[Add] DNR and IP hints

[Ben Schwartz <[e-mail]>]

Somewhat related to our text/wire format discussion, I see a problem with DNR's instruction about IP hints.  In most places, the draft simply says that the option "MUST NOT" contain ipv4hint or ipv6hint, which I interpret as a requirement on the configuration author (not the DHCP server or client).  However, DNR Section 3.1.8 [1] says that the receiver checks that "the service parameters do not include "ipv4hint" or "ipv6hint" service parameters", and if this check fails "the receiver discards the received Encrypted DNS option".

This appears to be based on a misunderstanding of how SVCB clients work.  SVCB clients simply ignore SvcParams that they are not using, or discard the record if an unrecognized SvcParam is marked as "mandatory".  This check is very strange: it forces clients to add knowledge of the "ipv4hint" key even though they don't intend to use it, and then artificially fail on any option that contains it.

It also makes implementation much harder on the DNR sender.  In principle, DNR senders should be able to memcpy the SvcParams directly out of the resolver's DDR RDATA.  This simplifies configuration by ensuring a single point of truth, and avoids ossification because the DHCP server does not need to understand the SvcParams.  However, since ipv4hint is not prohibited in DDR, this requirement forces the DHCP server to filter it out.

This filtering can be performed while passing unrecognized SvcParams through, but it represents added complexity for no obvious benefit.

--Ben Schwartz

[1] https://www.ietf.org/archive/id/draft-ietf-add-dnr-16.html#name-dnr-validation-checks