Re: [DNSOP] Fwd: New Version Notification for draft-bellis-dnsop-edns-tags-00.txt
Ray Bellis <ray@bellis.me.uk> Fri, 08 March 2019 21:21 UTC
Return-Path: <ray@bellis.me.uk>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C787A12716C for <dnsop@ietfa.amsl.com>; Fri, 8 Mar 2019 13:21:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DDO8IjQTzgwX for <dnsop@ietfa.amsl.com>; Fri, 8 Mar 2019 13:21:25 -0800 (PST)
Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9D97126DFA for <dnsop@ietf.org>; Fri, 8 Mar 2019 13:21:25 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:To:Subject:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=ataVsnwgUVlpilrEW+mo6ESlKKeF8oOfX3EHGenO9hI=; b=IhQko4SS/gqi6JD4OiRmbqTHeC WmdD620MGpT+A95aLiIkYt7fU8bD3jK/e1wdynQ2k5QeX+TIndl+kYz7ocPdt0ZP5Se8MshrvmCEI iWxE2fLu+28HPiLxAL8oGUA6HjMpTM6vsdNdGCp2pqJjlMnnRIZERjaADb8ctbMcKQJg=;
Received: from [88.212.170.147] (port=55085 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1h2Mvj-0003IP-C9 (Exim 4.89) for dnsop@ietf.org (return-path <ray@bellis.me.uk>); Fri, 08 Mar 2019 21:21:23 +0000
To: dnsop@ietf.org
References: <155171606493.5281.3957934874516100450.idtracker@ietfa.amsl.com> <5c3cc3f9-2225-9077-fb9e-0fb940bd1c1b@isc.org> <yblef7mp7io.fsf@wu.hardakers.net> <CAKW6Ri5doXL=uBpEy3Eqrkoyfu9rvt9upH9qxXkzZKUgS_=dMw@mail.gmail.com> <ybla7iap5nx.fsf@wu.hardakers.net> <B137690E-8063-4416-BFE2-706F0589AD5F@isc.org> <yblsgw125x4.fsf@w7.hardakers.net> <40758bbd-5289-8e21-8043-3c3d09c6b8d1@nic.cz> <bd27789a-e6f8-adca-874f-a4c298f0891f@bellis.me.uk> <alpine.LRH.2.21.1903072249100.7137@bofh.nohats.ca> <5f06e2ad-3710-4dbf-3c04-ca31f8b19c4a@bellis.me.uk> <alpine.LRH.2.21.1903080916520.20997@bofh.nohats.ca> <e07b94d6-d974-4e4f-5519-a90cc0e98979@bellis.me.uk> <alpine.LRH.2.21.1903081154310.30421@bofh.nohats.ca> <CAJE_bqc_a5-W+FvFGFn0p2MbQU7FJB9Qwa9Xiy1KMwNG0EUFKA@mail.gmail.com>
From: Ray Bellis <ray@bellis.me.uk>
Message-ID: <d7be719a-d510-4134-326b-85d09eec2687@bellis.me.uk>
Date: Fri, 08 Mar 2019 21:21:22 +0000
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.5.3
MIME-Version: 1.0
In-Reply-To: <CAJE_bqc_a5-W+FvFGFn0p2MbQU7FJB9Qwa9Xiy1KMwNG0EUFKA@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-GB
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/Auwcy3JuJ3DfF3cHa7KMbBX5kiY>
Subject: Re: [DNSOP] Fwd: New Version Notification for draft-bellis-dnsop-edns-tags-00.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Mar 2019 21:21:29 -0000
On 08/03/2019 18:33, 神明達哉 wrote: > For example, assume that an operator uses dnsdist as a DNS load > balancer and BIND 9 as backend servers with RRL, and the operator > wants to trust particular clients (identified by their IP addresses) > and bypass RRL for them. How can we expect off-the-shelf dnsdist and > off-the-shelf BIND 9 support this operation with the only assumption > being that both of them support edns-tags? Is there an implicit > assumption that: > - this version of off-the-shelf dnsdist happens to have a new > configuration option so it will add an edns-tag with setting bit X > when the client IP address matches a specified set of address list, Yes, that's feasible (and from dicussions I've had with them I think it's not just feasible but extremely likely). > - this version of off-the-shelf BIND 9 happens to have a new > configuration option to skip RRL if an incoming request contains an > edns-tag option with bit X on ? Yes, that is also completely feasible. I would expect (at some point) that BIND would offer the ability to use a tag comparison as part of an `address_match_element` that could then be used like so: rate-limit { exempt-clients { ... }; }; > At this moment I don't have a strong opinion on the proposal itself, > but the "off-the-shelf software" argument doesn't sound very > convincing or realistic. Perhaps I miss some implicit assumptions, in > which case I'd like the draft to explain these in more detail. The next version has this text: "The intended mode of operation is that the value of a bit (or range of bits) could be tested in access control lists or any other such policy control mechanism." I'm open to elaborating on this a little more in the draft, but it would be a shame for the draft to lose its current succintness. Ray
- [DNSOP] Fwd: New Version Notification for draft-b… Ray Bellis
- Re: [DNSOP] [Ext] Fwd: New Version Notification f… Paul Hoffman
- Re: [DNSOP] Fwd: New Version Notification for dra… Ted Lemon
- Re: [DNSOP] [Ext] Fwd: New Version Notification f… Paul Hoffman
- Re: [DNSOP] [Ext] Fwd: New Version Notification f… Ted Lemon
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] Fwd: New Version Notification for dra… Wes Hardaker
- Re: [DNSOP] Fwd: New Version Notification for dra… Dick Franks
- Re: [DNSOP] Fwd: New Version Notification for dra… Wes Hardaker
- Re: [DNSOP] Fwd: New Version Notification for dra… Mark Andrews
- Re: [DNSOP] Fwd: New Version Notification for dra… Dick Franks
- Re: [DNSOP] Fwd: New Version Notification for dra… Dick Franks
- Re: [DNSOP] Fwd: New Version Notification for dra… Paul Wouters
- Re: [DNSOP] [Ext] Fwd: New Version Notification f… Paul Hoffman
- Re: [DNSOP] [Ext] Fwd: New Version Notification f… Paul Wouters
- Re: [DNSOP] Fwd: New Version Notification for dra… Wes Hardaker
- Re: [DNSOP] Fwd: New Version Notification for dra… Wes Hardaker
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] Fwd: New Version Notification for dra… Dick Franks
- Re: [DNSOP] Fwd: New Version Notification for dra… Shane Kerr
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] Fwd: New Version Notification for dra… Dick Franks
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] Fwd: New Version Notification for dra… Tony Finch
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] Fwd: New Version Notification for dra… Petr Špaček
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] [Ext] Fwd: New Version Notification f… Peter van Dijk
- Re: [DNSOP] Fwd: New Version Notification for dra… Paul Wouters
- Re: [DNSOP] Fwd: New Version Notification for dra… Dick Franks
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] New Version Notification for draft-be… Peter van Dijk
- Re: [DNSOP] Fwd: New Version Notification for dra… Paul Wouters
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] Fwd: New Version Notification for dra… Paul Wouters
- Re: [DNSOP] Fwd: New Version Notification for dra… 神明達哉
- Re: [DNSOP] Fwd: New Version Notification for dra… Ray Bellis
- Re: [DNSOP] New Version Notification for draft-be… Peter van Dijk