Re: [Add] I-D Action: draft-btw-add-home-00.txt

[[e-mail]]

Hi Tommy,

Thank you for the comments.

Please see inline.

Cheers,
Med

De : Tommy Jensen [mailto:[e-mail]]
Envoyé : vendredi 6 mars 2020 19:03
À : BOUCADAIR Mohamed TGI/OLN; ADD Mailing list
Cc : Konda, Tirumaleswar Reddy ([e-mail]); Dan Wing <[e-mail]> ([e-mail])
Objet : Re: I-D Action: draft-btw-add-home-00.txt

Hey Med,

Thanks for sharing. Based on Section 10,
[Med] I guess you meant the Security section.

it seems the intent of this draft is to ensure use of DoT/DoH servers is prohibited until the user sees and agrees to a privacy policy (exception: the device is configured ahead of time by an admin to trust the given server). Is that accurate?

[Med] The draft discusses many options under which the DNS client auto-upgrades to use a discovered local DoH/DoT server without seeking for the user consent, but we have one particular case (called out in the security considerations Section) in which some 'input' is required to avoid a misuse of the service. That input can be a global configuration parameter, an explicit consent, a default, etc.

We need collectively to think about the exact behavior to follow. For example, it does not make sense to seek for the user consent to upgrade to DoT/DoH while that same server is used for Do53.

If this is the case, I would be opposed to this version of the draft. While I agree users and admins should have more control over their DNS queries, blocking Internet access on DNS server approval for home users (with no enterprise admin to do the hard work for them) seems like a deal breaker for OS vendors. I wouldn't block an HTTPS connection until the user reviews the certificate chain either. Having this information available to decorate Internet connection UI seems wise but blocking connectivity on approval is too heavy handed for the general use case for OSes.

Other feedback:

  *   I see you're using "Do53" and referring to RFC8499. That RFC doesn't specify whether "Do53" or "classic DNS" or something else is the appropriate term. There is a draft<https://tools.ietf.org/html/draft-hoffman-dns-terminology-ter-02> to address this by defining "classic DNS" but it expired. Probably time for us to revisit that and formalize a term we can all use.
[Med] Agree Do53 is not defined in RFC8499. It is defined in the dnsop I-D cited in Section 2.
   This document makes use of the terms defined in [RFC8499<https://tools.ietf.org/html/rfc8499>] and
  [I-D.ietf-dnsop-terminology-ter<https://tools.ietf.org/html/draft-btw-add-home-01#ref-I-D.ietf-dnsop-terminology-ter>].
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  *   Section 1:

     *   s/sotrage/storage
     *   s/resolexpervers/resolvers
[Med] Thank you for catching those. We have already fixed them in -01: https://tools.ietf.org/html/draft-btw-add-home.
Thanks,
Tommy

________________________________
From: Add <[e-mail]> on behalf of [e-mail] <[e-mail]>
Sent: Wednesday, March 4, 2020 1:52 AM
To: ADD Mailing list <[e-mail]>
Cc: Konda, Tirumaleswar Reddy ([e-mail]) <[e-mail]>; Dan Wing <[e-mail]> ([e-mail]) <[e-mail]>
Subject: [EXTERNAL] [Add] TR: I-D Action: draft-btw-add-home-00.txt

Hi all,

We submitted this new I-D.

Comments and suggestions are welcome.

Cheers,
Med

-----Message d'origine-----
De : I-D-Announce [mailto:[e-mail]] De la part de [e-mail]
Envoyé : mercredi 4 mars 2020 09:09
À : [e-mail]
Objet : I-D Action: draft-btw-add-home-00.txt


A New Internet-Draft is available from the on-line Internet-Drafts directories.


        Title           : DoH/DoT Deployment Considerations for Home Networks
        Authors         : Mohamed Boucadair
                          Tirumaleswar Reddy
                          Dan Wing
        Filename        : draft-btw-add-home-00.txt
        Pages           : 17
        Date            : 2020-03-04

Abstract:
   This document discusses DoT/DoH deployment considerations for home
   networks.  It particularly sketches the required steps to use DoT/DoH
   capabilities provided by local networks.

   One of the goals of this document is to assess to what extent
   existing tools can be used to provide a DoT/DoH service.  As an
   outcome, new DHCP and Router Advertisement Options are specified in
   order to convey a DNS Authentication Domain Name.


The IETF datatracker status page for this draft is:
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-btw-add-home%2F&amp;data=02%7C01%7CJensen.Thomas%40microsoft.com%7C5f21d93bdb3949ebf5d608d7c021c80a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637189123649108842&amp;sdata=F8pys3zEoy0vOGnOgT78LOJIbKzaNlMgtDconAJ2hLQ%3D&amp;reserved=0

There are also htmlized versions available at:
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-btw-add-home-00&amp;data=02%7C01%7CJensen.Thomas%40microsoft.com%7C5f21d93bdb3949ebf5d608d7c021c80a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637189123649108842&amp;sdata=EhFMoMg65FtPOpz2IJTWO%2BsYDL178RA75fjy7V2yHI0%3D&amp;reserved=0
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-btw-add-home-00&amp;data=02%7C01%7CJensen.Thomas%40microsoft.com%7C5f21d93bdb3949ebf5d608d7c021c80a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637189123649108842&amp;sdata=758uOmwdnh7QdcYVc4HtGgbeMIFHuLjtMp7wFsdS1mE%3D&amp;reserved=0


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


_______________________________________________
I-D-Announce mailing list
[e-mail]
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fi-d-announce&amp;data=02%7C01%7CJensen.Thomas%40microsoft.com%7C5f21d93bdb3949ebf5d608d7c021c80a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637189123649108842&amp;sdata=oLdsbny2vjhDliNJRVwM3r%2FpRXlUIlApOwf7cz2Snho%3D&amp;reserved=0
Internet-Draft directories: https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.ietf.org%2Fshadow.html&amp;data=02%7C01%7CJensen.Thomas%40microsoft.com%7C5f21d93bdb3949ebf5d608d7c021c80a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637189123649108842&amp;sdata=fiRJ58jcj7gEilNpexiWBmXpiIWPdj11WgqbIESfhSg%3D&amp;reserved=0
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

--
Add mailing list
[e-mail]
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fadd&amp;data=02%7C01%7CJensen.Thomas%40microsoft.com%7C5f21d93bdb3949ebf5d608d7c021c80a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637189123649108842&amp;sdata=a8stqwwalz8Cvab2vjAurTftzQfuiwhOqYSy048prJw%3D&amp;reserved=0