INTERNET-DRAFT                                             Eric A. Hall
  Document: draft-ietf-crisp-firs-asn-02.txt                    July draft-ietf-crisp-firs-asn-03.txt                  August 2003
  Expires: February, March, 2004
  Category: Experimental

               Defining and Locating Autonomous System Numbers
                 in the Federated Internet Registry Service

     Status of this Memo

     This document is an Internet-Draft and is in full conformance with
     all provisions of Section 10 of RFC 2026.

     Internet-Drafts are working documents of the Internet Engineering
     Task Force (IETF), its areas, and its working groups. Note that
     other groups may also distribute working documents as Internet-
     Drafts.

     Internet-Drafts are draft documents valid for a maximum of six
     months and may be updated, replaced, or obsoleted by other
     documents at any time. It is inappropriate to use Internet-Drafts
     as reference material or to cite them other than as "work in
     progress."

     The list of current Internet-Drafts can be accessed at
     http://www.ietf.org/ietf/1id-abstracts.txt

     The list of Internet-Draft Shadow Directories can be accessed at
     http://www.ietf.org/shadow.html.

     Copyright Notice

     Copyright (C) The Internet Society (2003).  All Rights Reserved.

     Abstract

     This document defines LDAP schema and searching rules for
     autonomous system numbers, in support of the Federated Internet
     Registry Service (FIRS) described in [FIRS-ARCH] and [FIRS-CORE].

     Table of Contents

     1.   Introduction...............................................2
     2.   Prerequisites and Terminology..............................2
     3.   Naming Syntax..............................................3
     4.   Object Classes and Attributes..............................3
     5.   Query Processing Rules.....................................6
       5.1.  Query Pre-Processing....................................6
       5.2.  Query Bootstrapping.....................................7
       5.3.  LDAP Matching...........................................7
       5.4.
       5.3.  Example Query...........................................8
     6.   Security Considerations....................................9 Considerations....................................8
     7.   IANA Considerations........................................9
     8.   Normative References.......................................9
     9.   Changes from Previous Versions............................10
     10.  Author's Address..........................................11
     11.  Acknowledgments...........................................11
     12.  Full Copyright Statement..................................12 Statement..................................11

  1.      Introduction

     This specification defines the naming syntax, object classes,
     attributes, matching filters, and query processing rules for
     storing and locating Autonomous System Numbers (ASNs) in the FIRS
     service. Refer to [FIRS-ARCH] for information on the FIRS
     architecture and [FIRS-CORE] for the schema definitions and rules
     which govern the FIRS service as a whole.

     The definitions in this specification are intended to be used with
     FIRS. Their usage outside of FIRS is not prohibited, but any such
     usage is beyond this specification's scope of authority.

  2.      Prerequisites and Terminology

     The complete set of specifications in the FIRS collection
     cumulative define a structured and distributed information service
     using LDAPv3 for the data-formatting and transport functions. This
     specification should be read in the context of that set, which
     currently includes [FIRS-ARCH], [FIRS-CORE], [FIRS-DNS],
     [FIRS-DNSRR], [FIRS-CONTCT], [FIRS-IPV4] and [FIRS-IPV6].

     The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
     NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
     in this document are to be interpreted as described in RFC 2119.

  Hall                   I-D Expires: February March 2004              [page 2] 
  3.      Naming Syntax

     The naming syntax for ASN entries in FIRS MUST follow the form of
     "cn=<inetAsNumberSyntax>,cn=inetResources,<partition>", where
     <inetAsNumberSyntax> is the Autonomous System Number resource, and
     where <partition> is a sequence of domainComponent relative
     distinguished names which identifies the scope of authority for
     the selected directory partition.

     Entries which use the inetAsNumberSyntax rules use the decimal
     equivalent of a 16-bit autonomous system number, with the non-
     affective leading zeroes removed.

     An augmented BNF for this syntax is as follows:

          inetAsNumberSyntax = decimal value between "0" and "65535"
             inclusive, with the non-affective leading zeroes removed

     The schema definition for inetAsNumberSyntax is as follows:

          inetAsNumberSyntax
          ( 1.3.6.1.4.1.7161.1.7.0
             NAME 'inetAsNumberSyntax'
             DESC 'An autonomous system number.' )

     For example, an entry for ASN "1" in the "dc=arin,dc=net"
     partition would be "cn=1,cn=inetResources,dc=arin,dc=net", while
     an entry for AS number "65535" in the same partition would be
     "cn=65535,cn=inetResources,dc=arin,dc=net".

  4.      Object Classes and Attributes

     ASN-specific entries in FIRS MUST use the inetAsNumber object
     class, in addition to the mandatory object classes defined in
     [FIRS-CORE]. ASN entries MUST be treated as containers capable of
     holding subordinate entries.

     If an entry exists as a referral source, the entry MUST also be defined
     with the referral object class, in addition to the above requirements. other object
     classes defined above. Referral sources MUST NOT contain
     subordinate entries. Refer to section 3.5 of [FIRS-CORE] for more
     information on referral entries in FIRS.

     The inetAsNumber object class is a structural object class which
     is subordinate to the inetResources object class. The inetAsNumber
     object class has no mandatory attributes, although it does have

  Hall                   I-D Expires: March 2004              [page 3] 
     several optional attributes. The inetAsNumber object class also
     inherits the attributes defined in the inetResources object class,
     including the "cn" naming attribute.

  Hall                  I-D Expires: February 2004             [page 3]

     The schema definition for the inetAsNumber object class is as
     follows:

          inetAsNumber
          ( 1.3.6.1.4.1.7161.1.7.1
             NAME 'inetAsNumber'
             DESC 'Autonomous system attributes.'
             SUP inetResources
             STRUCTURAL
             MAY ( inetAsnDelegationStatus $ inetAsnDelegationDate $
              inetAsnRegistrar $ inetAsnRegistry $ inetAsnContacts $
              inetAsnRoutingContacts ) )

     The attributes from the inetAsNumber object class are described
     below:

          inetAsnContacts
          ( 1.3.6.1.4.1.7161.1.7.2
             NAME 'inetAsnContacts'
             DESC 'Contacts for general administrative issues
             concerning this ASN.'
             EQUALITY caseIgnoreMatch
             SYNTAX 1.3.6.1.4.1.7161.1.7.1 1.3.6.1.4.1.7161.1.4.0 )

          inetAsnDelegationDate
          ( 1.3.6.1.4.1.7161.1.7.3
             NAME 'inetAsnDelegationDate'
             DESC 'Date this ASN was delegated.'
             EQUALITY generalizedTimeMatch
             ORDERING generalizedTimeOrderingMatch
             SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
             SINGLE-VALUE )

          inetAsnDelegationStatus
          ( 1.3.6.1.4.1.7161.1.7.4
             NAME 'inetAsnDelegationStatus'
             DESC 'Delegation status for this AS number.'
             EQUALITY numericStringMatch
             SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{2}
             SINGLE-VALUE )

  Hall                   I-D Expires: February March 2004              [page 4] 
            NOTE: In an effort to facilitate internationalization and
            programmatic processing, the current status of a delegation
            is identified by a 16-bit integer. The values and status
            mapping is as follows:

                 0   Reserved delegation (permanently inactive)
                 1   Assigned and active (normal state)
                 2   Assigned but not yet active (new delegation)
                 3   Assigned but on hold (disputed)
                 4   Assignment revoked (database purge pending)

            Additional values are reserved for future use, and are to
            be administered by IANA.

            Note that there is no status code for "unassigned";
            unassigned entries SHOULD NOT exist, and SHOULD NOT be
            returned as answers.

          inetAsnRegistrar
          ( 1.3.6.1.4.1.7161.1.7.5
             NAME 'inetAsnRegistrar'
             DESC 'Registrar or sub-registry who delegated this ASN.'
             EQUALITY caseExactMatch
             SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )

            NOTE: The inetAsnRegistrar attribute uses a URL to indicate
            the registrar who delegated the ASN. The attribute
            structure is identical to the labeledURI attribute, as
            defined in [RFC2798], including the URL and textual
            comments. The data can refer to any valid URL.

          inetAsnRegistry
          ( 1.3.6.1.4.1.7161.1.7.6
             NAME 'inetAsnRegistry'
             DESC 'Registry 'Regional registry where this ASN is managed.'
             EQUALITY caseExactMatch
             SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )

            NOTE: The inetAsnRegistry attribute uses a URL to indicate
            the registry who is ultimately responsible for the ASN. The
            attribute structure is identical to the labeledURI
            attribute, as defined in [RFC2798], including the URL and
            textual comments. The data can refer to any valid URL.

  Hall                   I-D Expires: February March 2004              [page 5] 
          inetAsnRoutingContacts
          ( 1.3.6.1.4.1.7161.1.7.7
             NAME 'inetAsnRoutingContacts'
             DESC 'Contacts for routing-related problems with this
             ASN.'
             EQUALITY caseIgnoreMatch
             SYNTAX 1.3.6.1.4.1.7161.1.7.1 1.3.6.1.4.1.7161.1.4.0 )

     An example of an inetAsNumber entry is shown in Figure 1 below.
     The example includes attributes from the inetAsNumber,
     inetResources, and inetAssociatedResources object classes.

          cn=65535,cn=inetResources,dc=arin,dc=net

          cn=65535,cn=inetResources,dc=asn,dc=net
          [top object class]
          [inetResources object class]
          [inetAsNumber object class]
          [inetAssociatedResources object class]
          |
          +-attribute: description
          | value: "Example Hosting's autonomous system"
          |
          +-attribute: inetAsnContacts
          | value: "hostmaster@example.net"
          |
          +-attribute: inetAssociatedIpv4Networks
          |
            value: "192.0.2.0/24"
          |
          +-attribute: inetAsnRegistrar
            value: "http://www.arin.net/ (ARIN)"

     Figure 1: The entry for ASN 65535 in the dc=arin,dc=net partition.

  5.      Query Processing Rules

     Queries for ASNs have several special requirements, as discussed
     in the following sections.

     Refer to [FIRS-CORE] for general information about FIRS queries.

  5.1.    Query Pre-Processing

     Clients

     FIRS clients MUST ensure that the query input is normalized according
     to use the rules specified in section 3 before targeted bootstrap model by default for
     ASN queries, using the input is used "asn.arpa" zone as the assertion value to seed domain for the resulting LDAP
     initial query.

     FIRS clients MAY use the top-down bootstrap model for queries if
     necessary or desirable. Due to the lack of any public DNS
     delegation mapping service, there is no practical reason for FIRS
     clients to use the bottom-up model with ASN queries.

  Hall                   I-D Expires: February March 2004              [page 6] 
     There are no pre-existing mechanisms for mapping ASNs to domain
     names. As such, there are no pre-existing mechanisms for mapping
     ASNs to authoritative LDAP partitions. In order to facilitate
     interoperability, FIRS queries for ASN resources MUST use
     "dc=asn,dc=arpa" as the authoritative partition, and MUST use
     "cn=inetResources,dc=asn,dc=arpa" for the search base. It is
     expected that FIRS-compliant LDAP servers will be established to
     serve this directory partition, with these servers providing
     entry-specific referrals to registrar-specific servers.

  5.2.    Query Bootstrapping

     FIRS clients MUST use the targeted bootstrap model by default for
     ASN queries, using the "asn.arpa" zone as    LDAP Matching

     If the seed domain for server advertises the
     initial query.

     FIRS clients MAY use inetAsNumber object class and the top-down bootstrap model for queries if
     necessary or desirable. Due to
     inetAsNumberMatch matching filter in the lack of any public DNS
     delegation mapping service, there is no practical reason for inetResourcesControl
     server control, FIRS clients to MUST use the bottom-up model with ASN queries.

  5.3.    LDAP Matching

     FIRS clients MUST specify equalityMatch inetAsNumberMatch
     matching filters filter in LDAP searches for ASN contact entries.

     In order to ensure

     The inetAsNumberMatch filter provides an identifier and search
     string format which collectively inform a queried server that a
     specific ASN value should be searched for, and that all of the relevant entries are found
     (including any referrals), the search filters for these resources
     MUST specify the
     inetAsNumber object class and entries which match the cn attribute.
     For example, "(&(objectclass=inetAsNumber)(cn=65535))" with a
     search base of "cn=inetResources,dc=arin,dc=net" would find all of assertion value
     should be returned.

     The inetAsNumberMatch filter is defined as follows:

          inetAsNumberMatch
          ( 1.3.6.1.4.1.7161.1.7.0.1
             NAME 'inetAsNumberMatch'
             SYNTAX 1.3.6.1.4.1.7161.1.7.0 )

     Clients MUST ensure that the inetAsNumber object class query input is normalized according
     to the rules specified in section 3 before the input is used as
     the assertion value to the resulting LDAP query.

     A FIRS server MUST compare the assertion value against the
     distinguished name of all entries within and beneath the container
     specified by the search base of "cn=65535" the query. Any entry in that
     hierarchy with an object class of inetAsNumber and a distinguished
     name component that is equal to the
     "dc=arin,dc=net" partition. assertion value MUST be
     returned to the client (this specifically includes any child
     entries, such as referral stubs). Entries which do not have an
     object class of inetAsNumber MUST NOT be returned.

     The matching filters defined in this specification MUST be
     supported by FIRS clients and servers. FIRS servers MAY support

  Hall                   I-D Expires: March 2004              [page 7] 
     additional sub-string filters, soundex matching filters, or any other
     filters they wish (these may be required to support generic LDAP
     clients), although FIRS clients MUST NOT expect
     any additional filters to be available.

  Hall                  I-D Expires: February 2004             [page 7] 
  5.4.

     If the server does not advertise support for the inetAsNumberMatch
     matching filter in the inetResourcesControl server control, the
     client MAY choose to emulate the matching filter through the use
     of locally-constructed equalityMatch filters. However, this
     process can result in incomplete answers in some cases, so if the
     server advertises support for the inetAsNumberMatch matching
     filter in the inetResourcesControl control, the client MUST use
     it.

  5.3.    Example Query

     The following example assumes that the user has specified "65535"
     as the query value:

        a.  Normalize the input, which is "65535" in this case.

        b.  Determine the authoritative partition, which is always "
            dc=asn,dc=arpa" in the case of ASNs.

        c.  Determine the search base for the query, which is always
            "cn=inetResources,dc=asn,dc=arpa" in the case of ASNs.

        d.  Initiate a DNS lookup for the SRV resource records
            associated with "_ldap._tcp.asn.arpa." For the purpose of
            this example, assume that this lookup succeeds, with the
            DNS response message indicating that "firs.iana.org" is the
            preferred LDAP server.

        e.  Submit an LDAPv3 query to the specified server, using
            "(&(objectclass=inetAsNumber)(cn:dn:65535))"
            "(1.3.6.1.4.1.7161.1.7.0.1:=65535)" as the matching filter,
            "cn=inetResources,dc=asn,dc=arpa" as the search base, and
            the global query defaults defined in [FIRS-CORE].

        f.  Assume that the queried server returns a continuation
            reference referral which points to
            "ldap:///cn=inetResources,dc=arin,dc=net". The
            distinguished name element of
            "cn=inetResources,dc=arin,dc=net" will be used as the new
            search base, while "dc=arin,dc=net" will be used as the new
            authoritative partition.

        g.  Initiate a DNS lookup for the SRV resource records
            associated with "_ldap._tcp.arin.net." For the purpose of
            this example, assume that this lookup succeeds, with the
            DNS response message indicating that "firs.arin.net" is the
            preferred LDAP server.

        h.  Submit an LDAPv3 query to the specified server, using
            "(&(objectclass=inetAsNumber)(cn:dn:65535))" as the
            matching filter, "cn=inetResources,dc=arin,dc=net" as the
            search base, and the global query defaults defined in
            [FIRS-CORE].

  Hall                  I-D Expires: February 2004             [page 8] 
        i.  Assume that no other referrals are received. Display the answer
            data which has been received and exit the query.

  6.      Security Considerations

     Security considerations are discussed in [FIRS-ARCH].

  Hall                   I-D Expires: March 2004              [page 8] 
  7.      IANA Considerations

     ASNs are not currently represented in the global DNS, and there
     are no simple mechanisms for mapping ASNs to authoritative
     partitions using the public DNS. This specification uses the
     "asn.arpa" zone for this mapping function, with the expectation
     that this zone will be created by IANA. It is also expected that
     authoritative LDAP partitions will be mapped to that zone, and
     that FIRS-capable LDAP servers will be established to service this
     partition, with this partition containing ASN-specific entries
     which will provide referrals to the appropriate RIR partitions. It
     is further expected that IANA will oversee the creation and
     management of the asn.arpa domain's LDAP SRV resource records, the
     "dc=asn,dc=arpa" LDAP partition, and the necessary LDAP servers.

     The inetAsnDelegationStatus attribute uses numeric code values. It
     is expected that IANA will manage the assignment of these values.

     Additional IANA considerations are discussed in [FIRS-ARCH].

  8.      Normative References

          [RFC2247]     Kille, S., Wahl, M., Grimstad, A., Huber, R.,
                         and Sataluri, S. "Using Domains in LDAP/X.500
                         DNs", RFC 2247, January 1998.

          [RFC2251]     Wahl, M., Howes, T., and Kille, S.
                         "Lightweight Directory Access Protocol (v3)",
                         RFC 2251, December 1997.

          [RFC2252]     Wahl, M., Coulbeck, A., Howes, T., and Kille,
                         S. "Lightweight Directory Access Protocol
                         (v3): Attribute Syntax Definitions", RFC 2252,
                         December 1997.

          [RFC2254]     Howes, T. "The String Representation of LDAP
                         Search Filters", RFC 2254, December 1997.

  Hall                  I-D Expires: February 2004             [page 9]

          [FIRS-ARCH]   Hall, E. "The Federated Internet Registry
                         Service: Architecture and Implementation
                         Guide", draft-ietf-crisp-firs-arch-02, July
                         2003.

          [FIRS-ASN]    Hall, E. "Defining and Locating Autonomous
                         System Numbers in the Federated Internet
                         Registry Service", draft-ietf-crisp-firs-asn-
                         02, July draft-ietf-crisp-firs-arch-03, August
                         2003.

          [FIRS-CONTCT] Hall, E. "Defining and Locating Contact
                         Persons in the Federated Internet Registry
                         Service", draft-ietf-crisp-firs-contact-02,
                         July draft-ietf-crisp-firs-contact-03,
                         August 2003.

  Hall                   I-D Expires: March 2004              [page 9] 
          [FIRS-CORE]   Hall, E. "The Federated Internet Registry
                         Service: Core Elements", draft-ietf-crisp-
                         firs-core-02, July
                         firs-core-03, August 2003.

          [FIRS-DNS]    Hall, E. "Defining and Locating DNS Domains in
                         the Federated Internet Registry Service",
                         draft-ietf-crisp-firs-dns-02, July
                         draft-ietf-crisp-firs-dns-03, August 2003.

          [FIRS-DNSRR]  Hall, E. "Defining and Locating DNS Resource
                         Records in the Federated Internet Registry
                         Service", draft-ietf-crisp-firs-dnsrr-02, July
                         2003.

          [FIRS-IPV4]   Hall, E. "Defining and Locating IPv4 Address
                         Blocks in the Federated Internet Registry
                         Service", draft-ietf-crisp-firs-ipv4-02, July draft-ietf-crisp-firs-ipv4-03,
                         August 2003.

          [FIRS-IPV6]   Hall, E. "Defining and Locating IPv6 Address
                         Blocks in the Federated Internet Registry
                         Service", draft-ietf-crisp-firs-ipv6-02, July draft-ietf-crisp-firs-ipv6-03,
                         August 2003.

  9.      Changes from Previous Versions

     draft-ietf-crisp-firs-asn-03:

        *   Several clarifications and corrections have been made.

        *   The inetAsNumberMatch matching filter was defined. The use
            of equalityMatch and extensibleMatch has been deprecated.

     draft-ietf-crisp-firs-asn-02:

        *   Several clarifications and corrections have been made.

        *   Changed the default bootstrap model to use targeted
            queries, with "asn.arpa" as the default zone and
            "dc=asn,dc=arpa" as the default partition.

  Hall                  I-D Expires: February 2004            [page 10]

        *   Several attributes had their OIDs changed. NOTE THAT THIS
            IS AN INTERNET DRAFT, AND THAT THE OIDS ARE SUBJECT TO
            ADDITIONAL CHANGES AS THIS DOCUMENT IS EDITED.

     draft-ietf-crisp-firs-asn-01:

        *   Several clarifications and corrections have been made.

  Hall                   I-D Expires: March 2004             [page 10] 
     draft-ietf-crisp-firs-asn-00:

        *   Restructured the document set.

        *   "Attribute references" have been eliminated from the
            specification. All referential attributes now provide
            actual data instead of URL pointers to data. Clients that
            wish to retrieve these values will need to start new
            queries using the data values instead of URLs.

        *   The attribute-specific operational attributes have been
            eliminated as unnecessary.

        *   The inetAsnRegistrar and inetAsnRegistry attributes were
            added.

        *   Several attributes had their OIDs changed. NOTE THAT THIS
            IS AN INTERNET DRAFT, AND THAT THE OIDS ARE SUBJECT TO
            ADDITIONAL CHANGES AS THIS DOCUMENT IS EDITED.

        *   Several typographical errors have been fixed.

        *   Some unnecessary text has been removed.

  10.     Author's Address

     Eric A. Hall
     ehall@ehsco.com

  11.     Acknowledgments

     Funding for the RFC editor function is currently provided by the
     Internet Society.

     Portions of this document were funded by VeriSign Labs.

     The first version of this specification was co-authored by Andrew
     Newton of VeriSign Labs, and subsequent versions continue to be

  Hall                  I-D Expires: February 2004            [page 11]
     developed with his active participation. Edward Lewis also
     contributed significant feedback to this specification in the
     later stages of its developments.

  12.     Full Copyright Statement

     Copyright (C) The Internet Society (2003). All Rights Reserved.

  Hall                   I-D Expires: March 2004             [page 11] 
     This document and translations of it may be copied and furnished
     to others, and derivative works that comment on or otherwise
     explain it or assist in its implementation may be prepared,
     copied, published and distributed, in whole or in part, without
     restriction of any kind, provided that the above copyright notice
     and this paragraph are included on all such copies and derivative
     works. However, this document itself may not be modified in any
     way, such as by removing the copyright notice or references to the
     Internet Society or other Internet organizations, except as needed
     for the purpose of developing Internet standards in which case the
     procedures for copyrights defined in the Internet Standards
     process must be followed, or as required to translate it into
     languages other than English.

     The limited permissions granted above are perpetual and will not
     be revoked by the Internet Society or its successors or assigns.

     This document and the information contained herein is provided on
     an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET
     ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR
     IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
     THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
     WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

  Hall                   I-D Expires: February March 2004             [page 12]