Re: [Add] Fwd: New Version Notification for draft-reddy-add-enterprise-split-dns-00.txt

[tirumal reddy <[e-mail]>]

Hi Ben,

Thanks for the review. Please see inline.

On Wed, 24 Feb 2021 at 02:20, Ben Schwartz <[e-mail]> wrote:

> This draft contains a large amount of veiled policy argumentation and
> outright specification of client policy.  That material is out of scope for
> this working group.
>

PvD can be used to provide the network configuration information, see
https://tools.ietf.org/html/rfc7556. If the WG thinks it is useful but not
in scope, we can discuss to enhance the scope; otherwise will remove the
text.


>
> Apart from that issue, the draft's quote from RFC 2826 quite expressly
> forbids the technical approach taken in this draft.  RFC 2826 says
> "if [private networks] wish to make use of names uniquely defined for the
> global Internet, they have to fetch that information from the global DNS
> naming hierarchy".  RFC 2826 later clarifies
>
> > The
> > requirement for uniqueness within a domain further implies that there
> > be some mechanism to prevent name conflicts within a domain.  In DNS
> > this is accomplished by assigning a single owner or maintainer to
> > every domain, including the root domain, who is responsible for
> > ensuring that each sub-domain of that domain has the proper records
> > associated with it.  This is a technical requirement, not a policy
> > choice.
>
> In my view, any draft that defines a modified lookup procedure must
> therefore ensure that it is not altering the party who controls the
> contents of any defined global domain.  This could work by first checking
> that a given name does not exist in the global namespace, or by providing
> evidence that the local network operator is the party responsible for the
> global name.
>

If the client queries a public resolver to check if the private DNS names
exist in the global namespace, it would leak the private sensitive names to
the public resolver and adversely impact privacy. Alternatively the client
can use bloom-filter of well-known domains to check if the name does not
exist in the global namespace (similar to the way Chrome uses bloom- filter
to identify if the domain visited by the user is not malicious), it avoids
leaking the private names to external resolvers.

We can update the draft to discuss the above mechanism.

I did not get the latter part of the comment : How would the local network
operator provide evidence that it claims authority over a global name ?

Further, it is quite common in split DNS for an authoritative server to
give different responses to queries from the Internet than queries from
devices attached to the network (see
https://tools.ietf.org/html/rfc6950#section-4).

Cheers,
-Tiru


> I recommend that the authors adopt one or both of those approaches to make
> this draft compliant with IAB guidance and good DNS practice.
>

>

> On Tue, Feb 23, 2021 at 3:59 AM tirumal reddy <[e-mail]> wrote:
>
>> Hi all,
>>
>>
>> https://tools.ietf.org/html/draft-reddy-add-enterprise-split-dns-00
>> discusses a mechanism to inform endpoints of split-horizon DNS and their
>> DNS domains, and is compatible with encrypted DNS. It addresses the use
>> cases of DNS configuration on explicitly trusted networks presented at ADD
>> interim (please see slides 7 to 9 in
>> https://datatracker.ietf.org/meeting/interim-2021-add-01/materials/slides-interim-2021-add-01-sessa-draft-box-add-requirements-design-slides-00.pdf
>> ).
>>
>>
>> Please review the draft and provide your valuable comments.
>>
>> Cheers,
>> -Tiru
>>
>> ---------- Forwarded message ---------
>> From: <[e-mail]>
>> Date: Sun, 21 Feb 2021 at 12:16
>> Subject: New Version Notification for
>> draft-reddy-add-enterprise-split-dns-00.txt
>> To: Tirumaleswar Reddy.K <[e-mail]>, Dan Wing <[e-mail]
>> >
>>
>>
>>
>> A new version of I-D, draft-reddy-add-enterprise-split-dns-00.txt
>> has been successfully submitted by Tirumaleswar Reddy and posted to the
>> IETF repository.
>>
>> Name:           draft-reddy-add-enterprise-split-dns
>> Revision:       00
>> Title:          Split-Horizon DNS Configuration in Enterprise Networks
>> Document date:  2021-02-20
>> Group:          Individual Submission
>> Pages:          12
>> URL:
>> https://www.ietf.org/archive/id/draft-reddy-add-enterprise-split-dns-00.txt
>> Status:
>> https://datatracker.ietf.org/doc/draft-reddy-add-enterprise-split-dns/
>> Htmlized:
>> https://datatracker.ietf.org/doc/html/draft-reddy-add-enterprise-split-dns
>> Htmlized:
>> https://tools.ietf.org/html/draft-reddy-add-enterprise-split-dns-00
>>
>>
>> Abstract:
>>    When split-horizon DNS is deployed by an enterprise, certain
>>    enterprise domains are only resolvable by querying the network-
>>    provided DNS server.  DNS clients which use DNS servers not provided
>>    by the network need to route those DNS domain queries to the network-
>>    provided DNS server.  This document informs DNS clients of split-
>>    horizon DNS, their DNS domains, and is compatible with encrypted DNS.
>>
>>
>>
>>
>> Please note that it may take a couple of minutes from the time of
>> submission
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>> The IETF Secretariat
>>
>>
>> --
>> Add mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/add
>>
>