Re: [DNSOP] Status of "let localhost be localhost"?

Robert Edmonds <edmonds@mycre.ws> Wed, 02 August 2017 18:02 UTC

Return-Path: <edmonds@mycre.ws>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBBB4129417 for <dnsop@ietfa.amsl.com>; Wed, 2 Aug 2017 11:02:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.903
X-Spam-Level:
X-Spam-Status: No, score=-1.903 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m6X2nI-IFKEL for <dnsop@ietfa.amsl.com>; Wed, 2 Aug 2017 11:02:22 -0700 (PDT)
Received: from mycre.ws (mycre.ws [45.33.102.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C494126E3A for <dnsop@ietf.org>; Wed, 2 Aug 2017 11:02:22 -0700 (PDT)
Received: by chase.mycre.ws (Postfix, from userid 1000) id D7BB712C0F92; Wed, 2 Aug 2017 14:02:21 -0400 (EDT)
Date: Wed, 2 Aug 2017 14:02:21 -0400
From: Robert Edmonds <edmonds@mycre.ws>
To: Ted Lemon <mellon@fugue.com>
Cc: Mike West <mkwst@google.com>, Richard Barnes <rlb@ipv.sx>, dnsop <dnsop@ietf.org>, Jacob Hoffman-Andrews <jsha@eff.org>, william manning <chinese.apricot@gmail.com>
Message-ID: <20170802180221.n7ezh5yzr5cuxklz@mycre.ws>
References: <05e469cf-1325-89fc-4a81-661f8647e869@eff.org> <CAKXHy=ctB=LZkX9j=8-Jy0NkTAs2tAesa4gmFhfp94O5=9U4TA@mail.gmail.com> <1dbb47a4-c6e2-97d2-a1d7-ce6c65a4042a@eff.org> <CACfw2hiX7U74n9+defcYiD7jLKZeLhtLM6WP5YM_WuAoA8ecYQ@mail.gmail.com> <CAL02cgRg6k7=b7berKr9J+9aL8PTS81nJ_yXQO8QTYqgiqXSbg@mail.gmail.com> <6B25B24C-4C80-4A04-BF27-2306F4A77EF6@fugue.com> <CAL02cgQ2z9Fze-Q2QWQ=+PHJEO_S3bTaq1fPJ6XSEwFUQ=ftvw@mail.gmail.com> <CAKXHy=eV0OBW+S308rdiHZ523foOgxYNB3i07RkeFJiTjMYQEQ@mail.gmail.com> <D9568E51-3C48-4BA3-9797-3F7756E857C9@fugue.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <D9568E51-3C48-4BA3-9797-3F7756E857C9@fugue.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/A1v_seOfqGWWejb91Sd8axIIuGQ>
Subject: Re: [DNSOP] Status of "let localhost be localhost"?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Aug 2017 18:02:24 -0000

Ted Lemon wrote:
> But we are arguing that "localhost" should be treated specially by every piece of software that looks at it, when its default meaning is "look up localhost in the DNS and connect to one of the addresses that you get in response."

RFC 6761 §6.3 already says that "localhost" should be treated specially
by pretty much every piece of software that looks at it. But especially:

   2.  Application software MAY recognize localhost names as special, or
       MAY pass them to name resolution APIs as they would for other
       domain names.

   3.  Name resolution APIs and libraries SHOULD recognize localhost
       names as special and SHOULD always return the IP loopback address
       for address queries and negative responses for all other query
       types.  Name resolution APIs SHOULD NOT send queries for
       localhost names to their configured caching DNS server(s).

(In practice, "localhost" already does get treated specially, especially
by operating systems that place a "Name Service Switch" or similar
component in front of the DNS stub resolver. If you put
"http://localhost/" into your browser bar, you shouldn't see a DNS query
for "localhost" leave your machine.)

Doesn't "Application software MAY recognize localhost names as special"
already give more than enough permission for browser developers to treat
"localhost" (and any subdomain of "localhost") specially, for instance
by hardcoding the names to a loopback address, or filtering the result
from the system's name resolver to verify that only a loopback address
is used? Or only allowing the "Secure Context" flag to be set when the
localhost name resolves to a loopback address.

draft-west-let-localhost-be-localhost-03 upgrades the requirements in
RFC 6761 §6.3 to make them much stricter, for all applications,
converting SHOULDs to MUSTs, etc. So we're not arguing about whether
localhost "should" be treated specially, but whether it MUST be treated
specially, by all applications. Can the W3C not impose stricter
requirements on browser developers even if 6761 doesn't impose mandatory
treatment for "localhost"?

Maybe a smaller addition to RFC 6761 §6.3 would be sufficient for the
W3C? Something like:

    Application software specifications MAY require that application
    software recognize localhost names as special.

But that seems weird because it's arguably just a specific case of
requirement #2.

-- 
Robert Edmonds