Subject: Re: [DNSOP] Starting a -bis document for RFC 8109: Initializing a DNS Resolver with Priming Queries

From: "Andrew McConachie" <[email-masked]>
Date: Thu, 06 Aug 2020 13:08:05 +0200

Dear Peter, Matt and Paul,

What does it mean for a resolver to be primed, or for a resolver to not 
be primed? For example, is a resolver considered primed only if it has 
all root server names and IP addresses? 50%? At least 1?

    Priming is the act of finding the list of root servers from a
    configuration that lists some or all of the purported IP addresses 
of
    some or all of those root servers.  A recursive resolver starts with
    no information about the root servers, and ends up with a list of
    their names and their addresses.

If that were true it would be impossible for the resolver to find 
anything. It definitely starts with some information about the root 
servers. Maybe change "no information" to "this information".

Thanks,
Andrew

On 1 Jul 2020, at 1:39, Paul Hoffman wrote:

> Greetings again. Since RFC 8109 has been published, there has been 
> more discussion of what DNS priming means. This has caused the 
> document authors to see a few places where RFC 8109 could be clarified 
> and improved. Please see:
>    https://datatracker.ietf.org/doc/draft-klh-dnsop-rfc8109bis/
>
> Comments are welcome. If the WG wants to adopt this work, that would 
> be grand as well.
>
> --Paul Hoffman_______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 6 Aug 2020 14:41:34 +0000

On Aug 6, 2020, at 4:08 AM, Andrew McConachie <[email-masked]> wrote:
> 
> What does it mean for a resolver to be primed, or for a resolver to not be primed? For example, is a resolver considered primed only if it has all root server names and IP addresses? 50%? At least 1?

Excellent questions, two that the WG can certainly consider. Note that it *is* two questions, the root server names and the associated addresses.

From the text you quote:

>   configuration that lists some or all of the purported IP addresses of

RFC 8109 indicates that priming means knowing the full set of names and the full set of addresses.

> If that were true it would be impossible for the resolver to find anything. It definitely starts with some information about the root servers. Maybe change "no information" to "this information".

This distinction is important. A resolver starts with no actual information, but only meta-information: where to get the actual names and addresses for the root server. Is there a better way to say this in the -bis document?

--Paul Hoffman

---

From: George Michaelson <[email-masked]>
Date: Fri, 7 Aug 2020 08:32:48 +1000

If I (insanely) ran a totally manual, out of band process to
periodically canvas the space and injected the knowns into the model
of "root" for my resolver, would I be able to say I am primed?

I am trying to get to the point that the "how" part is only exemplary,
explanatory. The requirement is that you have the information, now how
you get it or how it comes into your resolver.

The distinction between shipped states of the root.hints and the
actual live mappings of the domain labels inherent in it, to addresses
(if you like) I can bypass the hints file ,and use SQL to update my
root mapping.

I think the intent of "priming" is that you then populate the
information from 'inside' DNS. But, again, its only advisory, its not
standards enforced is it? I can populate my continuing knowledge of
the state of the DNS at the root, or anywhere else, in any mechanism I
like.

I could periodically FTP the zone files from places, and populate my
resolver cache state from these. I could basically "never" forward DNS
queries high in the tree, if I felt like making my server do that.

Am I "not primed" if I do this?

(this mechanism wouldn't support authenticated denial of arbitrary
labels, as an example)

-G

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 6 Aug 2020 23:20:51 +0000

> of "root" for my resolver, would I be able to say I am primed?

Not by the standard, no. RFC 8109 was passed by this WG as a standard.

> you get it or how it comes into your resolver.

That is not true for this standard. This standard gives the way to be primed following what has already been standardized before now. You can get the NS RRset for the root zone into your resolver in other ways, and the resolver would work fine, but that is not priming as standardized here.

If you're asking the trivial question of whether you could continue to operate without following the standard, the trivial answer is of course "yes".

> standards enforced is it?

You could ask to remove that designation in this -bis document if you want. I, for one, would disagree with such a request.

> I can populate my continuing knowledge of

Yep, and nothing in the current standard or this updating document says that you can't. They say that the standard for priming is done this way. 

> Am I "not primed" if I do this?

Not by the standard, no. You still would have a running system. If you want to call it "primed" (or "Fred"), that's up to you.

--Paul Hoffman

---

From: George Michaelson <[email-masked]>
Date: Fri, 7 Aug 2020 11:21:21 +1000

No. thats good and clear. Priming is not just the concept of being
correct, its specifically following a mandated in-band mechanism. It
is a standard, and the bis requirements are not just "arrive at the
state, don't care how" they are "arrive at the state by following this
specific procedure" -otherwise, you cannot say you are primed in the
RFC sense.

-G

---

From: "Andrew McConachie" <[email-masked]>
Date: Fri, 07 Aug 2020 16:20:37 +0200

On 6 Aug 2020, at 16:41, Paul Hoffman wrote:

>> What does it mean for a resolver to be primed, or for a resolver to 
>> not be primed? For example, is a resolver considered primed only if 
>> it has all root server names and IP addresses? 50%? At least 1?
>
> Excellent questions, two that the WG can certainly consider. Note that 
> it *is* two questions, the root server names and the associated 
> addresses.
>
> From the text you quote:
>
It would be good if this document said that without having to refer back 
to RFC 8109.

> This distinction is important. A resolver starts with no actual 
> information, but only meta-information: where to get the actual names 
> and addresses for the root server. Is there a better way to say this 
> in the -bis document?
>
Meta-information is information, just like meta-data is data. The 
distinction only depends on context.

How about this for the last sentence, “A recursive resolver starts 
with no cached information about the root servers, and finishes with a 
full list of their names and their addresses in its cache.”

—Andrew