Re: [DNSOP] Fwd: New Version Notification for draft-pan-dnsop-edns-isp-location-02.txt

[Lanlan Pan <[e-mail]>]

Hi Robert,

Thanks for your comments.

Robert Edmonds <[e-mail]>于2017年7月29日周六 上午1:17写道：

> Hi,
>
> Dave Lawrence wrote:
> > Have you had any feedback from authority server implementers who are
> > interested in using this?
>
> As an authority server implementer at a CDN -- we have no interest in
> using anything like this.
>
Fastly support  Creating location-based tagging
<https://docs.fastly.com/guides/vcl/creating-location-based-tagging> ,
offer HTTP header like Fastly-GeoIP-CountryCode for geographically
sensitive content, and Geolocation-related VCL features
<https://docs.fastly.com/guides/vcl/geolocation-related-vcl-features>.
Fastly has something like this, give tailor HTTP response based on client
ip's Geo Feature.

Hope you have interest to support something like this on DNS level in the
future, welcome cooperation, :-)


> > I'm having a hard time picturing many CDNs wanting to switch, in no
> > small part because geo is not the only goal of mapping.  The
> > < COUNTRY, AREA, ISP > tuple that is defined is insufficient.
>
> Yes, as has been made clear in previous discussion on this document.
>
The "sufficient" vs "not sufficent" has repeat many times.
Seperate path calculation and tailor DNS response
<https://github.com/abbypan/dns_test_eil#path-calculation-and-tailored-dns-response>:
CDN can do all analysis based on client ip *without ECS and EIL*, because
it is data provider, every client will visit.
Geoip enabled ECS vs EIL
<https://github.com/abbypan/dns_test_eil#eil-is-sufficient-for-geoip-enabled-authoritative-nameserver>
: The < COUNTRY, AREA, ISP > tuple *can be sufficient for GeoIP-enabled
Authoritative Nameserver*.
See also 3 pictures in attach.


> Even if it were sufficient, using only a <COUNTRY, AREA, ISP> tuple to
> direct traffic makes it incumbent on the resolver operator to accurately
> geolocate the client IP and faithfully transmit the result to the
> authoritative operator.

For user privacy concern and realistic geoip-enabled authoritative server,
EIL can be an alternative feature, not many cost on geoip-enabled
authoritative server to add this feature.

Generally speaking, the global public dns, which make resolver's IP not
close to client's IP, is the origin of "response accurate problem". Their
GeoIP database's accuracy should be no less than authoritative service
providers.
With ECS, authoritative server incumbent to accurately geolocate the client
IP. Big company with huge number of users has advantage. EIL can be more
fairly for small company and third patry startup authoritative sevice if
they have less accuracy GeoIP database.

Common security concern, if resolver not "faithfully transmit the <COUNTRY,
AREA, ISP> tuple to the authoritative operator", would it "faithfully
transmit the client-subnet tuple to the authoritative operator" ?

If the resolver operator is an ISP, this
> proposal would give the ISP an enormous amount of counter- traffic
> engineering power by spoofing the COUNTRY/AREA fields.
>
ISP resolver (or all type resolvers) can redirect traffic because its key
position, between user and authoritative server.

Use the same logic, we can imagine that,  ECS can give the ISP an enormous
amount of counter- traffic
engineering power by spoofing the CLIENT-SUBNET fields.


> --
> Robert Edmonds
>
-- 
致礼  Best Regards

潘蓝兰  Pan Lanlan