Re: [dnsext] DNS-AS RRTYPE PARAMETER ALLOCATION

["Wolfgang Riedel (wriedel)" <[e-mail]>]

Hi Ray,

may thanks for your reply.

I consultant with some colleagues and were good with filing a new request and replace the mnemonic = DNSAS with mnemonic = AVC as you suggested.
Also some answer to your question inline.

For all other on list, if you’re looking for more details on DNS-AS please have look at http://dns.as.org

Thank you,
Wolfgang


> On 10 Feb 2016, at 13:26PM, Ray Bellis <[e-mail]> wrote:
> 
> Wolfgang,
> 
> I've been appointed as the designated expert to review your RRTYPE
> application per RFC 6895.
> 
> In principle the application is OK, and it's highly desirable that you
> avoid use of TXT.
> 
> Within my remit however I do have some concerns over the name of the RRTYPE:
> 
> - the term "authoritative" has a particular meaning in the DNS
>  protocol, and "authoritative source" is a commonly used term
>  too.  Typing "dns authoritative source" into Google already
>  produces 75,000 results, none that I could see relating to
>  your project.

yes I agree and we have chosen the wording by intension to outline that we leverage the authoritative name server as a sigle source of truth for application metadata.

> - using "DNS" within the RRTYPE name seems redundant - we’re already in the DNS.

agree

> - the letters "AS" are also commonly used to refer to a BGP "Autonomous System”.

agree

> [FWIW, when I first saw your requested mnemonic in the subject of your
> application I was expecting to see an application for an RRTYPE to
> represent a BGP AS number!]

it’s not so far off given that BGP expresses routing policy intend and DNS-AS metadata for application policy intend

> Also missing is any explicit statement that the intended wire and
> presentation format are identical to that of a TXT record.
> Consideration should also be given to what happens if the data does not
> fit within a single 255 octet "character-string" sub-field.

OK will adress this

> Incidentally, the "CISCO-CLS=" prefix in the RDATA would appear to be
> redundant when you get your own RRTYPE, and if it's expected that other
> vendors would use this then I suggest that you either omit it or use
> something more neutral.

yes good catch and I agree and will remove this

> At a higher level I have concerns about the overall use case  that
> should be addressed if you plan to document "DNS Authoritative Source"
> in an Internet Draft (although I don't expect these to be a factor in my
> decision as they're probably outside the scope of RFC 6895):

at this time there are not plans to submit this as an Internet Draft

> -  why DNS?

Readily available tool - already leveraged to identify an application by DNS-NAME

> How does the client know what domain names are supposed to be looked up?

it’s a function of an DNS-AS client which snoop DNS request as an trigger and raises it’s own query for a DNS-AS Resource Record to get the metadata to enforce policy later

> -  if the "Application Name" is the primary key, why not incorporate
>   that into the domain name?

This ‘could be done’ - but most customers don’t or won’t always identify what application is running on a server via it’s FQDN.

>  - (corollary) is it expected that a client would want to (or even
>    be allowed to) obtain information about all known applications at
>    a domain with a single DNS query?

there is nothing confidential inside a DNS-AS resource record.
The key is that it it authoritative!

> -  what about DNS Security?  What happens in your SDN if someone
>   manages to poison a record?

what happens if I haven't done my homework and didn’t secure and harden my DNS infrastructure ;-)
If DNS is compromised you have bigger problems than how a network element chooses mark and service (queue) for a given application...

> The decision will be reached within two weeks of today, and before
> approval the explicit linking to the TXT record format must be resolved.
> 
> I urge you to reconsider your project name of "DNS Authoritative Source"
> as being a clash with existing terminology. I'm not currently inclined
> to reject the application on that basis of the requested DNSAS mnemonic,
> but welcome community feedback on that issue.

yes will file a new request for mnemonic = AVC

> 
> kind regards,
> 
> Ray Bellis