IETF Logo Mail Archive

Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

"Ralf Weber" <dns@fl1ger.de> Thu, 18 July 2019 07:13 UTC

Return-Path: <dns@fl1ger.de>
X-Original-To: add@ietfa.amsl.com
Delivered-To: add@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54AD11200FA for <add@ietfa.amsl.com>; Thu, 18 Jul 2019 00:13:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9_EuJ5BDHF6q for <add@ietfa.amsl.com>; Thu, 18 Jul 2019 00:13:21 -0700 (PDT)
Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 77BA31200F3 for <add@ietf.org>; Thu, 18 Jul 2019 00:13:21 -0700 (PDT)
Received: by nyx.guxx.net (Postfix, from userid 107) id A9A265F42A7A; Thu, 18 Jul 2019 09:13:19 +0200 (CEST)
Received: from [172.19.152.190] (p5DC68FD7.dip0.t-ipconnect.de [93.198.143.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 3CA655F42A3A; Thu, 18 Jul 2019 09:13:17 +0200 (CEST)
From: Ralf Weber <dns@fl1ger.de>
To: Ted Hardie <ted.ietf@gmail.com>
Cc: Brian Dickson <brian.peter.dickson@gmail.com>, Vittorio Bertola <vittorio.bertola@open-xchange.com>, add@ietf.org, Neil Cook <neil.cook@open-xchange.com>, Rob Sayre <sayrer@gmail.com>
Date: Thu, 18 Jul 2019 09:13:15 +0200
X-Mailer: MailMate (1.12.5r5635)
Message-ID: <E5B89923-F33D-4546-98A6-EB821B12D315@fl1ger.de>
In-Reply-To: <CA+9kkMBjL5VqiH+vjxgTFq2d76O0yoyeJdQF6HhKvO_pOdzDgA@mail.gmail.com>
References: <CAChr6SwEUz9MrdRA0bnv9f-oNi0oUHkfRKjd9-o6jwhuckLXdw@mail.gmail.com> <CAFWeb9LNdT=EYVKTsYDxcBCQKoQFNShKotYtWujt4U9GA-V1mg@mail.gmail.com> <CAFWeb9+eWKSKY9O2JLn9-0+Zq7hrD48F-y+Y4T-iRaaF0vtdOA@mail.gmail.com> <A45F4F74-D6C1-435A-A52F-C2DEA82E2999@sky.uk> <CAFWeb9JVBj+Yehup5q4v9X-7XDY+02frd-04AQGL2HoSLON2qA@mail.gmail.com> <CABcZeBMY9q9vKGse1svzbvXF_dSHA+9q06j4ugDVCZP9VT1koQ@mail.gmail.com> <CAChr6Sz5Rfz=UxOYuPguSvVK2HCX2ZoA1-FytW7+EOUxN8y46Q@mail.gmail.com> <CABcZeBNB7ASu2U3ZMBZ+OOxEhbSnhDXwFN3Lsex1uzVSDv3R=Q@mail.gmail.com> <CAChr6SwEwRRX7BA6ZCeBuC93hFxbfi3d7G_3G3VA7Lm09yuneg@mail.gmail.com> <CABcZeBNa97Vb6Fw-fMhoZnMezGtm3nJODENN4=XXsz7GWxf2Cg@mail.gmail.com> <CAChr6Sxm__NroZ92v4HL_6iCa62fwYgNw9r8ZDAxCdzVwNoDGw@mail.gmail.com> <20190716190219.5DEF4156CDF0@fafnir.remote.dragon.net> <CAChr6SzSkVU5xbh0sZCCEgd7BUdr-dMorNq=5iMkWp66k8PVow@mail.gmail.com> <15205609-8203-4C6F-9DE7-14D492873C51@rfc1035.com> <CAChr6Syf_=3__jcv6D7b1JokGFYpFuy9y9419V0nCAx=MMh24A@mail.gmail.com> <1513817825.9983.1563350802523@appsuite-gw1.open-xchange.com> <CA+9kkMAdGF_U-syxtFVz-MfBfv-GF_CFouvuUhqcSH96-=Hkjg@mail.gmail.com> <ABBFB472-DC7C-48E2-999E-C364BFD3260E@open-xchange.com> <CA+9kkMBO3LAhVmC+PzBoO7V5vzrfeYyrEPdq6s5nRBrYniqaNA@mail.gmail.com> <CAH1iCiqsSWRm7hbwcaoRYUaoLf-DCDXw8cZy7abaYbOAMjJBPw@mail.gmail.com> <CA+9kkMBjL5VqiH+vjxgTFq2d76O0yoyeJdQF6HhKvO_pOdzDgA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/add/GrJ0DGk8A5Qv5WYD2MB8oi8b_ZY>
Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00
X-BeenThere: add@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Applications Doing DNS <add.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/add>, <mailto:add-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/add/>
List-Post: <mailto:add@ietf.org>
List-Help: <mailto:add-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/add>, <mailto:add-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 18 Jul 2019 07:13:25 -0000

Moin!

On 17 Jul 2019, at 20:56, Ted Hardie wrote:
> On Wed, Jul 17, 2019 at 11:40 AM Brian Dickson <
> brian.peter.dickson@gmail.com> wrote:
>> The root of the problem is visible in "if they chose not to". The 
>> nature
>> of DoH, is that the network operator (regardless of who they are) is 
>> unable
>> either detect or prevent guests (or users or BYOD or whoever) from 
>> not
>> complying with your network policy.
>>
>>
> I disagree.  It forces the existence of the network policy to be 
> visible,
> but it is entirely possible to deny network access to a system which 
> is
> non-compliant.  It is not as simple as blocking or intercepting all 
> port 53
> traffic, but that method never addressed the reality that cleartext 
> traffic
> on that port was available to an observer.  To get both 
> confidentiality and
> policy enforcement via this means, practice will need to change.  It 
> will
> need to be visible to the system consuming the DNS (be it a browser, 
> an OS,
> or some other application), and the enforcement mechanism will have to 
> be
> better integrated into reachability mechanics.  That is definitely new 
> code
> for most people, but it is not impossible.
Can you please explain how this could be done, and more precisely how 
this
draft would help in achieving that. If an application uses DoH
as resolution mechanism without telling the network this traffic can not
be distinguished from normal HTTPs traffic. So the only way to block 
this
is to block known endpoints, but that can be done with or without 
knowing
the policy.

So long
-Ralf
—--
Ralf Weber
Principal Architect, Carrier Division

Akamai Technologies GmbH
Parkring 20-22, 85748 Garching
phone: +49.89.9400.6174
mobile: +49.151.22659325

Geschäftsführer: David Matthew McDonald Aitken, Justyna Kalina 
Jankowska
Sitz der Gesellschaft: Garching
Amtsgericht München HRB 129886

v2.23.0 | Report a Bug | By Email