[dns-privacy] Dnsdir last call review of draft-ietf-dprive-unilateral-probing-11

Florian Obser via Datatracker <noreply@ietf.org> Wed, 09 August 2023 11:49 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: Florian Obser via Datatracker <noreply@ietf.org>
To: dnsdir@ietf.org
Cc: dns-privacy@ietf.org, draft-ietf-dprive-unilateral-probing.all@ietf.org, last-call@ietf.org
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <169158176053.61618.9149967821439713552@ietfa.amsl.com>
Reply-To: Florian Obser <fobser@ripe.net>
Date: Wed, 09 Aug 2023 04:49:20 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/dns-privacy/uhRlb8zEjwTNsoxn3suTyI-L3Is>
Subject: [dns-privacy] Dnsdir last call review of draft-ietf-dprive-unilateral-probing-11

Reviewer: Florian Obser
Review result: Ready with Issues

Unfortunately -11 introduced two issues Which I've already raised on the dpriv mailing list.

This is the text I sent to dpriv yesterday:
------------------------------------------------------------------------
   For example, consider an authoritative server named ns0.example.com
   that is served by two installations (with two A records), one at
   192.0.2.7 that follows this guidance, and one at 2001:db8::8 that is
   a legacy (cleartext port 53-only) deployment.

It doesn't have two A records. It has an A and AAAA record. I know
that Éric asked for a non-legacy IP example, but I don't think this makes
things better. I find it very confusing, usually the server would be
dual stacked so why would it do different things depending on the
address family? Maybe just go v6 only, thusly?

   For example, consider an authoritative server named ns0.example.com
   that is served by two installations (with two AAAA records), one at
   2001:db8::7 that follows this guidance, and one at 2001:db8::8 that is
   a legacy (cleartext port 53-only) deployment.  A recursive client who
   associates state with the NS name and reaches 2001:db8::7 first will

Same in 4.5:

   For example, if a recursive resolver can send a packet to
   authoritative servers from IP addresses 192.0.2.100 and
   2001:db8::200, it could keep two distinct sets of per-authoritative-
   IP state, one for each source address it uses, if the recursive
   resolver knows the addresses in use.  Keeping these state tables
   distinct for each source address makes it possible for a pooled
   authoritative server behind a load balancer to do a partial rollout
   while minimizing accidental timeouts (see Section 3.1).

It seems unlikely that the load balancer would do a address family
translation. Maybe:

   For example, if a recursive resolver can send a packet to
   authoritative servers from IP addresses 2001:db8::100 and
   2001:db8::200, it could keep two distinct sets of per-authoritative-
------------------------------------------------------------------------

[dns-privacy] Dnsdir last call review of draft-ie… Florian Obser via Datatracker