Re: [Add] I-D Action: draft-ietf-add-dnr-06.txt

Hi Ben,

Please see inline

On Tue, 22 Mar 2022 at 17:47, Ben Schwartz <bemasc=
40google.com@dmarc.ietf.org> wrote:

> As I noted in my previous review, this draft is in violation of the IPv6
> RA forming requirements: (https://www.rfc-editor.org/rfc/rfc4861#section-9
> ):
>
>    Options in Neighbor Discovery packets can appear in any order;
>    receivers MUST be prepared to process them independently of their
>    order.
>

> By omitting the SvcPriority from the IPv6 RA option, this syntax becomes
> order-reliant, which is not allowed.  (My proposed syntax revision would
> avoid this problem.)
>

Our understanng is https://datatracker.ietf.org/doc/html/rfc8106 allows
ordering of DNS information without an explicit preference field. We sent
an mail to 6man WG to clarify whether our interpretation of RFC8106 is
correct or not (please see
https://mailarchive.ietf.org/arch/msg/ipv6/qeSwxWBoPTOs0fzyaSBzUC2g-sc/).

>
> I also note that this draft now says
>
>    AliasMode (Section 2.4.2 of [I-D.ietf-dnsop-svcb-https]) is not
>    supported because such a mode will trigger additional Do53 queries
>    while the data can be supplied directly by DHCP servers.
>
> I don't think we should impose this restriction.  As I noted in my
> previous review, it is easy to identify deployments where additional Do53
> queries would be highly preferable, instead of trying to distribute all of
> this information via DHCP.  Do53 followup seems straightforward, since it
> is exactly name-based DDR and is likely to be implemented in the same
> codebase, but it could be made optional if this is a concern.
>

We intended to avoid the Do53 look-up to avoid the possibility of an
external attack, additional lookup and relying on unencrypted DNS for
bootstrapping. The same reasons for adding IP addresses to the DHCP option.

However, I see your point that a deployment may want to move the complexity
to the client. We can update the draft to replace "MUST NOT" with "SHOULD
NOT" and add the reason for allowing AliasMode.

Cheers,
-Tiru

>
> On Tue, Mar 22, 2022 at 7:44 AM <internet-drafts@ietf.org> wrote:
>
>>
>> A New Internet-Draft is available from the on-line Internet-Drafts
>> directories.
>> This draft is a work item of the Adaptive DNS Discovery WG of the IETF.
>>
>>         Title           : DHCP and Router Advertisement Options for the
>> Discovery of Network-designated Resolvers (DNR)
>>         Authors         : Mohamed Boucadair
>>                           Tirumaleswar Reddy
>>                           Dan Wing
>>                           Neil Cook
>>                           Tommy Jensen
>>         Filename        : draft-ietf-add-dnr-06.txt
>>         Pages           : 21
>>         Date            : 2022-03-22
>>
>> Abstract:
>>    The document specifies new DHCP and IPv6 Router Advertisement options
>>    to discover encrypted DNS servers (e.g., DNS-over-HTTPS, DNS-over-
>>    TLS, DNS-over-QUIC).  Particularly, it allows to learn an
>>    authentication domain name together with a list of IP addresses and a
>>    set of service parameters to reach such encrypted DNS servers.
>>
>>
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-add-dnr/
>>
>> There is also an htmlized version available at:
>> https://datatracker.ietf.org/doc/html/draft-ietf-add-dnr-06
>>
>> A diff from the previous version is available at:
>> https://www.ietf.org/rfcdiff?url2=draft-ietf-add-dnr-06
>>
>>
>> Internet-Drafts are also available by rsync at rsync.ietf.org:
>> :internet-drafts
>>
>>
>> --
>> Add mailing list
>> Add@ietf.org
>> https://www.ietf.org/mailman/listinfo/add
>>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>