udp fragmentation with pf/ipf
Hugo Koji Kobayashi
koji at registro.br
Thu May 17 22:19:40 UTC 2007
Hello,
While making some tests with fragmented udp DNS responses (with
EDNS0), we discovered a possible problem with ipf and pf in FreeBSD
6.2 and 7.0 (200705 snapshot).
Our test is a DNS query to an DNSSEC enabled server which replies with
a ~4KB udp response. We do this with the following dig command:
dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
ipf and pf in FreeBSD 6.2 or 7.0 block the fragments and the DNS
queries timeout. Disabling the firewall, complete replies are received
with no problem.
We've made the same tests with FreeBSD 4.11 with ipf and OpenBSD 4.1
with pf with no problems. You can see a summary of the tests below.
OS + fw dig result
fbsd4.11 + ipf OK
obsd4.1 + pf OK
fbsd6.2 OK
fbsd6.2 + ipf timeout
fbsd6.2 + pf timeout
fbsd7.0 OK
fbsd7.0 + ipf timeout
fbsd7.0 + pf timeout
Complete test results (including tcpdump output and firewall rule
sets) are attached.
Can somebody tell us if he hit a bug or if there is something we are
missing?
Thanks,
Hugo
-------------- next part --------------
###### FreeBSD 4.11 + ipfilter -> dig OK
fbsd4.11# uname -v
FreeBSD 4.11-RELEASE #0: Fri Jan 21 17:21:22 GMT 2005 root at perseus.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
fbsd4.11# ipf -V
ipf: IP Filter: v3.4.35 (336)
Kernel: IP Filter: v3.4.35
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 0
fbsd4.11# ipfstat -ion
@1 pass out log quick on bge0 proto udp from xxx.xxx.xxx.113/32 to any port = 53 keep state keep frags
@2 pass out quick on bge0 proto tcp/udp from xxx.xxx.xxx.113/32 to any keep state
@3 pass out quick on bge0 proto icmp from xxx.xxx.xxx.113/32 to any keep state
@4 pass out quick on lo0 from any to any
@5 block out log from any to any
@1 pass in quick on bge0 proto tcp from xxx.xxx.xxx.81/32 to xxx.xxx.xxx.113/32 port = 22 keep state
@2 pass in quick on lo0 from any to any
@3 block in log from any to any
fbsd4.11# tcpdump -i bge0 -np host 192.36.144.107
tcpdump: listening on bge0
09:46:16.546878 xxx.xxx.xxx.113.2897 > 192.36.144.107.53: 37118+ [1au] Type48? se. (31)
09:46:16.789319 192.36.144.107.53 > xxx.xxx.xxx.113.2897: 37118*- 8/10/24 Type48[|domain] (frag 8851:1480 at 0+)
09:46:16.789325 192.36.144.107 > xxx.xxx.xxx.113: udp (frag 8851:1480 at 1480+)
09:46:16.789331 192.36.144.107 > xxx.xxx.xxx.113: udp (frag 8851:1134 at 2960)
fbsd4.11# grep 192.36.144.107 /var/log/messages
May 17 09:46:16 fbsd4.11 ipmon[54]: 09:46:16.546867 bge0 @0:1 p xxx.xxx.xxx.113,2897 -> 192.36.144.107,53 PR udp len 20 59 K-S K-F OUT
May 17 09:46:16 fbsd4.11 ipmon[54]: 09:46:16.789339 bge0 @0:1 p 192.36.144.107,53 -> xxx.xxx.xxx.113,2897 PR udp len 20 1500 K-S K-F IN
May 17 09:46:16 fbsd4.11 ipmon[54]: 09:46:16.789347 bge0 @-1:-1 p 192.36.144.107 -> xxx.xxx.xxx.113 PR udp len 20 (1500) (frag 8851:1480 at 1480+) K-S K-F IN
May 17 09:46:16 fbsd4.11 ipmon[54]: 09:46:16.789353 bge0 @-1:-1 p 192.36.144.107 -> xxx.xxx.xxx.113 PR udp len 20 (1154) (frag 8851:1134 at 2960) K-S K-F IN
fbsd4.11# /usr/local/bin/dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; <<>> DiG 9.4.1 <<>> @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37118
;; flags: qr aa rd; QUERY: 1, ANSWER: 8, AUTHORITY: 10, ADDITIONAL: 24
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
[...]
;; Query time: 245 msec
;; SERVER: 192.36.144.107#53(192.36.144.107)
;; WHEN: Thu May 17 09:46:16 2007
;; MSG SIZE rcvd: 4086
###### FreeBSD 6.2 + no firewall -> dig OK
fbsd6.2# uname -v
FreeBSD 6.2-RELEASE #0: Fri Jan 12 11:05:30 UTC 2007 root at dessler.cse.buffalo.edu:/usr/obj/usr/src/sys/SMP
fbsd6.2# dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; <<>> DiG 9.3.3 <<>> @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7745
;; flags: qr aa rd; QUERY: 1, ANSWER: 8, AUTHORITY: 10, ADDITIONAL: 24
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;se. IN DNSKEY
[...]
;; Query time: 243 msec
;; SERVER: 192.36.144.107#53(192.36.144.107)
;; WHEN: Thu May 17 11:31:39 2007
;; MSG SIZE rcvd: 4086
###### FreeBSD 6.2 + pf -> dig timeout
fbsd6.2# uname -v
FreeBSD 6.2-RELEASE #0: Fri Jan 12 11:05:30 UTC 2007 root at dessler.cse.buffalo.edu:/usr/obj/usr/src/sys/SMP
fbsd6.2# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub in all fragment reassemble
block drop in log all
pass in on bge0 inet proto tcp from xxx.xxx.xxx.81 to xxx.xxx.xxx.87 port = ssh keep state
pass out on bge0 proto tcp all keep state
pass out on bge0 proto udp all keep state
pass out on bge0 proto icmp all keep state
fbsd6.2# tcpdump -i bge0 -np host 192.36.144.107
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bge0, link-type EN10MB (Ethernet), capture size 96 bytes
11:06:34.589076 IP xxx.xxx.xxx.87.58606 > 192.36.144.107.53: 24422+ [1au] Type48? se. (31)
11:06:34.831367 IP 192.36.144.107.53 > xxx.xxx.xxx.87.58606: 24422*- 8/10/24 Type48[|domain]
11:06:34.831372 IP 192.36.144.107 > xxx.xxx.xxx.87: udp
11:06:34.831524 IP 192.36.144.107 > xxx.xxx.xxx.87: udp
fbsd6.2# dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; <<>> DiG 9.3.3 <<>> @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; (1 server found)
;; global options: printcmd
;; connection timed out; no servers could be reached
###### FreeBSD 6.2 + ipfilter -> dig timeout
fbsd6.2# uname -v
FreeBSD 6.2-RELEASE #0: Fri Jan 12 11:05:30 UTC 2007 root at dessler.cse.buffalo.edu:/usr/obj/usr/src/sys/SMP
fbsd6.2# ipf -V
ipf: IP Filter: v4.1.13 (416)
Kernel: IP Filter: v4.1.13
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 0
Feature mask: 0x10f
fbsd6.2# ipfstat -ion
@1 pass out log quick on bge0 proto udp from xxx.xxx.xxx.87/32 to any port = domain keep state keep frags
@2 pass out quick on bge0 proto tcp/udp from xxx.xxx.xxx.87/32 to any keep state
@3 pass out quick on bge0 proto icmp from xxx.xxx.xxx.87/32 to any keep state
@4 pass out quick on lo0 from any to any
@5 block out log all
@1 pass in quick on bge0 proto tcp from xxx.xxx.xxx.81/32 to xxx.xxx.xxx.87/32 port = ssh keep state
@2 pass in quick on lo0 from any to any
@3 block in log all
fbsd6.2# tcpdump -i bge0 -np host 192.36.144.107
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bge0, link-type EN10MB (Ethernet), capture size 96 bytes
11:11:39.724241 IP xxx.xxx.xxx.87.63499 > 192.36.144.107.53: 2906+ [1au] Type48? se. (31)
11:11:39.966378 IP 192.36.144.107.53 > xxx.xxx.xxx.87.63499: 2906*- 8/10/24 Type48[|domain]
11:11:39.966534 IP 192.36.144.107 > xxx.xxx.xxx.87: udp
11:11:39.966692 IP 192.36.144.107 > xxx.xxx.xxx.87: udp
fbsd6.2# grep 192.36.144.107 /var/log/messages
May 17 11:11:40 fbsd6.2 ipmon[1140]: 11:11:39.724232 bge0 @0:1 p xxx.xxx.xxx.87,63499 -> 192.36.144.107,53 PR udp len 20 59 K-S K-F OUT
May 17 11:11:40 fbsd6.2 ipmon[1140]: 11:11:39.966389 bge0 @0:3 b 192.36.144.107,53 -> xxx.xxx.xxx.87,63499 PR udp len 20 1500 IN bad
May 17 11:11:40 fbsd6.2 ipmon[1140]: 11:11:39.966544 bge0 @0:3 b 192.36.144.107 -> xxx.xxx.xxx.87 PR udp len 20 (1500) (frag 20089:1480 at 1480+) IN bad
May 17 11:11:40 fbsd6.2 ipmon[1140]: 11:11:39.966699 bge0 @0:3 b 192.36.144.107 -> xxx.xxx.xxx.87 PR udp len 20 (1154) (frag 20089:1134 at 2960) IN bad
fbsd6.2# dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; <<>> DiG 9.3.3 <<>> @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; (1 server found)
;; global options: printcmd
;; connection timed out; no servers could be reached
###### FreeBSD 7.0 + no firewall -> dig OK
fbsd7# uname -v
FreeBSD 7.0-CURRENT-200705 #0: Mon May 7 11:24:25 UTC 2007 root at almeida.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
fbsd7# dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; <<>> DiG 9.3.4 <<>> @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11647
;; flags: qr aa rd; QUERY: 1, ANSWER: 8, AUTHORITY: 10, ADDITIONAL: 24
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;se. IN DNSKEY
[...]
;; Query time: 243 msec
;; SERVER: 192.36.144.107#53(192.36.144.107)
;; WHEN: Mon May 7 12:29:14 2007
;; MSG SIZE rcvd: 4086
###### FreeBSD 7.0 + pf -> dig timeout
fbsd7# uname -v
FreeBSD 7.0-CURRENT-200705 #0: Mon May 7 11:24:25 UTC 2007 root at almeida.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
fbsd7# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub in all fragment reassemble
block drop in log all
pass in on bge0 inet proto tcp from xxx.xxx.xxx..81 to xxx.xxx.xxx..113 port = ssh keep state
pass out on bge0 proto tcp all keep state
pass out on bge0 proto udp all keep state
pass out on bge0 proto icmp all keep state
fbsd7# tcpdump -i bge0 -np host 192.36.144.107
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bge0, link-type EN10MB (Ethernet), capture size 96 bytes
12:39:25.631167 IP xxx.xxx.xxx..113.52250 > 192.36.144.107.53: 25549+ [1au] Type48? se. (31)
12:39:25.873610 IP 192.36.144.107.53 > xxx.xxx.xxx..113.52250: 25549*- 8/10/24 Type48[|domain]
12:39:25.873624 IP 192.36.144.107 > xxx.xxx.xxx..113: udp
12:39:25.873632 IP 192.36.144.107 > xxx.xxx.xxx..113: udp
fbsd7# dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; <<>> DiG 9.3.4 <<>> @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; (1 server found)
;; global options: printcmd
;; connection timed out; no servers could be reached
###### FreeBSD 7.0 + ipfilter -> dig timeout
fbsd7# uname -v
FreeBSD 7.0-CURRENT-200705 #0: Mon May 7 11:24:25 UTC 2007 root at almeida.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
fbsd7# ipf -V
ipf: IP Filter: v4.1.13 (404)
Kernel: IP Filter: v4.1.13
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 0
Feature mask: 0x10f
fbsd7# ipfstat -ion
@1 pass out log quick on bge0 proto udp from xxx.xxx.xxx..113/32 to any port = domain keep state keep frags
@2 pass out quick on bge0 proto tcp/udp from xxx.xxx.xxx..113/32 to any keep state
@3 pass out quick on bge0 proto icmp from xxx.xxx.xxx..113/32 to any keep state
@4 pass out quick on lo0 from any to any
@5 block out log from any to any
@1 pass in quick on bge0 proto tcp from xxx.xxx.xxx..81/32 to xxx.xxx.xxx..113/32 port = ssh keep state
@2 pass in quick on lo0 from any to any
@3 block in log from any to any
fbsd7# tcpdump -i bge0 -np host 192.36.144.107
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bge0, link-type EN10MB (Ethernet), capture size 96 bytes
12:26:47.020355 IP xxx.xxx.xxx..113.61181 > 192.36.144.107.53: 31400+ [1au] Type48? se. (31)
12:26:47.263165 IP 192.36.144.107.53 > xxx.xxx.xxx..113.61181: 31400*- 8/10/24 Type48[|domain]
12:26:47.263189 IP 192.36.144.107 > xxx.xxx.xxx..113: udp
12:26:47.263210 IP 192.36.144.107 > xxx.xxx.xxx..113: udp
fbsd7# grep 192.36.144.107 /var/log/messages
May 7 12:26:47 fbsd7 ipmon[756]: 12:26:47.020339 bge0 @0:1 p xxx.xxx.xxx..113,61181 -> 192.36.144.107,53 PR udp len 20 59 K-S K-F OUT
May 7 12:26:47 fbsd7 ipmon[756]: 12:26:47.263177 bge0 @0:3 b 192.36.144.107,53 -> xxx.xxx.xxx..113,61181 PR udp len 20 1500 IN bad
May 7 12:26:47 fbsd7 ipmon[756]: 12:26:47.263199 bge0 @0:3 b 192.36.144.107 -> xxx.xxx.xxx..113 PR udp len 20 (1500) (frag 30879:1480 at 1480+) IN bad
May 7 12:26:47 fbsd7 ipmon[756]: 12:26:47.263218 bge0 @0:3 b 192.36.144.107 -> xxx.xxx.xxx..113 PR udp len 20 (1154) (frag 30879:1134 at 2960) IN bad
fbsd7# dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; <<>> DiG 9.3.4 <<>> @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; (1 server found)
;; global options: printcmd
;; connection timed out; no servers could be reached
###### OpenBSD 4.1 + pf -> dig OK
obsd4.1# uname -svmr
OpenBSD 4.1 GENERIC#1435 i386
obsd4.1# pfctl -sr
scrub in all fragment reassemble
block drop in log all
pass in log on bge0 inet proto tcp from xxx.xxx.xxx..81 to xxx.xxx.xxx.87 port = ssh flags S/SA keep state
pass out on bge0 proto tcp all flags S/SA keep state
pass out on bge0 proto udp all keep state
pass out on bge0 proto icmp all keep state
obsd4.1# tcpdump -i bge0 -np host 192.36.144.107
tcpdump: listening on bge0, link-type EN10MB
17:29:31.204819 xxx.xxx.xxx.87.14024 > 192.36.144.107.53: 45447+ [1au] DNSKEY? se. (31)
17:29:31.446947 192.36.144.107.53 > xxx.xxx.xxx.87.14024: 45447*- 8/10/24 DNSKEY[|domain] (frag 1171:1480 at 0+)
17:29:31.447104 192.36.144.107 > xxx.xxx.xxx.87: (frag 1171:1480 at 1480+)
17:29:31.447107 192.36.144.107 > xxx.xxx.xxx.87: (frag 1171:1134 at 2960)
obsd4.1# dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; <<>> DiG 9.3.4 <<>> @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45447
;; flags: qr aa rd; QUERY: 1, ANSWER: 8, AUTHORITY: 10, ADDITIONAL: 24
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;se. IN DNSKEY
[...]
;; Query time: 244 msec
;; SERVER: 192.36.144.107#53(192.36.144.107)
;; WHEN: Thu May 17 17:29:31 2007
;; MSG SIZE rcvd: 4086
##### Expected result. (Answers above are truncated in favor of readability)
# dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; <<>> DiG 9.3.4 <<>> @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50574
;; flags: qr aa rd; QUERY: 1, ANSWER: 8, AUTHORITY: 10, ADDITIONAL: 24
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;se. IN DNSKEY
;; ANSWER SECTION:
se. 3600 IN DNSKEY 256 3 5 AQPbQk0WNRr2jofL3FJKSR8VJ2i8hsXUC2vp4L9pq86ca63+SwD7mll0 8jYfYY2fsn5jhPxyRY1Xva7Kwhp35o1NXyHBBcBmBkV3r2BGS9c62YzS jyv/RI4yHgs+03NVsqlNaMz9Cw34ov04K65s45ZSJ0fFg05VVVCgCUli 3h6hJQ==
se. 3600 IN DNSKEY 256 3 5 AwEAAbhCVInOCVKWoaeWFmCHfO0SW4MAEWiM2MrbR6q1fclgAa04Lkqu c2Lp1xQ1ssO7rDYDLf8Uhe6EU6Xs56mRS5ZhHGiWwozrY4duxyAaYQUo d6LuH0u5Q0VRUs5Yv5hh9YvVxR1iclbQleg6NDVVeMQU4lFWOnHbP6Md 2SNWptVV
se. 3600 IN DNSKEY 256 3 5 AwEAAc3n4vV7f6TbRjSpfADcIBn+MDqzuFUo+s3b85wC8Tp+d1EDlLPF /5GIR4Y3P+8u1OpPKuCCzurvfics/HiGQU3Jkv3wlFP5cZLBSpCiwazY 253uJwXpItS+liP6AK+kOOwsEWTYxG6vvBodm/ASTbqs2FqokFTPLW74 lTOp51a5
se. 3600 IN DNSKEY 257 3 5 AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe3Y 9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbbOTcM 8pwXlj0EiX3oDFVmjHO444gLkBOUKUf/mC7HvfwYH/Be22GnClrinKJp 1Og4ywzO9WglMk7jbfW33gUKvirTHr25GL7STQUzBb5Usxt8lgnyTUHs 1t3JwCY5hKZ6CqFxmAVZP20igTixin/1LcrgX/KMEGd/buvF4qJCydui eHukuY3H4XMAcR+xia2nIUPvm/oyWR8BW/hWdzOvnSCThlHf3xiYleDb t/o1OTQ09A0=
se. 3600 IN DNSKEY 257 3 5 AwEAAb6xRZHEf+PyF5dxEvz0BHEHbziu6iZaiNW/yjSaZcmrmZiRMF8F PppD+XuKSau0rgu4eBwYdpkEoMVR4FhI8frkuPHIue2LP1ETo+2hCrdr 60K1538yLvzbOhMxXt6knjPN+OlalMmCknadaofKga5FLKOPQs2C3nw6 AH4WUNGrchmDMVBwRwfZdQXYZTXesqULmGMK7mwjQGOxerRDQWrFv8Nh NnVV31PihaYBdQ1TJjvfGS/FYZJwv/BddiELiLeUnNWu3AOsRAshgOcD BOAPUvKJNEq6RHELFmvXOOe2d8H2yzv02EMQik6GwUm16DrSdmX+SWfe lQs+9ELFN6k=
se. 3600 IN RRSIG DNSKEY 5 1 3600 20070522215824 20070517140614 23025 se. KyJc0iw4+ZV8msUBcYd9F2NtqEI7bzeLyea3Ko2kbhH3vq15uP3YXF29 9zZakYC44h1I9eOnv099sQPVJ8GzRwFO/5/sq9VBwz3XCtERy3QnITRE Zwtzpd1/FN++oY3eCy2X20/uyOJLpYPtm8XVuJCFlr0J63OjlzV1WV7U ufs=
se. 3600 IN RRSIG DNSKEY 5 1 3600 20070614000000 20070503074224 6166 se. nQpV0GvBMXC347NLpCqTvzCRIQeDJkVB2q//gHQu52syHUYraVfGLYNZ AUO5T7Aj2bBEkeg5BQvc940arfNaQjMAigXU2hnOYVqOEMZ7lvU/tjEQ xRt44NehAbRwv0hf3oUsRd/3VQPVe6gc96DFK5x+/R0c8h9M9ZpRTLjj rZtqRHJXuX5sEe/M+zxO+9h+tRMGTPuMHHnyb5cIHpGBly6Z6kUvdlIY NOlqpjUclFApxC1oqcU8Tdq/CWOI8k+QcsavowPn/EvczLiXnLL0l0Qw Q9ZZ0A867G2vVBXlb6O3oq4EYwxt+nJgIsxAkHRteQ8+F/hXcPAjgYDI R+kCeg==
se. 3600 IN RRSIG DNSKEY 5 1 3600 20070614000000 20070503074224 17686 se. KbRtzleVEliDjkQkVyRlwxPKKnOG+6K/wzafH3le8Hja9i97WEdVwU2g AlovnvcropRN5Cojf0MoYVNOKfJPFoQqJ+eLL/oZrCauQcdp9E/XPfvV 0XvZsO7Hft5vFQ2SrCAo2QBvKXGAvf6DY8wV6I0ioeT4Oayce1/eVtXu 8mej1rEz+dAzj2kyVsSuhfrnL+P5q19/1PtlUC1N3xowdrRk1vL1MLOp qhiFSMSyGGM4hhi1YPd3KK7hoL9wrQYghdaFp6ritgXxJ4TLPQP8zZY7 A6C65BziyqZ3Jcwga69dLDqbLLmhcMgDCc9jCEhLSSDi1NUc6BJRIg99 4CLJqg==
;; AUTHORITY SECTION:
se. 172800 IN NS i.ns.se.
se. 172800 IN NS a.ns.se.
se. 172800 IN NS b.ns.se.
se. 172800 IN NS c.ns.se.
se. 172800 IN NS d.ns.se.
se. 172800 IN NS e.ns.se.
se. 172800 IN NS f.ns.se.
se. 172800 IN NS g.ns.se.
se. 172800 IN NS h.ns.se.
se. 172800 IN RRSIG NS 5 1 172800 20070523092930 20070517200614 23025 se. jiOTilNoYSbMOwDUhcKQMZtar1eCGrPtkLYoTsENKLW7IVYu8JMt4VyG 5lCNmk7T3ltTSPsohC/v3XU1geCMiyTcDc62FmTM6Th7QVcGWHMtJk/Z Aj/3DkcnqsciRGmlC5SLUHK7wIqSOk0R4O8Blb40gQUkjwBJQWTuQ20P ZWM=
;; ADDITIONAL SECTION:
a.ns.se. 172800 IN A 192.36.144.107
a.ns.se. 172800 IN AAAA 2001:698:9:301::53
b.ns.se. 172800 IN A 192.36.133.107
c.ns.se. 172800 IN A 192.36.135.107
d.ns.se. 172800 IN A 81.228.8.16
e.ns.se. 172800 IN A 81.228.10.57
f.ns.se. 172800 IN A 192.71.53.53
f.ns.se. 172800 IN AAAA 2a01:280:1:53::53
g.ns.se. 172800 IN A 130.239.5.114
g.ns.se. 172800 IN AAAA 2001:6b0:e:3::1
h.ns.se. 172800 IN A 199.7.49.30
i.ns.se. 172800 IN A 194.146.106.22
a.ns.se. 172800 IN RRSIG A 5 3 172800 20070523041526 20070517200614 23025 se. CWkUdq3WG2fWZ2eX9FtPTeG15ky8J+l416flxzI/Iq+KxOfpiyHWJReT xaKO9TUkI9oaIqWLApwuH36njKMXXwzMKG3ffsrvaHr+u7+02dGTOMMs yLrC8nUoX6SF28hKtMY7ZKyyNXzTA8s0KQXCfvL5vDlhg+xSy+SIo9aN PwQ=
a.ns.se. 172800 IN RRSIG AAAA 5 3 172800 20070524122023 20070517200614 23025 se. NAHToPOR0c7Nc+bAbCl78ZmkM3137HvS/SRQFVcNhcby1pF0nZiu651B nVBG5HmTytvR3qWeJ+bjyRCbnC0418/KDaPDKHiAxeKkwBTBDEV9kgZG EGkqusMqGlAP9YmWJUQwTOQfWJ3LsjbgGURIYPSgNwMl13O3X0nZFKs4 mKY=
b.ns.se. 172800 IN RRSIG A 5 3 172800 20070523055447 20070517200614 23025 se. Y039PEs+5f0zYOT8w5gPm+e9BaEfdxTCRXyvGGujgGrVRck8/RN1E+hF Xz7TbfywM3NiSYUuOcx5CefKC5Iztt2TqW2fJ8vs3Doy8vHO8DdSbSNx tNC6A7Fnoc4qNOGj8xcT9yVRCa150LhsVV/Cl2NSH13U5Uuihdg/Uhrt lMc=
c.ns.se. 172800 IN RRSIG A 5 3 172800 20070524135553 20070517200614 23025 se. g+aWnXys/U5Kg/Cbngp3zVkUKItbByZc9yW8/kn0k7I7u4VM1U3xss/S yrkD9fJgFZ1tiWjLNbbMNQf2h3DwFMMouWK7ZoQtmS57GvzSYymHd2IC CUMNb9VQDwnt7Hs/2F4veTwSUft56K5stZYnymjtjjQmJn+K5K3v+bjq A0I=
d.ns.se. 172800 IN RRSIG A 5 3 172800 20070524024155 20070517200614 23025 se. g2sitUYy/V9FYC18Ql7cYrx1Tdk5omte6dKASwCSx3ZTlkEtoLVFFX2f PU+59Fa9SN1yUVLNH5IHjQKCSoSMmDmaIfer5LMy6sjqEMQiC7zMyJuk +23E517p1bNKpt91YRFINmGE3n4Zl0RX4YWLs++SxkEGeSj3vKboj1UA oqM=
e.ns.se. 172800 IN RRSIG A 5 3 172800 20070523194606 20070517200614 23025 se. wB/kpKq0R0QI5XDztERu51XMp2Eo3DVgph6QJs+vbrvWBU5idIUOTxly KL5BiNYxngd8CyyFUEKmC/lQy04OewoD1Dk/fecE6CXL3NhXNAo92rj8 DvJyZTB0NLVvVtNb/ZDvIBHlnp+xuwba/r3wGlinHDGf6SeYPoo8JO2w nXY=
f.ns.se. 172800 IN RRSIG A 5 3 172800 20070524065721 20070517200614 23025 se. Uku3n96Jr8mjAEQHDs7aoIeplXQCq8uiLABm6eErjchIgaDBgSuBa9HX JLpA+meeCy2W72WYD4Ywv603mPRj/JjhpB0/MF4m84C2MfQnloDaCWRT x4VknE8kuRVK6I5mxepcqsC1TulcyxtvWv5tWyY8HD+L4HomM6d5Cugq H5E=
f.ns.se. 172800 IN RRSIG AAAA 5 3 172800 20070523024116 20070517200614 23025 se. IcFNk7a7/pw8kha9LQGqDJG0wBXeGk4AuHMNwWUqJtkfKDFm/M6xACgW 8bubKgHs7K0HEqhLrrWTYRueUVh/w+Fy9BvOXQwX4h+SMxWTeTtmPxug ZESOOqf0C0Zs+Oa8UJvlHGwhsg3rt0qAUDGZQiQGwY3lpYCxCFY/5sM3 XSo=
g.ns.se. 172800 IN RRSIG A 5 3 172800 20070524113105 20070517200614 23025 se. xras7HnqqbohuAM85kzwV8WzGCqXhF2ZWI4y1omWz7SQ1sXKiAMiM1zU mv6xk4F4NVuOakDaPc/b03TEQAhnVDZzRrzmo0ZdfYzP3kxI1NTkYUmC O2Qyv+7FqnRCrLzK94TeTArbKHXBYE+36K5b8htckG/LeBjRZTHIso7X LBk=
g.ns.se. 172800 IN RRSIG AAAA 5 3 172800 20070523151643 20070517200614 23025 se. miTXV/aUVUsvuFPIvsmuRoJ0HYiCnMpjkRJl+cpGZ+Te0bnhmikJVAx2 nuMqcjuJvZPiShTWr68wrFN0TnCfUltsdNWIawSKuisszzHj3fHFUFfw ZBbmSr/0zWU8NF8M5IU2PJ8tL2Kohk6W3/ZORjQaAaMoiuOb+VFulgPP Nn8=
h.ns.se. 172800 IN RRSIG A 5 3 172800 20070523091232 20070517200614 23025 se. ifwY6aYVRtO+zqHO3aYEWP3tiFT3hig9wkPmbCu+k2nYOE9pxjka+zSh vMU/4qpzlT2Z/aDNmBq/wSzXYEzvUjXi06KtHsS1NVEwSamE6l0NU0Bq TblxJQ0u/zPLOmES8Sj25a4qPGRG5T+SEzLJg65BRFjVrlXBgUuebv3L CjQ=
;; Query time: 245 msec
;; SERVER: 192.36.144.107#53(192.36.144.107)
;; WHEN: Thu May 17 18:37:24 2007
;; MSG SIZE rcvd: 4086
More information about the freebsd-stable
mailing list