Internet Engineering Task Force (IETF) J. Abley
Request for Comments: 7534 Dyn, Inc.
Obsoletes: 6304 W. Sotomayor
Category: Informational OttIX
ISSN: 2070-1721 May 2015
Internet Engineering Task Force (IETF) J. Abley
Request for Comments: 7534 Dyn, Inc.
Obsoletes: 6304 W. Sotomayor
Category: Informational OttIX
ISSN: 2070-1721 May 2015
AS112 Nameserver Operations
AS112名称服务器操作
Abstract
摘要
Many sites connected to the Internet make use of IPv4 addresses that are not globally unique. Examples are the addresses designated in RFC 1918 for private use within individual sites.
许多连接到Internet的站点使用的IPv4地址不是全局唯一的。例如，RFC 1918中指定的地址，供各个站点内的私人使用。
Devices in such environments may occasionally originate Domain Name System (DNS) queries (so-called "reverse lookups") corresponding to those private-use addresses. Since the addresses concerned have only local significance, it is good practice for site administrators to ensure that such queries are answered locally. However, it is not uncommon for such queries to follow the normal delegation path in the public DNS instead of being answered within the site.
此类环境中的设备有时可能会发起与这些专用地址对应的域名系统（DNS）查询（所谓的“反向查找”）。由于相关地址仅具有本地意义，因此站点管理员最好确保在本地回答此类查询。然而，这种查询遵循公共DNS中的正常委托路径而不是在站点内得到答复的情况并不少见。
It is not possible for public DNS servers to give useful answers to such queries. In addition, due to the wide deployment of private-use addresses and the continuing growth of the Internet, the volume of such queries is large and growing. The AS112 project aims to provide a distributed sink for such queries in order to reduce the load on the corresponding authoritative servers. The AS112 project is named after the Autonomous System Number (ASN) that was assigned to it.
公共DNS服务器不可能为此类查询提供有用的答案。此外，由于私用地址的广泛部署和互联网的持续增长，此类查询的数量巨大且不断增长。AS112项目旨在为此类查询提供一个分布式接收器，以减少相应权威服务器上的负载。AS112项目以分配给它的自治系统编号（ASN）命名。
This document describes the steps required to install a new AS112 node and offers advice relating to such a node's operation.
本文档描述了安装新AS112节点所需的步骤，并提供了有关此类节点操作的建议。
This document obsoletes RFC 6304.
本文件淘汰RFC 6304。
Status of This Memo
关于下段备忘
This document is not an Internet Standards Track specification; it is published for informational purposes.
本文件不是互联网标准跟踪规范；它是为了提供信息而发布的。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741.
本文件是互联网工程任务组（IETF）的产品。它代表了IETF社区的共识。它已经接受了公众审查，并已被互联网工程指导小组（IESG）批准出版。并非IESG批准的所有文件都适用于任何级别的互联网标准；见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7534.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问http://www.rfc-editor.org/info/rfc7534.
Copyright Notice
版权公告
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2015 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本，并提供简化BSD许可证中所述的无担保。
Table of Contents
目录
1. Introduction ....................................................4
2. AS112 DNS Service ...............................................4
2.1. Approach ...................................................4
2.1.1. Direct Delegation ...................................4
2.1.2. DNAME Redirection ...................................5
2.2. Zones ......................................................5
2.3. Nameservers ................................................6
3. Installation of a New Node ......................................6
3.1. Useful Background Knowledge ................................6
3.2. Topological Location .......................................6
3.3. Operating System and Host Considerations ...................7
3.4. Routing Software ...........................................7
3.5. DNS Software ..............................................10
3.6. Testing a Newly Installed Node ............................15
4. Operations .....................................................16
4.1. Monitoring ................................................16
4.2. Downtime ..................................................16
4.3. Statistics and Measurement ................................16
5. Communications .................................................17
6. On the Future of AS112 Nodes ...................................17
7. IANA Considerations ............................................18
7.1. General ...................................................18
7.2. IANA Actions ..............................................18
7.2.1. IPv6 Transport for Direct Delegation AS112
Servers ............................................18
7.2.2. Registration in the Special-Purpose AS
Numbers Registry ...................................19
7.2.3. Registration in the IANA IPv4
Special-Purpose Address Registry ...................19
7.2.4. Registration in the IANA IPv6
Special-Purpose Address Registry ...................19
8. Security Considerations ........................................20
9. References .....................................................21
9.1. Normative References ......................................21
9.2. Informative References ....................................22
Appendix A. A Brief History of AS112 ..............................23
Appendix B. Changes since RFC 6304 ................................23
Acknowledgements ..................................................24
Authors' Addresses ................................................24
1. Introduction ....................................................4
2. AS112 DNS Service ...............................................4
2.1. Approach ...................................................4
2.1.1. Direct Delegation ...................................4
2.1.2. DNAME Redirection ...................................5
2.2. Zones ......................................................5
2.3. Nameservers ................................................6
3. Installation of a New Node ......................................6
3.1. Useful Background Knowledge ................................6
3.2. Topological Location .......................................6
3.3. Operating System and Host Considerations ...................7
3.4. Routing Software ...........................................7
3.5. DNS Software ..............................................10
3.6. Testing a Newly Installed Node ............................15
4. Operations .....................................................16
4.1. Monitoring ................................................16
4.2. Downtime ..................................................16
4.3. Statistics and Measurement ................................16
5. Communications .................................................17
6. On the Future of AS112 Nodes ...................................17
7. IANA Considerations ............................................18
7.1. General ...................................................18
7.2. IANA Actions ..............................................18
7.2.1. IPv6 Transport for Direct Delegation AS112
Servers ............................................18
7.2.2. Registration in the Special-Purpose AS
Numbers Registry ...................................19
7.2.3. Registration in the IANA IPv4
Special-Purpose Address Registry ...................19
7.2.4. Registration in the IANA IPv6
Special-Purpose Address Registry ...................19
8. Security Considerations ........................................20
9. References .....................................................21
9.1. Normative References ......................................21
9.2. Informative References ....................................22
Appendix A. A Brief History of AS112 ..............................23
Appendix B. Changes since RFC 6304 ................................23
Acknowledgements ..................................................24
Authors' Addresses ................................................24
Many sites connected to the Internet make use of IPv4 addresses that are not globally unique. Examples are the addresses designated in [RFC1918] for private use within individual sites.
许多连接到Internet的站点使用的IPv4地址不是全局唯一的。例如，在[RFC1918]中指定的供各个站点内私人使用的地址。
Devices in such environments may occasionally originate Domain Name System (DNS) [RFC1034] queries (so-called "reverse lookups") corresponding to those private-use addresses. Since the addresses concerned have only local significance, it is good practice for site administrators to ensure that such queries are answered locally [RFC6303]. However, it is not uncommon for such queries to follow the normal delegation path in the public DNS instead of being answered within the site.
此类环境中的设备有时可能会发起与这些专用地址对应的域名系统（DNS）[RFC1034]查询（所谓的“反向查找”）。由于相关地址仅具有本地意义，因此站点管理员应确保在本地回答此类查询[RFC6303]。然而，这种查询遵循公共DNS中的正常委托路径而不是在站点内得到答复的情况并不少见。
It is not possible for public DNS servers to give useful answers to such queries. In addition, due to the wide deployment of private-use addresses and the continuing growth of the Internet, the volume of such queries is large and growing. The AS112 project aims to provide a distributed sink for such queries in order to reduce the load on the IN-ADDR.ARPA authoritative servers [RFC5855].
公共DNS服务器不可能为此类查询提供有用的答案。此外，由于私用地址的广泛部署和互联网的持续增长，此类查询的数量巨大且不断增长。AS112项目旨在为此类查询提供分布式接收器，以减少in-ADDR.ARPA权威服务器上的负载[RFC5855]。
The AS112 project encompasses a loosely coordinated collection of independently operated nameservers. Each nameserver functions as a single node in an AS112 anycast cloud [RFC4786] and is configured to answer authoritatively for a particular set of nominated zones.
AS112项目包含一个松散协调的独立操作名称服务器集合。每个名称服务器作为AS112选播云[RFC4786]中的单个节点运行，并配置为对指定区域的特定集合进行授权应答。
The AS112 project is named after the Autonomous System Number (ASN) that was assigned to it (see Appendix A).
AS112项目以分配给它的自治系统编号（ASN）命名（见附录A）。
The AS112 project currently uses an approach whereby zones whose traffic should be directed towards an AS112 sink should be directly delegated to AS112 nameservers. Correspondingly, each AS112 node is manually configured to answer appropriately for those zones.
AS112项目目前使用一种方法，即应将其流量定向到AS112接收器的区域应直接委托给AS112名称服务器。相应地，每个AS112节点被手动配置为适当地响应这些区域。
The guidance in this document describes this capability for the zones that were originally delegated in this fashion. AS112 nodes that were implemented in accordance with the guidance found here will continue to provide service for those zones.
本文档中的指南描述了最初以这种方式授权的区域的这种能力。按照此处指南实施的AS112节点将继续为这些区域提供服务。
[RFC7535] describes a different approach whereby queries towards specific zones are redirected to an empty zone also hosted on AS112 servers, using DNAME [RFC6672].
[RFC7535]描述了一种不同的方法，即使用DNAME[RFC6672]将对特定区域的查询重定向到同样托管在AS112服务器上的空区域。
The guidance in this document introduces this capability, allowing any zone administrator to sink query traffic in AS112 infrastructure without requiring changes to any AS112 node.
本文档中的指南介绍了此功能，允许任何区域管理员接收AS112基础结构中的查询流量，而无需更改任何AS112节点。
To support Direct Delegation AS112 service, AS112 nameservers answer authoritatively for the following zones, corresponding to [RFC1918] private-use netblocks:
为了支持直接委派AS112服务，AS112名称服务器对以下区域进行授权应答，对应于[RFC1918]专用NetBlock：
o 10.IN-ADDR.ARPA
o 10.IN-ADDR.ARPA
o 16.172.IN-ADDR.ARPA, 17.172.IN-ADDR.ARPA, ..., 31.172.IN-ADDR.ARPA
o 16.172.IN-ADDR.ARPA，17.172.IN-ADDR.ARPA，…，31.172.IN-ADDR.ARPA
o 168.192.IN-ADDR.ARPA
o 168.192.IN-ADDR.ARPA
and the following zone, corresponding to the "link local" netblock 169.254.0.0/16 listed in [RFC6890]:
以及以下区域，对应于[RFC6890]中列出的“链接本地”netblock 169.254.0.0/16：
o 254.169.IN-ADDR.ARPA
o 254.169.IN-ADDR.ARPA
To support DNAME redirection AS112 service, AS112 nameservers answer authoritatively for the following zone, as specified in [RFC7535]:
为了支持DNAME重定向AS112服务，AS112名称服务器按照[RFC7535]中的规定，对以下区域进行授权应答：
o EMPTY.AS112.ARPA
o EMPTY.AS112.ARPA
To aid identification of AS112 anycast nodes, each node also answers authoritatively for the following zones:
为了帮助识别AS112选播节点，每个节点还对以下区域进行授权应答：
o HOSTNAME.AS112.NET
o HOSTNAME.AS112.NET
o HOSTNAME.AS112.ARPA
o HOSTNAME.AS112.ARPA
See Section 3.5 for the recommended contents of all these zones.
所有这些区域的建议内容见第3.5节。
To support Direct Delegation AS112 service, the relevant zones listed in Section 2.2 are delegated to the two nameservers BLACKHOLE-1.IANA.ORG (192.175.48.6, 2620:4f:8000::6) and BLACKHOLE-2.IANA.ORG (192.175.48.42, 2620:4f:8000::42).
为了支持直接委托AS112服务，第2.2节中列出的相关区域被委托给两个命名服务器BLACKHOLE-1.IANA.ORG（192.175.48.620:4f:8000:：6）和BLACKHOLE-2.IANA.ORG（192.175.48.422620:4f:8000:：42）。
Additionally, the server PRISONER.IANA.ORG (192.175.48.1, 2620:4f:8000::1) is listed in the MNAME field of the SOA records of the IN-ADDR.ARPA zones served by AS112 nameservers. PRISONER.IANA.ORG receives mainly dynamic update queries.
此外，服务器capture.IANA.ORG（192.175.48.1620:4f:8000:：1）列在AS112名称服务器服务的in-ADDR.ARPA区域的SOA记录的MNAME字段中。ORG主要接收动态更新查询。
The addresses of all these nameservers are covered by the single IPv4 prefix 192.175.48.0/24 and the IPv6 prefix 2620:4f:8000::/48. To date, IPv6 transport for these nameservers has only been available for pre-production testing. IANA has added AAAA RRSets for the owner names of these nameservers; see Section 7.
所有这些名称服务器的地址都由单个IPv4前缀192.175.48.0/24和IPv6前缀2620:4f:8000:：/48覆盖。到目前为止，这些名称服务器的IPv6传输仅可用于生产前测试。IANA为这些名称服务器的所有者名称添加了AAAA RRSET；见第7节。
To support DNAME redirection AS112 service, the single zone EMPTY.AS112.ARPA is delegated to the single nameserver BLACKHOLE.AS112.ARPA (192.31.196.1, 2001:4:112::1). The addresses of that nameserver are covered by the single IPv4 prefix 192.31.196.0/24 and the single IPv6 prefix 2001:4:112::/48.
为了支持DNAME重定向AS112服务，将单个区域EMPTY.AS112.ARPA委托给单个名称服务器BLACKHOLE.AS112.ARPA（192.31.196.11901:4:112:：1）。该名称服务器的地址由单个IPv4前缀192.31.196.0/24和单个IPv6前缀2001:4:112:：/48覆盖。
Installation of an AS112 node is relatively straightforward. However, experience in the following general areas may prove useful:
AS112节点的安装相对简单。但是，以下一般领域的经验可能会证明是有用的：
o inter-domain routing with BGP [RFC4271];
o BGP域间路由[RFC4271]；
o DNS authoritative server operations; and
o DNS权威服务器操作；和
o anycast [RFC4786] distribution of DNS services.
o anycast[RFC4786]DNS服务的分发。
AS112 nodes may be located anywhere on the Internet. For nodes that are intended to provide a public service to the Internet community (as opposed to private use), it may well be advantageous to choose a location that is easily (and cheaply) reachable by multiple providers, such as an Internet Exchange Point.
AS112节点可以位于Internet上的任何位置。对于打算向互联网社区提供公共服务（而非私人使用）的节点，选择多个提供商容易（且便宜）到达的位置（例如互联网交换点）很可能是有利的。
AS112 nodes may advertise their service prefix to BGP peers for local use (analogous to a conventional peering relationship between two providers) or for global use (analogous to a customer relationship with one or more providers).
AS112节点可向BGP对等方公布其服务前缀以供本地使用（类似于两个提供商之间的传统对等关系）或供全局使用（类似于与一个或多个提供商的客户关系）。
It is good operational practice to notify the community of users that may fall within the reach of a new AS112 node before it is installed. At an Internet Exchange, local mailing lists usually exist to facilitate such announcements. For nodes that are intended to be globally reachable, coordination with other AS112 operators is highly recommended. See also Section 5.
在安装新AS112节点之前，向社区通知可能在其范围内的用户是一种良好的操作实践。在互联网交换中，通常存在本地邮件列表以方便此类公告。对于计划全局可访问的节点，强烈建议与其他AS112运营商协调。另见第5节。
Examples in this document are based on UNIX and UNIX-like operating systems, but other operating systems exist that are suitable for use in construction of an AS112 node.
本文档中的示例基于UNIX和类UNIX操作系统，但也存在适合用于构建AS112节点的其他操作系统。
The chosen platform should include either support for cloned loopback interfaces or the capability to bind multiple addresses to a single loopback interface. The addresses of the nameservers listed in Section 2.3 will be configured on these interfaces in order that the DNS software can respond to queries properly.
所选平台应包括对克隆环回接口的支持或将多个地址绑定到单个环回接口的能力。将在这些接口上配置第2.3节中列出的名称服务器地址，以便DNS软件能够正确响应查询。
A host that is configured to act as an AS112 anycast node should be dedicated to that purpose and should not be used to simultaneously provide other services. This guidance is provided due to the unpredictable (and occasionally high) traffic levels that AS112 nodes have been seen to attract.
配置为充当AS112选播节点的主机应专用于此目的，且不应用于同时提供其他服务。由于AS112节点所吸引的流量水平不可预测（有时甚至很高），因此提供了此指导。
System startup scripts should be arranged such that the various AS112-related components start automatically following a system reboot. The order in which interfaces are configured and software components started should be arranged such that routing software startup follows DNS software startup, and DNS software startup follows loopback interface configuration.
系统启动脚本的安排应确保各种AS112相关组件在系统重新启动后自动启动。接口配置和软件组件启动的顺序应安排为：路由软件启动遵循DNS软件启动，DNS软件启动遵循环回接口配置。
Wrapper scripts or other arrangements should be employed to ensure that the anycast service prefix for AS112 is not advertised while either the anycast addresses are not configured or the DNS software is not running.
应采用包装器脚本或其他安排，以确保在未配置选播地址或DNS软件未运行时，AS112的选播服务前缀不会被通告。
AS112 nodes signal the availability of AS112 nameservers to the Internet using BGP [RFC4271]: each AS112 node is a BGP speaker and announces the prefixes 192.175.48.0/24 and 2620:4f:8000::/48 to the Internet with origin AS 112 (see also Section 2.3).
AS112节点使用BGP[RFC4271]向互联网发送AS112名称服务器可用性信号：每个AS112节点都是BGP扬声器，并向互联网宣布前缀192.175.48.0/24和2620:4f:8000:：/48，来源为112（另请参见第2.3节）。
The examples in this document are based on the Quagga Routing Suite <http://www.quagga.net> running on Linux, but other software packages exist that also provide suitable BGP support for AS112 nodes.
本文档中的示例基于Quagga路由套件<http://www.quagga.net>在Linux上运行，但也有其他软件包为AS112节点提供适当的BGP支持。
The "bgpd.conf" file is used by Quagga's bgpd daemon, which provides BGP support. The router ID in this example is 203.0.113.1; the AS112 node peers with external peers 192.0.2.1, 192.0.2.2, 2001:db8::1, and 2001:db8::2. Note that the local AS number is 112, and the service prefixes originated from the AS112 node to support Direct Delegation service are 192.175.48.0/24 and 2620:4f:8000::/48; the IPv4 prefix 192.31.196.0/24 and the IPv6 prefix 2001:4:112::/48 support DNAME redirection.
Quagga的bgpd守护程序使用“bgpd.conf”文件，该守护程序提供BGP支持。本例中的路由器ID为203.0.113.1；AS112节点与外部节点192.0.2.1、192.0.2.22001:db8:：1和2001:db8:：2对等。请注意，本地AS编号为112，来自AS112节点以支持直接委派服务的服务前缀为192.175.48.0/24和2620:4f:8000:：/48；IPv4前缀192.31.196.0/24和IPv6前缀2001:4:112:：/48支持DNAME重定向。
For clarity, an IPv4-only AS112 node need not configure any of the IPv6 elements that follow; similarly, an IPv6-only AS112 node need not configure any of the IPv4 elements. Such single-stack hosts can still contribute usefully to IPv4 and IPv6 AS112 services, however, and single-stack operation is not discouraged.
为清楚起见，仅IPv4 AS112节点无需配置以下任何IPv6元素；类似地，仅限IPv6的AS112节点不需要配置任何IPv4元素。然而，这样的单栈主机仍然可以为IPv4和IPv6 AS112服务做出有益的贡献，单栈操作也不受鼓励。
! bgpd.conf
!
hostname as112-bgpd
password <something>
enable password <supersomething>
!
! Note that all AS112 nodes use the local Autonomous System Number
! 112, and originate the IPv4 prefixes 192.175.48.0/24 and
! 192.31.196.0/24 and the IPv6 prefixes 2620:4f:8000::/48 and
! 2001:4:112::/48.
!
! All other addresses shown below are illustrative, and
! actual numbers will depend on local circumstances.
!
! IPv4-only or IPv6-only AS112 nodes should omit advertisements
! for address families they do not support.
!
router bgp 112
bgp router-id 203.0.113.1
neighbor 192.0.2.1 remote-as 64496
neighbor 192.0.2.1 next-hop-self
neighbor 192.0.2.1 prefix-list AS112-v4 out
neighbor 192.0.2.1 filter-list 1 out
!
neighbor 192.0.2.2 remote-as 64497
neighbor 192.0.2.2 next-hop-self
neighbor 192.0.2.2 prefix-list AS112-v4 out
neighbor 192.0.2.2 filter-list 1 out
!
! bgpd.conf
!
hostname as112-bgpd
password <something>
enable password <supersomething>
!
! Note that all AS112 nodes use the local Autonomous System Number
! 112, and originate the IPv4 prefixes 192.175.48.0/24 and
! 192.31.196.0/24 and the IPv6 prefixes 2620:4f:8000::/48 and
! 2001:4:112::/48.
!
! All other addresses shown below are illustrative, and
! actual numbers will depend on local circumstances.
!
! IPv4-only or IPv6-only AS112 nodes should omit advertisements
! for address families they do not support.
!
router bgp 112
bgp router-id 203.0.113.1
neighbor 192.0.2.1 remote-as 64496
neighbor 192.0.2.1 next-hop-self
neighbor 192.0.2.1 prefix-list AS112-v4 out
neighbor 192.0.2.1 filter-list 1 out
!
neighbor 192.0.2.2 remote-as 64497
neighbor 192.0.2.2 next-hop-self
neighbor 192.0.2.2 prefix-list AS112-v4 out
neighbor 192.0.2.2 filter-list 1 out
!
neighbor 2001:db8::1 remote-as 64498
neighbor 2001:db8::1 next-hop-self
neighbor 2001:db8::1 prefix-list AS112-v6 out
neighbor 2001:db8::1 filter-list 1 out
!
neighbor 2001:db8::2 remote-as 64499
neighbor 2001:db8::2 next-hop-self
neighbor 2001:db8::2 prefix-list AS112-v6 out
neighbor 2001:db8::2 filter-list 1 out
!
network 192.175.48.0/24
network 192.31.196.0/24
!
address-family ipv6 unicast
network 2620:4f:8000::/48
network 2001:4:112::/48
exit-address-family
!
ip prefix-list AS112-v4 permit 192.175.48.0/24
ip prefix-list AS112-v4 permit 192.31.196.0/24
!
ipv6 prefix-list AS112-v6 permit 2620:4f:8000::/48
ipv6 prefix-list AS112-v6 permit 2001:4:112::/48
!
ip as-path access-list 1 permit ^$
neighbor 2001:db8::1 remote-as 64498
neighbor 2001:db8::1 next-hop-self
neighbor 2001:db8::1 prefix-list AS112-v6 out
neighbor 2001:db8::1 filter-list 1 out
!
neighbor 2001:db8::2 remote-as 64499
neighbor 2001:db8::2 next-hop-self
neighbor 2001:db8::2 prefix-list AS112-v6 out
neighbor 2001:db8::2 filter-list 1 out
!
network 192.175.48.0/24
network 192.31.196.0/24
!
address-family ipv6 unicast
network 2620:4f:8000::/48
network 2001:4:112::/48
exit-address-family
!
ip prefix-list AS112-v4 permit 192.175.48.0/24
ip prefix-list AS112-v4 permit 192.31.196.0/24
!
ipv6 prefix-list AS112-v6 permit 2620:4f:8000::/48
ipv6 prefix-list AS112-v6 permit 2001:4:112::/48
!
ip as-path access-list 1 permit ^$
The configuration above includes two restrictions on what the AS112 should advertise to its BGP neighbours: a prefix filter that permits only the service prefixes, and an AS_PATH filter that matches only locally originated routes. Together, these measures prevent the node from becoming a transit point for its adjacent ASes.
上述配置包括AS112应向其BGP邻居公布的内容的两个限制：仅允许服务前缀的前缀过滤器和仅匹配本地起源路由的AS_路径过滤器。这些措施共同防止节点成为其相邻ASE的中转点。
The "zebra.conf" file is required to provide integration between protocol daemons (bgpd, in this case) and the kernel.
需要“zebra.conf”文件来提供协议守护进程（本例中为bgpd）和内核之间的集成。
! zebra.conf ! hostname as112 password <something> enable password <supersomething> ! interface lo ! interface eth0 !
! 斑马军团！主机名as112密码<something>启用密码<supersomething>！接口lo！接口eth0！
Although the queries received by AS112 nodes are definitively misdirected, it is important that they be answered in a manner that is accurate and consistent. For this reason, AS112 nodes operate as fully functional and standards-compliant DNS authoritative servers [RFC1034], and hence require appropriate DNS software.
尽管AS112节点接收到的查询肯定是错误的，但以准确一致的方式回答它们是很重要的。因此，AS112节点作为功能齐全且符合标准的DNS权威服务器[RFC1034]运行，因此需要适当的DNS软件。
Examples in this document are based on ISC BIND9 <http://www.isc.org/software/BIND/>, but other DNS software exists that is suitable for use in construction of an AS112 node.
本文档中的示例基于ISC BIND9<http://www.isc.org/software/BIND/>，但存在适合用于构建AS112节点的其他DNS软件。
The following is a sample BIND9 "named.conf" file for a dedicated AS112 server. Note that the nameserver is configured to act as an authoritative-only server (i.e., recursion is disabled). The nameserver is also configured to listen on the various AS112 anycast nameserver addresses, as well as its local addresses.
以下是专用AS112服务器的示例BIND9“named.conf”文件。请注意，名称服务器被配置为仅作为权威服务器（即，禁用递归）。名称服务器还配置为侦听各种AS112选播名称服务器地址及其本地地址。
A basic logging example is included in the sample as well. AS112 operators may exercise discretion at the amount of logging detail they desire or the type of logging they may use in the maintenance of their node. The detail of information can then be used to single out bad implementors or badly managed nameservers, or it can be used for simple measurement analysis.
示例中还包括一个基本的日志记录示例。AS112运营商可根据其需要的日志详细信息量或在维护其节点时可能使用的日志类型行使自由裁量权。然后，信息的细节可以用来挑出糟糕的实现者或管理糟糕的名称服务器，也可以用于简单的度量分析。
// named.conf
//named.conf
// Global options
//全球选择
options {
listen-on {
127.0.0.1; // localhost
options {
listen-on {
127.0.0.1; // localhost
// The following address is node-dependent and should be set to // something appropriate for the new AS112 node.
//以下地址依赖于节点，应设置为//适合新AS112节点的某个地址。
203.0.113.1; // local address (globally unique, unicast)
203.0.113.1; // local address (globally unique, unicast)
// The following addresses are used to support Direct Delegation // AS112 service and are the same for all AS112 nodes.
//以下地址用于支持直接委派//AS112服务，并且对于所有AS112节点都相同。
192.175.48.1; // prisoner.iana.org (anycast)
192.175.48.6; // blackhole-1.iana.org (anycast)
192.175.48.42; // blackhole-2.iana.org (anycast)
192.175.48.1; // prisoner.iana.org (anycast)
192.175.48.6; // blackhole-1.iana.org (anycast)
192.175.48.42; // blackhole-2.iana.org (anycast)
// The following address is used to support DNAME redirection // AS112 service and is the same for all AS112 nodes.
//以下地址用于支持DNAME重定向//AS112服务，对于所有AS112节点都是相同的。
192.31.196.1; // blackhole.as112.arpa (anycast)
};
192.31.196.1; // blackhole.as112.arpa (anycast)
};
listen-on-v6 {
::1; // localhost
listen-on-v6 {
::1; // localhost
// The following addresses are used to support Direct Delegation // AS112 service and are the same for all AS112 nodes.
//以下地址用于支持直接委派//AS112服务，并且对于所有AS112节点都相同。
2620:4f:8000::1; // prisoner.iana.org (anycast)
2620:4f:8000::6; // blackhole-1.iana.org (anycast)
2620:4f:8000::42; // blackhole-2.iana.org (anycast)
2620:4f:8000::1; // prisoner.iana.org (anycast)
2620:4f:8000::6; // blackhole-1.iana.org (anycast)
2620:4f:8000::42; // blackhole-2.iana.org (anycast)
// The following address is used to support DNAME redirection // AS112 service and is the same for all AS112 nodes.
//以下地址用于支持DNAME重定向//AS112服务，对于所有AS112节点都是相同的。
2001:4:112::1; // blackhole.as112.arpa (anycast)
};
2001:4:112::1; // blackhole.as112.arpa (anycast)
};
directory "/var/named";
recursion no; // authoritative-only server
};
directory "/var/named";
recursion no; // authoritative-only server
};
// Log queries, so that when people call us about unexpected
// answers to queries they didn't realise they had sent, we
// have something to talk about. Note that activating this
// naively has the potential to create high CPU load and consume
// enormous amounts of disk space. This example retains 2 old
// versions at a maximum of 500 MB each before rotating out the
// oldest one.
// Log queries, so that when people call us about unexpected
// answers to queries they didn't realise they had sent, we
// have something to talk about. Note that activating this
// naively has the potential to create high CPU load and consume
// enormous amounts of disk space. This example retains 2 old
// versions at a maximum of 500 MB each before rotating out the
// oldest one.
logging {
channel "querylog" {
file "/var/log/query.log" versions 2 size 500m;
print-time yes;
};
category queries { querylog; };
};
logging {
channel "querylog" {
file "/var/log/query.log" versions 2 size 500m;
print-time yes;
};
category queries { querylog; };
};
// Direct Delegation AS112 Service
//直接委托AS112服务
// RFC 1918
//RFC1918
zone "10.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "16.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "17.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "18.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "19.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "20.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "21.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "22.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "23.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "24.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "25.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "26.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "27.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "28.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "29.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "30.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "31.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "168.192.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "10.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "16.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "17.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "18.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "19.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "20.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "21.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "22.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "23.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "24.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "25.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "26.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "27.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "28.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "29.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "30.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "31.172.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "168.192.in-addr.arpa" { type master; file "db.dd-empty"; };
// RFC 6890
//RFC6890
zone "254.169.in-addr.arpa" { type master; file "db.dd-empty"; };
zone "254.169.in-addr.arpa" { type master; file "db.dd-empty"; };
// DNAME redirection AS112 Service
//DNAME重定向AS112服务
zone "empty.as112.arpa" { type master; file "db.dr-empty"; };
zone "empty.as112.arpa" { type master; file "db.dr-empty"; };
// Also answer authoritatively for the HOSTNAME.AS112.NET and
// HOSTNAME.AS112.ARPA zones, which contain data of operational
// relevance.
// Also answer authoritatively for the HOSTNAME.AS112.NET and
// HOSTNAME.AS112.ARPA zones, which contain data of operational
// relevance.
zone "hostname.as112.net" {
type master;
file "db.hostname.as112.net";
};
zone "hostname.as112.net" {
type master;
file "db.hostname.as112.net";
};
zone "hostname.as112.arpa" {
type master;
file "db.hostname.as112.arpa";
};
zone "hostname.as112.arpa" {
type master;
file "db.hostname.as112.arpa";
};
The "db.dd-empty" file follows, below. This is the source data used to populate all the IN-ADDR.ARPA zones listed in Section 2.2 that support Direct Delegation AS112 service. Note that the RNAME specified in the SOA record corresponds to hostmaster@root-servers.org, a suitable email address for receiving technical queries about these zones.
下面是“db.dd empty”文件。这是用于填充第2.2节中列出的所有支持直接委托AS112服务的IN-ADDR.ARPA区域的源数据。请注意，SOA记录中指定的RNAME对应于hostmaster@root-servers.org，用于接收有关这些区域的技术查询的合适电子邮件地址。
; db.dd-empty
;
; Empty zone for Direct Delegation AS112 service.
;
$TTL 1W
@ IN SOA prisoner.iana.org. hostmaster.root-servers.org. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS blackhole-1.iana.org.
NS blackhole-2.iana.org.
;
; There should be no other resource records included in this zone.
;
; Records that relate to RFC 1918-numbered resources within the
; site hosting this AS112 node should not be hosted on this
; nameserver.
; db.dd-empty
;
; Empty zone for Direct Delegation AS112 service.
;
$TTL 1W
@ IN SOA prisoner.iana.org. hostmaster.root-servers.org. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS blackhole-1.iana.org.
NS blackhole-2.iana.org.
;
; There should be no other resource records included in this zone.
;
; Records that relate to RFC 1918-numbered resources within the
; site hosting this AS112 node should not be hosted on this
; nameserver.
The "db.dr-empty" file follows, below. This is the source data used to populate the EMPTY.AS112.ARPA zone that supports DNAME redirection AS112 service. Note that the RNAME specified in the SOA record corresponds to noc@dns.icann.org, a suitable email address for technical queries about this zone.
下面是“db.drempty”文件。这是用于填充支持DNAME重定向AS112服务的EMPTY.AS112.ARPA区域的源数据。请注意，SOA记录中指定的RNAME对应于noc@dns.icann.org，这是一个合适的电子邮件地址，用于对该区域进行技术查询。
; db.dr-empty
;
; Empty zone for DNAME redirection AS112 service.
;
$TTL 1W
@ IN SOA blackhole.as112.arpa. noc.dns.icann.org. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS blackhole.as112.arpa.
;
; db.dr-empty
;
; Empty zone for DNAME redirection AS112 service.
;
$TTL 1W
@ IN SOA blackhole.as112.arpa. noc.dns.icann.org. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS blackhole.as112.arpa.
;
; There should be no other resource records included in this zone.
;
; Records that relate to RFC 1918-numbered resources within the
; site hosting this AS112 node should not be hosted on this
; nameserver.
; There should be no other resource records included in this zone.
;
; Records that relate to RFC 1918-numbered resources within the
; site hosting this AS112 node should not be hosted on this
; nameserver.
The "db.hostname.as112.net" and "db.hostname.as112.arpa" files follow, below. These zones contain various resource records that provide operational data to users for troubleshooting or measurement purposes; the data should be edited to suit local circumstances. Note that the responses to the queries "HOSTNAME.AS112.NET IN TXT" and "HOSTNAME.AS112.ARPA IN TXT" should fit within a 512-octet DNS/ UDP datagram: i.e., it should be available over UDP transport without requiring EDNS0 support by the client.
下面是“db.hostname.as112.net”和“db.hostname.as112.arpa”文件。这些区域包含各种资源记录，为用户提供操作数据，用于故障排除或测量目的；应根据当地情况对数据进行编辑。请注意，对查询“HOSTNAME.AS112.NET IN TXT”和“HOSTNAME.AS112.ARPA IN TXT”的响应应包含在512个八位字节的DNS/UDP数据报中：即，它应可通过UDP传输，而无需客户端支持EDNS0。
The optional LOC record [RFC1876] included in each zone apex provides information about the geospatial location of the node.
每个分区顶点中包含的可选LOC记录[RFC1876]提供了有关节点地理空间位置的信息。
Where software implementations support it, operational data should also be carried using NSID [RFC5001].
在软件实现支持的情况下，还应使用NSID[RFC5001]携带操作数据。
; db.hostname.as112.net
;
$TTL 1W
@ SOA server.example.net. admin.example.net. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS blackhole-1.iana.org.
NS blackhole-2.iana.org.
;
TXT "Name of Facility or similar" "City, Country"
TXT "See http://www.as112.net/ for more information."
TXT "Unique IP: 203.0.113.1."
;
LOC 45 25 0.000 N 75 42 0.000 W 80.00m 1m 10000m 10m
; db.hostname.as112.net
;
$TTL 1W
@ SOA server.example.net. admin.example.net. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS blackhole-1.iana.org.
NS blackhole-2.iana.org.
;
TXT "Name of Facility or similar" "City, Country"
TXT "See http://www.as112.net/ for more information."
TXT "Unique IP: 203.0.113.1."
;
LOC 45 25 0.000 N 75 42 0.000 W 80.00m 1m 10000m 10m
; db.hostname.as112.arpa
;
$TTL 1W
@ SOA server.example.net. admin.example.net. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS blackhole.as112.arpa.
;
TXT "Name of Facility or similar" "City, Country"
TXT "See http://www.as112.net/ for more information."
;
LOC 45 25 0.000 N 75 42 0.000 W 80.00m 1m 10000m 10m
; db.hostname.as112.arpa
;
$TTL 1W
@ SOA server.example.net. admin.example.net. (
1 ; serial number
1W ; refresh
1M ; retry
1W ; expire
1W ) ; negative caching TTL
;
NS blackhole.as112.arpa.
;
TXT "Name of Facility or similar" "City, Country"
TXT "See http://www.as112.net/ for more information."
;
LOC 45 25 0.000 N 75 42 0.000 W 80.00m 1m 10000m 10m
The BIND9 tool "dig" can be used to retrieve the TXT resource records associated with the names "HOSTNAME.AS112.NET" and "HOSTNAME.AS112.ARPA", directed at one of the AS112 anycast nameserver addresses. Continuing the example from above, the response received should indicate the identity of the AS112 node that responded to the query. See Section 3.5 for more details about the resource records associated with "HOSTNAME.AS112.NET".
BIND9工具“dig”可用于检索与名称“HOSTNAME.AS112.NET”和“HOSTNAME.AS112.ARPA”关联的TXT资源记录，这些记录指向AS112任意广播名称服务器地址之一。继续上面的示例，收到的响应应该指示响应查询的AS112节点的标识。有关与“HOSTNAME.AS112.NET”关联的资源记录的更多详细信息，请参见第3.5节。
% dig @prisoner.iana.org hostname.as112.net txt +short +norec
"Name of Facility or similar" "City, Country"
"See http://www.as112.net/ for more information."
%
% dig @prisoner.iana.org hostname.as112.net txt +short +norec
"Name of Facility or similar" "City, Country"
"See http://www.as112.net/ for more information."
%
If the response received indicates that a different node is being used, then there is probably a routing problem to solve. If there is no response received at all, there might be a host or nameserver problem. Judicious use of tools such as traceroute and consultation of BGP looking glasses might be useful in troubleshooting.
如果收到的响应表明正在使用不同的节点，则可能需要解决路由问题。如果根本没有收到响应，则可能存在主机或名称服务器问题。明智地使用traceroute和BGP眼镜咨询等工具可能有助于故障排除。
Note that an appropriate set of tests for a new server will include queries sent from many different places within the expected service area of the node, using both UDP and TCP transport, and exercising all three AS112 anycast nameserver addresses.
请注意，新服务器的一组适当测试将包括从节点预期服务区域内的许多不同位置发送的查询，使用UDP和TCP传输，并执行所有三个AS112选播名称服务器地址。
AS112 nodes should be monitored to ensure that they are functioning correctly, just as with any other production service. An AS112 node that stops answering queries correctly can cause failures and timeouts in unexpected places and can lead to failures in dependent systems that can be difficult to troubleshoot.
应监控AS112节点，以确保它们与任何其他生产服务一样正常运行。停止正确回答查询的AS112节点可能会在意外的地方导致故障和超时，并可能导致从属系统中难以排除的故障。
An AS112 node that needs to go off-line (e.g., for planned maintenance or as part of the diagnosis of some problem) should stop advertising the AS112 service prefixes to its BGP peers. This can be done by shutting down the routing software on the node altogether or by causing the routing system to withdraw the route.
需要离线的AS112节点（例如，用于计划维护或作为某些问题诊断的一部分）应停止向其BGP对等方公布AS112服务前缀。这可以通过完全关闭节点上的路由软件或使路由系统退出路由来实现。
Withdrawing the service prefixes is important in order to avoid blackholing query traffic in the event that the DNS software on the node is not functioning normally.
在节点上的DNS软件无法正常运行的情况下，撤销服务前缀对于避免黑洞查询流量非常重要。
Use of the AS112 node should be measured in order to track long-term trends, identify anomalous conditions, and ensure that the configuration of the AS112 node is sufficient to handle the query load.
应测量AS112节点的使用情况，以便跟踪长期趋势，识别异常情况，并确保AS112节点的配置足以处理查询负载。
Examples of free monitoring tools that might be useful to operators of AS112 nodes include:
AS112节点的操作员可能有用的免费监视工具示例包括：
o bindgraph <http://www.linux.it/~md/software/>
o 活页夹<http://www.linux.it/~md/software/>
o dnstop <http://dns.measurement-factory.com/tools/dnstop/>
o dnstop<http://dns.measurement-factory.com/tools/dnstop/>
o DSC <https://www.dns-oarc.net/tools/dsc/>
o 差示扫描量热仪<https://www.dns-oarc.net/tools/dsc/>
Operators of AS112 nodes should also consider participating in collection events as part of a larger, coordinated effort to gather important baselines. One example of such an effort is Day in the Life <https://www.dns-oarc.net/oarc/data/ditl/>, coordinated by the DNS-OARC <https://www.dns-oarc.net/>.
AS112节点的运营商也应该考虑参与收集事件作为一个更大的、协调的努力来收集重要基线的一部分。生活中的一天就是这样一个例子<https://www.dns-oarc.net/oarc/data/ditl/>，由DNS-OARC协调<https://www.dns-oarc.net/>.
It is good operational practice to notify the community of users that may fall within the reach of a new AS112 node before it is installed. At Internet Exchanges, local mailing lists usually exist to facilitate such announcements.
在安装新AS112节点之前，向社区通知可能在其范围内的用户是一种良好的操作实践。在互联网交易所，通常存在本地邮件列表，以方便此类公告。
For nodes that are intended to be globally reachable, coordination with other AS112 operators is especially recommended. The mailing list <as112-ops@lists.dns-oarc.net> is operated for this purpose.
对于打算全局可访问的节点，特别建议与其他AS112运营商协调。邮件列表<as112-ops@lists.dns-oarc.net>就是为此而运行的。
Information pertinent to AS112 operations is maintained at <http://www.as112.net/>.
与AS112操作相关的信息保存在<http://www.as112.net/>.
Information about an AS112 node should also be published within the DNS, within the "HOSTNAME.AS112.NET" and "HOSTNAME.AS112.ARPA" zones. See Section 3.5 for more details.
关于AS112节点的信息也应该在DNS中的“HOSTNAME.AS112.NET”和“HOSTNAME.AS112.ARPA”区域中发布。详见第3.5节。
AS112 operators should also be aware of the measures described in [RFC6305] and direct site administrators appropriately.
AS112操作员还应了解[RFC6305]中所述的措施，并适当指导现场管理员。
It is recommended practice for the operators of recursive nameservers to answer queries for zones served by AS112 nodes locally, such that queries never have an opportunity to reach AS112 servers [RFC6303]. Operational experience with AS112 nodes does not currently indicate an observable trend towards compliance with those recommendations, however.
建议递归名称服务器的操作员在本地回答AS112节点所服务区域的查询，这样查询就永远不会有机会到达AS112服务器[RFC6303]。然而，AS112节点的运行经验目前并未表明遵守这些建议的明显趋势。
It is expected that some DNS software vendors will include default configuration that will implement measures such as those described in [RFC6303]. If such software is widely deployed, it is reasonable to assume that the query load received by AS112 nodes will decrease; however, it is safe to assume that the query load will not decrease to zero, and consequently that AS112 nodes will continue to provide a useful service for the foreseeable future.
预计一些DNS软件供应商将包括默认配置，以实现[RFC6303]中所述的措施。如果这种软件被广泛部署，可以合理地假设AS112节点接收到的查询负载将减少；然而，可以安全地假设查询负载不会减少到零，因此AS112节点将在可预见的未来继续提供有用的服务。
The use of DNAME redirection to provide AS112 service is new and hence is informed by minimal operational experience. The use of DNAME means that queries for many source zones could be redirected to AS112 infrastructure with no real opportunity for coordination.
使用DNAME重定向来提供AS112服务是新的，因此需要最少的操作经验。使用DNAME意味着对许多源区域的查询可以重定向到AS112基础设施，而没有真正的协调机会。
If the DNAME redirection approach is successful, and in the absence of any operational concerns, the community might well recommend the retirement of the original Direct Delegation AS112 service. This document makes no such recommendation, however.
如果DNAME重定向方法成功，并且在没有任何操作问题的情况下，社区很可能会建议取消最初的直接委托AS112服务。然而，本文件未提出此类建议。
The nameservers associated with Direct Delegation AS112 service are all named under the domain IANA.ORG (see Section 2.3). However, the anycast infrastructure itself is operated by a loosely coordinated, diverse mix of organisations across the Internet and is not an IANA function.
与直接委托AS112服务相关联的名称服务器都在域IANA.ORG下命名（参见第2.3节）。然而，选播基础设施本身是由互联网上松散协调、多样化的组织组合运营的，不是IANA的职能。
The autonomous system number 112, the IPv4 prefix 192.175.48.0/24, and the IPv6 prefix 2620:4f:8000::/48 were assigned by ARIN.
自主系统编号112、IPv4前缀192.175.48.0/24和IPv6前缀2620:4f:8000:：/48由ARIN分配。
The IPv4 prefix 192.31.196.0/24 and the IPv6 prefix 2001:4:112::/48, used for DNAME redirection AS112 service, were assigned by the IANA [RFC7535].
IANA[RFC7535]分配了IPv4前缀192.31.196.0/24和IPv6前缀2001:4:112:：/48，用于DNAME重定向AS112服务。
The three nameservers BLACKHOLE-1.IANA.ORG, BLACKHOLE-2.IANA.ORG, and PRISONER.IANA.ORG are also reachable over IPv6, as described in Section 2.3. Following a substantial period of pre-production testing by AS112 operators, the IANA has added AAAA RRSets to those owner names in Section 7.2.1, to allow the servers to receive queries and generate responses over IPv6 transport.
如第2.3节所述，也可以通过IPv6访问BLACKHOLE-1.IANA.ORG、BLACKHOLE-2.IANA.ORG和Capture.IANA.ORG这三个名称服务器。在AS112运营商进行了长时间的生产前测试之后，IANA在第7.2.1节的所有者名称中添加了AAAA RRSET，以允许服务器通过IPv6传输接收查询并生成响应。
The IANA has added the following AAAA resource records for the three Direct Delegation AS112 nameservers named under IANA.ORG:
IANA为IANA.ORG下命名的三个直接委派AS112名称服务器添加了以下AAAA资源记录：
+----------------------+------------------+
| Owner Name | AAAA RDATA |
+----------------------+------------------+
| PRISONER.IANA.ORG | 2620:4f:8000::1 |
| | |
| BLACKHOLE-1.IANA.ORG | 2620:4f:8000::6 |
| | |
| BLACKHOLE-2.IANA.ORG | 2620:4f:8000::42 |
+----------------------+------------------+
+----------------------+------------------+
| Owner Name | AAAA RDATA |
+----------------------+------------------+
| PRISONER.IANA.ORG | 2620:4f:8000::1 |
| | |
| BLACKHOLE-1.IANA.ORG | 2620:4f:8000::6 |
| | |
| BLACKHOLE-2.IANA.ORG | 2620:4f:8000::42 |
+----------------------+------------------+
The IANA has added AS112 to the "Special-Purpose AS Numbers" registry specified in [RFC7249] as follows:
IANA已将AS112添加到[RFC7249]中指定的“特殊用途AS编号”注册表中，如下所示：
AS Numbers: 112
数目：112
Reason for Reservation: Used by the AS112 project to sink misdirected DNS queries; see RFC 7534.
保留原因：AS112项目用于接收定向错误的DNS查询；见RFC 7534。
The IANA has added 192.175.48.0/24 to the "IANA IPv4 Special-Purpose Address Registry" specified in [RFC6890] as follows:
IANA已将192.175.48.0/24添加到[RFC6890]中指定的“IANA IPv4专用地址注册表”，如下所示：
Address Block: 192.175.48.0/24
地址块：192.175.48.0/24
Name: Direct Delegation AS112 Service
名称：直接委托AS112服务
RFC: RFC 7534
查询电话：RFC7534
Allocation Date: 1996-01
分配日期：1996-01
Termination Date: N/A
终止日期：不适用
Source: True
资料来源：真实
Destination: True
目的地：正确
Forwardable: True
可转发：正确
Global: True
全球：真的
Reserved-by-Protocol: False
协议保留：False
The IANA has added 2620:4f:8000::/48 to the "IANA IPv6 Special-Purpose Address Registry" specified in [RFC6890] as follows:
IANA已将2620:4f:8000:：/48添加到[RFC6890]中指定的“IANA IPv6专用地址注册表”，如下所示：
Address Block: 2620:4f:8000::/48
Address Block: 2620:4f:8000::/48
Name: Direct Delegation AS112 Service
名称：直接委托AS112服务
RFC: RFC 7534
查询电话：RFC7534
Allocation Date: 2011-05
分配日期：2011-05
Termination Date: N/A
终止日期：不适用
Source: True
资料来源：真实
Destination: True
目的地：正确
Forwardable: True
可转发：正确
Global: True
全球：真的
Reserved-by-Protocol: False
协议保留：False
Hosts should never normally send queries to AS112 servers; queries relating to private-use addresses should be answered locally within a site. Hosts that send queries to AS112 servers may well leak information relating to private infrastructure to the public network, and this could present a security risk. Additionally, AS112 operators may log this information, making it further subject to whatever security and privacy risks that might entail. These risks are orthogonal to the presence or absence of authoritative servers for these zones in the public DNS infrastructure, however.
主机通常不应向AS112服务器发送查询；与私人使用地址相关的查询应在现场本地回答。向AS112服务器发送查询的主机很可能会将与私有基础设施相关的信息泄漏到公共网络，这可能会带来安全风险。此外，AS112运营商可能会记录此信息，使其进一步受到可能带来的任何安全和隐私风险的影响。然而，这些风险与公共DNS基础设施中这些区域是否存在权威服务器是正交的。
Queries that are answered by AS112 servers are usually unintentional; it follows that the responses from AS112 servers are usually unexpected. Unexpected inbound traffic can trigger intrusion detection systems or alerts by firewalls. Operators of AS112 servers should be prepared to be contacted by operators of remote infrastructure who believe their security has been violated. Advice to those who mistakenly believe that responses from AS112 nodes constitute an attack on their infrastructure can be found in [RFC6305].
AS112服务器回答的查询通常是无意的；因此，来自AS112服务器的响应通常是意外的。意外的入站流量可能触发入侵检测系统或防火墙警报。AS112服务器的运营商应准备好让远程基础设施的运营商联系，他们认为他们的安全性受到了侵犯。对于那些错误地认为AS112节点的响应构成对其基础设施的攻击的人，可以在[RFC6305]中找到建议。
The deployment of AS112 nodes is very loosely coordinated compared to other services distributed using anycast. The malicious compromise of an AS112 node and subversion of the data served by the node are hence more difficult to detect due to the lack of central management. Since it is conceivable that changing the responses to queries received by AS112 nodes might influence the behaviour of the hosts sending the queries, such a compromise might be used as an attack vector against private infrastructure.
与使用选播分发的其他服务相比，AS112节点的部署非常松散。因此，由于缺乏集中管理，AS112节点的恶意危害和节点所服务数据的破坏更难检测。由于可以想象的是，改变AS112节点接收到的查询的响应可能会影响发送查询的主机的行为，这样的折衷可以用作攻击私有基础设施的攻击向量。
Operators of AS112 should take appropriate measures to ensure that AS112 nodes are appropriately protected from compromise, such as would normally be employed for production nameserver or network infrastructure. The guidance provided for root nameservers in [RFC2870] may be instructive.
AS112的运营商应采取适当的措施，以确保AS112节点得到适当的保护，免受危害，例如通常用于生产名称服务器或网络基础设施的节点。[RFC2870]中为根名称服务器提供的指导可能具有指导意义。
The zones hosted by AS112 servers are not signed with DNSSEC [RFC4033]. Given the distributed and loosely coordinated structure of the AS112 service, the zones concerned could only be signed if the private key material used was effectively public, obviating any security benefit resulting from the use of those keys.
AS112服务器承载的区域未使用DNSSEC[RFC4033]签名。考虑到AS112服务的分布式和松散协调结构，只有在使用的私钥材料有效公开的情况下，才能签署相关区域，从而避免使用这些密钥带来的任何安全好处。
[RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987, <http://www.rfc-editor.org/info/rfc1034>.
[RFC1034]Mockapetris，P.，“域名-概念和设施”，STD 13，RFC 1034，DOI 10.17487/RFC1034，1987年11月<http://www.rfc-editor.org/info/rfc1034>.
[RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G., and E. Lear, "Address Allocation for Private Internets", BCP 5, RFC 1918, DOI 10.17487/RFC1918, February 1996, <http://www.rfc-editor.org/info/rfc1918>.
[RFC1918]Rekhter，Y.，Moskowitz，B.，Karrenberg，D.，de Groot，G.，和E.Lear，“私人互联网地址分配”，BCP 5，RFC 1918，DOI 10.17487/RFC1918，1996年2月<http://www.rfc-editor.org/info/rfc1918>.
[RFC2870] Bush, R., Karrenberg, D., Kosters, M., and R. Plzak, "Root Name Server Operational Requirements", BCP 40, RFC 2870, DOI 10.17487/RFC2870, June 2000, <http://www.rfc-editor.org/info/rfc2870>.
[RFC2870]Bush，R.，Karrenberg，D.，Kosters，M.，和R.Plzak，“根名称服务器操作要求”，BCP 40，RFC 2870，DOI 10.17487/RFC2870，2000年6月<http://www.rfc-editor.org/info/rfc2870>.
[RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "DNS Security Introduction and Requirements", RFC 4033, DOI 10.17487/RFC4033, March 2005, <http://www.rfc-editor.org/info/rfc4033>.
[RFC4033]Arends，R.，Austein，R.，Larson，M.，Massey，D.，和S.Rose，“DNS安全介绍和要求”，RFC 4033，DOI 10.17487/RFC4033，2005年3月<http://www.rfc-editor.org/info/rfc4033>.
[RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A Border Gateway Protocol 4 (BGP-4)", RFC 4271, DOI 10.17487/RFC4271, January 2006, <http://www.rfc-editor.org/info/rfc4271>.
[RFC4271]Rekhter，Y.，Ed.，Li，T.，Ed.，和S.Hares，Ed.，“边境网关协议4（BGP-4）”，RFC 4271，DOI 10.17487/RFC4271，2006年1月<http://www.rfc-editor.org/info/rfc4271>.
[RFC4786] Abley, J. and K. Lindqvist, "Operation of Anycast Services", BCP 126, RFC 4786, DOI 10.17487/RFC4786, December 2006, <http://www.rfc-editor.org/info/rfc4786>.
[RFC4786]Abley，J.和K.Lindqvist，“任意广播服务的运营”，BCP 126，RFC 4786，DOI 10.17487/RFC4786，2006年12月<http://www.rfc-editor.org/info/rfc4786>.
[RFC7535] Abley, J., Dickson, B., Kumari, W., and G. Michaelson, "AS112 Redirection Using DNAME", RFC 7535, DOI 10.17487/RFC7535, May 2015, <http://www.rfc-editor.org/info/rfc7535>.
[RFC7535]Abley，J.，Dickson，B.，Kumari，W.，和G.Michaelson，“使用DNAME的AS112重定向”，RFC 7535，DOI 10.17487/RFC7535，2015年5月<http://www.rfc-editor.org/info/rfc7535>.
[RFC1876] Davis, C., Vixie, P., Goodwin, T., and I. Dickinson, "A Means for Expressing Location Information in the Domain Name System", RFC 1876, DOI 10.17487/RFC1876, January 1996, <http://www.rfc-editor.org/info/rfc1876>.
[RFC1876]Davis，C.，Vixie，P.，Goodwin，T.，和I.Dickinson，“域名系统中表达位置信息的方法”，RFC 1876，DOI 10.17487/RFC1876，1996年1月<http://www.rfc-editor.org/info/rfc1876>.
[RFC5001] Austein, R., "DNS Name Server Identifier (NSID) Option", RFC 5001, DOI 10.17487/RFC5001, August 2007, <http://www.rfc-editor.org/info/rfc5001>.
[RFC5001]Austein，R.，“DNS名称服务器标识符（NSID）选项”，RFC 5001，DOI 10.17487/RFC5001，2007年8月<http://www.rfc-editor.org/info/rfc5001>.
[RFC5855] Abley, J. and T. Manderson, "Nameservers for IPv4 and IPv6 Reverse Zones", BCP 155, RFC 5855, DOI 10.17487/RFC5855, May 2010, <http://www.rfc-editor.org/info/rfc5855>.
[RFC5855]Abley，J.和T.Manderson，“IPv4和IPv6反向区域的名称服务器”，BCP 155，RFC 5855，DOI 10.17487/RFC5855，2010年5月<http://www.rfc-editor.org/info/rfc5855>.
[RFC6303] Andrews, M., "Locally Served DNS Zones", BCP 163, RFC 6303, DOI 10.17487/RFC6303, July 2011, <http://www.rfc-editor.org/info/rfc6303>.
[RFC6303]Andrews，M.，“本地服务DNS区域”，BCP 163，RFC 6303，DOI 10.17487/RFC6303，2011年7月<http://www.rfc-editor.org/info/rfc6303>.
[RFC6304] Abley, J. and W. Maton, "AS112 Nameserver Operations", RFC 6304, DOI 10.17487/RFC6304, July 2011, <http://www.rfc-editor.org/info/rfc6304>.
[RFC6304]Abley，J.和W.Maton，“AS112名称服务器操作”，RFC 6304，DOI 10.17487/RFC6304，2011年7月<http://www.rfc-editor.org/info/rfc6304>.
[RFC6305] Abley, J. and W. Maton, "I'm Being Attacked by PRISONER.IANA.ORG!", RFC 6305, DOI 10.17487/RFC6305, July 2011, <http://www.rfc-editor.org/info/rfc6305>.
[RFC6305]Abley，J.和W.Maton，“我被囚犯攻击了.IANA.ORG！”，RFC 6305，DOI 10.17487/RFC6305，2011年7月<http://www.rfc-editor.org/info/rfc6305>.
[RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the DNS", RFC 6672, DOI 10.17487/RFC6672, June 2012, <http://www.rfc-editor.org/info/rfc6672>.
[RFC6672]Rose，S.和W.Wijngaards，“DNS中的DNAME重定向”，RFC 6672，DOI 10.17487/RFC6672，2012年6月<http://www.rfc-editor.org/info/rfc6672>.
[RFC6890] Cotton, M., Vegoda, L., Bonica, R., Ed., and B. Haberman, "Special-Purpose IP Address Registries", BCP 153, RFC 6890, DOI 10.17487/RFC6890, April 2013, <http://www.rfc-editor.org/info/rfc6890>.
[RFC6890]Cotton，M.，Vegoda，L.，Bonica，R.，Ed.，和B.Haberman，“特殊用途IP地址注册”，BCP 153，RFC 6890，DOI 10.17487/RFC6890，2013年4月<http://www.rfc-editor.org/info/rfc6890>.
[RFC7249] Housley, R., "Internet Numbers Registries", RFC 7249, DOI 10.17487/RFC7249, May 2014, <http://www.rfc-editor.org/info/rfc7249>.
[RFC7249]Housley，R.，“互联网号码注册”，RFC 7249，DOI 10.17487/RFC7249，2014年5月<http://www.rfc-editor.org/info/rfc7249>.
Widespread use of the private address blocks listed in [RFC1918] followed that document's publication in 1996. At that time, the IN-ADDR.ARPA zone was served by root servers.
[RFC1918]中列出的私有地址块在1996年该文件发布后被广泛使用。当时，IN-ADDR.ARPA区域由根服务器提供服务。
The idea of offloading IN-ADDR.ARPA queries relating to [RFC1918] addresses from the root nameservers was first proposed by Bill Manning and John Brown.
Bill Manning和John Brown首先提出了从根名称服务器卸载与[RFC1918]地址相关的IN-ADDR.ARPA查询的想法。
The use of anycast for distributing authoritative DNS service for [RFC1918] IN-ADDR.ARPA zones was subsequently proposed at a private meeting of root server operators.
随后，在根服务器运营商的一次私人会议上，提议使用anycast为[RFC1918]IN-ADDR.ARPA区域分发权威DNS服务。
ARIN provided an IPv4 prefix for the anycast service and also the autonomous system number 112 for use in originating that prefix. This assignment gave the project its name.
ARIN为选播服务提供了IPv4前缀，还提供了自治系统编号112，用于发起该前缀。这项任务为该项目命名。
In 2002, the first AS112 anycast nodes were deployed.
2002年，部署了第一批AS112选播节点。
In 2011, the IN-ADDR.ARPA zone was redelegated from the root servers to a new set of servers operated independently by AfriNIC, APNIC, ARIN, ICANN, LACNIC, and the RIPE NCC and named according to [RFC5855].
2011年，In-ADDR.ARPA区域从根服务器重新分配到由AfriNIC、APNIC、ARIN、ICANN、LACNIC和成熟的NCC独立运行的一组新服务器，并根据[RFC5855]命名。
[RFC6304], the precursor to this document, was published in July 2011.
本文件的前身[RFC6304]于2011年7月发布。
The use of anycast nameservers in the AS112 project contributed to the operational experience of anycast DNS services, and it can be seen as a precursor to the anycast distribution of other authoritative DNS servers in subsequent years (e.g., various root servers).
在AS112项目中使用anycast名称服务器有助于提高anycast DNS服务的运营经验，并且可以将其视为其他权威DNS服务器（例如，各种根服务器）在随后几年中的anycast分发的先驱。
A number of changes and enhancements to the AS112 service has been introduced since the publication of [RFC6304].
自[RFC6304]发布以来，对AS112服务进行了许多更改和增强。
o The addition of IPv6 transport.
o 添加IPv6传输。
o The extension of the AS112 service to include the ability to have additional zones delegated for sinking or removed using the DNAME resource record.
o AS112服务的扩展，包括使用DNAME资源记录委派或删除其他区域的能力。
o Requisite changes to the guidance regarding the configuration of current and future AS112 nodes.
o 有关当前和未来AS112节点配置的指南的必要更改。
o Further clarification about the leakage of information in the Security Considerations section.
o 关于信息泄露的进一步澄清，请参见安全注意事项一节。
o A direction to the IANA to register the AS112 project's prefixes in the IANA Special-Purpose Address registries.
o 指示IANA在IANA专用地址注册中心注册AS112项目的前缀。
Acknowledgements
致谢
This document benefited from review and suggestions from Leo Vegoda and Pearl Liang.
本文件得益于Leo Vegoda和Pearl Liang的审查和建议。
The authors wish to acknowledge the assistance of Bill Manning, John Brown, Marco D'Itri, Daniele Arena, Stephane Bortzmeyer, Frank Habicht, Chris Thompson, Peter Losher, Peter Koch, Alfred Hoenes, S. Moonesamy, Mehmet Akcin, and Aleksi Suhonen in the preparation of [RFC6304], which this document supersedes.
作者希望感谢Bill Manning、John Brown、Marco D'Itri、Daniele Arena、Stephane Bortzmeyer、Frank Habicht、Chris Thompson、Peter Losher、Peter Koch、Alfred Hoenes、S.Moonesamy、Mehmet Akcin和Aleksi Suhonen在编制[RFC6304]过程中提供的协助，本文件将取代该文件。
Authors' Addresses
作者地址
Joe Abley Dyn, Inc. 103-186 Albert Street London, ON N6A 1M1 Canada
Joe Abley Dyn公司，地址：加拿大伦敦艾伯特街103-186号，邮编：N6A 1M1
Phone: +1 519 670 9327
EMail: jabley@dyn.com
Phone: +1 519 670 9327
EMail: jabley@dyn.com
William F. Maton Sotomayor Ottawa Internet Exchange Constitution Square 1400-340 Albert Street Ottawa, ON K1R 0A5 Canada
William F.Maton Sotomayor渥太华互联网交换宪法广场1400-340加拿大K1R 0A5渥太华阿尔伯特街
EMail: wfms@ottix.net
EMail: wfms@ottix.net