Re: [Add] I-D Action: draft-ietf-add-resolver-info-05.txt

[tirumal reddy <[e-mail]>]

On Tue, 3 Oct 2023 at 06:16, Martin Thomson <[e-mail]> wrote:

> Why is this not a TLV format?  It seems like this would be easier to
> process if that were the case.  And smaller.  I'm not clear on what the
> authoring constraints would be though.
>

It was discussed in the WG to use the DNS-SD key=value syntax (see
https://mailarchive.ietf.org/arch/msg/add/snYQotT2CMV-NiTXAQIGCkwyo3s/ for
details).


>
> A set of supported features (f=err,qmin) might be more extensible.  Do you
> really need to list all of the extended error codes?  Or can a client test
> for those once the resolver indicates support for the feature?  (Just
> saying, but an empirical test seems better than something that might bitrot
> like this.)
>

The client may not be able to test all of the features claimed by the
server.


> I found the thread of reasoning leading to `sig` processing hard to
> follow.  "the certificate" is offered in one case without substantiation,
> which is odd if you consider retrieving this RR over an unsecured
> transport.  The tie to DDR is also a little too indirect (I found it in
> security considerations, but it wasn't very straightforward.)
>
> Initially, I was thinking DNSSEC might make `sig` redundant.  That's
> obviously not an option with resolver.arpa, but maybe you could explain
> that for casual readers.  Does `sig` make sense if you do have DNSSEC?
>

No, If DNSSEC validation can be performed, "sig" is not required. "sig" is
mandatory with "resolver.arpa". We will update the draft for better clarity.

-Tiru

>
> On Tue, Oct 3, 2023, at 11:10, Tommy Jensen wrote:
> > Bringing this back up to the WG as I'm sure the ongoing DNR discussion
> > has pushed this to the back of your minds. The updated draft introduces
> > a net new mechanism to provide some security promises for discovering
> > resolver info when the resolver was DDR-discovered (and therefore the
> > client does not know a server domain name it can trust, only an IP
> > address).
> >
> > Ben, MT, Ralf: I know you've all previously given feedback on DDR and
> > EDSR for SVCB-reliant mechanisms; even if it's just "LGTM", I'd love to
> > hear your thoughts.
> >
> > Thanks,
> > Tommy
> >
> >> -----Original Message-----
> >> From: Add <[e-mail]> On Behalf Of Tommy Jensen
> >> Sent: Wednesday, September 20, 2023 11:51 AM
> >> To: [e-mail]; [e-mail]
> >> Subject: [EXTERNAL] Re: [Add] I-D Action:
> draft-ietf-add-resolver-info-05.txt
> >>
> >> Thank you Med and Tiru for all your work reacting to the shepherd
> review.
> >>
> >> I agree that this is ready to move forward as well. The new text
> addresses the
> >> same style of attack that came up during WG review of EDSR (accidental
> >> resolver.arpa query passthrough) without using the name of the resolver
> (which
> >> in this case would rescind DDR's security model where the name in the
> SVCB
> >> record cannot be trusted).
> >>
> >> Thanks,
> >> Tommy
> >>
> >> > -----Original Message-----
> >> > From: Add <[e-mail]> On Behalf Of
> >> > [e-mail]
> >> > Sent: Wednesday, September 20, 2023 11:45 AM
> >> > To: [e-mail]
> >> > Subject: [EXTERNAL] Re: [Add] I-D Action:
> >> > draft-ietf-add-resolver-info-05.txt
> >> >
> >> > Hi all,
> >> >
> >> > This version addresses a pending comment from Tommy J. about the
> >> > validation of the sig attribute.
> >> >
> >> > We think that this version is now ready to move forward.
> >> >
> >> > Cheers,
> >> > Med
> >> >
> >> > > -----Message d'origine-----
> >> > > De : I-D-Announce <[e-mail]> De la part de
> >> > > [e-mail] Envoyé : mercredi 20 septembre 2023 20:41
> À :
> >> > > [e-mail] Cc : [e-mail] Objet : I-D Action:
> >> > > draft-ietf-add-resolver-info-05.txt
> >> > >
> >> > > Internet-Draft draft-ietf-add-resolver-info-05.txt is now available.
> >> > > It is a work item of the Adaptive DNS Discovery (ADD) WG of the
> IETF.
> >> > >
> >> > >    Title:   DNS Resolver Information
> >> > >    Authors: Tirumaleswar Reddy
> >> > >             Mohamed Boucadair
> >> > >    Name:    draft-ietf-add-resolver-info-05.txt
> >> > >    Pages:   10
> >> > >    Dates:   2023-09-20
> >> > >
> >> > > Abstract:
> >> > >
> >> > >    This document specifies a method for DNS resolvers to publish
> >> > >    information about themselves.  DNS clients can use the resolver
> >> > >    information to identify the capabilities of DNS resolvers.  How
> >> > > such
> >> > >    an information is then used by DNS clients is out of the scope of
> >> > > the
> >> > >    document.
> >> > >
> >> > > The IETF datatracker status page for this Internet-Draft is:
> >> > > https://data/
> >> > >
> >> >
> >> %2F&data=05%7C01%7CJensen.Thomas%40microsoft.com%7Ccba009a5b6804
> >> > a0921e
> >> > >
> >> >
> >> 908dbba0a062d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C6383
> >> > 0832453
> >> > >
> >> >
> >> 4373512%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2l
> >> > uMzIiLC
> >> > >
> >> >
> >> JBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=zL%2BnoychfW
> >> > NMLUTVQ
> >> > > XntT7AjrSxAXNZhU0tEptjQWsU%3D&reserved=0
> >> > > tracker.ietf.org%2Fdoc%2Fdraft-ietf-add-resolver-
> >> > >
> >> >
> >> info%2F&data=05%7C01%7Cmohamed.boucadair%40orange.com%7C45e2c0a3
> >> > e74f4e
> >> > >
> >> >
> >> 3c7f2e08dbba09430b%7C90c7a20af34b40bfbc48b9253b6f5d20%7C0%7C0%7
> >> > C638308
> >> > >
> >> >
> >> 321157858283%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQ
> >> > IjoiV2luM
> >> > >
> >> >
> >> zIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=plCaudvjw
> >> > YHzyt
> >> > > S%2Fn238AFkMmy6V5Ne%2BEoFPLdf6mzU%3D&reserved=0
> >> > >
> >> > > There is also an HTML version available at:
> >> > >
> >> >
> >>
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww%25
> >> > 252
> >> >
> >> F&data=05%7C01%7CJensen.Thomas%40microsoft.com%7Ccba009a5b6804a0
> >> >
> >> 921e908dbba0a062d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C
> >> >
> >> 638308324534373512%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwM
> >> >
> >> DAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C
> >> >
> >> &sdata=h5X6EhE79M9zeAn2Jiu3Yb3QuuRWUKG0gRCUUoBN1W4%3D&reserve
> >> > d=0.
> >> > > ietf.org%2Farchive%2Fid%2Fdraft-ietf-add-resolver-info-
> >> > >
> >> >
> >> 05.html&data=05%7C01%7Cmohamed.boucadair%40orange.com%7C45e2c0a3
> >> > e74f4e
> >> > >
> >> >
> >> 3c7f2e08dbba09430b%7C90c7a20af34b40bfbc48b9253b6f5d20%7C0%7C0%7
> >> > C638308
> >> > >
> >> >
> >> 321157858283%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQ
> >> > IjoiV2luM
> >> > >
> >> >
> >> zIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=XU5JrEgrd
> >> > bd2Iz
> >> > > YxLVzHqIDo27VXkk4d3S96q%2FEk0KI%3D&reserved=0
> >> > >
> >> > > A diff from the previous version is available at:
> >> > > https://auth/
> >> > >
> >> >
> >> %2F&data=05%7C01%7CJensen.Thomas%40microsoft.com%7Ccba009a5b6804
> >> > a0921e
> >> > >
> >> >
> >> 908dbba0a062d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C6383
> >> > 0832453
> >> > >
> >> >
> >> 4373512%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2l
> >> > uMzIiLC
> >> > >
> >> >
> >> JBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=XEIhRifnfFimva
> >> > YDcuI
> >> > > f%2FFaVD3qlz80M%2Bx59v3bX6Cs%3D&reserved=0
> >> > > or-tools.ietf.org%2Fiddiff%3Furl2%3Ddraft-ietf-add-resolver-info-
> >> > >
> >> >
> >> 05&data=05%7C01%7Cmohamed.boucadair%40orange.com%7C45e2c0a3e74f
> >> > 4e3c7f2
> >> > >
> >> >
> >> e08dbba09430b%7C90c7a20af34b40bfbc48b9253b6f5d20%7C0%7C0%7C638
> >> > 30832115
> >> > >
> >> >
> >> 7858283%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2l
> >> > uMzIiLC
> >> > >
> >> >
> >> JBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=D%2FN6uIOnv
> >> > N34VjB%2
> >> > > Br09Fh71czxAtRCXxixE1KsKELok%3D&reserved=0
> >> > >
> >> > > Internet-Drafts are also available by rsync at:
> >> > > rsync.ietf.org::internet-drafts
> >> > >
> >> > >
> >> > > _______________________________________________
> >> > > I-D-Announce mailing list
> >> > > [e-mail]
> >> > >
> >> >
> >>
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww%25
> >> > 252
> >> >
> >> F&data=05%7C01%7CJensen.Thomas%40microsoft.com%7Ccba009a5b6804a0
> >> >
> >> 921e908dbba0a062d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C
> >> >
> >> 638308324534373512%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwM
> >> >
> >> DAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C
> >> >
> >> &sdata=h5X6EhE79M9zeAn2Jiu3Yb3QuuRWUKG0gRCUUoBN1W4%3D&reserve
> >> > d=0.
> >> > > ietf.org%2Fmailman%2Flistinfo%2Fi-d-
> >> > >
> >> >
> >> announce&data=05%7C01%7Cmohamed.boucadair%40orange.com%7C45e2c0
> >> > a3e74f4
> >> > >
> >> >
> >> e3c7f2e08dbba09430b%7C90c7a20af34b40bfbc48b9253b6f5d20%7C0%7C0%
> >> > 7C63830
> >> > >
> >> >
> >> 8321157858283%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJ
> >> > QIjoiV2lu
> >> > >
> >> >
> >> MzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=4JfYq52t
> >> > 9E1z3
> >> > > 3%2FYDpoeXRDKcn515RofR9dVYPaRrBY%3D&reserved=0
> >> >
> >> >
> >> ___________________________________________________________________
> >> > _________________________________________
> >> > Ce message et ses pieces jointes peuvent contenir des informations
> >> > confidentielles ou privilegiees et ne doivent donc pas etre diffuses,
> >> > exploites ou copies sans autorisation. Si vous avez recu ce message
> >> > par erreur, veuillez le signaler a l'expediteur et le detruire ainsi
> >> > que les pieces jointes. Les messages electroniques etant susceptibles
> >> > d'alteration, Orange decline toute responsabilite si ce message a ete
> altere,
> >> deforme ou falsifie. Merci.
> >> >
> >> > This message and its attachments may contain confidential or
> >> > privileged information that may be protected by law; they should not
> >> > be distributed, used or copied without authorisation.
> >> > If you have received this email in error, please notify the sender and
> >> > delete this message and its attachments.
> >> > As emails may be altered, Orange is not liable for messages that have
> >> > been modified, changed or falsified.
> >> > Thank you.
> >> >
> >> > --
> >> > Add mailing list
> >> > [e-mail]
> >> > https://www/.
> >> >
> >> ie%2F&data=05%7C01%7CJensen.Thomas%40microsoft.com%7C1fda2605f5e9
> >> 44c3b
> >> >
> >> 44408dbba0a913d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63
> >> 8308326
> >> >
> >> 815341382%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoi
> >> V2luMzIi
> >> >
> >> LCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=oQa9vGcBo
> >> Qa7mOCvv
> >> > ceWepWopMWRQ654EU1uJS%2B37Qg%3D&reserved=0
> >> >
> >> tf.org%2Fmailman%2Flistinfo%2Fadd&data=05%7C01%7CJensen.Thomas%40mi
> >> >
> >> crosoft.com%7Ccba009a5b6804a0921e908dbba0a062d%7C72f988bf86f141af
> >> > 91ab2d7cd011db47%7C1%7C0%7C638308324534373512%7CUnknown%7CT
> >> >
> >> WFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJX
> >> >
> >> VCI6Mn0%3D%7C3000%7C%7C%7C&sdata=snbY045muxE5m92srCmHzyYcKAq
> >> > aBif0VW%2BUDTXfNNI%3D&reserved=0
> >>
> >> --
> >> Add mailing list
> >> [e-mail]
> >> https://www.ie/
> >> tf.org%2Fmailman%2Flistinfo%2Fadd&data=05%7C01%7CJensen.Thomas%40mi
> >> crosoft.com%7C1fda2605f5e944c3b44408dbba0a913d%7C72f988bf86f141af9
> >> 1ab2d7cd011db47%7C1%7C0%7C638308326815341382%7CUnknown%7CTW
> >> FpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVC
> >> I6Mn0%3D%7C3000%7C%7C%7C&sdata=Mjb2RkA7dCvY0PIZwDp99zQACJj1mv
> >> pvQrHCW293ppk%3D&reserved=0
> >
> > --
> > Add mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/add
>
> --
> Add mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/add
>