esds-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3EA6.A710CDB0 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: esds-0000017407= 3547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for= taxpayer id: esds-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3EA6.A710CDB0-- From conflictshf6@selenium.com.br Sat Sep 26 12:53:39 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 09E083A6989; Sat, 26 Sep 2009 12:53:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.29 X-Spam-Level: X-Spam-Status: No, score=-9.29 tagged_above=-999 required=5 tests=[AWL=-8.929, BAYES_99=3.5, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_DYNAMIC_SPLIT_IP=3.493, HELO_EQ_BR=0.955, HELO_EQ_DSL=1.129, HELO_EQ_DYNAMIC=1.144, HELO_EQ_IP_ADDR=1.119, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RCVD_NUMERIC_HELO=2.067, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id neuOagRdZkNN; Sat, 26 Sep 2009 12:53:38 -0700 (PDT) Received: from 189.26.64.180.dynamic.adsl.gvt.net.br (189.26.64.180.dynamic.adsl.gvt.net.br [189.26.64.180]) by core3.amsl.com (Postfix) with ESMTP id C62CB3A6407; Sat, 26 Sep 2009 12:53:37 -0700 (PDT) Received: from 189.26.64.180 by mail.selenium.com.br; Sat, 26 Sep 2009 16:54:39 -0300 From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sat, 26 Sep 2009 16:54:39 -0300 Message-ID: <000d01ca3ee3$2ee04b30$6400a8c0@conflictshf6> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01CA3EE3.2EE04B30" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830 Importance: Normal This is a multi-part message in MIME format. ------=_NextPart_000_000E_01CA3EE3.2EE04B30 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Taxpayer ID: edu-discuss-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below): review tax statement for taxpayer id: edu-discuss-00000174073547US Internal Revenue Service ------=_NextPart_000_000E_01CA3EE3.2EE04B30 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: edu-discuss-000= 00174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax= statement for taxpayer id: edu-discuss-00000174073547US

Internal Revenue Service

------=_NextPart_000_000E_01CA3EE3.2EE04B30-- From tablet35@romer.com Sat Sep 26 14:33:36 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 905D83A68C8 for ; Sat, 26 Sep 2009 14:33:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -39.459 X-Spam-Level: X-Spam-Status: No, score=-39.459 tagged_above=-999 required=5 tests=[AWL=16.431, BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_BR=0.955, HOST_EQ_BR=1.295, HOST_EQ_STATIC=1.172, HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, TVD_RCVD_IP=1.931, URIBL_BLACK=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZT+8ZqcO-Ybw for ; Sat, 26 Sep 2009 14:33:35 -0700 (PDT) Received: from 189-112-196-111.static.ctbctelecom.com.br (189-112-196-111.static.ctbctelecom.com.br [189.112.196.111]) by core3.amsl.com (Postfix) with ESMTP id 486723A67C0 for ; Sat, 26 Sep 2009 14:33:34 -0700 (PDT) Received: from 189.112.196.111 by mx-relay3.hexagonmetrology.com; Sat, 26 Sep 2009 18:34:09 -0300 Message-ID: <000d01ca3ef1$14f76b00$6400a8c0@tablet35> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sat, 26 Sep 2009 18:34:09 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3EF1.14F76B00" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3EF1.14F76B00 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3EF1.14F76B00 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3EF1.14F76B00-- From dyslexicssxp84@ripec.com Sat Sep 26 14:33:37 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4244C3A67C0; Sat, 26 Sep 2009 14:33:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.154 X-Spam-Level: X-Spam-Status: No, score=-11.154 tagged_above=-999 required=5 tests=[BAYES_95=3, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR=2.426, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HjnNeMakMgqw; Sat, 26 Sep 2009 14:33:36 -0700 (PDT) Received: from host86-143-251-59.range86-143.btcentralplus.com (host86-143-251-59.range86-143.btcentralplus.com [86.143.251.59]) by core3.amsl.com (Postfix) with ESMTP id 3EC563A68B1; Sat, 26 Sep 2009 14:33:36 -0700 (PDT) Received: from 86.143.251.59 by spamfilter2.envisionsuccess.net; Sat, 26 Sep 2009 22:33:24 +0000 Message-ID: <000d01ca3ef0$fa524810$6400a8c0@dyslexicssxp84> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sat, 26 Sep 2009 22:33:24 +0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3EF0.FA524810" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3EF0.FA524810 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: esds-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: esds-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3EF0.FA524810 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: esds-0000017407= 3547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for= taxpayer id: esds-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3EF0.FA524810-- From hairiness@smtp.de.easynet.net Sat Sep 26 17:43:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D86D13A6875 for ; Sat, 26 Sep 2009 17:43:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -36.748 X-Spam-Level: X-Spam-Status: No, score=-36.748 tagged_above=-999 required=5 tests=[AWL=5.294, BAYES_99=3.5, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_DSL=1.129, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_PH_SURBL=1.787, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LlwKgv5UH1Ll for ; Sat, 26 Sep 2009 17:43:09 -0700 (PDT) Received: from 228-6-20-190.adsl.terra.cl (228-6-20-190.adsl.terra.cl [190.20.6.228]) by core3.amsl.com (Postfix) with ESMTP id 965EA3A67D7 for ; Sat, 26 Sep 2009 17:42:46 -0700 (PDT) Received: from 190.20.6.228 by smtp.de.easynet.net; Sat, 26 Sep 2009 21:43:40 -0300 Message-ID: <000d01ca3f0b$8efdfa80$6400a8c0@hairiness> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sat, 26 Sep 2009 21:43:40 -0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3F0B.8EFDFA80" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3F0B.8EFDFA80 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3F0B.8EFDFA80 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3F0B.8EFDFA80-- From maow@93-44-156-100.ip97.fastwebnet.it Sun Sep 27 02:29:35 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8E3543A6805 for ; Sun, 27 Sep 2009 02:29:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -31.238 X-Spam-Level: X-Spam-Status: No, score=-31.238 tagged_above=-999 required=5 tests=[AWL=-37.651, BAYES_99=3.5, DOS_OE_TO_MX=2.75, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RDNS_DYNAMIC=0.1, STOX_REPLY_TYPE=0.001, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_SBL=20, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ip3Kccqyroox for ; Sun, 27 Sep 2009 02:29:34 -0700 (PDT) Received: from 93-44-156-100.ip97.fastwebnet.it (93-44-156-100.ip97.fastwebnet.it [93.44.156.100]) by core3.amsl.com (Postfix) with ESMTP id 011503A6836 for ; Sun, 27 Sep 2009 02:29:33 -0700 (PDT) Message-ID: <01ca3f5d$950917f0$649c2c5d@maow> From: "Dnsext" To: Subject: ##Awesome Gifts@@@ Date: Sun, 27 Sep 2009 10:30:49 +0100 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-2"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1106 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 X-Spam: Not detected The best gift affordable. http://browngum.com From smirkedi005@storrfamily.net Sun Sep 27 03:00:45 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6CD2E3A6805; Sun, 27 Sep 2009 03:00:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -53.389 X-Spam-Level: X-Spam-Status: No, score=-53.389 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_DHCP=1.398, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_CPE=0.5, HOST_EQ_CPE=0.979, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RDNS_DYNAMIC=0.1, URIBL_BLACK=20, URIBL_PH_SURBL=1.787, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f4dQ7wiz8fRL; Sun, 27 Sep 2009 03:00:44 -0700 (PDT) Received: from cpe-66-69-193-113.austin.res.rr.com (cpe-66-69-193-113.austin.res.rr.com [66.69.193.113]) by core3.amsl.com (Postfix) with ESMTP id B40EF3A67A5; Sun, 27 Sep 2009 03:00:43 -0700 (PDT) Received: from 66.69.193.113 by ALT1.ASPMX.L.GOOGLE.COM; Sun, 27 Sep 2009 05:01:54 -0600 Message-ID: <000d01ca3f59$8a972180$6400a8c0@smirkedi005> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sun, 27 Sep 2009 05:01:54 -0600 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3F59.8A972180" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3F59.8A972180 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: edu-discuss-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: edu-discuss-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3F59.8A972180 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: edu-discuss-000= 00174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax= statement for taxpayer id: edu-discuss-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3F59.8A972180-- From lodgesj@sinergetica.pt Sun Sep 27 03:53:43 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A0D3D3A677E; Sun, 27 Sep 2009 03:53:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -38.766 X-Spam-Level: X-Spam-Status: No, score=-38.766 tagged_above=-999 required=5 tests=[BAYES_99=3.5, DNS_FROM_RFC_BOGUSMX=1.482, HELO_EQ_JP=1.244, HELO_EQ_NE_JP=1.244, HOST_EQ_JP=1.265, HOST_EQ_NE_JP=2.599, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jo-mWyeNnkLV; Sun, 27 Sep 2009 03:53:42 -0700 (PDT) Received: from p2018-ipbfp3005osakakita.osaka.ocn.ne.jp (p2018-ipbfp3005osakakita.osaka.ocn.ne.jp [180.5.25.18]) by core3.amsl.com (Postfix) with ESMTP id 7F6B23A63CB; Sun, 27 Sep 2009 03:53:41 -0700 (PDT) Received: from 180.5.25.18 by mail.sinergetica.pt; Sun, 27 Sep 2009 19:54:54 +0900 Message-ID: <000d01ca3f60$f2611760$6400a8c0@lodgesj> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sun, 27 Sep 2009 19:54:54 +0900 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3F60.F2611760" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3F60.F2611760 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dnsind-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dnsind-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3F60.F2611760 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsind-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

revi= ew tax statement for taxpayer id: dnsind-archive-00000174073547US<= /a>

Internal Revenue Service

------=_NextPart_000_0007_01CA3F60.F2611760-- From deweyex97@smith-graham.com Sun Sep 27 07:27:42 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A5B883A69D9 for ; Sun, 27 Sep 2009 07:27:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -29.095 X-Spam-Level: X-Spam-Status: No, score=-29.095 tagged_above=-999 required=5 tests=[AWL=0.294, BAYES_99=3.5, DOS_OE_TO_MX=2.75, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JypA6MzzQVps for ; Sun, 27 Sep 2009 07:27:42 -0700 (PDT) Received: from 93-44-72-179.ip96.fastwebnet.it (93-44-72-179.ip96.fastwebnet.it [93.44.72.179]) by core3.amsl.com (Postfix) with ESMTP id 581B83A69D7 for ; Sun, 27 Sep 2009 07:27:41 -0700 (PDT) Message-ID: <000d01ca3f7e$d7c6a730$6400a8c0@deweyex97> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sun, 27 Sep 2009 16:28:55 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3F7E.D7C6A730" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3F7E.D7C6A730 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3F7E.D7C6A730 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3F7E.D7C6A730-- From hi4260@removeusa.net Sun Sep 27 07:28:00 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AE2D93A69D4; Sun, 27 Sep 2009 07:28:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -42.023 X-Spam-Level: X-Spam-Status: No, score=-42.023 tagged_above=-999 required=5 tests=[BAYES_60=1, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, HELO_DYNAMIC_IPADDR2=4.395, HELO_DYNAMIC_SPLIT_IP=3.493, HELO_EQ_IP_ADDR=1.119, HOST_EQ_USERONOCOM=1.444, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RCVD_NUMERIC_HELO=2.067, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_JP_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fK+d1xUqqazk; Sun, 27 Sep 2009 07:28:00 -0700 (PDT) Received: from 84.125.72.223.dyn.user.ono.com (84.125.72.223.dyn.user.ono.com [84.125.72.223]) by core3.amsl.com (Postfix) with SMTP id 44B4A3A69D7; Sun, 27 Sep 2009 07:27:51 -0700 (PDT) Date: Sun, 27 Sep 2009 10:29:08 -0500 Subject: Newest rep watches line on 2010 From: "Winston Cuevas" To: "Mel Good" Message-ID: Content-Type: text/plain; Content-Transfer-Encoding: 7Bit It just came out... rep watches line on 2010... Just see them here http://bottletele.com/ From tiniert357@spd-mittelfranken.de Sun Sep 27 12:55:37 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0CEA03A6806 for ; Sun, 27 Sep 2009 12:55:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -24.428 X-Spam-Level: X-Spam-Status: No, score=-24.428 tagged_above=-999 required=5 tests=[AWL=-4.679, BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_BR=0.955, HELO_EQ_DYNAMIC=1.144, HOST_EQ_BR=1.295, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cQDxX2tWlSf6 for ; Sun, 27 Sep 2009 12:55:36 -0700 (PDT) Received: from 189-041-152-159.xd-dynamic.ctbcnetsuper.com.br (189-041-152-159.xd-dynamic.ctbcnetsuper.com.br [189.41.152.159]) by core3.amsl.com (Postfix) with ESMTP id EBBF23A67B8 for ; Sun, 27 Sep 2009 12:55:35 -0700 (PDT) Received: from 189.41.152.159 by spd-mittelfranken.de; Sun, 27 Sep 2009 16:56:22 -0300 From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sun, 27 Sep 2009 16:56:22 -0300 Message-ID: <000d01ca3fac$96a2b1d0$6400a8c0@tiniert357> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01CA3FAC.96A2B1D0" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4963.1700 Importance: Normal This is a multi-part message in MIME format. ------=_NextPart_000_000E_01CA3FAC.96A2B1D0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_000E_01CA3FAC.96A2B1D0 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_000E_01CA3FAC.96A2B1D0-- From forgoneav@rileymxracing.com Sun Sep 27 13:04:58 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 232503A6850; Sun, 27 Sep 2009 13:04:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -26.208 X-Spam-Level: X-Spam-Status: No, score=-26.208 tagged_above=-999 required=5 tests=[AWL=-9.982, BAYES_99=3.5, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR=2.426, HOST_EQ_DHCP=1.295, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QgPP5Fkyhoo0; Sun, 27 Sep 2009 13:04:57 -0700 (PDT) Received: from in-67-236-72-235.dhcp.embarqhsd.net (in-67-236-72-235.dhcp.embarqhsd.net [67.236.72.235]) by core3.amsl.com (Postfix) with ESMTP id B7EF13A6890; Sun, 27 Sep 2009 13:04:56 -0700 (PDT) Received: from 67.236.72.235 by mailstore1.secureserver.net; Sun, 27 Sep 2009 13:06:09 -0800 Message-ID: <000d01ca3fad$f4161360$6400a8c0@forgoneav> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sun, 27 Sep 2009 13:06:09 -0800 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3FAD.F4161360" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3FAD.F4161360 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dime-owner-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dime-owner-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3FAD.F4161360 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dime-owner-0000= 0174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax s= tatement for taxpayer id: dime-owner-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3FAD.F4161360-- From discontentmenta16@rh2.com Sun Sep 27 13:12:25 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AF8803A690E for ; Sun, 27 Sep 2009 13:12:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -20.932 X-Spam-Level: X-Spam-Status: No, score=-20.932 tagged_above=-999 required=5 tests=[BAYES_99=3.5, HELO_EQ_DIP_DIALIN=1.573, HOST_EQ_DIP_TDIAL=2.144, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100, XMAILER_MIMEOLE_OL_3AC1D=0.688] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZWCStrqwqj19 for ; Sun, 27 Sep 2009 13:12:25 -0700 (PDT) Received: from p54abd9b0.dip.t-dialin.net (p54ABD9B0.dip.t-dialin.net [84.171.217.176]) by core3.amsl.com (Postfix) with ESMTP id B04EE3A68F6 for ; Sun, 27 Sep 2009 13:12:24 -0700 (PDT) Received: from 84.171.217.176 by www.rh2.com; Sun, 27 Sep 2009 23:12:28 +0200 Message-ID: <000d01ca3fae$d67435c0$6400a8c0@discontentmenta16> From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sun, 27 Sep 2009 23:12:28 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01CA3FAE.D67435C0" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01CA3FAE.D67435C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website = (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0007_01CA3FAE.D67435C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0007_01CA3FAE.D67435C0-- From owner-namedroppers@ops.ietf.org Sun Sep 27 14:03:40 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 857323A68F3; Sun, 27 Sep 2009 14:03:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3 X-Spam-Level: *** X-Spam-Status: No, score=3 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z-DmmvTZuZfH; Sun, 27 Sep 2009 14:03:39 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B65B03A68E0; Sun, 27 Sep 2009 14:03:39 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ms0np-000KAu-Pp for namedroppers-data0@psg.com; Sun, 27 Sep 2009 20:57:05 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ms0ng-000KAF-5V for namedroppers@ops.ietf.org; Sun, 27 Sep 2009 20:57:03 +0000 Received: from crankycanuck.ca (spliair.spotnik.ADSL.akn.ca [66.135.98.67]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 99DF52FE8CE3 for ; Sun, 27 Sep 2009 20:56:54 +0000 (UTC) Date: Sun, 27 Sep 2009 16:56:49 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? Message-ID: <20090927205649.GA19520@shinkuro.com> References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4ABD9B35.7030101@dougbarton.us> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Fri, Sep 25, 2009 at 09:40:21PM -0700, Doug Barton wrote: > IANA could kill two birds with one stone by not assigning 8-11 "in the > foreseeable future" and assigning something totally different to > RSA/SHA{256|512}. Actually, in consultation with IANA, we've determined that we'll assign the identifiers in the 8-11 range, but reserve the "polluted" ones until there remain no other identifiers left. In defence of Jelte and his colleagues, we were in last call on what had previously seemed like a completely uncontroversial document, and they did mark the feature as experimental. That said, it is indeed a very bad idea to release software with this sort of optimistic assumption in it. (But I think Jelte and his colleagues feel suitably chastised by the facts of the matter.) I appreciate that there might be some desire for a punitive assignment strategy, but we _are_ about interoperation, after all. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From cysb@asiawaterbusiness.com Sun Sep 27 14:17:00 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6F5703A67B6; Sun, 27 Sep 2009 14:17:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -25.94 X-Spam-Level: X-Spam-Status: No, score=-25.94 tagged_above=-999 required=5 tests=[BAYES_80=2, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_MODEMCABLE=0.768, HOST_EQ_MODEMCABLE=1.368, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_NJABL_PROXY=1.643, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_BLACK=20, URIBL_OB_SURBL=10, URIBL_SBL=20, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mrSgbQechZjJ; Sun, 27 Sep 2009 14:16:59 -0700 (PDT) Received: from bzq-84-108-4-206.cablep.bezeqint.net (bzq-84-108-4-206.cablep.bezeqint.net [84.108.4.206]) by core3.amsl.com (Postfix) with SMTP id 113193A62C1; Sun, 27 Sep 2009 14:16:45 -0700 (PDT) Date: Sun, 27 Sep 2009 17:17:58 -0500 Subject: Upgraded rep watches models from 2010 From: "Raymond Richey" To: "Wilma Metcalf" Message-ID: Content-Type: text/plain; Content-Transfer-Encoding: 7Bit It just came out... rep watches line on 2010... Just see them here http://bottleflash.com/ From owner-namedroppers@ops.ietf.org Sun Sep 27 17:40:55 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C91693A68B4; Sun, 27 Sep 2009 17:40:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.537 X-Spam-Level: X-Spam-Status: No, score=0.537 tagged_above=-999 required=5 tests=[AWL=-1.568, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eINpjg0QiIbI; Sun, 27 Sep 2009 17:40:55 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id B78073A6882; Sun, 27 Sep 2009 17:40:54 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ms4Dr-000GWZ-As for namedroppers-data0@psg.com; Mon, 28 Sep 2009 00:36:11 +0000 Received: from [204.14.89.4] (helo=mail2.fluidhosting.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ms4Di-000GVr-60 for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 00:36:09 +0000 Received: (qmail 13098 invoked by uid 399); 28 Sep 2009 00:35:55 -0000 Received: from localhost (HELO foreign.dougb.net) (dougb@dougbarton.us@127.0.0.1) by localhost with ESMTPAM; 28 Sep 2009 00:35:55 -0000 X-Originating-IP: 127.0.0.1 X-Sender: dougb@dougbarton.us Message-ID: <4AC004E2.3060800@dougbarton.us> Date: Sun, 27 Sep 2009 17:35:46 -0700 From: Doug Barton User-Agent: Thunderbird 2.0.0.23 (X11/20090822) MIME-Version: 1.0 To: Andrew Sullivan CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> In-Reply-To: <20090927205649.GA19520@shinkuro.com> X-Enigmail-Version: 0.96.0 OpenPGP: id=D5B2F0FB Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Andrew Sullivan wrote: > On Fri, Sep 25, 2009 at 09:40:21PM -0700, Doug Barton wrote: > >> IANA could kill two birds with one stone by not assigning 8-11 "in the >> foreseeable future" and assigning something totally different to >> RSA/SHA{256|512}. > > Actually, in consultation with IANA, we've determined that we'll > assign the identifiers in the 8-11 range, but reserve the "polluted" > ones until there remain no other identifiers left. In defence of > Jelte and his colleagues, we were in last call on what had previously > seemed like a completely uncontroversial document, and they did mark > the feature as experimental. That said, it is indeed a very bad idea > to release software with this sort of optimistic assumption in it. > (But I think Jelte and his colleagues feel suitably chastised by the > facts of the matter.) > > I appreciate that there might be some desire for a punitive assignment > strategy, but we _are_ about interoperation, after all. It has nothing to do with being punitive in the "punishment for its own sake" category. Regardless of how well justified the decision to release the code in this format was, as you pointed out it was wrong to do it. By accommodating this mistake you both lower the bar a notch and embolden the next person who decides to hijack a code point for what they consider a "good reason." If the feature was marked as experimental then the user impact of assigning a different code point should be negligible. Is there a separate mechanism I should avail myself of to make this a formal request? Doug From owner-namedroppers@ops.ietf.org Sun Sep 27 19:01:52 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 93ADF3A6885; Sun, 27 Sep 2009 19:01:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.602 X-Spam-Level: X-Spam-Status: No, score=0.602 tagged_above=-999 required=5 tests=[AWL=-1.503, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id URxEsH40vtSA; Sun, 27 Sep 2009 19:01:51 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 954BA3A67A4; Sun, 27 Sep 2009 19:01:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ms5Tn-000Ndw-VY for namedroppers-data0@psg.com; Mon, 28 Sep 2009 01:56:43 +0000 Received: from [204.14.89.4] (helo=mail2.fluidhosting.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Ms5S5-000NS6-Fp for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 01:55:51 +0000 Received: (qmail 31096 invoked by uid 399); 28 Sep 2009 01:54:52 -0000 Received: from localhost (HELO foreign.dougb.net) (dougb@dougbarton.us@127.0.0.1) by localhost with ESMTPAM; 28 Sep 2009 01:54:52 -0000 X-Originating-IP: 127.0.0.1 X-Sender: dougb@dougbarton.us Message-ID: <4AC01766.6010604@dougbarton.us> Date: Sun, 27 Sep 2009 18:54:46 -0700 From: Doug Barton User-Agent: Thunderbird 2.0.0.23 (X11/20090822) MIME-Version: 1.0 To: Andrew Sullivan CC: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> In-Reply-To: <4AC004E2.3060800@dougbarton.us> X-Enigmail-Version: 0.96.0 OpenPGP: id=D5B2F0FB Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Doug Barton wrote: > Andrew Sullivan wrote: >> On Fri, Sep 25, 2009 at 09:40:21PM -0700, Doug Barton wrote: >> >>> IANA could kill two birds with one stone by not assigning 8-11 "in the >>> foreseeable future" and assigning something totally different to >>> RSA/SHA{256|512}. >> Actually, in consultation with IANA, we've determined that we'll >> assign the identifiers in the 8-11 range, but reserve the "polluted" >> ones until there remain no other identifiers left. In defence of >> Jelte and his colleagues, we were in last call on what had previously >> seemed like a completely uncontroversial document, and they did mark >> the feature as experimental. That said, it is indeed a very bad idea >> to release software with this sort of optimistic assumption in it. >> (But I think Jelte and his colleagues feel suitably chastised by the >> facts of the matter.) >> >> I appreciate that there might be some desire for a punitive assignment >> strategy, but we _are_ about interoperation, after all. > > It has nothing to do with being punitive in the "punishment for its > own sake" category. Regardless of how well justified the decision to > release the code in this format was, as you pointed out it was wrong > to do it. By accommodating this mistake you both lower the bar a notch > and embolden the next person who decides to hijack a code point for > what they consider a "good reason." > > If the feature was marked as experimental then the user impact of > assigning a different code point should be negligible. Is there a > separate mechanism I should avail myself of to make this a formal request? BTW, I should probably make a few more things clear on this subject. First of all, I haven't spoken to anyone at IANA about this, and I am speaking only for myself. I have no axe to grind against Jelte (indeed, I only know him from this list) and I like the idea of getting RSA/SHA{256|512} deployed. That said, I was at one time the general manager of the IANA, and dealt with this problem (of people hijacking things and then expecting IANA to legitimize them after the fact) on a regular basis. It's a serious problem, and all of the past hand-waves in the name of "interoperability" or whatever the excuse was at the time haven't made things better, they've made things worse. I'm sorry that Jelte and/or his users are stuck in the middle of this thing, but we need to draw the line somewhere, and given the facts of this particular case it seems like the right time to take a stand. Doug From kimberleyd68@stevenstransport.com Sun Sep 27 22:10:04 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2EEDD3A689D; Sun, 27 Sep 2009 22:10:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -36.192 X-Spam-Level: X-Spam-Status: No, score=-36.192 tagged_above=-999 required=5 tests=[AWL=-10.501, BAYES_99=3.5, FH_FAKE_RCVD_LINE_B=5.777, FH_HOST_EQ_D_D_D_D=0.765, HELO_DYNAMIC_IPADDR=2.426, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kq3H2uki6JCX; Sun, 27 Sep 2009 22:10:03 -0700 (PDT) Received: from triband-mum-120.61.139.168.mtnl.net.in (triband-mum-120.61.139.168.mtnl.net.in [120.61.139.168]) by core3.amsl.com (Postfix) with ESMTP id BD6A53A6879; Sun, 27 Sep 2009 22:10:02 -0700 (PDT) Received: from 120.61.139.168 by ironport.stevenstransport.com; Mon, 28 Sep 2009 10:41:14 +0530 From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Mon, 28 Sep 2009 10:41:14 +0530 Message-ID: <000d01ca3ffa$19cdebe0$6400a8c0@kimberleyd68> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01CA3FFA.19CDEBE0" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.3416 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2663 Importance: Normal This is a multi-part message in MIME format. ------=_NextPart_000_0006_01CA3FFA.19CDEBE0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit Taxpayer ID: rmt-request-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below): review tax statement for taxpayer id: rmt-request-00000174073547US Internal Revenue Service ------=_NextPart_000_0006_01CA3FFA.19CDEBE0 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: rmt-request-000= 00174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax= statement for taxpayer id: rmt-request-00000174073547US

Internal Revenue Service

------=_NextPart_000_0006_01CA3FFA.19CDEBE0-- From accruesdh02@shell.daug.net Sun Sep 27 22:36:22 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 66E353A67D2; Sun, 27 Sep 2009 22:36:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -19.658 X-Spam-Level: X-Spam-Status: No, score=-19.658 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_DHCP=1.398, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_RHS_DOB=1.083, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XCRknSRzkQjB; Sun, 27 Sep 2009 22:36:21 -0700 (PDT) Received: from cable-202-8-250-186.d-one.net (cable-202-8-250-186.d-one.net [202.8.250.186]) by core3.amsl.com (Postfix) with ESMTP id 641563A67DD; Sun, 27 Sep 2009 22:36:19 -0700 (PDT) Received: from 202.8.250.186 by east.mediatraffic.fi; Sun, 27 Sep 2009 22:37:33 -0800 From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Sun, 27 Sep 2009 22:37:33 -0800 Message-ID: <000d01ca3ffd$c6f3c260$6400a8c0@accruesdh02> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01CA3FFD.C6F3C260" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 Importance: Normal This is a multi-part message in MIME format. ------=_NextPart_000_000E_01CA3FFD.C6F3C260 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit Taxpayer ID: edu-discuss-admin-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below): review tax statement for taxpayer id: edu-discuss-admin-00000174073547US Internal Revenue Service ------=_NextPart_000_000E_01CA3FFD.C6F3C260 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: edu-discuss-adm= in-00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: edu-discuss-admin-00000174073547US<= /strong>

Internal Revenue Service

------=_NextPart_000_000E_01CA3FFD.C6F3C260-- From sunj0979@rjfci.com Mon Sep 28 02:01:40 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 55EC03A6846 for ; Mon, 28 Sep 2009 02:01:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -13.742 X-Spam-Level: X-Spam-Status: No, score=-13.742 tagged_above=-999 required=5 tests=[AWL=-8.942, BAYES_99=3.5, FH_FAKE_RCVD_LINE_B=5.777, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_HCC=4.295, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_DIALUP=0.862, HELO_EQ_DSL=1.129, HOST_EQ_DIALUP=0.862, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_WEB=0.619, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_PH_SURBL=1.787, URIBL_RHS_DOB=1.083, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OI5xAApBlRkc for ; Mon, 28 Sep 2009 02:01:39 -0700 (PDT) Received: from r190-135-208-251.dialup.adsl.anteldata.net.uy (r190-135-131-102.dialup.adsl.anteldata.net.uy [190.135.131.102]) by core3.amsl.com (Postfix) with ESMTP id 0F73D3A67F9 for ; Mon, 28 Sep 2009 02:01:38 -0700 (PDT) Received: from 190.135.131.102 by amx.rjfci.com.redcondor.net; Mon, 28 Sep 2009 06:01:17 -0300 From: "Internal Revenue Service" To: Subject: Notice of Underreported Income Date: Mon, 28 Sep 2009 06:01:17 -0300 Message-ID: <000d01ca401a$3d893510$6400a8c0@sunj0979> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01CA401A.3D893510" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.3416 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Importance: Normal This is a multi-part message in MIME format. ------=_NextPart_000_0006_01CA401A.3D893510 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Taxpayer ID: dnsext-archive-00000174073547US Tax Type: INCOME TAX Issue: Unreported/Underreported Income (Fraud Application) Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below): review tax statement for taxpayer id: dnsext-archive-00000174073547US Internal Revenue Service ------=_NextPart_000_0006_01CA401A.3D893510 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Taxpayer ID: dnsext-archive-= 00000174073547US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax state= ment on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: dnsext-archive-00000174073547US

Internal Revenue Service

------=_NextPart_000_0006_01CA401A.3D893510-- From asymmetricale55@93-46-40-210.ip105.fastwebnet.it Mon Sep 28 08:13:58 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 51D763A688F for ; Mon, 28 Sep 2009 08:13:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.895 X-Spam-Level: X-Spam-Status: No, score=-9.895 tagged_above=-999 required=5 tests=[BAYES_99=3.5, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FH_HOST_EQ_D_D_D_DB=0.888, FM_DDDD_TIMES_2=1.999, HELO_DYNAMIC_IPADDR2=4.395, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5, RCVD_IN_BL_SPAMCOP_NET=1.96, RCVD_IN_PBL=0.905, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931, URIBL_AB_SURBL=10, URIBL_BLACK=20, URIBL_JP_SURBL=10, URIBL_OB_SURBL=10, URIBL_RHS_DOB=1.083, URIBL_WS_SURBL=10, USER_IN_WHITELIST=-100, XMAILER_MIMEOLE_OL_83BF7=2.069] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GaoAKxjC5UtC for ; Mon, 28 Sep 2009 08:13:57 -0700 (PDT) Received: from 93-46-40-210.ip105.fastwebnet.it (93-46-40-210.ip105.fastwebnet.it [93.46.40.210]) by core3.amsl.com (Postfix) with ESMTP id B729C3A677D for ; Mon, 28 Sep 2009 08:13:56 -0700 (PDT) Received: from 93.46.40.210 by relay1.completel.fr; Mon, 28 Sep 2009 16:15:15 +0100 Message-ID: <01ca4056$dd0d9360$d2282e5d@asymmetricale55> From: "Dnsext" To: Subject: *_Best Gifts__ Date: Mon, 28 Sep 2009 16:15:15 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.3110.3 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 Your loved ones will love this gift http://brownsave.com From owner-namedroppers@ops.ietf.org Mon Sep 28 08:20:08 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BBFD23A68B3; Mon, 28 Sep 2009 08:20:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.185 X-Spam-Level: X-Spam-Status: No, score=-0.185 tagged_above=-999 required=5 tests=[AWL=-0.585, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wFK7X1OAIcbl; Mon, 28 Sep 2009 08:20:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0AC833A685F; Mon, 28 Sep 2009 08:20:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsHvJ-000Dal-Ij for namedroppers-data0@psg.com; Mon, 28 Sep 2009 15:13:57 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsHvA-000Da5-IE for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 15:13:55 +0000 Received: from crankycanuck.ca (external.shinkuro.com [66.92.164.104]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 285802FE8CE3 for ; Mon, 28 Sep 2009 15:13:47 +0000 (UTC) Date: Mon, 28 Sep 2009 11:13:45 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? Message-ID: <20090928151345.GD536@shinkuro.com> References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4AC004E2.3060800@dougbarton.us> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Dear colleagues, On Sun, Sep 27, 2009 at 05:35:46PM -0700, Doug Barton wrote: > to do it. By accommodating this mistake you both lower the bar a notch > and embolden the next person who decides to hijack a code point for > what they consider a "good reason." I want to ask the WG for its views on the above argument. I confess I find it unpersuasive. We are not the protocol police. Moreover, I don't believe anyone is watching us to see whether they can be emboldened. On the contrary, I suspect that the only effect of using completely new identifiers would be to break an existing (but wrong) released implementation without any concomitant benefit. I am susceptible to persuasion, however, so if others feel as Doug does, then it would be good to know it. Best, A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon Sep 28 09:01:10 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A90F23A68A5; Mon, 28 Sep 2009 09:01:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.467 X-Spam-Level: X-Spam-Status: No, score=-3.467 tagged_above=-999 required=5 tests=[AWL=-0.831, BAYES_20=-0.74, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3-WRlPlcyu+h; Mon, 28 Sep 2009 09:01:09 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BC5DA3A685C; Mon, 28 Sep 2009 09:01:09 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsIcA-000Igl-91 for namedroppers-data0@psg.com; Mon, 28 Sep 2009 15:58:14 +0000 Received: from [192.245.12.227] (helo=balder-227.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsIc0-000IfU-OD for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 15:58:12 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n8SFw1Qr019684 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 28 Sep 2009 08:58:02 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <20090928151345.GD536@shinkuro.com> References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> Date: Mon, 28 Sep 2009 08:57:59 -0700 To: namedroppers@ops.ietf.org From: Paul Hoffman Subject: Re: [dnsext] GOST DNSSEC implementations? Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 11:13 AM -0400 9/28/09, Andrew Sullivan wrote: >On Sun, Sep 27, 2009 at 05:35:46PM -0700, Doug Barton wrote: > >> to do it. By accommodating this mistake you both lower the bar a notch >> and embolden the next person who decides to hijack a code point for >> what they consider a "good reason." > >I want to ask the WG for its views on the above argument. I confess I >find it unpersuasive. We are not the protocol police. Moreover, I >don't believe anyone is watching us to see whether they can be >emboldened. On the contrary, I suspect that the only effect of using >completely new identifiers would be to break an existing (but wrong) >released implementation without any concomitant benefit. > >I am susceptible to persuasion, however, so if others feel as Doug >does, then it would be good to know it. Other IETF WGs, particularly in the Security Area have dealt with this very issue in the past. The short answer is that both of you are right in approximately the same amount. I have heard developers say "BigCo shipped with this number that they assumed IANA would assign in the Foo protocol, so we should not wait and just do the same". Other vendors have patiently waited because they didn't want to be assholes like BigCo. At least one WG did the "change the identifier to level the playing field" dance, and interoperability went to hell, and is still there many years later. If you agree that both sides are right, then we should lean strongly towards interoperability, not punishing hijackers. --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Mon Sep 28 09:05:09 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 084133A67B3; Mon, 28 Sep 2009 09:05:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.771 X-Spam-Level: X-Spam-Status: No, score=-101.771 tagged_above=-999 required=5 tests=[AWL=-0.276, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_LOW=-1, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ICloOxDnhMu2; Mon, 28 Sep 2009 09:05:08 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 32B3F3A67F8; Mon, 28 Sep 2009 09:05:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsIgh-000JMs-UX for namedroppers-data0@psg.com; Mon, 28 Sep 2009 16:02:55 +0000 Received: from [207.97.245.115] (helo=smtp115.iad.emailsrvr.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsIgV-000JJq-3J for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 16:02:50 +0000 Received: from relay31.relay.iad.mlsrvr.com (localhost [127.0.0.1]) by relay31.relay.iad.mlsrvr.com (SMTP Server) with ESMTP id E00BD1B4296; Mon, 28 Sep 2009 12:02:41 -0400 (EDT) Received: by relay31.relay.iad.mlsrvr.com (Authenticated sender: schnizlein-AT-isoc.org) with ESMTPSA id 2003E1B4011; Mon, 28 Sep 2009 12:02:41 -0400 (EDT) Cc: namedroppers@ops.ietf.org Message-Id: <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> From: John Schnizlein To: Andrew Sullivan In-Reply-To: <20090928151345.GD536@shinkuro.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] GOST DNSSEC implementations? Date: Mon, 28 Sep 2009 12:02:40 -0400 References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: While I have my own memories of the anger I felt when discovering that broken applications were due to a colleague having made up numbers he should have requested that I allocate (uniqueness matters), my sympathy for Doug's experience does not convince me that numbers now in (erroneous) circulation should be assigned to some innocent new role. John On 2009Sep28, at 11:13 AM, Andrew Sullivan wrote: > Dear colleagues, > > On Sun, Sep 27, 2009 at 05:35:46PM -0700, Doug Barton wrote: > >> to do it. By accommodating this mistake you both lower the bar a >> notch >> and embolden the next person who decides to hijack a code point for >> what they consider a "good reason." > > I want to ask the WG for its views on the above argument. I confess I > find it unpersuasive. We are not the protocol police. Moreover, I > don't believe anyone is watching us to see whether they can be > emboldened. On the contrary, I suspect that the only effect of using > completely new identifiers would be to break an existing (but wrong) > released implementation without any concomitant benefit. > > I am susceptible to persuasion, however, so if others feel as Doug > does, then it would be good to know it. > > Best, > > A > > -- > Andrew Sullivan > ajs@shinkuro.com > Shinkuro, Inc. > From owner-namedroppers@ops.ietf.org Mon Sep 28 09:55:56 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 99BE13A696F; Mon, 28 Sep 2009 09:55:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.577 X-Spam-Level: X-Spam-Status: No, score=-2.577 tagged_above=-999 required=5 tests=[AWL=0.022, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vzxN0VUlIgWS; Mon, 28 Sep 2009 09:55:55 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BC8913A688F; Mon, 28 Sep 2009 09:55:55 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsJRY-000PHt-Co for namedroppers-data0@psg.com; Mon, 28 Sep 2009 16:51:20 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsJRO-000PGv-Tn for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 16:51:18 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 44255B7FC8; Mon, 28 Sep 2009 16:51:10 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: Andrew Sullivan cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? In-Reply-To: Your message of "Mon, 28 Sep 2009 11:13:45 -0400." <20090928151345.GD536@shinkuro.com> References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Mon, 28 Sep 2009 16:51:10 +0000 Message-ID: <51459.1254156670@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > I am susceptible to persuasion, however, so if others feel as Doug > does, then it would be good to know it. i don't feel precisely the way doug did, but i'm close. we should reserve these wrongly allocated identifiers until we run out of available code points, in order to avoid penalizing other protocols with messages from these rogues. however, we should standardize on different code points than any rogue has used, because otherwise all hell will break loose. if the IETF wants to encourage self-allocation then they should reserve a range of code points for that. From owner-namedroppers@ops.ietf.org Mon Sep 28 10:28:03 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C22003A69D7; Mon, 28 Sep 2009 10:28:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.686 X-Spam-Level: X-Spam-Status: No, score=-0.686 tagged_above=-999 required=5 tests=[AWL=-0.191, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lsgzJnygENjm; Mon, 28 Sep 2009 10:27:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5627E3A6981; Mon, 28 Sep 2009 10:27:58 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsJyJ-0003QI-2W for namedroppers-data0@psg.com; Mon, 28 Sep 2009 17:25:11 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsJy4-0003P7-GA for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 17:25:03 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id 71D491542060 for ; Mon, 28 Sep 2009 18:24:53 +0100 (BST) Message-Id: From: Jim Reid To: IETF DNSEXT WG In-Reply-To: <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: [dnsext] algorithm identifier code point hijacking Date: Mon, 28 Sep 2009 18:24:53 +0100 References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Although everyone's right, I tend to agree with Doug here. Why bother having such a registry if there's going to be an effective free for all with algorithm subtyping? It should not be acceptable for someone to just pluck algorithm numbers out of the air and then have IANA register these after the fact. Doing this now sets a precedent that could create nasty problems in the future, especially when all sorts of crazy crypto schemes start to get flung at a DNS that has broader DNSSEC uptake. Algorithm numbers for private or experimental use where set aside. So I don't know why these weren't used for the "experiment" that has now somehow morphed into a production environment. I think this incident has demonstarted there's a need for an RFC5395- like process for assigning algorithm identifiers for DNSSEC. IMO, the identifiers that have been misused should be entered into the registry as "Reserved" or something like that. Then some to-be- invented process gets followed for identifiers to be assigned to the algorithms that accidentally got type codes withount undergoing IETF scrutiny. From owner-namedroppers@ops.ietf.org Mon Sep 28 11:08:51 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 87D8D3A6991; Mon, 28 Sep 2009 11:08:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.76 X-Spam-Level: X-Spam-Status: No, score=-4.76 tagged_above=-999 required=5 tests=[AWL=-0.265, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hqBmi-0PRHI5; Mon, 28 Sep 2009 11:08:50 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 9894028C0FA; Mon, 28 Sep 2009 11:08:50 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsKaJ-000A4J-1w for namedroppers-data0@psg.com; Mon, 28 Sep 2009 18:04:27 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsKZx-000A0g-MK for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 18:04:17 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n8SI31NE014364; Mon, 28 Sep 2009 18:03:04 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n8SI31uQ014363; Mon, 28 Sep 2009 18:03:01 GMT Date: Mon, 28 Sep 2009 18:03:01 +0000 From: bmanning@vacation.karoshi.com To: Jim Reid Cc: IETF DNSEXT WG Subject: Re: [dnsext] algorithm identifier code point hijacking Message-ID: <20090928180301.GB14041@vacation.karoshi.com.> References: <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: well... the IANA used to be much more proactive in engagement with the development process - and code points would not be an after the fact assignment. It happened before (this is not new) and with the current process, it is the "easy" path... Not just because of an un-approachable IANA, but a strict, process-driven IETF that pretty much insists that no code be written before the spec is hammered out. Of course everyone couldmove into the private set-aside, kind of liek the address folks have abandoned the RIR process for NAT/ULA space. Put too much red tape in place and folks will work around it. --bill On Mon, Sep 28, 2009 at 06:24:53PM +0100, Jim Reid wrote: > Although everyone's right, I tend to agree with Doug here. Why bother > having such a registry if there's going to be an effective free for > all with algorithm subtyping? It should not be acceptable for someone > to just pluck algorithm numbers out of the air and then have IANA > register these after the fact. Doing this now sets a precedent that > could create nasty problems in the future, especially when all sorts > of crazy crypto schemes start to get flung at a DNS that has broader > DNSSEC uptake. > > Algorithm numbers for private or experimental use where set aside. So > I don't know why these weren't used for the "experiment" that has now > somehow morphed into a production environment. > > I think this incident has demonstarted there's a need for an RFC5395- > like process for assigning algorithm identifiers for DNSSEC. > > IMO, the identifiers that have been misused should be entered into the > registry as "Reserved" or something like that. Then some to-be- > invented process gets followed for identifiers to be assigned to the > algorithms that accidentally got type codes withount undergoing IETF > scrutiny. From owner-namedroppers@ops.ietf.org Mon Sep 28 11:36:59 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CBBA228C0FA; Mon, 28 Sep 2009 11:36:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.678 X-Spam-Level: X-Spam-Status: No, score=-0.678 tagged_above=-999 required=5 tests=[AWL=-0.183, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b4YT8XuY4EsZ; Mon, 28 Sep 2009 11:36:58 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 2202628C11A; Mon, 28 Sep 2009 11:36:58 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsL2G-000Eyt-87 for namedroppers-data0@psg.com; Mon, 28 Sep 2009 18:33:20 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsL21-000Ewz-UH for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 18:33:14 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id E15C41542060; Mon, 28 Sep 2009 19:33:03 +0100 (BST) Cc: IETF DNSEXT WG Message-Id: <4A0D1D73-7319-4BE5-949D-E54D0AD04F3F@rfc1035.com> From: Jim Reid To: bmanning@vacation.karoshi.com In-Reply-To: <20090928180301.GB14041@vacation.karoshi.com.> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] algorithm identifier code point hijacking Date: Mon, 28 Sep 2009 19:33:04 +0100 References: <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 28 Sep 2009, at 19:03, bmanning@vacation.karoshi.com wrote: > Not just because of an un-approachable IANA, but a strict, process- > driven > IETF that pretty much insists that no code be written before the > spec is hammered out. > > Put too much red tape in place and folks will work around it. Bill, I was not advocating a cumbersome process: far from it. RFC5395 seems to be working reasonably well for RR type codes. It doesn't require RFCs or diverse implementations. All it takes is a reasonable enough amount of information for an independent reviewer to say whether IANA should assign a type code or not. Something similar for algorithm numbers should work just as well too. Though in this case the reviewer would ask "does this crypto algorithm look sound?" rather than "does the proposed RR do bad things at zone cuts or with Additional Section processing?". There would be no need for WG review or comment. In fact I'd argue that the reason for the current discussion is precisely because there is no process for registering algorithm codes other than writing a standards-track RFC. From owner-namedroppers@ops.ietf.org Mon Sep 28 11:51:42 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CE4433A6A04; Mon, 28 Sep 2009 11:51:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.386 X-Spam-Level: X-Spam-Status: No, score=-4.386 tagged_above=-999 required=5 tests=[AWL=0.109, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zHx6yCRx9idX; Mon, 28 Sep 2009 11:51:41 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BCE8A3A68FB; Mon, 28 Sep 2009 11:51:41 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsLEm-000HK7-Pc for namedroppers-data0@psg.com; Mon, 28 Sep 2009 18:46:16 +0000 Received: from [192.245.12.227] (helo=balder-227.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsLEU-000HHc-Hs for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 18:46:10 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n8SIjpbC031079 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 28 Sep 2009 11:45:52 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> Date: Mon, 28 Sep 2009 11:45:50 -0700 To: Jim Reid , Paul Vixie , Doug Barton From: Paul Hoffman Subject: Re: [dnsext] algorithm identifier code point hijacking Cc: IETF DNSEXT WG Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 6:24 PM +0100 9/28/09, Jim Reid wrote: >Although everyone's right, I tend to agree with Doug here. Why bother having such a registry if there's going to be an effective free for all with algorithm subtyping? Straw-man alert: that's not what happened here, and it is inappropriate to suggest that it was. The author of an active WG document made the mistake of hard-coding numbers in the Internet Draft based on looking at the history of allocation (namely, monotonically increasing). The draft *with those numbers included* went through multiple iterations in the WG. None of the three of you objected to the use of those code points during that review. That is far from "free for all". > It should not be acceptable for someone to just pluck algorithm numbers out of the air and then have IANA register these after the fact. If you believe that, why did not not object during WG Last Call, much less earlier? Why wait until now? >Doing this now sets a precedent that could create nasty problems in the future, especially when all sorts of crazy crypto schemes start to get flung at a DNS that has broader DNSSEC uptake. Having IANA assign after-the-fact *because* of vendor use is, of course, a bad idea, but that is not what Andrew proposed. We are talking about a WG work item for which there were multiple requests for review. >Algorithm numbers for private or experimental use where set aside. So I don't know why these weren't used for the "experiment" that has now somehow morphed into a production environment. The document in question is destined for Standards Track, not Experimental. >I think this incident has demonstarted there's a need for an RFC5395-like process for assigning algorithm identifiers for DNSSEC. Fully agree; that's what we have, modulo a document author who screwed up and dozens of probable reviewers who didn't call him on it. >IMO, the identifiers that have been misused should be entered into the registry as "Reserved" or something like that. Then some to-be-invented process gets followed for identifiers to be assigned to the algorithms that accidentally got type codes withount undergoing IETF scrutiny. Define "misused" in this case. --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Mon Sep 28 12:12:12 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 48FFF3A6840; Mon, 28 Sep 2009 12:12:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.577 X-Spam-Level: X-Spam-Status: No, score=-2.577 tagged_above=-999 required=5 tests=[AWL=0.022, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t2Z43XB7TsWE; Mon, 28 Sep 2009 12:12:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5C0C93A67B3; Mon, 28 Sep 2009 12:12:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsLZf-000KLC-VS for namedroppers-data0@psg.com; Mon, 28 Sep 2009 19:07:51 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsLZW-000KKP-5t for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 19:07:49 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id CEB4DB7FEA for ; Mon, 28 Sep 2009 19:07:41 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: IETF DNSEXT WG Subject: Re: [dnsext] algorithm identifier code point hijacking In-Reply-To: Your message of "Mon, 28 Sep 2009 18:03:01 GMT." <20090928180301.GB14041@vacation.karoshi.com.> References: <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Mon, 28 Sep 2009 19:07:41 +0000 Message-ID: <57145.1254164861@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Mon, 28 Sep 2009 18:03:01 +0000 > From: bmanning@vacation.karoshi.com > > well... the IANA used to be much more proactive in engagement > with the development process - and code points would not be > an after the fact assignment. It happened before (this is not > new) and with the current process, it is the "easy" path... the day i met jon postel in person for the first time, it was because i was attending my first IETF (somewhere in canada) and i'd stayed up all night prototyping NOTIFY and i ran into bmanning in the hallway somewhere and asked "how do i get a codepoint assigned for the NOTIFY opcode" and he said "you have to talk to the IANA, i see him coming right now." jon heard me out, took me to the terminal room, logged into an ISI computer, and made the assignment. thus my prototype was able to be tested with the same opcode number as it would have in production, even though there was no spec, not even a draft, at that moment. > Not just because of an un-approachable IANA, but a strict, process-driven > IETF that pretty much insists that no code be written before the spec is > hammered out. Of course everyone couldmove into the private set-aside, > kind of liek the address folks have abandoned the RIR process for NAT/ULA > space. > > Put too much red tape in place and folks will work around it. i think we should encourage prototyping and experimentation. i should've had to write a draft before i could get a codepoint assigned for NOTIFY, and that rule came into effect shortly thereafter. but i'm in favour of having only as much red tape as people will not work around, so, +1 here. From owner-namedroppers@ops.ietf.org Mon Sep 28 12:34:45 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3E9BC3A69B4; Mon, 28 Sep 2009 12:34:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.108 X-Spam-Level: X-Spam-Status: No, score=0.108 tagged_above=-999 required=5 tests=[AWL=-0.019, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KbE4LOfatRJI; Mon, 28 Sep 2009 12:34:44 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 571613A6920; Mon, 28 Sep 2009 12:34:44 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsLwf-000NDy-Ft for namedroppers-data0@psg.com; Mon, 28 Sep 2009 19:31:37 +0000 Received: from [209.85.216.176] (helo=mail-px0-f176.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsLwV-000NCI-UJ for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 19:31:35 +0000 Received: by pxi6 with SMTP id 6so5959319pxi.32 for ; Mon, 28 Sep 2009 12:31:26 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.6.25 with SMTP id 25mr6432065waf.25.1254166286685; Mon, 28 Sep 2009 12:31:26 -0700 (PDT) In-Reply-To: <57145.1254164861@nsa.vix.com> References: <200909151542.n8FFgGhr005086@stora.ogud.com> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <57145.1254164861@nsa.vix.com> Date: Mon, 28 Sep 2009 12:31:26 -0700 Message-ID: Subject: Re: [dnsext] algorithm identifier code point hijacking From: Matthew Dempsky To: Paul Vixie Cc: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, Sep 28, 2009 at 12:07 PM, Paul Vixie wrote: >=A0thus my prototype was able to be tested with > the same opcode number as it would have in production, even though there > was no spec, not even a draft, at that moment. I think this is a desirable property of whatever allocation mechanism is used. I'd like to see people able to reserve an identifier for use as long as they make a good faith explanation regarding its intended use. We need to discourage people from misappropriating available identifiers, but if someone's going to use an identifier, it's better to document it so we can avoid unnecessary incompatibilities. E.g., even if GOST isn't accepted as a standard DNSSEC protocol suite, IANA should still note that the identifiers 8--11 (or whichever) were used by some prototype implementations, and should avoid allocating them to other uses as long as there are unused identifiers available. From owner-namedroppers@ops.ietf.org Mon Sep 28 12:38:12 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6B37B3A69DE; Mon, 28 Sep 2009 12:38:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.67 X-Spam-Level: X-Spam-Status: No, score=-0.67 tagged_above=-999 required=5 tests=[AWL=-0.175, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vxFpVLv6MP25; Mon, 28 Sep 2009 12:38:11 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7A5943A6970; Mon, 28 Sep 2009 12:38:11 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsM1U-000Nvl-Ku for namedroppers-data0@psg.com; Mon, 28 Sep 2009 19:36:36 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsM1F-000Nqq-M1 for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 19:36:34 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id AEB5B1542060; Mon, 28 Sep 2009 20:36:19 +0100 (BST) Cc: Paul Vixie , Doug Barton , IETF DNSEXT WG Message-Id: From: Jim Reid To: Paul Hoffman In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] algorithm identifier code point hijacking Date: Mon, 28 Sep 2009 20:36:20 +0100 References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 28 Sep 2009, at 19:45, Paul Hoffman wrote: > Straw-man alert: that's not what happened here, and it is > inappropriate to suggest that it was. The author of an active WG > document made the mistake of hard-coding numbers in the Internet > Draft based on looking at the history of allocation (namely, > monotonically increasing). The draft *with those numbers included* > went through multiple iterations in the WG. None of the three of you > objected to the use of those code points during that review. > > That is far from "free for all". With respect Paul, it is. You point out that the review process didn't pick up on this error. [I'm guilty as charged m'lud.] Which makes me wonder what other Bad Ideas or comparable administrative errors might be that draft and have escaped scrutiny. Or in other drafts for that matter.... Perhaps we're all burnt out with DNSSEC and nothing gets the same level of attention as in the early days of DNSSEC protocol development. If that's true, it's worrying. >> It should not be acceptable for someone to just pluck algorithm >> numbers out of the air and then have IANA register these after the >> fact. > > If you believe that, why did not not object during WG Last Call, > much less earlier? Why wait until now? Because I did not notice it then. And it seems nobody else did either. Until Jelte 'fessed up. > Having IANA assign after-the-fact *because* of vendor use is, of > course, a bad idea, but that is not what Andrew proposed. We are > talking about a WG work item for which there were multiple requests > for review. Fair enough. But the review which did take place didn't spot the new algorithm IDs. So in that respect, it's not that different from just plucking numbers out of the air. The WG's still arrived at a position where algorithm codes that shouldn't have been assigned are about to be registered by IANA. > The document in question is destined for Standards Track, not > Experimental. OK. I misremembered Jelte's initial mail. > Define "misused" in this case. Well how about "escaped proper scrutiny by the WG". Although the circumstances you've outlined are not the same as or as bad as "plucking numbers out the ether", the end result is pretty much the same. If anything your mail strengthens my disapproval of a proposal to assign these codes. It points to a failure in the review process and then a rewriting of history to deal with that. This is Bad. I'm particularly worried about this when future attempts are made to roll more crypto algorithms into DNSSEC. Because now not only has a dangerous precedent been set, but someone would have a valid complaint that there was one set of rules for those inside the IETF machine and another for those who weren't. Imagine a DJB-style rant along the lines of "they let Jelte's codes though but won't give me one for the crypto I've deployed". From owner-namedroppers@ops.ietf.org Mon Sep 28 12:56:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5A8B23A6867; Mon, 28 Sep 2009 12:56:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.388 X-Spam-Level: X-Spam-Status: No, score=-4.388 tagged_above=-999 required=5 tests=[AWL=0.107, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t0qgdvex-3z6; Mon, 28 Sep 2009 12:56:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 19FF13A68BB; Mon, 28 Sep 2009 12:56:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsMFL-000PmA-BN for namedroppers-data0@psg.com; Mon, 28 Sep 2009 19:50:55 +0000 Received: from [192.245.12.227] (helo=balder-227.proper.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsMFB-000Pgz-Ah for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 19:50:52 +0000 Received: from [10.20.30.158] (75-101-30-90.dsl.dynamic.sonic.net [75.101.30.90]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n8SJod3E034625 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 28 Sep 2009 12:50:40 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> Date: Mon, 28 Sep 2009 12:50:38 -0700 To: Jim Reid From: Paul Hoffman Subject: Re: [dnsext] algorithm identifier code point hijacking Cc: Paul Vixie , Doug Barton , IETF DNSEXT WG Content-Type: text/plain; charset="us-ascii" Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: At 8:36 PM +0100 9/28/09, Jim Reid wrote: >On 28 Sep 2009, at 19:45, Paul Hoffman wrote: > >>Straw-man alert: that's not what happened here, and it is inappropriate to suggest that it was. The author of an active WG document made the mistake of hard-coding numbers in the Internet Draft based on looking at the history of allocation (namely, monotonically increasing). The draft *with those numbers included* went through multiple iterations in the WG. None of the three of you objected to the use of those code points during that review. >> >>That is far from "free for all". > >With respect Paul, it is. > >You point out that the review process didn't pick up on this error. [I'm guilty as charged m'lud.] Which makes me wonder what other Bad Ideas or comparable administrative errors might be that draft and have escaped scrutiny. Or in other drafts for that matter.... Perhaps we're all burnt out with DNSSEC and nothing gets the same level of attention as in the early days of DNSSEC protocol development. If that's true, it's worrying. I fully agree with everything in the second paragraph, but I don't see how it leads to the first. We have a review process that (at least) allows us to find errors. That's not a free-for-all. To be clear: if someone puts a value in an I-D that is not meant to be being reviewed by the WG, I have much, much less compassion for them expecting IANA to then give them the number they chose. I would want IANA to follow its monotonically-increasing rule which might or might not make those authors happy. But that's not what we are talking about here. >>>It should not be acceptable for someone to just pluck algorithm numbers out of the air and then have IANA register these after the fact. >> >>If you believe that, why did not not object during WG Last Call, much less earlier? Why wait until now? > >Because I did not notice it then. And it seems nobody else did either. Until Jelte 'fessed up. And then what? I don't see anyone, you included, saying on the list that the inclusion would cause an IANA reset. It did not come up until the mostly-unrelated discussion this week. >But the review which did take place didn't spot the new algorithm IDs. So in that respect, it's not that different from just plucking numbers out of the air. >. . . >If anything your mail strengthens my disapproval of a proposal to assign these codes. It points to a failure in the review process and then a rewriting of history to deal with that. This is Bad. We'll have to agree to disagree on this; I see the process quite differently than you do. >I'm particularly worried about this when future attempts are made to roll more crypto algorithms into DNSSEC. Because now not only has a dangerous precedent been set, but someone would have a valid complaint that there was one set of rules for those inside the IETF machine and another for those who weren't. Fully disagree. That would not be a "valid complaint" at all. >Imagine a DJB-style rant along the lines of "they let Jelte's codes though but won't give me one for the crypto I've deployed". I can imagine it, and I can imagine my response: "your document wasn't a WG document so the rules are different". Why would you want to respond in a different way? --Paul Hoffman, Director --VPN Consortium From owner-namedroppers@ops.ietf.org Mon Sep 28 13:35:18 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B86F83A6942; Mon, 28 Sep 2009 13:35:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.437 X-Spam-Level: X-Spam-Status: No, score=-4.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aidQk1rp1bOd; Mon, 28 Sep 2009 13:35:18 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D4FEF3A63EC; Mon, 28 Sep 2009 13:35:17 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsMuV-0005AF-5y for namedroppers-data0@psg.com; Mon, 28 Sep 2009 20:33:27 +0000 Received: from [204.152.189.190] (helo=virtualized.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsMuL-00059J-18 for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 20:33:25 +0000 Received: from localhost (localhost [127.0.0.1]) by virtualized.org (Postfix) with ESMTP id 96D80816D2F; Mon, 28 Sep 2009 13:33:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at virtualized.org Received: from virtualized.org ([127.0.0.1]) by localhost (trantor.virtualized.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QravZG3cgOVC; Mon, 28 Sep 2009 13:33:15 -0700 (PDT) Received: from [172.19.131.156] (unknown [12.130.118.26]) by virtualized.org (Postfix) with ESMTP id B003F816D26; Mon, 28 Sep 2009 13:33:10 -0700 (PDT) Subject: Re: [dnsext] algorithm identifier code point hijacking Mime-Version: 1.0 (Apple Message framework v1076) Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes From: David Conrad In-Reply-To: <20090928180301.GB14041@vacation.karoshi.com.> Date: Mon, 28 Sep 2009 13:32:56 -0700 Cc: Jim Reid , IETF DNSEXT WG Content-Transfer-Encoding: 7bit Message-Id: <97156AF7-BDE5-4558-9BD5-3821B00F9898@virtualized.org> References: <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> To: bmanning@vacation.karoshi.com X-Mailer: Apple Mail (2.1076) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Bill, On Sep 28, 2009, at 11:03 AM, bmanning@vacation.karoshi.com wrote: > well... the IANA used to be much more proactive in engagement > with the development process Jon was a bit more technical than most and what was being standardized was much more limited than what it is today. > Not just because of an un-approachable IANA, Michelle and the other folks who do IANA stuff are unapproachable? There is an IANA booth at every IETF. IANA staff answer phones and email. How exactly is IANA unapproachable? > but a strict, process-driven > IETF that pretty much insists that no code be written before the > spec is hammered out. Ignoring the anti-IETF hyperbole, IANA has allocated code points based on unhammered out drafts in the past. This really shouldn't be that hard. With respect to code point "hijacking", when IANA staff have asked in the past, the IESG has consistently come down on the side of prescriptive registries rather than descriptive. In some cases, I actually think this is a mistake, but the job of folks at IANA isn't to make policy. Regards, -drc From owner-namedroppers@ops.ietf.org Mon Sep 28 13:38:00 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EC1383A6A0F; Mon, 28 Sep 2009 13:38:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.039 X-Spam-Level: X-Spam-Status: No, score=-0.039 tagged_above=-999 required=5 tests=[AWL=-0.439, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G1SNBRZJSwE8; Mon, 28 Sep 2009 13:38:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1E0E53A691E; Mon, 28 Sep 2009 13:38:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsMsX-0004vj-S2 for namedroppers-data0@psg.com; Mon, 28 Sep 2009 20:31:25 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsMsO-0004uA-I5 for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 20:31:24 +0000 Received: from crankycanuck.ca (external.shinkuro.com [66.92.164.104]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 286CB2FE8CE3 for ; Mon, 28 Sep 2009 20:31:15 +0000 (UTC) Date: Mon, 28 Sep 2009 16:31:13 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] algorithm identifier code point hijacking Message-ID: <20090928203113.GH536@shinkuro.com> References: <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, Sep 28, 2009 at 08:36:20PM +0100, Jim Reid wrote: > Fair enough. But the review which did take place didn't spot the new > algorithm IDs. So in that respect, it's not that different from just > plucking numbers out of the air. Now, wait just a minute. That's a total abdication of the WG's responsibility for the quality of its output. For instance, I reviewed the drafts that had these algorithm numbers in them, and I screwed up by not saying, "That ought to be TBD1 and TBD2." (Indeed, I didn't even notice this issue until we had to pull the draft back from the IESG after the post-WGLC negative comments arrived. If you want to dump on someone, your chair is a good target here.) If we're supposed to do review, and we somehow fail, we're not absolved of the faults in the result. This isn't "plucking numbers out of the air", it's just a series of mistakes by humans. Surely, if we're worried about bureaucratic processes and so on, we ought not to set a rule that tends to obscure the difference between, "Bad actor tries to do something nasty to force a situation," and, "Oh, phooey, we screwed up." A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Mon Sep 28 13:44:21 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A8ABE3A67AD; Mon, 28 Sep 2009 13:44:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.75 X-Spam-Level: X-Spam-Status: No, score=-4.75 tagged_above=-999 required=5 tests=[AWL=-0.255, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wLzHQPscFT-m; Mon, 28 Sep 2009 13:44:20 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BC4F13A63EC; Mon, 28 Sep 2009 13:44:20 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsN2g-0006LY-4b for namedroppers-data0@psg.com; Mon, 28 Sep 2009 20:41:54 +0000 Received: from [198.32.6.68] (helo=vacation.karoshi.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsN2W-0006KZ-Pe for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 20:41:52 +0000 Received: from karoshi.com (localhost.localdomain [127.0.0.1]) by vacation.karoshi.com (8.12.8/8.12.8) with ESMTP id n8SKegNE015451; Mon, 28 Sep 2009 20:40:42 GMT Received: (from bmanning@localhost) by karoshi.com (8.12.8/8.12.8/Submit) id n8SKefIC015450; Mon, 28 Sep 2009 20:40:41 GMT Date: Mon, 28 Sep 2009 20:40:41 +0000 From: bmanning@vacation.karoshi.com To: David Conrad Cc: bmanning@vacation.karoshi.com, Jim Reid , IETF DNSEXT WG Subject: Re: [dnsext] algorithm identifier code point hijacking Message-ID: <20090928204041.GA15359@vacation.karoshi.com.> References: <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <97156AF7-BDE5-4558-9BD5-3821B00F9898@virtualized.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <97156AF7-BDE5-4558-9BD5-3821B00F9898@virtualized.org> User-Agent: Mutt/1.4.1i Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Mon, Sep 28, 2009 at 01:32:56PM -0700, David Conrad wrote: > Bill, > > On Sep 28, 2009, at 11:03 AM, bmanning@vacation.karoshi.com wrote: > >well... the IANA used to be much more proactive in engagement > >with the development process > > Jon was a bit more technical than most and what was being standardized > was much more limited than what it is today. True and maybe. > > >Not just because of an un-approachable IANA, > > Michelle and the other folks who do IANA stuff are unapproachable? > There is an IANA booth at every IETF. IANA staff answer phones and > email. How exactly is IANA unapproachable? well... as Paul pointed out - Jon would get out and meet with folks, go to WG meetings, etc. Not have a booth where folks would need to walk up to talk to him. > >but a strict, process-driven > >IETF that pretty much insists that no code be written before the > >spec is hammered out. > > Ignoring the anti-IETF hyperbole, IANA has allocated code points based > on unhammered out drafts in the past. This really shouldn't be that > hard. agreed - that should be the easy path. > With respect to code point "hijacking", when IANA staff have asked in > the past, the IESG has consistently come down on the side of > prescriptive registries rather than descriptive. In some cases, I > actually think this is a mistake, but the job of folks at IANA isn't > to make policy. we've had this discussion before. > > Regards, > -drc From owner-namedroppers@ops.ietf.org Mon Sep 28 13:56:32 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AA71F3A682C; Mon, 28 Sep 2009 13:56:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.663 X-Spam-Level: X-Spam-Status: No, score=-0.663 tagged_above=-999 required=5 tests=[AWL=-0.168, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 13g8jy0CNk5U; Mon, 28 Sep 2009 13:56:32 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E68DF3A680C; Mon, 28 Sep 2009 13:56:31 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsNEY-0007xG-ND for namedroppers-data0@psg.com; Mon, 28 Sep 2009 20:54:10 +0000 Received: from [195.54.233.70] (helo=hutch.rfc1035.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsNEP-0007wk-CZ for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 20:54:08 +0000 Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) by hutch.rfc1035.com (Postfix) with ESMTP id 566DE1542060; Mon, 28 Sep 2009 21:53:59 +0100 (BST) Cc: namedroppers@ops.ietf.org Message-Id: <44C2CBDB-B1DA-42CE-A7A0-433CEAB2C89E@rfc1035.com> From: Jim Reid To: Andrew Sullivan In-Reply-To: <20090928203113.GH536@shinkuro.com> Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] algorithm identifier code point hijacking Date: Mon, 28 Sep 2009 21:54:00 +0100 References: <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928203113.GH536@shinkuro.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 28 Sep 2009, at 21:31, Andrew Sullivan wrote: > If you want to dump on someone, your chair is a good target here.) I don't want to dump on anyone. There's been a collective failure here. From owner-namedroppers@ops.ietf.org Mon Sep 28 14:01:52 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C43ED3A680C; Mon, 28 Sep 2009 14:01:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.559 X-Spam-Level: * X-Spam-Status: No, score=1.559 tagged_above=-999 required=5 tests=[AWL=-0.604, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_NET=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id It-rYlFxL3kH; Mon, 28 Sep 2009 14:01:51 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 606663A67AD; Mon, 28 Sep 2009 14:01:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsNKM-0008ln-D7 for namedroppers-data0@psg.com; Mon, 28 Sep 2009 21:00:10 +0000 Received: from [209.86.89.69] (helo=elasmtp-mealy.atl.sa.earthlink.net) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsNKC-0008lA-Vp for namedroppers@ops.ietf.org; Mon, 28 Sep 2009 21:00:08 +0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=ix.netcom.com; b=fWTab4fDTNl8JyYvtmF3oKxnx1vXHzK6de+9PtejxLsdzFwQRkfG1GTfpIgWU1dS; h=Message-ID:Date:From:Reply-To:To:Subject:Cc:Mime-Version:Content-Type:Content-Transfer-Encoding:X-Mailer:X-ELNK-Trace:X-Originating-IP; Received: from [209.86.224.41] (helo=elwamui-mouette.atl.sa.earthlink.net) by elasmtp-mealy.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from ) id 1MsNKB-0005ka-4t; Mon, 28 Sep 2009 16:59:59 -0400 Received: from 209.44.32.166 by webmail.earthlink.net with HTTP; Mon, 28 Sep 2009 16:59:58 -0400 Message-ID: <17865361.1254171599134.JavaMail.root@elwamui-mouette.atl.sa.earthlink.net> Date: Mon, 28 Sep 2009 15:59:58 -0500 (GMT-05:00) From: "Jeffrey A. Williams" Reply-To: "Jeffrey A. Williams" To: Jim Reid , Andrew Sullivan Subject: Re: [dnsext] algorithm identifier code point hijacking Cc: namedroppers@ops.ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Mailer: EarthLink Zoo Mail 1.0 X-ELNK-Trace: c8e3929e1e9c87a874cfc7ce3b1ad11381c87f5e519606884fa06e1c53bae5f553a8eca1647a93ca350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c X-Originating-IP: 209.86.224.41 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Jim and all, Not an unusual occurance from what I've been reading on this subject area thus far. -----Original Message----- >From: Jim Reid >Sent: Sep 28, 2009 3:54 PM >To: Andrew Sullivan >Cc: namedroppers@ops.ietf.org >Subject: Re: [dnsext] algorithm identifier code point hijacking > > >On 28 Sep 2009, at 21:31, Andrew Sullivan wrote: > >> If you want to dump on someone, your chair is a good target here.) > >I don't want to dump on anyone. There's been a collective failure here. > > Regards, Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 294k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1@ix.netcom.com Phone: 214-244-4827 From owner-namedroppers@ops.ietf.org Mon Sep 28 17:10:17 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E97DB3A68BB; Mon, 28 Sep 2009 17:10:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.461 X-Spam-Level: X-Spam-Status: No, score=-2.461 tagged_above=-999 required=5 tests=[AWL=0.138, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mztwY5JbZb+V; Mon, 28 Sep 2009 17:10:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id CEE403A62C1; Mon, 28 Sep 2009 17:10:16 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsQ8g-0006hU-7E for namedroppers-data0@psg.com; Tue, 29 Sep 2009 00:00:18 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsQ8O-0006fW-EV for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 00:00:08 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 46297E605D; Mon, 28 Sep 2009 23:59:59 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8SNxp1N073209; Tue, 29 Sep 2009 09:59:52 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909282359.n8SNxp1N073209@drugs.dv.isc.org> To: Paul Hoffman Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> Subject: Re: [dnsext] GOST DNSSEC implementations? In-reply-to: Your message of "Mon, 28 Sep 2009 08:57:59 MST." Date: Tue, 29 Sep 2009 09:59:51 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Paul Hoffman writes: > At 11:13 AM -0400 9/28/09, Andrew Sullivan wrote: > >On Sun, Sep 27, 2009 at 05:35:46PM -0700, Doug Barton wrote: > > > >> to do it. By accommodating this mistake you both lower the bar a notch > >> and embolden the next person who decides to hijack a code point for > >> what they consider a "good reason." > > > >I want to ask the WG for its views on the above argument. I confess I > >find it unpersuasive. We are not the protocol police. Moreover, I > >don't believe anyone is watching us to see whether they can be > >emboldened. On the contrary, I suspect that the only effect of using > >completely new identifiers would be to break an existing (but wrong) > >released implementation without any concomitant benefit. > > > >I am susceptible to persuasion, however, so if others feel as Doug > >does, then it would be good to know it. > > Other IETF WGs, particularly in the Security Area have dealt with this very i > ssue in the past. The short answer is that both of you are right in approxima > tely the same amount. I have heard developers say "BigCo shipped with this nu > mber that they assumed IANA would assign in the Foo protocol, so we should no > t wait and just do the same". Other vendors have patiently waited because the > y didn't want to be assholes like BigCo. At least one WG did the "change the > identifier to level the playing field" dance, and interoperability went to he > ll, and is still there many years later. I don't see a interop problem here. The zones will be treated as insecure by everyone else. By the time these numbers are reused the offending code should no longer be being used. We are talking 20+ years. Just have everyone warn about them until 00:00 Jan 1, 2015 UTC. TLD and other infrustructure providers should be requested not to accept these algorithms code points until after this date and to state why they are not being accepted. This will help clean the use of the offending code points out sooner. This is easy to fix for offending zones. Download and compile the new code. Generate new keys and sign the zone with those keys. The only hard part is to make sure any published trust anchors are pulled from validators that "understand" the code point. DS should be removed from parent zones before re-signing so the zone will cleanly transition to being treated as insecure for these algorithms. Mark > If you agree that both sides are right, then we should lean strongly towards > interoperability, not punishing hijackers. > > --Paul Hoffman, Director > --VPN Consortium > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon Sep 28 19:16:22 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E8F283A6923; Mon, 28 Sep 2009 19:16:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.463 X-Spam-Level: X-Spam-Status: No, score=-2.463 tagged_above=-999 required=5 tests=[AWL=0.136, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n3yN4S8tUxtT; Mon, 28 Sep 2009 19:16:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 0762E3A68EC; Mon, 28 Sep 2009 19:16:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsSBr-000PaS-Um for namedroppers-data0@psg.com; Tue, 29 Sep 2009 02:11:43 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsSBh-000PZK-Mk for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 02:11:41 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id B0053E601E; Tue, 29 Sep 2009 02:11:32 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8T2BTlQ074821; Tue, 29 Sep 2009 12:11:30 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909290211.n8T2BTlQ074821@drugs.dv.isc.org> To: Jim Reid Cc: bmanning@vacation.karoshi.com, IETF DNSEXT WG From: Mark Andrews References: <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <4A0D1D73-7319-4BE5-949D-E54D0AD04F3F@rfc1035.com> Subject: Re: [dnsext] algorithm identifier code point hijacking In-reply-to: Your message of "Mon, 28 Sep 2009 19:33:04 +0100." <4A0D1D73-7319-4BE5-949D-E54D0AD04F3F@rfc1035.com> Date: Tue, 29 Sep 2009 12:11:29 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <4A0D1D73-7319-4BE5-949D-E54D0AD04F3F@rfc1035.com>, Jim Reid writes: > On 28 Sep 2009, at 19:03, bmanning@vacation.karoshi.com wrote: > > > Not just because of an un-approachable IANA, but a strict, process- > > driven > > IETF that pretty much insists that no code be written before the > > spec is hammered out. > > > > Put too much red tape in place and folks will work around it. > > Bill, I was not advocating a cumbersome process: far from it. > > RFC5395 seems to be working reasonably well for RR type codes. It > doesn't require RFCs or diverse implementations. All it takes is a > reasonable enough amount of information for an independent reviewer to > say whether IANA should assign a type code or not. > > Something similar for algorithm numbers should work just as well too. > Though in this case the reviewer would ask "does this crypto algorithm > look sound?" rather than "does the proposed RR do bad things at zone > cuts or with Additional Section processing?". There would be no need > for WG review or comment. > > In fact I'd argue that the reason for the current discussion is > precisely because there is no process for registering algorithm codes > other than writing a standards-track RFC. If one want to experiment with new crypto there already is a way to do that without involving anyone other than the experimenters. You don't need to go to IANA to experiment in this area. If there is consensus that the algorithm is good/needed we can give it a algorithm number and it is then likely to be picked up by most/all of the vendors. Having that consensus go through the RFC process is not bad. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon Sep 28 19:28:31 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1EFC53A6A0D; Mon, 28 Sep 2009 19:28:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.464 X-Spam-Level: X-Spam-Status: No, score=-2.464 tagged_above=-999 required=5 tests=[AWL=0.135, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Ia-IkdQc4BU; Mon, 28 Sep 2009 19:28:30 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1ED743A69F9; Mon, 28 Sep 2009 19:28:30 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsSPh-00021K-M2 for namedroppers-data0@psg.com; Tue, 29 Sep 2009 02:26:01 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsSPX-00020U-CN for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 02:25:59 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 77D4EE601E; Tue, 29 Sep 2009 02:25:50 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8T2PZPj074971; Tue, 29 Sep 2009 12:25:46 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909290225.n8T2PZPj074971@drugs.dv.isc.org> To: Paul Hoffman Cc: Jim Reid , Paul Vixie , Doug Barton , IETF DNSEXT WG From: Mark Andrews References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> Subject: Re: [dnsext] algorithm identifier code point hijacking In-reply-to: Your message of "Mon, 28 Sep 2009 11:45:50 MST." Date: Tue, 29 Sep 2009 12:25:35 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , Paul Hoffman writes: > At 6:24 PM +0100 9/28/09, Jim Reid wrote: > >Although everyone's right, I tend to agree with Doug here. Why bother having > such a registry if there's going to be an effective free for all with algori > thm subtyping? > > Straw-man alert: that's not what happened here, and it is inappropriate to su > ggest that it was. The author of an active WG document made the mistake of ha > rd-coding numbers in the Internet Draft based on looking at the history of al > location (namely, monotonically increasing). The draft *with those numbers in > cluded* went through multiple iterations in the WG. None of the three of you > objected to the use of those code points during that review. The author also clearly marked the code points as TBA. The examples had a number in them but all the descriptive text was TBA. > That is far from "free for all". > > > It should not be acceptable for someone to just pluck algorithm numbers out > of the air and then have IANA register these after the fact. > > If you believe that, why did not not object during WG Last Call, much less ea > rlier? Why wait until now? The numbers in the examples had no bearing on whether the design was good or not. Changing the examples to reflect a assigned code point is a editorial change that doesn't require WG consensus. > >Doing this now sets a precedent that could create nasty problems in the futu > re, especially when all sorts of crazy crypto schemes start to get flung at a > DNS that has broader DNSSEC uptake. > > Having IANA assign after-the-fact *because* of vendor use is, of course, a ba > d idea, but that is not what Andrew proposed. We are talking about a WG work > item for which there were multiple requests for review. And which were clearly marked as TBA. > >Algorithm numbers for private or experimental use where set aside. So I don' > t know why these weren't used for the "experiment" that has now somehow morph > ed into a production environment. > > The document in question is destined for Standards Track, not Experimental. > > >I think this incident has demonstarted there's a need for an RFC5395-like pr > ocess for assigning algorithm identifiers for DNSSEC. No it hasn't. There is a way for anyone to experiment in this area without having to get a algorithm number assigned. > Fully agree; that's what we have, modulo a document author who screwed up and > dozens of probable reviewers who didn't call him on it. It was immaterial to whether the document was good enough to go to IESG and IETF last call or not. Regenerating the examples for a new code point is a mechanical process. > >IMO, the identifiers that have been misused should be entered into the regis > try as "Reserved" or something like that. Then some to-be-invented process ge > ts followed for identifiers to be assigned to the algorithms that accidentall > y got type codes withount undergoing IETF scrutiny. > > Define "misused" in this case. > > --Paul Hoffman, Director > --VPN Consortium > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Mon Sep 28 19:56:10 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 11C983A6A27; Mon, 28 Sep 2009 19:56:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.466 X-Spam-Level: X-Spam-Status: No, score=-2.466 tagged_above=-999 required=5 tests=[AWL=0.133, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xuc-6wGaPhVL; Mon, 28 Sep 2009 19:56:09 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id BB3803A6A0D; Mon, 28 Sep 2009 19:56:08 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsSo4-0006a7-V7 for namedroppers-data0@psg.com; Tue, 29 Sep 2009 02:51:12 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsSm9-0006IL-Fo for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 02:49:20 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 5D670E6026; Tue, 29 Sep 2009 02:49:12 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8T2n9YA075563; Tue, 29 Sep 2009 12:49:09 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909290249.n8T2n9YA075563@drugs.dv.isc.org> To: Andrew Sullivan Cc: namedroppers@ops.ietf.org From: Mark Andrews References: <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928203113.GH536@shinkuro.com> Subject: Re: [dnsext] algorithm identifier code point hijacking In-reply-to: Your message of "Mon, 28 Sep 2009 16:31:13 -0400." <20090928203113.GH536@shinkuro.com> Date: Tue, 29 Sep 2009 12:49:09 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <20090928203113.GH536@shinkuro.com>, Andrew Sullivan writes: > On Mon, Sep 28, 2009 at 08:36:20PM +0100, Jim Reid wrote: > > > Fair enough. But the review which did take place didn't spot the new > > algorithm IDs. So in that respect, it's not that different from just > > plucking numbers out of the air. > > Now, wait just a minute. That's a total abdication of the WG's > responsibility for the quality of its output. For instance, I > reviewed the drafts that had these algorithm numbers in them, and I > screwed up by not saying, "That ought to be TBD1 and TBD2." (Indeed, > I didn't even notice this issue until we had to pull the draft back > from the IESG after the post-WGLC negative comments arrived. If you > want to dump on someone, your chair is a good target here.) You could TBA the DNSKEY record. You can't really TBA a RRSIG as the signature bits are dependent on the assigned code point. > If we're supposed to do review, and we somehow fail, we're not > absolved of the faults in the result. This isn't "plucking numbers > out of the air", it's just a series of mistakes by humans. Surely, if > we're worried about bureaucratic processes and so on, we ought not to > set a rule that tends to obscure the difference between, "Bad actor > tries to do something nasty to force a situation," and, "Oh, phooey, > we screwed up." Perhaps we should have added [to be regenerated on code point assignment] to prevent it being forgotten. > A > > -- > Andrew Sullivan > ajs@shinkuro.com > Shinkuro, Inc. > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 29 00:51:54 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EDBB53A6A85; Tue, 29 Sep 2009 00:51:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.434 X-Spam-Level: X-Spam-Status: No, score=0.434 tagged_above=-999 required=5 tests=[AWL=-0.316, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y5M7HdgoFsSg; Tue, 29 Sep 2009 00:51:54 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C6B9A3A68B1; Tue, 29 Sep 2009 00:51:53 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsXNV-000OEL-AL for namedroppers-data0@psg.com; Tue, 29 Sep 2009 07:44:05 +0000 Received: from [193.227.124.2] (helo=mx01.bfk.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsXNI-000OBr-Vy for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 07:44:03 +0000 Received: from mx00.int.bfk.de ([10.119.110.2]) by mx01.bfk.de with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) id 1MsXNF-0003Ov-2f; Tue, 29 Sep 2009 09:43:49 +0200 Received: by bfk.de with local id 1MsXNE-0004nd-VW; Tue, 29 Sep 2009 07:43:48 +0000 To: Andrew Sullivan Cc: namedroppers@ops.ietf.org Subject: Re: [dnsext] GOST DNSSEC implementations? References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> From: Florian Weimer Date: Tue, 29 Sep 2009 07:43:48 +0000 In-Reply-To: <20090928151345.GD536@shinkuro.com> (Andrew Sullivan's message of "Mon\, 28 Sep 2009 11\:13\:45 -0400") Message-ID: <82ocoukxfv.fsf@mid.bfk.de> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: * Andrew Sullivan: > Dear colleagues, > > On Sun, Sep 27, 2009 at 05:35:46PM -0700, Doug Barton wrote: > >> to do it. By accommodating this mistake you both lower the bar a notch >> and embolden the next person who decides to hijack a code point for >> what they consider a "good reason." > > I want to ask the WG for its views on the above argument. I guess we have to conede that the registry is not actively used. IMHO, you can't rightfully complain if people bypass a dormant registry. --=20 Florian Weimer BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstra=DFe 100 tel: +49-721-96201-1 D-76133 Karlsruhe fax: +49-721-96201-99 From owner-namedroppers@ops.ietf.org Tue Sep 29 00:54:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 135F63A68B1; Tue, 29 Sep 2009 00:54:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.455 X-Spam-Level: X-Spam-Status: No, score=0.455 tagged_above=-999 required=5 tests=[AWL=-0.295, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v+566iZr50hl; Tue, 29 Sep 2009 00:54:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 452973A6A47; Tue, 29 Sep 2009 00:54:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsXUz-000POS-J3 for namedroppers-data0@psg.com; Tue, 29 Sep 2009 07:51:49 +0000 Received: from [193.227.124.2] (helo=mx01.bfk.de) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsXUY-000PCg-BP for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 07:51:35 +0000 Received: from mx00.int.bfk.de ([10.119.110.2]) by mx01.bfk.de with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) id 1MsXUW-0004j9-TL; Tue, 29 Sep 2009 09:51:20 +0200 Received: by bfk.de with local id 1MsXUW-000334-Pb; Tue, 29 Sep 2009 07:51:20 +0000 To: Paul Vixie Cc: IETF DNSEXT WG Subject: Re: [dnsext] algorithm identifier code point hijacking References: <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <57145.1254164861@nsa.vix.com> From: Florian Weimer Date: Tue, 29 Sep 2009 07:51:20 +0000 In-Reply-To: <57145.1254164861@nsa.vix.com> (Paul Vixie's message of "Mon\, 28 Sep 2009 19\:07\:41 +0000") Message-ID: <82k4zikx3b.fsf@mid.bfk.de> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: * Paul Vixie: > the day i met jon postel in person for the first time, it was because i > was attending my first IETF (somewhere in canada) and i'd stayed up all > night prototyping NOTIFY and i ran into bmanning in the hallway somewhere > and asked "how do i get a codepoint assigned for the NOTIFY opcode" and > he said "you have to talk to the IANA, i see him coming right now." jon > heard me out, took me to the terminal room, logged into an ISI computer, > and made the assignment. thus my prototype was able to be tested with > the same opcode number as it would have in production, even though there > was no spec, not even a draft, at that moment. For port numbers, is it really that different today? Some time ago, when James Yonan requested a port number for OpenVPN, a decidedly non-IETFy protocol with a single implementation, we were all surprised by the quick assignment. As far as I know, this WG has decided to put the DNS security algorithm numbers registry into stasis. This is not IANA's fault. --=20 Florian Weimer BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstra=DFe 100 tel: +49-721-96201-1 D-76133 Karlsruhe fax: +49-721-96201-99 From owner-namedroppers@ops.ietf.org Tue Sep 29 02:13:02 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 777883A6849; Tue, 29 Sep 2009 02:13:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.542 X-Spam-Level: X-Spam-Status: No, score=-102.542 tagged_above=-999 required=5 tests=[AWL=0.058, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tSC2jh-J3+k5; Tue, 29 Sep 2009 02:13:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A17083A6873; Tue, 29 Sep 2009 02:13:00 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsYhd-000Cud-QZ for namedroppers-data0@psg.com; Tue, 29 Sep 2009 09:08:57 +0000 Received: from [2001:7b8:206:1::1] (helo=open.nlnetlabs.nl) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsYhT-000Cte-7w for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 09:08:55 +0000 Received: from [IPv6:2001:7b8:206:1:226:b0ff:fee2:a770] ([IPv6:2001:7b8:206:1:226:b0ff:fee2:a770]) (authenticated bits=0) by open.nlnetlabs.nl (8.14.3/8.14.3) with ESMTP id n8T98cv5029267 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Tue, 29 Sep 2009 11:08:38 +0200 (CEST) (envelope-from olaf@NLnetLabs.nl) Subject: Re: [dnsext] GOST DNSSEC implementations? Mime-Version: 1.0 (Apple Message framework v1076) Content-Type: multipart/signed; boundary=Apple-Mail-36-1030211964; protocol="application/pkcs7-signature"; micalg=sha1 From: Olaf Kolkman In-Reply-To: <4ABD9B35.7030101@dougbarton.us> Date: Tue, 29 Sep 2009 11:08:38 +0200 Cc: Jelte Jansen , namedroppers@ops.ietf.org Message-Id: <968B5B54-6180-4A52-B7DC-C2AA34B83152@NLnetLabs.nl> References: <200909141718.n8EHI5U4004295@stora.ogud.com> <4AAF56CD.6060401@nlnetlabs.nl> <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> To: Doug Barton X-Mailer: Apple Mail (2.1076) X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.3 (open.nlnetlabs.nl [IPv6:2001:7b8:206:1::1]); Tue, 29 Sep 2009 11:08:39 +0200 (CEST) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --Apple-Mail-36-1030211964 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes On Sep 26, 2009, at 6:40 AM, Doug Barton wrote: > Jelte Jansen wrote: >> which I also happened to have chosen for my implementation of RSA/ >> SHA2 in ldns >> (as well as 9, 10 and 11, back when the first last call was done >> and the draft >> had 4 different algorithms). Those have 'escaped' through a nice >> combination of >> expecting the draft to become an rfc as it was, and some >> communication errors, >> so now there might be validators out there that expect algorithm 8 >> to mean >> RSA/SHA256, even if the actual algorithm id turns out to be >> something else (or >> even if the draft is completely turned down). >> >> Which now means that if we want to be sure that nobody gets >> unexpected failures, >> IANA should assign numbers 8 and 10 to RSA/SHA256 and RSA/SHA512, >> and 9 and 11 >> should be marked as don't-use-in-the-forseeable-future... >> >> and we need to figure out a way to prevent people like me from >> making the same >> mistake :) > > IANA could kill two birds with one stone by not assigning 8-11 "in the > foreseeable future" and assigning something totally different to > RSA/SHA{256|512}. There is a special place reserved in hell for people > who hijack code points (and port numbers, etc. etc.). Making examples > of you (and those who relied on you) should hopefully serve as the > "way to prevent people like you from making the same mistake." And > yes, I'm serious. As Jelte explained above there are a number of reasons why code was shipped with non IANA-assigned code points. Speaking for NLnet Labs: It is not our policy to ship code with self- assigned code points enabled by default. Sometimes our code does contain such code points for interoperability testing (the running code part of rough consensus) but that code MUST be enabled at compile time. This time the code "escaped" in error and not because of conscious hijack, mea culpa non-the less. The code using these code points has been disabled in more recent releases. From an Unbound perspective the code points can be safely used for RSA SHA256 en SHA512 but you would also not meet with any resistance if other code points would be assigned. --Olaf Kolkman director NLnet Labs PS: While Jelte's email address now contains ISC, this happens while he was at NLnet Labs and is Labs' responsibility. ________________________________________________________ Olaf M. Kolkman NLnet Labs Science Park 140, http://www.nlnetlabs.nl/ 1098 XG Amsterdam --Apple-Mail-36-1030211964 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIFMTCCBS0w ggMVoAMCAQICAwbqdTANBgkqhkiG9w0BAQUFADB5MRAwDgYDVQQKEwdSb290IENBMR4wHAYDVQQL ExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNBIENlcnQgU2lnbmluZyBBdXRob3Jp dHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAY2FjZXJ0Lm9yZzAeFw0wOTA1MjUwODQ4MTJaFw0x MTA1MjUwODQ4MTJaMDkxFTATBgNVBAMTDE9sYWYgS29sa21hbjEgMB4GCSqGSIb3DQEJARYRb2xh ZkBubG5ldGxhYnMubmwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtxtZNngmuLgcf rto+Uax1WhonECqb5W8US2Z+ZPw/ASKsjKEF8Wa3Nnispys6Gj9Sl7C1X0/2pH//qauLpBqA+lHW L9mgdGW1T9KU1Fb8Odqw0PBnIIhbLNQzecZL+BchEetcrubplQWzDOpROCJ00IwXksusBiKqhew4 u7X2QoraW+z32Knj5ogajIhdkAeBHUy1pwXsk/mDnV8cIEdz1MhaZWDSn7kJUQtRMVCpFBjVoiXh ToXMJfiMvn0CKaeFxFm72dcdzvFsw906Ndafd2MOfdP7QSsTVP6sG9am790AOgkzxT5CM77IDPbD zxZlQ8jTdhcp/WtUrFWIU4QBAgMBAAGjgf0wgfowDAYDVR0TAQH/BAIwADBWBglghkgBhvhCAQ0E SRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQgb3ZlciB0byBodHRw Oi8vd3d3LkNBY2VydC5vcmcwQAYDVR0lBDkwNwYIKwYBBQUHAwQGCCsGAQUFBwMCBgorBgEEAYI3 CgMEBgorBgEEAYI3CgMDBglghkgBhvhCBAEwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZo dHRwOi8vb2NzcC5jYWNlcnQub3JnMBwGA1UdEQQVMBOBEW9sYWZAbmxuZXRsYWJzLm5sMA0GCSqG SIb3DQEBBQUAA4ICAQCLpawAoUQAxivf6blyMswVokRmDl2JGEbtmEu8j0h1BVOlGh6hlI8WaeWy 3x2jJ9uun3VK6oYnHy45ez+dUDjBLjOZdAgwFg225lm1OPdmisghDDVwCIiEogHPqmJtvKYMFoPF 3iFUambJDoQF8DeVeg8ctDvsxsaVGjA8OrMpo0K4I11vnNbCLv7mWCjnaZWt/6Y6TD8ErHQl5dmI rpsHmEZx1/nsocdPkZGRA4QVf1omYHUNs79DtxpYdGKHoorpBNzlzIIjpceiqeOeykoDeYLTZX2G c7Mh4Gdj2MHFqZucxV1cHibb8XKv8ebaGltMV5SrciqRn8yFXmiyTvmId6myNXLiOx+VJiGbLSS3 TltM/kf7UejXeEHulEKufU6Ya6EfH7W2/spTayYCauyLljOjE2Ey5A4oIoJV9eY64OCDuLF2nmGR jOh3JB9nGkZIPhmTUwGZnMELLhzKz+eOZoulM4tXH6KEubed1shQEq1dkJ+tFtRS3Lm+vLCKWvVo 1iZScqPaQf9riPApAVrL+3Wat0p/jtCk5gLBF02uTiWvT2t4ZfSHMEBXR7CvVm58etRQuyZSMHyz UQC4wkDvCeVawNRCZjq6wWdvx5hmr2JeDSkkRtSZ/Fa1WXf26b3BZugI75p5JXafbWdOTRpNc8M5 YMk7tx29ZG3u0qODgDGCAzMwggMvAgEBMIGAMHkxEDAOBgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsT FWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0 eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9ydEBjYWNlcnQub3JnAgMG6nUwCQYFKw4DAhoFAKCCAYcw GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDkwOTI5MDkwODM5WjAj BgkqhkiG9w0BCQQxFgQUD27figWBLMjQ3xOQ+S+MWJdwZ1IwgZEGCSsGAQQBgjcQBDGBgzCBgDB5 MRAwDgYDVQQKEwdSb290IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNV BAMTGUNBIENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAY2Fj ZXJ0Lm9yZwIDBup1MIGTBgsqhkiG9w0BCRACCzGBg6CBgDB5MRAwDgYDVQQKEwdSb290IENBMR4w HAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNBIENlcnQgU2lnbmluZyBB dXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRAY2FjZXJ0Lm9yZwIDBup1MA0GCSqGSIb3 DQEBAQUABIIBAF5JT3aGDTRJAUd6kJo20tnDNPQYh38fpMM1fExib73uYROZF4+Bx0rAX1tcKVE/ Ciw2fNqg/Z2T4M0VN27ChN09rXTUpFUmcygYiGuQJ9I5mFTOrIesWIuPOD+r6AKr5ndTgkv46nnv gGa3T/lPjw6BM2X3oG6B8UjLKgQVxOtJ3SgOS6AOcod+rHBZ6f+6ESBSZnc72/7kjtJ3Bg55DtCo hG3H4SbeWVDAoidGumLyJMAFtyiFyizjnB3jsqDuo+QSHs8hE06M0oZ2ZK1eriKgg1MzTtAtB52L d8t8Fjp6T36FpIFmUUQcLBWsGd637VWN5N8UIL13dpZ4IcryJ9YAAAAAAAA= --Apple-Mail-36-1030211964-- From owner-namedroppers@ops.ietf.org Tue Sep 29 07:15:18 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 07EFB3A6945; Tue, 29 Sep 2009 07:15:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.467 X-Spam-Level: X-Spam-Status: No, score=-2.467 tagged_above=-999 required=5 tests=[AWL=0.132, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5jF4BX56Oq2N; Tue, 29 Sep 2009 07:15:17 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3626228C187; Tue, 29 Sep 2009 07:14:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsdOh-000Ewn-0a for namedroppers-data0@psg.com; Tue, 29 Sep 2009 14:09:43 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsdOV-000Ep2-BQ for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 14:09:39 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 4BA45E601C for ; Tue, 29 Sep 2009 14:09:30 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8TE9QMG086125 for ; Wed, 30 Sep 2009 00:09:28 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909291409.n8TE9QMG086125@drugs.dv.isc.org> To: IETF DNSEXT WG From: Mark Andrews References: <200909151542.n8FFgGhr005086@stora.ogud.com> <4AAFC772.9050909@isc.org> <4AAFCEB9.9070305@cryptocom.ru> <4AB09915.2010801@isc.org> <4ABD9B35.7030101@dougbarton.us> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <57145.1254164861@nsa.vix.com> <82k4zikx3b.fsf@mid.bfk.de> Subject: Re: [dnsext] algorithm identifier code point hijacking In-reply-to: Your message of "Tue, 29 Sep 2009 07:51:20 GMT." <82k4zikx3b.fsf@mid.bfk.de> Date: Wed, 30 Sep 2009 00:09:26 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <82k4zikx3b.fsf@mid.bfk.de>, Florian Weimer writes: > * Paul Vixie: > > > the day i met jon postel in person for the first time, it was because i > > was attending my first IETF (somewhere in canada) and i'd stayed up all > > night prototyping NOTIFY and i ran into bmanning in the hallway somewhere > > and asked "how do i get a codepoint assigned for the NOTIFY opcode" and > > he said "you have to talk to the IANA, i see him coming right now." jon > > heard me out, took me to the terminal room, logged into an ISI computer, > > and made the assignment. thus my prototype was able to be tested with > > the same opcode number as it would have in production, even though there > > was no spec, not even a draft, at that moment. > > For port numbers, is it really that different today? Some time ago, > when James Yonan requested a port number for OpenVPN, a decidedly > non-IETFy protocol with a single implementation, we were all surprised > by the quick assignment. > > As far as I know, this WG has decided to put the DNS security > algorithm numbers registry into stasis. This is not IANA's fault. There is nothing preventing anyone using their own crypto for DNSSEC except themselves. Algorithm number 253 is reserved for private use and will never be assigned to a specific algorithm. The public key area in the DNSKEY RR and the signature area in the RRSIG RR begin with a wire encoded domain name, which MUST NOT be compressed. The domain name indicates the private algorithm to use, and the remainder of the public key area is determined by that algorithm. Entities should only use domain names they control to designate their private algorithms. I would think that using 253 would be a good way to prove that there is enough interest in a algorithm to get it assigned its own algorithm number. Mark > --=20 > Florian Weimer > BFK edv-consulting GmbH http://www.bfk.de/ > Kriegsstra=DFe 100 tel: +49-721-96201-1 > D-76133 Karlsruhe fax: +49-721-96201-99 > -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 29 07:57:30 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 18BA43A697F; Tue, 29 Sep 2009 07:57:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.515 X-Spam-Level: X-Spam-Status: No, score=-0.515 tagged_above=-999 required=5 tests=[AWL=-0.020, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SbRliAy40Zit; Tue, 29 Sep 2009 07:57:29 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 553D93A6876; Tue, 29 Sep 2009 07:57:29 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mse4A-000O2x-Tu for namedroppers-data0@psg.com; Tue, 29 Sep 2009 14:52:34 +0000 Received: from [209.85.219.215] (helo=mail-ew0-f215.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mse3w-000NuH-N2 for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 14:52:33 +0000 Received: by ewy11 with SMTP id 11so5024565ewy.11 for ; Tue, 29 Sep 2009 07:52:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=E0nmfmO0KiKEkkH+SBDLH3OEqQA/vMChpXtOlV/VU1k=; b=tflZrj5VinzNAaBblalvZiPpTjkN2JVqH55JzlECIMQ2HNN53l1YQ9NI0rGkxS23KJ JtNElsh624MqKjwpJq1LO8zwoJvYmn5ka8QSbf4zs34yLtR+CJ5nVfdVmEp0ooY86Cbf q3MybPSrq7gL+1VfjLSxfsC4y+J66Yy74DC+c= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=aq6I3i7XQVWkpl2aDw7+H2yPrsje7io/CPKc2F5TQ2tA+pq6wpva4+1O6GyQyJTWlq dndNE6thc34XzskUb8hRDvtBOzt8Rie1T7FkznUAnn+nONN42rrckJYe8YqskrnenYYQ 4EmgldNKGp3mLlF9HTuQcJy3GL3WwEKN5C2FM= MIME-Version: 1.0 Received: by 10.211.146.1 with SMTP id y1mr4806591ebn.0.1254235939225; Tue, 29 Sep 2009 07:52:19 -0700 (PDT) In-Reply-To: <200909291409.n8TE9QMG086125@drugs.dv.isc.org> References: <200909151542.n8FFgGhr005086@stora.ogud.com> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <57145.1254164861@nsa.vix.com> <82k4zikx3b.fsf@mid.bfk.de> <200909291409.n8TE9QMG086125@drugs.dv.isc.org> From: bert hubert Date: Tue, 29 Sep 2009 16:51:59 +0200 Message-ID: <3efd34cc0909290751g28cba073j6cb6dafb003aef9f@mail.gmail.com> Subject: Re: [dnsext] algorithm identifier code point hijacking To: Mark Andrews Cc: IETF DNSEXT WG Content-Type: text/plain; charset=ISO-8859-1 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Tue, Sep 29, 2009 at 4:09 PM, Mark Andrews wrote: > There is nothing preventing anyone using their own crypto for DNSSEC > except themselves. .... > I would think that using 253 would be a good way to prove that there > is enough interest in a algorithm to get it assigned its own algorithm > number. Are you serious? I mean, it would never work, you'd have multiple implementations out there speaking '253' and meaning different things. That's no way to drum up interest.. Bert From owner-namedroppers@ops.ietf.org Tue Sep 29 08:33:48 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 317E928C170; Tue, 29 Sep 2009 08:33:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.299 X-Spam-Level: X-Spam-Status: No, score=-5.299 tagged_above=-999 required=5 tests=[AWL=-0.804, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WQvoeeNOAOxd; Tue, 29 Sep 2009 08:33:47 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 1CBCF28C167; Tue, 29 Sep 2009 08:33:47 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Msed6-00052o-ME for namedroppers-data0@psg.com; Tue, 29 Sep 2009 15:28:40 +0000 Received: from [65.201.175.9] (helo=cliffie.verisignlabs.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Msecm-0004sO-SE for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 15:28:28 +0000 Received: from dul1mcdblacka-l2.vcorp.ad.vrsn.com (h87.s239.verisign.com [216.168.239.87]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by cliffie.verisignlabs.com (Postfix) with ESMTPSA id 29789181A2; Tue, 29 Sep 2009 11:28:19 -0400 (EDT) Cc: Mark Andrews , IETF DNSEXT WG Message-Id: From: David Blacka To: bert hubert In-Reply-To: <3efd34cc0909290751g28cba073j6cb6dafb003aef9f@mail.gmail.com> Content-Type: multipart/signed; boundary=Apple-Mail-6-1052992179; micalg=sha1; protocol="application/pkcs7-signature" Mime-Version: 1.0 (Apple Message framework v936) Subject: Re: [dnsext] algorithm identifier code point hijacking Date: Tue, 29 Sep 2009 11:28:18 -0400 References: <200909151542.n8FFgGhr005086@stora.ogud.com> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <57145.1254164861@nsa.vix.com> <82k4zikx3b.fsf@mid.bfk.de> <200909291409.n8TE9QMG086125@drugs.dv.isc.org> <3efd34cc0909290751g28cba073j6cb6dafb003aef9f@mail.gmail.com> X-Mailer: Apple Mail (2.936) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: --Apple-Mail-6-1052992179 Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit On Sep 29, 2009, at 10:51 AM, bert hubert wrote: > On Tue, Sep 29, 2009 at 4:09 PM, Mark Andrews wrote: > >> There is nothing preventing anyone using their own crypto for DNSSEC >> except themselves. > .... > >> I would think that using 253 would be a good way to prove that there >> is enough interest in a algorithm to get it assigned its own >> algorithm >> number. > > Are you serious? I mean, it would never work, you'd have multiple > implementations out there speaking '253' and meaning different things. > That's no way to drum up interest.. Bert, Mark is referring to the well-defined private algorithm mechanism present in DNSSECbis. We don't have a lot of actual implementation experience with it, but it absolutely should work. See RFC 4034 section A.1.1 and draft-ietf-dnsext-dnssec-bis-updates-09 section 4.3. -- David Blacka Sr. Engineer VeriSign Platform Product Development --Apple-Mail-6-1052992179 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMcDCCBhow ggUCoAMCAQICEBc0Avppt6vT9KJWAKLsKTAwDQYJKoZIhvcNAQEFBQAwgcoxCzAJBgNVBAYTAlVT MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y azE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ug b25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0 aW9uIEF1dGhvcml0eSAtIEczMB4XDTA5MDMwMzAwMDAwMFoXDTE5MDMwMjIzNTk1OVowgbAxCzAJ BgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1 c3QgTmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWdu LmNvbS9ycGEgKGMpMDkxKjAoBgNVBAMTIVZlcmlTaWduIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBH MzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMZBVVIHbQdG81jb1cp+jOE4D5vUIaST JqKfkRcKNC8Q7l/sEuBplO3NRos9MRwdagtQtfeTiZC8NwQ1IfbPIAtd3BO4u5WRzWdD2G4BRTbK C/nkXDtJYGVgFD2m+OXsS31p4ryXlZo2OhbKQvXZof0qUWI/79smv37sOG9jRsPHUPVeMVtqtuHf YoG0PBNOfyu0Qq2W4a2RzYToKLekE4cJejlMLIsq8fk5J3Vb/hicWuNA9nVS8K5OZJ7dmNVxiqA6 yvWTt5u0lDLCRjYBUWuQ95AIG3yyTnCP8A39k3jlP24fYcIe1r1By2Fk7uzH/L9sOnrSFL8Aq9WS zws+u0UCAwEAAaOCAhIwggIOMBIGA1UdEwEB/wQIMAYBAf8CAQAwNAYDVR0fBC0wKzApoCegJYYj aHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMi1nMy5jcmwwDgYDVR0PAQH/BAQDAgEGMHAGA1Ud IARpMGcwZQYLYIZIAYb4RQEHFwIwVjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24u Y29tL2NwczAqBggrBgEFBQcCAjAeGhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMC4GA1Ud EQQnMCWkIzAhMR8wHQYDVQQDExZQcml2YXRlTGFiZWw0LTIwNDgtMTA3MB0GA1UdDgQWBBTVH5Sm O27W26S0sXCieoiKViFvFTCB8AYDVR0jBIHoMIHloYHQpIHNMIHKMQswCQYDVQQGEwJVUzEXMBUG A1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4 BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkx RTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkgLSBHM4IQYXDLSYxfmEUp57Cm2VBbejANBgkqhkiG9w0BAQUFAAOCAQEAFTXCpaBB Rq5kc0XwUen7u5EsOzy7iiwvAHrsd7PKLCHg0NSbZKWg4Tzk/Yl5HRl59esmG7e6avTxiEaDG7OV 2+BX5sEfFvKQmtTFyiI3sozDNs+nCFQ+ksSzNVS0msKRSX22qik6AH6diXmQvcb0PIM4QuZadhb+ qwxac5AvA8IKgfPkaXdnIpcotuqtKaqHe60qUw7hnCpN9gamcUoNDVx0Gu1nObq2usSjCVvXWiYY ohDin9MHLkmJ1uYOoRzsQA4WXVAa11UpMXsnd6JotLVKLnrjgZEdK0id0RTBpVbcI9VgxP1LCEaw rYgwfjsT08wUtdampqUUPcljHG4SzDCCBk4wggU2oAMCAQICEFlESltAaqYwh1BuJmTypIAwDQYJ KoZIhvcNAQEFBQAwgbAxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0 dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMpMDkxKjAoBgNVBAMTIVZlcmlTaWduIENsYXNz IDIgRW1wbG95ZWUgQ0EgLSBHMzAeFw0wOTA0MTUwMDAwMDBaFw0xMDA0MTUwMDAwMDBaMGsxaTAQ BgNVBAsUCVZDT1JQIFVBUzAUBgNVBAMTDUJsYWNrYSwgRGF2aWQwHQYDVQQKFBZWZXJpU2lnbiBJ bmMuIFZDT1JQVUFTMCAGCSqGSIb3DQEJARYTZGF2aWRiQHZlcmlzaWduLmNvbTCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBAMJF5/YeA95kbx4bUSDqFnlh1w2cBRUWJBXoYOYxaWzzT5vH MutLNO6oCmbl+R8dZoR2QgOPLhtxQEgr0bryxv2yOiRPJ4t+yZCdow7LPfvtjwSiMMn5d+EgSQ0Q 7VkMwXDA5s4JMf5FT9nB1SER9hJZd9nEJ0FfR1yWPYbj+AMT7LtcuVVz4I7uAPwQo66kYlUMxLZM Mh/DvOE/O10W3/M/I+NDbj9Cp6gkTuCK+It6E5HfumFKJsHDMqA+hwcAPtK/aFMGM2nSmr4bFTB7 ooYFIWedG2+lS73JdbLow8vk9sxbSrGGkOivZYIHWg7H3vouIuqfMvVuW5sKUTMJDkcCAwEAAaOC AqYwggKiMAkGA1UdEwQCMAAwSAYDVR0RBEEwP4ETZGF2aWRiQHZlcmlzaWduLmNvbaAoBgorBgEE AYI3FAIDoBoMGGRhdmlkYkB2Y29ycC5hZC52cnNuLmNvbTAmBgkrBgEEAYI3FQcEGTAXBg9ghkgB hvhFAQ0EiGeB6AUCAWQCAQMwYQYDVR0fBFowWDBWoFSgUoZQaHR0cDovL29uc2l0ZWNybC52ZXJp c2lnbi5jb20vY2FfMzBlMmNkOGJhMjkzMDljYTAyMDJkMTVkNGJjZGYzZjAvTGF0ZXN0Q1JMLmNy bAAwggEGBgNVHSMEgf4wgfuAFNUflKY7btbbpLSxcKJ6iIpWIW8VoYHQpIHNMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHM4IQFzQC+mm3q9P0olYAouwpMDBEBgNVHSAEPTA7MDkGC2CG SAGG+EUBBxcCMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwCwYD VR0PBAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDBEBgkqhkiG9w0BCQ8ENzA1 MA4GCCqGSIb3DQMCAgIAgDAOBggqhkiG9w0DBAICAIAwBwYFKw4DAgcwCgYIKoZIhvcNAwcwDQYJ KoZIhvcNAQEFBQADggEBAK3/93oCO1EhAYcff6uSUu9RT7MiBM1okOvJcpLH28NVeXBs2/ugeCV9 t/DfHUTBPG4yje39rT+F4uN3aOhW9iGzz7m8Bq7OcWIjtWhP465FSsnbq5O+Jvmuc6rwOG8qKTDd W1RJ9MMQ3tVnWkDbM3UNFvEu8qw86noZ3C2seAX6CyBACwpMh331pu1WD2v9Dxzj1EtyKCBMPMVb pKwlQHrcHS6vOcmfmX6HZ9A4JhVGzPz5D9fbCTz7GsBjcCFuvfQqoJwXCoDq6E0kHMvihtppC6WU yzlhNTiJvoQ7+SPRmw6dYyZN6X1ZYhOOuywJWzXEFGR70B/w2wTmzX2wwQ4xggQCMIID/gIBATCB xTCBsDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJp U2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cu dmVyaXNpZ24uY29tL3JwYSAoYykwOTEqMCgGA1UEAxMhVmVyaVNpZ24gQ2xhc3MgMiBFbXBsb3ll ZSBDQSAtIEczAhBZREpbQGqmMIdQbiZk8qSAMAkGBSsOAwIaBQCgggIRMBgGCSqGSIb3DQEJAzEL BgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA5MDkyOTE1MjgxOVowIwYJKoZIhvcNAQkEMRYE FBtWu6IdNiEpcw02uVoAZ1L3/ZIlMIHWBgkrBgEEAYI3EAQxgcgwgcUwgbAxCzAJBgNVBAYTAlVT MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y azE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEg KGMpMDkxKjAoBgNVBAMTIVZlcmlTaWduIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBHMwIQWURKW0Bq pjCHUG4mZPKkgDCB2AYLKoZIhvcNAQkQAgsxgciggcUwgbAxCzAJBgNVBAYTAlVTMRcwFQYDVQQK Ew5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7MDkGA1UE CxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMpMDkxKjAo BgNVBAMTIVZlcmlTaWduIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBHMwIQWURKW0BqpjCHUG4mZPKk gDANBgkqhkiG9w0BAQEFAASCAQB3edwELiETNzQ7pQ/M7SwR8F0QAU8wvplKKcOUcmBjrNy0ZeYa W8dal/+O6Hx7KFVQCylyYAC83XtiPhcdkuc5e+GPoCOq6EDr2XmeRpFN20Ts10i/fB/2jP65HYl1 1VRQYYC91mrfTBiLk/h/fJOCw6VWYGB2qftDQMuAe78n/OA907A7TaZ9vVaW5ggbRlWUDW8OvRvy Bfc2e2SuBW6HsR/PinCtmzhH7QxAFWfhGLYKhHApx0Tp4h5JmyNPtFwxhUT9WFmZojJSvGuAPAnv j0Np1nC6sHquWWyoOb/rYHbucUCn6LKoyrPOVGQcoL5s+csHXEu/7W+dBUk/hTrGAAAAAAAA --Apple-Mail-6-1052992179-- From owner-namedroppers@ops.ietf.org Tue Sep 29 08:40:53 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6538B28C176; Tue, 29 Sep 2009 08:40:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.469 X-Spam-Level: X-Spam-Status: No, score=-2.469 tagged_above=-999 required=5 tests=[AWL=0.130, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dpj8-5kedCcF; Tue, 29 Sep 2009 08:40:52 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 71DF128C17D; Tue, 29 Sep 2009 08:40:51 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Msen6-00079p-Df for namedroppers-data0@psg.com; Tue, 29 Sep 2009 15:39:00 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Msemw-00078l-FU for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 15:38:58 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id B1FF9E609B; Tue, 29 Sep 2009 15:38:49 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8TFclgO090264; Wed, 30 Sep 2009 01:38:47 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909291538.n8TFclgO090264@drugs.dv.isc.org> To: bert hubert Cc: IETF DNSEXT WG From: Mark Andrews References: <200909151542.n8FFgGhr005086@stora.ogud.com> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <57145.1254164861@nsa.vix.com> <82k4zikx3b.fsf@mid.bfk.de> <200909291409.n8TE9QMG086125@drugs.dv.isc.org> <3efd34cc0909290751g28cba073j6cb6dafb003aef9f@mail.gmail.com> Subject: Re: [dnsext] algorithm identifier code point hijacking In-reply-to: Your message of "Tue, 29 Sep 2009 16:51:59 +0200." <3efd34cc0909290751g28cba073j6cb6dafb003aef9f@mail.gmail.com> Date: Wed, 30 Sep 2009 01:38:47 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message <3efd34cc0909290751g28cba073j6cb6dafb003aef9f@mail.gmail.com>, bert hubert writes: > On Tue, Sep 29, 2009 at 4:09 PM, Mark Andrews wrote: > > > There is nothing preventing anyone using their own crypto for DNSSEC > > except themselves. > .... > > > I would think that using 253 would be a good way to prove that there > > is enough interest in a algorithm to get it assigned its own algorithm > > number. > > Are you serious? Yes. > I mean, it would never work, you'd have multiple > implementations out there speaking '253' and meaning different things. > That's no way to drum up interest.. > > Bert KEY and DNSKEY w/ algorithms 253 and 245 are designed to be sub-typed, (253 domain name and 245 oid). DS however isn't (something we missed) which means that we need to add the equivalent to DS for DNSKEY algorithms 253 and 254. This can easily be done by having new DS hash algorithm numbers which indicates the hash field contains the domain name or oid as appropriate as well as a hash. The more radical approach, and one I don't recommend, would be to add DNSKEY algorithms 253 and 254 knowledge to DS hash algorithms 1 and 2 but you may have servers complain about too long hash fields. At the moment DNSKEY w/ algorithms 253 and 245 won't work reliably in a secure delegation so we may as well fix the oversight. All future has DS hash algorithms assignments should support 253 and 254. When comparing DS's and the DNSKEY algorithms are 253 and 254 you also check the domainname or oid as appropriate to determine if you the child zone is signed with a algorithm the validator supports. This presents no problems for validators that don't know about algorithms 253 and 245 or for validators that don't know about the proposed new DS hash algorithms. This is fodder for draft-ietf-dnsext-dnssec-bis-updates. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 29 09:04:07 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 25D343A6AE8; Tue, 29 Sep 2009 09:04:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.049 X-Spam-Level: X-Spam-Status: No, score=0.049 tagged_above=-999 required=5 tests=[AWL=-0.351, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_INFO=1.448, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jRRnlC4B0X3m; Tue, 29 Sep 2009 09:04:06 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 5ADFA3A67B2; Tue, 29 Sep 2009 09:04:06 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Msf9H-000C3g-Da for namedroppers-data0@psg.com; Tue, 29 Sep 2009 16:01:55 +0000 Received: from [208.86.224.201] (helo=mail.yitter.info) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Msf98-000C1z-CK for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 16:01:53 +0000 Received: from crankycanuck.ca (external.shinkuro.com [66.92.164.104]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.yitter.info (Postfix) with ESMTPSA id 633472FE8CE3 for ; Tue, 29 Sep 2009 16:01:42 +0000 (UTC) Date: Tue, 29 Sep 2009 12:01:40 -0400 From: Andrew Sullivan To: namedroppers@ops.ietf.org Subject: Re: [dnsext] algorithm identifier code point hijacking Message-ID: <20090929160140.GB3372@shinkuro.com> References: <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <57145.1254164861@nsa.vix.com> <82k4zikx3b.fsf@mid.bfk.de> <200909291409.n8TE9QMG086125@drugs.dv.isc.org> <3efd34cc0909290751g28cba073j6cb6dafb003aef9f@mail.gmail.com> <200909291538.n8TFclgO090264@drugs.dv.isc.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200909291538.n8TFclgO090264@drugs.dv.isc.org> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 30, 2009 at 01:38:47AM +1000, Mark Andrews wrote: > This is fodder for draft-ietf-dnsext-dnssec-bis-updates. Not unless you have specific text to propose. We need to get that document out the door, so I'm reluctant to add more stuff to it. A -- Andrew Sullivan ajs@shinkuro.com Shinkuro, Inc. From owner-namedroppers@ops.ietf.org Tue Sep 29 09:05:23 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 247E53A6AEA; Tue, 29 Sep 2009 09:05:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.17 X-Spam-Level: X-Spam-Status: No, score=-2.17 tagged_above=-999 required=5 tests=[AWL=-0.171, BAYES_00=-2.599, J_CHICKENPOX_53=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1tn4SABylef2; Tue, 29 Sep 2009 09:05:22 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 53FCD3A6899; Tue, 29 Sep 2009 09:05:22 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsfAn-000CRN-ED for namedroppers-data0@psg.com; Tue, 29 Sep 2009 16:03:29 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsfAZ-000CO9-Li for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 16:03:27 +0000 Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id DAAD1E609B; Tue, 29 Sep 2009 16:03:14 +0000 (UTC) (envelope-from marka@isc.org) Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id n8TG3Bo5090689; Wed, 30 Sep 2009 02:03:12 +1000 (EST) (envelope-from marka@drugs.dv.isc.org) Message-Id: <200909291603.n8TG3Bo5090689@drugs.dv.isc.org> To: David Blacka Cc: bert hubert , IETF DNSEXT WG From: Mark Andrews References: <200909151542.n8FFgGhr005086@stora.ogud.com> <20090927205649.GA19520@shinkuro.com> <4AC004E2.3060800@dougbarton.us> <20090928151345.GD536@shinkuro.com> <81A3A92B-8F68-45AE-A973-A77C2AB8D06F@isoc.org> <20090928180301.GB14041@vacation.karoshi.com.> <57145.1254164861@nsa.vix.com> <82k4zikx3b.fsf@mid.bfk.de> <200909291409.n8TE9QMG086125@drugs.dv.isc.org> <3efd34cc0909290751g28cba073j6cb6dafb003aef9f@mail.gmail.com> Subject: Re: [dnsext] algorithm identifier code point hijacking In-reply-to: Your message of "Tue, 29 Sep 2009 11:28:18 -0400." Date: Wed, 30 Sep 2009 02:03:11 +1000 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: In message , David Blacka wr ites: > > --Apple-Mail-6-1052992179 > Content-Type: text/plain; > charset=US-ASCII; > format=flowed; > delsp=yes > Content-Transfer-Encoding: 7bit > > > On Sep 29, 2009, at 10:51 AM, bert hubert wrote: > > > On Tue, Sep 29, 2009 at 4:09 PM, Mark Andrews wrote: > > > >> There is nothing preventing anyone using their own crypto for DNSSEC > >> except themselves. > > .... > > > >> I would think that using 253 would be a good way to prove that there > >> is enough interest in a algorithm to get it assigned its own > >> algorithm > >> number. > > > > Are you serious? I mean, it would never work, you'd have multiple > > implementations out there speaking '253' and meaning different things. > > That's no way to drum up interest.. > > Bert, Mark is referring to the well-defined private algorithm > mechanism present in DNSSECbis. We don't have a lot of actual > implementation experience with it, but it absolutely should work. > > See RFC 4034 section A.1.1 and draft-ietf-dnsext-dnssec-bis-updates-09 > section 4.3. Which I missed seeing but works, so ignore most of my other email except for the "yes". Named doesn't yet implement this but then it doesn't yet have support for any algorithms that need it to be implemented. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From owner-namedroppers@ops.ietf.org Tue Sep 29 12:17:20 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 61CF628C112; Tue, 29 Sep 2009 12:17:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.855 X-Spam-Level: **** X-Spam-Status: No, score=4.855 tagged_above=-999 required=5 tests=[AWL=-1.809, BAYES_40=-0.185, CHARSET_FARAWAY_HEADER=3.2, FH_RELAY_NODNS=1.451, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3LZ3wWom-lfB; Tue, 29 Sep 2009 12:17:19 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7555D28C0F3; Tue, 29 Sep 2009 12:17:19 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Msi6w-00057N-VC for namedroppers-data0@psg.com; Tue, 29 Sep 2009 19:11:42 +0000 Received: from [213.178.172.147] (helo=TR-Sys.de) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Msi6j-0004wV-5P for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 19:11:37 +0000 Received: from ZEUS.TR-Sys.de by w. with ESMTP ($Revision: 1.37.109.26 $/16.3.2) id AA144911437; Tue, 29 Sep 2009 21:10:37 +0200 Received: (from ah@localhost) by z.TR-Sys.de (8.9.3 (PHNE_25183)/8.7.3) id VAA21152; Tue, 29 Sep 2009 21:10:36 +0200 (MESZ) From: Alfred =?hp-roman8?B?SM5uZXM=?= Message-Id: <200909291910.VAA21152@TR-Sys.de> Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item To: namedroppers@ops.ietf.org, george.barwood@blueyonder.co.uk Date: Tue, 29 Sep 2009 21:10:36 +0200 (MESZ) X-Mailer: ELM [$Revision: 1.17.214.3 $] Mime-Version: 1.0 Content-Type: text/plain; charset=hp-roman8 Content-Transfer-Encoding: 7bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: George and all, I generally sympathize with the transport signal draft and would agree to say it's "worthwile for further study", but I hesitate to push it so quickly. Unless a draft has been fabricated "on order", it always has proven useful to have it being discussed to some extent, and perhaps cycled through a few updates, before approaching WG work item status. For instance, IMHO the proposed solution looks promising, but it should be explored explicitely in advance and in the draft, whether an EDNS option might be a reasonable alternate vehicle for the desired semantics. The very likely (sigh!) trouble with middleboxes on the path counteracting the 'message' of the proposed RR type might deserve particular consideration as well, maybe in the ("TDB" anyway!) security considerations. I would appreciate such topics being mentioned and weighed in the draft before WG adoption. I'm interested in related discussions, but I have to share responsibly my spare cycles available for IETF work between new items and ongoing work, and I hesitate spending expeditely too much cycles for the former if doing so might defer due follow-up work that has some realistic chance of contributing to ongoing efforts being completed. The WG already has quite a couple of work items that are due (or arguably over-due) for being completed and shipped to the IESG. I therefore would appreciate if we could try to not feed the pipeline too quickly and too heavily. George, could you agree on postponing the question for adoption until, say, after the upcoming IETF, and some degree of evolution of the draft? Many thanks for your patience in advance! Kind regards, Alfred. -- +------------------------+--------------------------------------------+ | TR-Sys Alfred Hoenes | Alfred Hoenes Dipl.-Math., Dipl.-Phys. | | Gerlinger Strasse 12 | Phone: (+49)7156/9635-0, Fax: -18 | | D-71254 Ditzingen | E-Mail: ah@TR-Sys.de | +------------------------+--------------------------------------------+ From owner-namedroppers@ops.ietf.org Tue Sep 29 14:30:17 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 681463A69FC; Tue, 29 Sep 2009 14:30:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.549 X-Spam-Level: X-Spam-Status: No, score=-4.549 tagged_above=-999 required=5 tests=[AWL=-0.412, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MgSMSmyvmfbz; Tue, 29 Sep 2009 14:30:15 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D35533A69F8; Tue, 29 Sep 2009 14:30:14 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MskC2-0009ei-I6 for namedroppers-data0@psg.com; Tue, 29 Sep 2009 21:25:06 +0000 Received: from [168.61.5.27] (helo=harry.mail-abuse.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MskBt-0009e5-7D for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 21:25:04 +0000 Received: from sjc-office-nat-214.mail-abuse.org (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id A8427A94448; Tue, 29 Sep 2009 21:24:56 +0000 (UTC) Message-ID: <4AC27B28.2000309@mail-abuse.org> Date: Tue, 29 Sep 2009 14:24:56 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.4pre) Gecko/20090915 Thunderbird/3.0b4 MIME-Version: 1.0 To: =?UTF-8?B?QWxmcmVkIO+/vQ==?= CC: namedroppers@ops.ietf.org, george.barwood@blueyonder.co.uk Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item References: <200909291910.VAA21152@TR-Sys.de> In-Reply-To: <200909291910.VAA21152@TR-Sys.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On 9/29/09 12:10 PM, Alfred � wrote: > George and all, > I generally sympathize with the transport signal draft and > would agree to say it's "worthwile for further study", > but I hesitate to push it so quickly. > > Unless a draft has been fabricated "on order", it always has > proven useful to have it being discussed to some extent, and > perhaps cycled through a few updates, before approaching WG > work item status. > > For instance, IMHO the proposed solution looks promising, > but it should be explored explicitely in advance and in the > draft, whether an EDNS option might be a reasonable alternate > vehicle for the desired semantics. The very likely (sigh!) > trouble with middleboxes on the path counteracting the 'message' > of the proposed RR type might deserve particular consideration > as well, maybe in the ("TDB" anyway!) security considerations. > I would appreciate such topics being mentioned and weighed in > the draft before WG adoption. > > I'm interested in related discussions, but I have to share > responsibly my spare cycles available for IETF work between > new items and ongoing work, and I hesitate spending expeditely > too much cycles for the former if doing so might defer due > follow-up work that has some realistic chance of contributing > to ongoing efforts being completed. > > The WG already has quite a couple of work items that are due > (or arguably over-due) for being completed and shipped to the > IESG. I therefore would appreciate if we could try to not > feed the pipeline too quickly and too heavily. > > George, could you agree on postponing the question for adoption > until, say, after the upcoming IETF, and some degree of evolution > of the draft? Many thanks for your patience in advance! This seems like good advice. This draft limits itself to describing transports, but transport protocols might be created that operate over existing transports such as UDP. It seems to be flexible in how to signal the supported transport modes, this might require its own registry without reliance upon simple transport protocol numbers. -Doug From owner-namedroppers@ops.ietf.org Tue Sep 29 15:34:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 320BF3A67B6; Tue, 29 Sep 2009 15:34:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.813 X-Spam-Level: **** X-Spam-Status: No, score=4.813 tagged_above=-999 required=5 tests=[AWL=-0.228, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, MIME_8BIT_HEADER=0.3, MIME_BASE64_BLANKS=0.041, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hFhnG9e87fHn; Tue, 29 Sep 2009 15:34:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 3DF1D3A63EC; Tue, 29 Sep 2009 15:34:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MslCz-000MhS-Nn for namedroppers-data0@psg.com; Tue, 29 Sep 2009 22:30:09 +0000 Received: from [195.188.213.6] (helo=smtp-out3.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MslCq-000Mgg-9d for namedroppers@ops.ietf.org; Tue, 29 Sep 2009 22:30:07 +0000 Received: from [172.23.170.143] (helo=anti-virus02-10) by smtp-out3.blueyonder.co.uk with smtp (Exim 4.52) id 1MslCn-00010E-7H; Tue, 29 Sep 2009 23:29:57 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out2.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MslCm-0002VR-MF; Tue, 29 Sep 2009 23:29:56 +0100 Message-ID: From: "George Barwood" To: "Douglas Otis" , =?UTF-8?Q?Alfred_=EF=BF=BD?= Cc: References: <200909291910.VAA21152@TR-Sys.de> <4AC27B28.2000309@mail-abuse.org> Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item Date: Tue, 29 Sep 2009 23:29:52 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: RG91ZyB3cm90ZToNCj4gVGhpcyBkcmFmdCBsaW1pdHMgaXRzZWxmIHRvIGRlc2NyaWJpbmcgdHJh bnNwb3J0cywgYnV0IHRyYW5zcG9ydCBwcm90b2NvbHMNCj4gbWlnaHQgYmUgY3JlYXRlZCB0aGF0 IG9wZXJhdGUgb3ZlciBleGlzdGluZyB0cmFuc3BvcnRzIHN1Y2ggYXMgVURQLiAgDQoNClllcywg aXQgaXMgaW50ZW5kZWQgdGhhdCBhbnkgRE5TIHRyYW5zcG9ydCBwcm90b2NvbCBzaG91bGQgYmUg cG9zc2libGUsDQppbmNsdWRpbmcgbmV3IHByb3RvY29sKHMpIG9wZXJhdGluZyBvdmVyIFVEUC4g SW4gZmFjdCBJJ20gd29ya2luZyBvbiANCnN1Y2ggYSBwcm90b2NvbCBodHRwOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1iYXJ3b29kLWRuc2V4dC1kbnMtdHJhbnNwb3J0Lg0KSSB3aWxsIHRy eSB0byBtYWtlIHRoaXMgY2xlYXJlciBpbiB0aGUgbmV4dCB2ZXJzaW9uIG9mIHRoZSBkcmFmdC4N Cg0KPiBJdCBzZWVtcyB0byBiZSBmbGV4aWJsZSBpbiBob3cgdG8gDQo+IHNpZ25hbCB0aGUgc3Vw cG9ydGVkIHRyYW5zcG9ydCBtb2RlcywgdGhpcyBtaWdodCByZXF1aXJlIGl0cyBvd24gDQo+IHJl Z2lzdHJ5IHdpdGhvdXQgcmVsaWFuY2UgdXBvbiBzaW1wbGUgdHJhbnNwb3J0IHByb3RvY29sIG51 bWJlcnMuDQoNClllcywgaW5kZWVkIHRoZSBkcmFmdCBkZXNjcmliZXMgc3VjaCBhIHJlZ2lzdHJ5 IGluIHRoZSBJQU5BIGNvbnNpZGVyYXRpb25zIHNlY3Rpb24gOg0KDQo8PA0KNS4gIElBTkEgQ29u c2lkZXJhdGlvbnMNCg0KVGhlIFRQT1JUIHJlc291cmNlIHJlY29yZCB0eXBlLCB3aXRoIGEgc3Vi LXJlZ2lzdHJ5IGZvciBETlMgdHJhbnNwb3J0IA0KcHJvdG9jb2xzLCBpbml0aWFsaXplZCB0bw0K DQpUQ1AgICAgICAgICAgICAgICAgMSAgICAgW1JGQzEwMzVdDQpVRFAgICAgICAgICAgICAgICAg MiAgICAgW1JGQzEwMzVdDQo+Pg0KDQpUaGVyZSBpcyBhIG1pbGQgbmFtaW5nIHByb2JsZW0gaGVy ZS4gVGhlcmUgaXMgbm8gc2hvcnQgbmFtZSB0aGF0IGRpc3Rpbmd1aXNoZXMNCmJldHdlZW4gIkRO Uy9VRFAgYXMgcGVyIFJGQzEwMzUiIGFuZCAiVGhlIFVEUCBwcm90b2NvbCxSRkM3NjgiLiANCkkg dGhpbmsgd2UgaGF2ZSB0byBsaXZlIHdpdGggdGhpcywgdGhlIGNvbnRleHQgc2hvdWxkIG1ha2Ug aXQgY2xlYXIuDQpOZXcgcHJvdG9jb2xzIHdpbGwgaGF2ZSBuZXcgbmFtZXMsIGlmIHRoZXkgaGFw cGVuIHRvIG9wZXJhdGUgb3ZlciBVRFAsIA0KdGhhdCB3aWxsIGJlIGFuIGluY2lkZW50YWwgZGV0 YWlsLg0KDQpSZWdhcmRzLA0KR2Vvcmdl From owner-namedroppers@ops.ietf.org Wed Sep 30 02:58:43 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DB1C528C0D9; Wed, 30 Sep 2009 02:58:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.45 X-Spam-Level: X-Spam-Status: No, score=-102.45 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id abnEjMvMbvTM; Wed, 30 Sep 2009 02:58:43 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D704F3A6835; Wed, 30 Sep 2009 02:58:42 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsvrN-0006vn-3M for namedroppers-data0@psg.com; Wed, 30 Sep 2009 09:52:33 +0000 Received: from [2001:4f8:3:bb::5] (helo=farside.isc.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsvrC-0006m1-9j for namedroppers@ops.ietf.org; Wed, 30 Sep 2009 09:52:30 +0000 Received: from [IPv6:2001:610:719:1:221:5dff:fe1e:113a] (unknown [IPv6:2001:610:719:1:221:5dff:fe1e:113a]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by farside.isc.org (Postfix) with ESMTP id A9249E601E; Wed, 30 Sep 2009 09:52:20 +0000 (UTC) (envelope-from shane@isc.org) Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item From: Shane Kerr To: Alfred =?ISO-8859-1?Q?H=F6nes?= Cc: namedroppers In-Reply-To: <200909291910.VAA21152@TR-Sys.de> References: <200909291910.VAA21152@TR-Sys.de> Content-Type: text/plain; charset="UTF-8" Organization: ISC Date: Wed, 30 Sep 2009 11:52:17 +0200 Message-Id: <1254304337.6754.7867.camel@shane-asus-laptop> Mime-Version: 1.0 X-Mailer: Evolution 2.26.1 Content-Transfer-Encoding: 8bit Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Alfred, On Tue, 2009-09-29 at 21:10 +0200, Alfred Hönes wrote: > For instance, IMHO the proposed solution looks promising, > but it should be explored explicitely in advance and in the > draft, whether an EDNS option might be a reasonable alternate > vehicle for the desired semantics. The very likely (sigh!) > trouble with middleboxes on the path counteracting the 'message' > of the proposed RR type might deserve particular consideration > as well, maybe in the ("TDB" anyway!) security considerations. > I would appreciate such topics being mentioned and weighed in > the draft before WG adoption. I thought the way to proceed in the IETF was to write a draft, so we know what is actually being discussed? I am thankful that George has taken the time to put such a thing together! (Thanks George) I don't think that an EDNS option is useful because this information only helps after you have reached the server you are trying to get to. Ideally you want information about acceptable protocols before you try them. I think we should push for putting even information into such a record. I'd like to see all kinds of useful information published about servers, including: * DNSSEC capabilities (NSEC, NSEC3, algorithms) * EDNS options supported * Perhaps transport-specific options (UDP buffer size) My reasoning is that such a record is most useful at the parent - like NS or DS records, they help the resolver to reach the correct name server. However, since getting records from the child to the parent is currently a clumsy, non-automated process, it is not something we want to do often. Alternately we could use RR types that publish specific information, like the useful-but-poorly-named(*) TPORT, but then look at defining an automated way to get information from the child into the parent. I think Secure64 already has a proprietary protocol like this to get DS records from children into parents. With a secured zone, it should be possible to get all kinds of useful stuff from child into parent. Or we could do both: define a single meta-NS record *and* a way to get this into the parent. -- Shane (*) Sorry, when I see "port" I think "port number". Perhaps "TPROT" is better? From owner-namedroppers@ops.ietf.org Wed Sep 30 05:32:27 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A5A6C3A6905; Wed, 30 Sep 2009 05:32:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.578 X-Spam-Level: X-Spam-Status: No, score=-2.578 tagged_above=-999 required=5 tests=[AWL=0.021, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IFrxi-o4YxJc; Wed, 30 Sep 2009 05:32:26 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id A7BF93A68D9; Wed, 30 Sep 2009 05:32:26 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsyHc-000J8D-7K for namedroppers-data0@psg.com; Wed, 30 Sep 2009 12:27:48 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MsyHS-000J6I-0B for namedroppers@ops.ietf.org; Wed, 30 Sep 2009 12:27:45 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 57C02C9727; Wed, 30 Sep 2009 12:27:37 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: Shane Kerr cc: Alfred =?ISO-8859-1?Q?H=F6nes?= , namedroppers Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item In-Reply-To: Your message of "Wed, 30 Sep 2009 11:52:17 +0200." <1254304337.6754.7867.camel@shane-asus-laptop> References: <200909291910.VAA21152@TR-Sys.de> <1254304337.6754.7867.camel@shane-asus-laptop> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Wed, 30 Sep 2009 12:27:37 +0000 Message-ID: <61143.1254313657@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > From: Shane Kerr > Date: Wed, 30 Sep 2009 11:52:17 +0200 > ... > I think we should push for putting even information into such a record. > I'd like to see all kinds of useful information published about servers, > including: > > * DNSSEC capabilities (NSEC, NSEC3, algorithms) > * EDNS options supported > * Perhaps transport-specific options (UDP buffer size) > > My reasoning is that such a record is most useful at the parent - like > NS or DS records, they help the resolver to reach the correct name > server. However, since getting records from the child to the parent is > currently a clumsy, non-automated process, it is not something we want > to do often. since this information is about a server and not about a delegation, if we put it into "the parent" we would gain the ability to describe the same server in many and incompatible ways, which is a power i do not think we have the discipline to avoid using. > Alternately we could use RR types that publish specific information, > like the useful-but-poorly-named(*) TPORT, but then look at defining an > automated way to get information from the child into the parent. I think > Secure64 already has a proprietary protocol like this to get DS records > from children into parents. With a secured zone, it should be possible > to get all kinds of useful stuff from child into parent. > > Or we could do both: define a single meta-NS record *and* a way to get > this into the parent. information about the server's capabilities should be part of the server, like its A and AAAA are today -- so, EDNS capabilities or other transport metadata like protocols and buffer sizes. only information about the delegation or the zone should be part of that zone's parent -- so, NSEC(3) and algo's and key hashes (DS). From owner-namedroppers@ops.ietf.org Wed Sep 30 10:41:00 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E58EC3A68B5; Wed, 30 Sep 2009 10:41:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.108 X-Spam-Level: X-Spam-Status: No, score=0.108 tagged_above=-999 required=5 tests=[AWL=-0.019, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FrtYqIzmIXql; Wed, 30 Sep 2009 10:41:00 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id D952F3A6885; Wed, 30 Sep 2009 10:40:59 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mt327-000HKx-9m for namedroppers-data0@psg.com; Wed, 30 Sep 2009 17:32:07 +0000 Received: from [209.85.222.198] (helo=mail-pz0-f198.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mt31x-000HJb-O6 for namedroppers@ops.ietf.org; Wed, 30 Sep 2009 17:32:05 +0000 Received: by pzk36 with SMTP id 36so2335046pzk.5 for ; Wed, 30 Sep 2009 10:31:57 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.162.5 with SMTP id k5mr162586wae.10.1254331917080; Wed, 30 Sep 2009 10:31:57 -0700 (PDT) In-Reply-To: <61143.1254313657@nsa.vix.com> References: <200909291910.VAA21152@TR-Sys.de> <1254304337.6754.7867.camel@shane-asus-laptop> <61143.1254313657@nsa.vix.com> Date: Wed, 30 Sep 2009 10:31:57 -0700 Message-ID: Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item From: Matthew Dempsky To: Paul Vixie Cc: Shane Kerr , =?ISO-8859-1?Q?Alfred_H=F6nes?= , namedroppers Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 30, 2009 at 5:27 AM, Paul Vixie wrote: > information about the server's capabilities should be part of the server, > like its A and AAAA are today -- so, EDNS capabilities or other transport > metadata like protocols and buffer sizes. =A0only information about the > delegation or the zone should be part of that zone's parent -- so, NSEC(3= ) > and algo's and key hashes (DS). Is your concern that these newly suggested records shouldn't be stored under example.com but instead under ns{1,2,3,...}.example.com, or that parent servers should not need to know about or serve these new records? From owner-namedroppers@ops.ietf.org Wed Sep 30 10:56:14 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7A4E43A6932; Wed, 30 Sep 2009 10:56:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.578 X-Spam-Level: X-Spam-Status: No, score=-2.578 tagged_above=-999 required=5 tests=[AWL=0.021, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dxJSozFAdSc8; Wed, 30 Sep 2009 10:56:13 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 99DBE3A682A; Wed, 30 Sep 2009 10:56:13 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mt3Mv-000Ndk-Sx for namedroppers-data0@psg.com; Wed, 30 Sep 2009 17:53:37 +0000 Received: from [2001:4f8:3:bb:230:48ff:fe5a:2f38] (helo=nsa.vix.com) by psg.com with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mt3Ml-000NcN-QM for namedroppers@ops.ietf.org; Wed, 30 Sep 2009 17:53:35 +0000 Received: from nsa.vix.com (localhost [127.0.0.1]) by nsa.vix.com (Postfix) with ESMTP id 41DEDC9791 for ; Wed, 30 Sep 2009 17:53:27 +0000 (UTC) (envelope-from vixie@nsa.vix.com) From: Paul Vixie To: namedroppers Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item In-Reply-To: Your message of "Wed, 30 Sep 2009 10:31:57 MST." References: <200909291910.VAA21152@TR-Sys.de> <1254304337.6754.7867.camel@shane-asus-laptop> <61143.1254313657@nsa.vix.com> X-Mailer: MH-E 8.1; nil; GNU Emacs 22.2.1 Date: Wed, 30 Sep 2009 17:53:27 +0000 Message-ID: <76575.1254333207@nsa.vix.com> Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: > Date: Wed, 30 Sep 2009 10:31:57 -0700 > From: Matthew Dempsky > > On Wed, Sep 30, 2009 at 5:27 AM, Paul Vixie wrote: > > information about the server's capabilities should be part of the > > server, like its A and AAAA are today -- so, EDNS capabilities or other > > transport metadata like protocols and buffer sizes. only information > > about the delegation or the zone should be part of that zone's parent > > -- so, NSEC(3) and algo's and key hashes (DS). > > Is your concern that these newly suggested records shouldn't be stored > under example.com but instead under ns{1,2,3,...}.example.com, or that > parent servers should not need to know about or serve these new records? both, though i'd say that if we have a new NSCAP RR located adjacent to the A/AAAA RRs, then this should be returned as glue in delegations, so as to prevent anybody from having to look up these new RRsets. in that sense, there is a change in behaviour at the parent, even though it's in the nameserver behaviour and not in the zone content itself. From owner-namedroppers@ops.ietf.org Wed Sep 30 11:08:41 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3D27A3A6A96; Wed, 30 Sep 2009 11:08:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.108 X-Spam-Level: X-Spam-Status: No, score=0.108 tagged_above=-999 required=5 tests=[AWL=-0.019, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, FM_FORGED_GMAIL=0.622, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fKRr0suFEb6D; Wed, 30 Sep 2009 11:08:40 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7A4C83A6A17; Wed, 30 Sep 2009 11:08:40 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mt3ZS-0001gz-3c for namedroppers-data0@psg.com; Wed, 30 Sep 2009 18:06:34 +0000 Received: from [209.85.216.176] (helo=mail-px0-f176.google.com) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mt3ZI-0001bU-Te for namedroppers@ops.ietf.org; Wed, 30 Sep 2009 18:06:32 +0000 Received: by pxi6 with SMTP id 6so8085190pxi.32 for ; Wed, 30 Sep 2009 11:06:24 -0700 (PDT) MIME-Version: 1.0 Received: by 10.114.165.18 with SMTP id n18mr152537wae.154.1254333984366; Wed, 30 Sep 2009 11:06:24 -0700 (PDT) In-Reply-To: <76575.1254333207@nsa.vix.com> References: <200909291910.VAA21152@TR-Sys.de> <1254304337.6754.7867.camel@shane-asus-laptop> <61143.1254313657@nsa.vix.com> <76575.1254333207@nsa.vix.com> Date: Wed, 30 Sep 2009 11:06:24 -0700 Message-ID: Subject: Re: [dnsext] draft-barwood-dnsext-dns-transport-signal-00 to WG work item From: Matthew Dempsky To: Paul Vixie Cc: namedroppers Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: On Wed, Sep 30, 2009 at 10:53 AM, Paul Vixie wrote: >> Date: Wed, 30 Sep 2009 10:31:57 -0700 >> From: Matthew Dempsky >> >> Is your concern that these newly suggested records shouldn't be stored >> under example.com but instead under ns{1,2,3,...}.example.com, or that >> parent servers should not need to know about or serve these new records? > > both, though i'd say that if we have a new NSCAP RR located adjacent to > the A/AAAA RRs, then this should be returned as glue in delegations, so > as to prevent anybody from having to look up these new RRsets. =A0in that > sense, there is a change in behaviour at the parent, even though it's in > the nameserver behaviour and not in the zone content itself. Okay, I concur with this then. From owner-namedroppers@ops.ietf.org Wed Sep 30 13:48:58 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 625153A68FB; Wed, 30 Sep 2009 13:48:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.055 X-Spam-Level: X-Spam-Status: No, score=-5.055 tagged_above=-999 required=5 tests=[AWL=-0.007, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10zh15hnXK2z; Wed, 30 Sep 2009 13:48:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7EC453A6912; Wed, 30 Sep 2009 13:48:57 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mt62X-000DEn-So for namedroppers-data0@psg.com; Wed, 30 Sep 2009 20:44:45 +0000 Received: from [192.150.186.11] (helo=fruitcake.ICSI.Berkeley.EDU) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from ) id 1Mt62O-000DE4-E7 for namedroppers@ops.ietf.org; Wed, 30 Sep 2009 20:44:43 +0000 Received: from [IPv6:::1] (jack.ICSI.Berkeley.EDU [192.150.186.73]) by fruitcake.ICSI.Berkeley.EDU (8.12.11.20060614/8.12.11) with ESMTP id n8UKiXdE018509; Wed, 30 Sep 2009 13:44:33 -0700 (PDT) Subject: [dnsext] Collection of recursive resolvers? Content-Transfer-Encoding: 7bit From: Nicholas Weaver Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes Message-Id: <6F4A300D-3020-4BF8-9A02-FCB7830FBD97@icsi.berkeley.edu> Date: Wed, 30 Sep 2009 13:44:33 -0700 Cc: Nicholas Weaver To: "namedroppers@ops.ietf.org WG" Mime-Version: 1.0 (Apple Message framework v1076) X-Mailer: Apple Mail (2.1076) Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: Does someone have a collection of recursive resolvers which can be queried externally? Looking at the Netalyzr data, there seems to be a big opportunity to get the usage population for various resolvers based on their glue policy and EDNS behavior. But I'd need to be able to query a bunch of these running to develop fingerprints. thanks. From owner-namedroppers@ops.ietf.org Wed Sep 30 23:32:57 2009 Return-Path: X-Original-To: ietfarch-dnsext-archive@core3.amsl.com Delivered-To: ietfarch-dnsext-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C0DE728C0F5; Wed, 30 Sep 2009 23:32:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.947 X-Spam-Level: **** X-Spam-Status: No, score=4.947 tagged_above=-999 required=5 tests=[AWL=-0.355, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_BLUEYON=1.4, HELO_MISMATCH_UK=1.749, HTML_MESSAGE=0.001, J_CHICKENPOX_23=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NaNWoxS4crU7; Wed, 30 Sep 2009 23:32:57 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id C658728C0EA; Wed, 30 Sep 2009 23:32:56 -0700 (PDT) Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MtF96-0007Kw-DU for namedroppers-data0@psg.com; Thu, 01 Oct 2009 06:28:08 +0000 Received: from [195.188.213.8] (helo=smtp-out5.blueyonder.co.uk) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from ) id 1MtF8v-0007K2-3N for namedroppers@ops.ietf.org; Thu, 01 Oct 2009 06:28:06 +0000 Received: from [172.23.170.140] (helo=anti-virus02-07) by smtp-out5.blueyonder.co.uk with smtp (Exim 4.52) id 1MtF8u-0001Ku-1x for namedroppers@ops.ietf.org; Thu, 01 Oct 2009 07:27:56 +0100 Received: from [82.46.70.191] (helo=GeorgeLaptop) by asmtp-out3.blueyonder.co.uk with esmtpa (Exim 4.52) id 1MtF8q-0005Xe-62 for namedroppers@ops.ietf.org; Thu, 01 Oct 2009 07:27:52 +0100 Message-ID: <8F0B2F9E393C4B72B74BC1855C3EA5FE@localhost> From: "George Barwood" To: Subject: [dnsext] draft-ietf-dnsext-rfc2671bis-edns0 Date: Thu, 1 Oct 2009 07:27:45 +0100 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_036A_01CA4268.AB9AC780" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5843 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Sender: owner-namedroppers@ops.ietf.org Precedence: bulk List-ID: List-Unsubscribe: To unsubscribe send a message to namedroppers-request@ops.ietf.org with List-Unsubscribe: the word 'unsubscribe' in a single line as the message text body. List-Archive: This is a multi-part message in MIME format. ------=_NextPart_000_036A_01CA4268.AB9AC780 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I have a comment regarding section 8, Security Considerations. http://tools.ietf.org/html/draft-ietf-dnsext-rfc2671bis-edns0-02#section-= 8 There is no mention of amplification attacks on third parties. There is also no mention of attacks on fragmented IP packets. I suggest that implementors / operators should be warned about these attacks, and guidelines for mitigating these attacks be included, my initial suggestion being : << Servers must set a limit on the maximum UDP payload size. Values higher than this limit MUST be treated as equal to the limit. The limit must not be higher than 4096 bytes. The default limit should be no higher than the de-facto internet MTU ( 1500 bytes ) less IP+UDP Overhead ( normally 28 bytes ), and preferably less. Operators may set a higher limit, no higher than 4096 bytes, and preferably less. Operators may also set a lower limit. However too low a limit may result in an unacceptable increase in TCP traffic. >> This should not be taken as an endorsement of the EDNS UDP Payload size mechanism, since I am opposed to it and advocate a different approach, but if we are going to have it, proper limits should be set. George ------=_NextPart_000_036A_01CA4268.AB9AC780 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
I have a comment regarding section 8, = Security=20 Considerations.
 
http://tools.ietf.org/html/draft-ietf-dnsext-rfc2671bis-edns0-= 02#section-8
 
There is no mention of amplification = attacks on=20 third parties.
There is also no mention of attacks = on fragmented=20 IP packets.
 
I suggest that implementors / = operators should be=20 warned about
these attacks, and guidelines for = mitigating=20 these attacks
be included, my initial suggestion = being=20 :
 
<<
 
Servers must set a limit on the = maximum UDP=20 payload size.
Values higher than this limit MUST be = treated as=20 equal to
the limit.
 
The limit must not be higher than = 4096=20 bytes.
 
The default limit should = be no higher=20 than the=20 de-facto
internet MTU (=20 1500 bytes ) less IP+UDP = Overhead ( normally
 28 bytes ), and preferably=20 less.
 
Operators may set a higher limit, no = higher than=20 4096 bytes,
and preferably less.
 
Operators may also set a lower limit. = However too low a = limit
may result in an unacceptable = increase=20 in TCP traffic.
 
>>
 
This should not be taken as an = endorsement of the=20 EDNS UDP
Payload size mechanism, since I am = opposed to it=20 and advocate
a different approach, but if we are going = to have it,=20 proper
limits should be set.
 
George
 
------=_NextPart_000_036A_01CA4268.AB9AC780--