Lame RFC1918 delegations

Mailman List Mirror (Read Only)
1

The primary for these zones moved to a dedicated server (blackhole.isi.edu)
in early february 1998. Due to an unfortunate confluence of events,
this week we identified several points of misconfiguration in both
zone files and system configuration files. Talking with the sysadmin
this morning leads me to believe that the system is working properly.

26% dig -x 172.16 any @blackhole.isi.edu

; <<>> DiG 2.0 <<>> -x any @blackhole.isi.edu
;; ->>HEADER<<- opcode: QUERY , status: NOERROR, id: 12
;; flags: qr rd ra ; Ques: 1, Ans: 2, Auth: 2, Addit: 2
;; QUESTIONS:
;; 16.172.in-addr.arpa, type = ANY, class = IN

;; ANSWERS:
16.172.in-addr.arpa. 490877 NS NS2.INTERNIC.NET.
16.172.in-addr.arpa. 490877 NS BLACKHOLE.ISI.EDU.

;; AUTHORITY RECORDS:
16.172.in-addr.arpa. 490877 NS NS2.INTERNIC.NET.
16.172.in-addr.arpa. 490877 NS BLACKHOLE.ISI.EDU.

;; ADDITIONAL RECORDS:
NS2.INTERNIC.NET. 84712 A 198.41.0.11
BLACKHOLE.ISI.EDU. 41512 A 128.9.64.26

;; Sent 3 pkts, answer found in time: 401 msec
;; FROM: zed.isi.edu to SERVER: blackhole.isi.edu 128.9.64.26
;; WHEN: Fri Apr 3 11:35:07 1998
;; MSG SIZE sent: 37 rcvd: 158

2

The primary for these zones moved to a dedicated server (blackhole.isi.edu)
   in early february 1998. Due to an unfortunate confluence of events,
   this week we identified several points of misconfiguration in both
   zone files and system configuration files. Talking with the sysadmin
   this morning leads me to believe that the system is working properly.

   26% dig -x 172.16 any @blackhole.isi.edu

This is *not* proper, it's a Lame Delegation. That query should return an
SOA record and it should have the Authoritative Answer flag set.

   ; <<>> DiG 2.0 <<>> -x any @blackhole.isi.edu
   ;; ->>HEADER<<- opcode: QUERY , status: NOERROR, id: 12
   ;; flags: qr rd ra ; Ques: 1, Ans: 2, Auth: 2, Addit: 2
   ;; QUESTIONS:
   ;; 16.172.in-addr.arpa, type = ANY, class = IN

   ;; ANSWERS:
   16.172.in-addr.arpa. 490877 NS NS2.INTERNIC.NET.
   16.172.in-addr.arpa. 490877 NS BLACKHOLE.ISI.EDU.

   ;; AUTHORITY RECORDS:
   16.172.in-addr.arpa. 490877 NS NS2.INTERNIC.NET.
   16.172.in-addr.arpa. 490877 NS BLACKHOLE.ISI.EDU.

   ;; ADDITIONAL RECORDS:
   NS2.INTERNIC.NET. 84712 A 198.41.0.11
   BLACKHOLE.ISI.EDU. 41512 A 128.9.64.26

   ;; Sent 3 pkts, answer found in time: 401 msec
   ;; FROM: zed.isi.edu to SERVER: blackhole.isi.edu 128.9.64.26
   ;; WHEN: Fri Apr 3 11:35:07 1998
   ;; MSG SIZE sent: 37 rcvd: 158

3

There are *still* problems:

$ check_soa 16.172.in-addr.arpa.
RS0.INTERNIC.NET is not authoritative for 16.172.in-addr.arpa.
NS2.INTERNIC.NET is not authoritative for 16.172.in-addr.arpa.
BLACKHOLE.ISI.EDU is not authoritative for 16.172.in-addr.arpa.
$ check_soa 10.in-addr.arpa.
NS2.INTERNIC.NET has serial number 199714
BLACKHOLE.ISI.EDU has serial number 199714
RS0.INTERNIC.NET is not authoritative for 10.in-addr.arpa.
$ check_soa 168.192.in-addr.arpa.
RS0.INTERNIC.NET is not authoritative for 168.192.in-addr.arpa.
NS2.INTERNIC.NET has serial number 199713
BLACKHOLE.ISI.EDU has serial number 199713