Re: [DNSOP] Fwd: New Version Notification for draft-bellis-dnsop-edns-tags-00.txt

Ray Bellis <ray@bellis.me.uk> Fri, 08 March 2019 21:21 UTC

Return-Path: <ray@bellis.me.uk>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C787A12716C for <dnsop@ietfa.amsl.com>; Fri, 8 Mar 2019 13:21:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=portfast.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DDO8IjQTzgwX for <dnsop@ietfa.amsl.com>; Fri, 8 Mar 2019 13:21:25 -0800 (PST)
Received: from mail.portfast.net (mail.portfast.net [IPv6:2a03:9800:20:1::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9D97126DFA for <dnsop@ietf.org>; Fri, 8 Mar 2019 13:21:25 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=portfast.net; s=dkim; h=Content-Transfer-Encoding:Content-Type:In-Reply-To: MIME-Version:Date:Message-ID:From:References:To:Subject:Sender:Reply-To:Cc: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=ataVsnwgUVlpilrEW+mo6ESlKKeF8oOfX3EHGenO9hI=; b=IhQko4SS/gqi6JD4OiRmbqTHeC WmdD620MGpT+A95aLiIkYt7fU8bD3jK/e1wdynQ2k5QeX+TIndl+kYz7ocPdt0ZP5Se8MshrvmCEI iWxE2fLu+28HPiLxAL8oGUA6HjMpTM6vsdNdGCp2pqJjlMnnRIZERjaADb8ctbMcKQJg=;
Received: from [88.212.170.147] (port=55085 helo=Rays-MacBook-Pro.local) by mail.portfast.net ([188.246.200.9]:465) with esmtpsa (fixed_plain:ray@bellis.me.uk) (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) id 1h2Mvj-0003IP-C9 (Exim 4.89) for dnsop@ietf.org (return-path <ray@bellis.me.uk>); Fri, 08 Mar 2019 21:21:23 +0000
To: dnsop@ietf.org
References: <155171606493.5281.3957934874516100450.idtracker@ietfa.amsl.com> <5c3cc3f9-2225-9077-fb9e-0fb940bd1c1b@isc.org> <yblef7mp7io.fsf@wu.hardakers.net> <CAKW6Ri5doXL=uBpEy3Eqrkoyfu9rvt9upH9qxXkzZKUgS_=dMw@mail.gmail.com> <ybla7iap5nx.fsf@wu.hardakers.net> <B137690E-8063-4416-BFE2-706F0589AD5F@isc.org> <yblsgw125x4.fsf@w7.hardakers.net> <40758bbd-5289-8e21-8043-3c3d09c6b8d1@nic.cz> <bd27789a-e6f8-adca-874f-a4c298f0891f@bellis.me.uk> <alpine.LRH.2.21.1903072249100.7137@bofh.nohats.ca> <5f06e2ad-3710-4dbf-3c04-ca31f8b19c4a@bellis.me.uk> <alpine.LRH.2.21.1903080916520.20997@bofh.nohats.ca> <e07b94d6-d974-4e4f-5519-a90cc0e98979@bellis.me.uk> <alpine.LRH.2.21.1903081154310.30421@bofh.nohats.ca> <CAJE_bqc_a5-W+FvFGFn0p2MbQU7FJB9Qwa9Xiy1KMwNG0EUFKA@mail.gmail.com>
From: Ray Bellis <ray@bellis.me.uk>
Message-ID: <d7be719a-d510-4134-326b-85d09eec2687@bellis.me.uk>
Date: Fri, 8 Mar 2019 21:21:22 +0000
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.5.3
MIME-Version: 1.0
In-Reply-To: <CAJE_bqc_a5-W+FvFGFn0p2MbQU7FJB9Qwa9Xiy1KMwNG0EUFKA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-GB
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/Auwcy3JuJ3DfF3cHa7KMbBX5kiY>
Subject: Re: [DNSOP] Fwd: New Version Notification for draft-bellis-dnsop-edns-tags-00.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Mar 2019 21:21:29 -0000


On 08/03/2019 18:33, 神明達哉 wrote:

> For example, assume that an operator uses dnsdist as a DNS load
> balancer and BIND 9 as backend servers with RRL, and the operator
> wants to trust particular clients (identified by their IP addresses)
> and bypass RRL for them.  How can we expect off-the-shelf dnsdist and
> off-the-shelf BIND 9 support this operation with the only assumption
> being that both of them support edns-tags?  Is there an implicit
> assumption that:
> - this version of off-the-shelf dnsdist happens to have a new
>    configuration option so it will add an edns-tag with setting bit X
>    when the client IP address matches a specified set of address list,

Yes, that's feasible (and from dicussions I've had with them I think 
it's not just feasible but extremely likely).

> - this version of off-the-shelf BIND 9 happens to have a new
>    configuration option to skip RRL if an incoming request contains an
>    edns-tag option with bit X on ?

Yes, that is also completely feasible.  I would expect (at some point) 
that BIND would offer the ability to use a tag comparison as part of an 
`address_match_element` that could then be used like so:

   rate-limit {
     exempt-clients { ... };
   };

> At this moment I don't have a strong opinion on the proposal itself,
> but the "off-the-shelf software" argument doesn't sound very
> convincing or realistic.  Perhaps I miss some implicit assumptions, in
> which case I'd like the draft to explain these in more detail.

The next version has this text:

"The intended mode of operation is that the value of a bit (or range of
bits) could be tested in access control lists or any other such policy
control mechanism."

I'm open to elaborating on this a little more in the draft, but it would 
be a shame for the draft to lose its current succintness.

Ray