INTERNET-DRAFT Eric A. Hall Document: draft-ietf-crisp-firs-asn-03.txt August 2003 Expires: March, 2004 Category: Experimental Defining and Locating Autonomous System Numbers in the Federated Internet Registry Service Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC 2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. Copyright Notice Copyright (C) The Internet Society (2003). All Rights Reserved. Abstract This document defines LDAP schema and searching rules for autonomous system numbers, in support of the Federated Internet Registry Service (FIRS) described in [FIRS-ARCH] and [FIRS-CORE]. Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 Table of Contents 1. Introduction...............................................2 2. Prerequisites and Terminology..............................2 3. Naming Syntax..............................................3 4. Object Classes and Attributes..............................3 5. Query Processing Rules.....................................6 5.1. Query Pre-Processing....................................6 5.2. LDAP Matching...........................................7 5.3. Example Query...........................................8 6. Security Considerations....................................8 7. IANA Considerations........................................9 8. Normative References.......................................9 9. Changes from Previous Versions............................10 10. Author's Address..........................................11 11. Acknowledgments...........................................11 12. Full Copyright Statement..................................11 1. Introduction This specification defines the naming syntax, object classes, attributes, matching filters, and query processing rules for storing and locating Autonomous System Numbers (ASNs) in the FIRS service. Refer to [FIRS-ARCH] for information on the FIRS architecture and [FIRS-CORE] for the schema definitions and rules which govern the FIRS service as a whole. The definitions in this specification are intended to be used with FIRS. Their usage outside of FIRS is not prohibited, but any such usage is beyond this specification's scope of authority. 2. Prerequisites and Terminology The complete set of specifications in the FIRS collection cumulative define a structured and distributed information service using LDAPv3 for the data-formatting and transport functions. This specification should be read in the context of that set, which currently includes [FIRS-ARCH], [FIRS-CORE], [FIRS-DNS], [FIRS-DNSRR], [FIRS-CONTCT], [FIRS-IPV4] and [FIRS-IPV6]. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. Hall I-D Expires: March 2004 [page 2]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 3. Naming Syntax The naming syntax for ASN entries in FIRS MUST follow the form of "cn=<inetAsNumberSyntax>,cn=inetResources,<partition>", where <inetAsNumberSyntax> is the Autonomous System Number resource, and where <partition> is a sequence of domainComponent relative distinguished names which identifies the scope of authority for the selected directory partition. Entries which use the inetAsNumberSyntax rules use the decimal equivalent of a 16-bit autonomous system number, with the non- affective leading zeroes removed. An augmented BNF for this syntax is as follows: inetAsNumberSyntax = decimal value between "0" and "65535" inclusive, with the non-affective leading zeroes removed The schema definition for inetAsNumberSyntax is as follows: inetAsNumberSyntax ( 1.3.6.1.4.1.7161.1.7.0 NAME 'inetAsNumberSyntax' DESC 'An autonomous system number.' ) For example, an entry for ASN "1" in the "dc=arin,dc=net" partition would be "cn=1,cn=inetResources,dc=arin,dc=net", while an entry for AS number "65535" in the same partition would be "cn=65535,cn=inetResources,dc=arin,dc=net". 4. Object Classes and Attributes ASN-specific entries in FIRS MUST use the inetAsNumber object class, in addition to the mandatory object classes defined in [FIRS-CORE]. ASN entries MUST be treated as containers capable of holding subordinate entries. If an entry exists as a referral source, the entry MUST be defined with the referral object class, in addition to the other object classes defined above. Referral sources MUST NOT contain subordinate entries. Refer to section 3.5 of [FIRS-CORE] for more information on referral entries in FIRS. The inetAsNumber object class is a structural object class which is subordinate to the inetResources object class. The inetAsNumber object class has no mandatory attributes, although it does have Hall I-D Expires: March 2004 [page 3]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 several optional attributes. The inetAsNumber object class also inherits the attributes defined in the inetResources object class, including the "cn" naming attribute. The schema definition for the inetAsNumber object class is as follows: inetAsNumber ( 1.3.6.1.4.1.7161.1.7.1 NAME 'inetAsNumber' DESC 'Autonomous system attributes.' SUP inetResources STRUCTURAL MAY ( inetAsnDelegationStatus $ inetAsnDelegationDate $ inetAsnRegistrar $ inetAsnRegistry $ inetAsnContacts $ inetAsnRoutingContacts ) ) The attributes from the inetAsNumber object class are described below: inetAsnContacts ( 1.3.6.1.4.1.7161.1.7.2 NAME 'inetAsnContacts' DESC 'Contacts for general administrative issues concerning this ASN.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.7161.1.4.0 ) inetAsnDelegationDate ( 1.3.6.1.4.1.7161.1.7.3 NAME 'inetAsnDelegationDate' DESC 'Date this ASN was delegated.' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE ) inetAsnDelegationStatus ( 1.3.6.1.4.1.7161.1.7.4 NAME 'inetAsnDelegationStatus' DESC 'Delegation status for this AS number.' EQUALITY numericStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{2} SINGLE-VALUE ) Hall I-D Expires: March 2004 [page 4]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 NOTE: In an effort to facilitate internationalization and programmatic processing, the current status of a delegation is identified by a 16-bit integer. The values and status mapping is as follows: 0 Reserved delegation (permanently inactive) 1 Assigned and active (normal state) 2 Assigned but not yet active (new delegation) 3 Assigned but on hold (disputed) 4 Assignment revoked (database purge pending) Additional values are reserved for future use, and are to be administered by IANA. Note that there is no status code for "unassigned"; unassigned entries SHOULD NOT exist, and SHOULD NOT be returned as answers. inetAsnRegistrar ( 1.3.6.1.4.1.7161.1.7.5 NAME 'inetAsnRegistrar' DESC 'Registrar or sub-registry who delegated this ASN.' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) NOTE: The inetAsnRegistrar attribute uses a URL to indicate the registrar who delegated the ASN. The attribute structure is identical to the labeledURI attribute, as defined in [RFC2798], including the URL and textual comments. The data can refer to any valid URL. inetAsnRegistry ( 1.3.6.1.4.1.7161.1.7.6 NAME 'inetAsnRegistry' DESC 'Regional registry where this ASN is managed.' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) NOTE: The inetAsnRegistry attribute uses a URL to indicate the registry who is ultimately responsible for the ASN. The attribute structure is identical to the labeledURI attribute, as defined in [RFC2798], including the URL and textual comments. The data can refer to any valid URL. Hall I-D Expires: March 2004 [page 5]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 inetAsnRoutingContacts ( 1.3.6.1.4.1.7161.1.7.7 NAME 'inetAsnRoutingContacts' DESC 'Contacts for routing-related problems with this ASN.' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.7161.1.4.0 ) An example of an inetAsNumber entry is shown in Figure 1 below. The example includes attributes from the inetAsNumber, inetResources, and inetAssociatedResources object classes. cn=65535,cn=inetResources,dc=asn,dc=net [top object class] [inetResources object class] [inetAsNumber object class] [inetAssociatedResources object class] | +-attribute: description | value: "Example Hosting's autonomous system" | +-attribute: inetAsnContacts | value: "hostmaster@example.net" | +-attribute: inetAssociatedIpv4Networks value: "192.0.2.0/24" Figure 1: The entry for ASN 65535 in the dc=arin,dc=net partition. 5. Query Processing Rules Queries for ASNs have several special requirements, as discussed in the following sections. Refer to [FIRS-CORE] for general information about FIRS queries. 5.1. Query Pre-Processing FIRS clients MUST use the targeted bootstrap model by default for ASN queries, using the "asn.arpa" zone as the seed domain for the initial query. FIRS clients MAY use the top-down bootstrap model for queries if necessary or desirable. Due to the lack of any public DNS delegation mapping service, there is no practical reason for FIRS clients to use the bottom-up model with ASN queries. Hall I-D Expires: March 2004 [page 6]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 There are no pre-existing mechanisms for mapping ASNs to domain names. As such, there are no pre-existing mechanisms for mapping ASNs to authoritative LDAP partitions. In order to facilitate interoperability, FIRS queries for ASN resources MUST use "dc=asn,dc=arpa" as the authoritative partition, and MUST use "cn=inetResources,dc=asn,dc=arpa" for the search base. It is expected that FIRS-compliant LDAP servers will be established to serve this directory partition, with these servers providing entry-specific referrals to registrar-specific servers. 5.2. LDAP Matching If the server advertises the inetAsNumber object class and the inetAsNumberMatch matching filter in the inetResourcesControl server control, FIRS clients MUST use the inetAsNumberMatch matching filter in LDAP searches for contact entries. The inetAsNumberMatch filter provides an identifier and search string format which collectively inform a queried server that a specific ASN value should be searched for, and that any inetAsNumber object class entries which match the assertion value should be returned. The inetAsNumberMatch filter is defined as follows: inetAsNumberMatch ( 1.3.6.1.4.1.7161.1.7.0.1 NAME 'inetAsNumberMatch' SYNTAX 1.3.6.1.4.1.7161.1.7.0 ) Clients MUST ensure that the query input is normalized according to the rules specified in section 3 before the input is used as the assertion value to the resulting LDAP query. A FIRS server MUST compare the assertion value against the distinguished name of all entries within and beneath the container specified by the search base of the query. Any entry in that hierarchy with an object class of inetAsNumber and a distinguished name component that is equal to the assertion value MUST be returned to the client (this specifically includes any child entries, such as referral stubs). Entries which do not have an object class of inetAsNumber MUST NOT be returned. The matching filters defined in this specification MUST be supported by FIRS clients and servers. FIRS servers MAY support Hall I-D Expires: March 2004 [page 7]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 additional matching filters, although FIRS clients MUST NOT expect any additional filters to be available. If the server does not advertise support for the inetAsNumberMatch matching filter in the inetResourcesControl server control, the client MAY choose to emulate the matching filter through the use of locally-constructed equalityMatch filters. However, this process can result in incomplete answers in some cases, so if the server advertises support for the inetAsNumberMatch matching filter in the inetResourcesControl control, the client MUST use it. 5.3. Example Query The following example assumes that the user has specified "65535" as the query value: a. Normalize the input, which is "65535" in this case. b. Determine the authoritative partition, which is always " dc=asn,dc=arpa" in the case of ASNs. c. Determine the search base for the query, which is always "cn=inetResources,dc=asn,dc=arpa" in the case of ASNs. d. Initiate a DNS lookup for the SRV resource records associated with "_ldap._tcp.asn.arpa." For the purpose of this example, assume that this lookup succeeds, with the DNS response message indicating that "firs.iana.org" is the preferred LDAP server. e. Submit an LDAPv3 query to the specified server, using "(1.3.6.1.4.1.7161.1.7.0.1:=65535)" as the matching filter, "cn=inetResources,dc=asn,dc=arpa" as the search base, and the global query defaults defined in [FIRS-CORE]. f. Assume that no referrals are received. Display the answer data which has been received and exit the query. 6. Security Considerations Security considerations are discussed in [FIRS-ARCH]. Hall I-D Expires: March 2004 [page 8]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 7. IANA Considerations ASNs are not currently represented in the global DNS, and there are no simple mechanisms for mapping ASNs to authoritative partitions using the public DNS. This specification uses the "asn.arpa" zone for this mapping function, with the expectation that this zone will be created by IANA. It is also expected that authoritative LDAP partitions will be mapped to that zone, and that FIRS-capable LDAP servers will be established to service this partition, with this partition containing ASN-specific entries which will provide referrals to the appropriate RIR partitions. It is further expected that IANA will oversee the creation and management of the asn.arpa domain's LDAP SRV resource records, the "dc=asn,dc=arpa" LDAP partition, and the necessary LDAP servers. The inetAsnDelegationStatus attribute uses numeric code values. It is expected that IANA will manage the assignment of these values. Additional IANA considerations are discussed in [FIRS-ARCH]. 8. Normative References [RFC2247] Kille, S., Wahl, M., Grimstad, A., Huber, R., and Sataluri, S. "Using Domains in LDAP/X.500 DNs", RFC 2247, January 1998. [RFC2251] Wahl, M., Howes, T., and Kille, S. "Lightweight Directory Access Protocol (v3)", RFC 2251, December 1997. [RFC2252] Wahl, M., Coulbeck, A., Howes, T., and Kille, S. "Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997. [RFC2254] Howes, T. "The String Representation of LDAP Search Filters", RFC 2254, December 1997. [FIRS-ARCH] Hall, E. "The Federated Internet Registry Service: Architecture and Implementation Guide", draft-ietf-crisp-firs-arch-03, August 2003. [FIRS-CONTCT] Hall, E. "Defining and Locating Contact Persons in the Federated Internet Registry Service", draft-ietf-crisp-firs-contact-03, August 2003. Hall I-D Expires: March 2004 [page 9]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 [FIRS-CORE] Hall, E. "The Federated Internet Registry Service: Core Elements", draft-ietf-crisp- firs-core-03, August 2003. [FIRS-DNS] Hall, E. "Defining and Locating DNS Domains in the Federated Internet Registry Service", draft-ietf-crisp-firs-dns-03, August 2003. [FIRS-DNSRR] Hall, E. "Defining and Locating DNS Resource Records in the Federated Internet Registry Service", draft-ietf-crisp-firs-dnsrr-02, July 2003. [FIRS-IPV4] Hall, E. "Defining and Locating IPv4 Address Blocks in the Federated Internet Registry Service", draft-ietf-crisp-firs-ipv4-03, August 2003. [FIRS-IPV6] Hall, E. "Defining and Locating IPv6 Address Blocks in the Federated Internet Registry Service", draft-ietf-crisp-firs-ipv6-03, August 2003. 9. Changes from Previous Versions draft-ietf-crisp-firs-asn-03: * Several clarifications and corrections have been made. * The inetAsNumberMatch matching filter was defined. The use of equalityMatch and extensibleMatch has been deprecated. draft-ietf-crisp-firs-asn-02: * Several clarifications and corrections have been made. * Changed the default bootstrap model to use targeted queries, with "asn.arpa" as the default zone and "dc=asn,dc=arpa" as the default partition. * Several attributes had their OIDs changed. NOTE THAT THIS IS AN INTERNET DRAFT, AND THAT THE OIDS ARE SUBJECT TO ADDITIONAL CHANGES AS THIS DOCUMENT IS EDITED. draft-ietf-crisp-firs-asn-01: * Several clarifications and corrections have been made. Hall I-D Expires: March 2004 [page 10]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 draft-ietf-crisp-firs-asn-00: * Restructured the document set. * "Attribute references" have been eliminated from the specification. All referential attributes now provide actual data instead of URL pointers to data. Clients that wish to retrieve these values will need to start new queries using the data values instead of URLs. * The attribute-specific operational attributes have been eliminated as unnecessary. * The inetAsnRegistrar and inetAsnRegistry attributes were added. * Several attributes had their OIDs changed. NOTE THAT THIS IS AN INTERNET DRAFT, AND THAT THE OIDS ARE SUBJECT TO ADDITIONAL CHANGES AS THIS DOCUMENT IS EDITED. * Several typographical errors have been fixed. * Some unnecessary text has been removed. 10. Author's Address Eric A. Hall ehall@ehsco.com 11. Acknowledgments Funding for the RFC editor function is currently provided by the Internet Society. Portions of this document were funded by VeriSign Labs. The first version of this specification was co-authored by Andrew Newton of VeriSign Labs, and subsequent versions continue to be developed with his active participation. Edward Lewis also contributed significant feedback to this specification in the later stages of its developments. 12. Full Copyright Statement Copyright (C) The Internet Society (2003). All Rights Reserved. Hall I-D Expires: March 2004 [page 11]
Internet Draft draft-ietf-crisp-firs-asn-03.txt August 2003 This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Hall I-D Expires: March 2004 [page 12]
