Re: [DNSOP] Status of "let localhost be localhost"?

Mike West <mkwst@google.com> Mon, 07 August 2017 08:41 UTC

Return-Path: <mkwst@google.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEB5713218E for <dnsop@ietfa.amsl.com>; Mon, 7 Aug 2017 01:41:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Level:
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id leSUZDIZo7V7 for <dnsop@ietfa.amsl.com>; Mon, 7 Aug 2017 01:41:40 -0700 (PDT)
Received: from mail-oi0-x232.google.com (mail-oi0-x232.google.com [IPv6:2607:f8b0:4003:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1C7613218D for <dnsop@ietf.org>; Mon, 7 Aug 2017 01:41:40 -0700 (PDT)
Received: by mail-oi0-x232.google.com with SMTP id x3so59939287oia.1 for <dnsop@ietf.org>; Mon, 07 Aug 2017 01:41:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=2GphdkdW/ftm7iXUrKrPoj38S/FowSwPpNfY+Yqqu24=; b=RNCn0lEKWA3ARszbhqlr9NtIBVNqli/XCnECnuKG3VZVvGU94T8GcFmkxd8WXDaTLk ac7lO+7lZAIRr+LXOjSkRkhj1ZkeIwhyH0Ye+oGU56S9u0Dc5XqxQ1N+t/NIR4bfQWVT graVqY1nqO3k99ORPkiPsSIfU9s1I/KOsmatfBv2ocLq2TB55k2CSMNN1yYLPpxbEFDf Xn0610GaAX+2IkwfbP9keIITNO57cBolzQOlCnl8a4pM+IGz6KF7V+XrLGL8klTHVp0o GpSFZfaxLl8aVLbggPSxB3t7Uz5OqsjVyR1QZCYcLebm+ijSnPEz2bhukN86gcWfXZWG DyMg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=2GphdkdW/ftm7iXUrKrPoj38S/FowSwPpNfY+Yqqu24=; b=hD74lsdWjhl/xyZRzpiqRU0z0iodkb7dAGrt91FiK1G8ge4Q1n7geiB0OUaA6tpsfy 5Penw7Zlpnc2I4aeqahw4HwV1+9rABmU9wi2Z+RHxU6PjpCa8ckecYSxJq/TaP5KLw8P bFPbM1Nht//iEbOpAzjMKWQJz4mGHTaf4CK/s4kKglaHsSRMYISFQPlbGlG81RamFZMf 0obAMhjTSWU32vuE9Fjb0x4OhuteNRE8Wpxgl1Y5NhZN4WREh43FlwRStRpfcjB2QC+0 30WSaMaz9XoKuvDwY8wc7ZLgJdF6mxJw6Sam6ThrvWW9zMOEbkEyWqOsByeqNqABgSZa LC9A==
X-Gm-Message-State: AHYfb5gjX0ORNyS3BfWT53A0nN0cjUxyPi1P34m+7aGydfkc4p+wzVk0 eKcRc6e3esfhMLGb2eGs6ur/J2PHIeskv6w=
X-Received: by 10.202.102.25 with SMTP id a25mr6146866oic.296.1502095299326; Mon, 07 Aug 2017 01:41:39 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.74.47.5 with HTTP; Mon, 7 Aug 2017 01:41:18 -0700 (PDT)
In-Reply-To: <CAKXHy=cZ2o4OCzAYG=Jmf2qJGK_JwdeRt3uUi7-V3Jy+cJLWqA@mail.gmail.com>
References: <05e469cf-1325-89fc-4a81-661f8647e869@eff.org> <CAKXHy=ctB=LZkX9j=8-Jy0NkTAs2tAesa4gmFhfp94O5=9U4TA@mail.gmail.com> <1dbb47a4-c6e2-97d2-a1d7-ce6c65a4042a@eff.org> <20170802012345.2CE2680BCC5E@rock.dv.isc.org> <CAKXHy=e48CqjPPj-kXu34ptqSipgvJDRkVjHRwwDezCKvepFtQ@mail.gmail.com> <7019539A-48B1-4FA2-801D-20A78D85B339@hopcount.ca> <CAL02cgQoS4r33WypArMFQHuRD38XcLfV2Y2qju+ooqykYc2ATw@mail.gmail.com> <CAKXHy=cZ2o4OCzAYG=Jmf2qJGK_JwdeRt3uUi7-V3Jy+cJLWqA@mail.gmail.com>
From: Mike West <mkwst@google.com>
Date: Mon, 7 Aug 2017 10:41:18 +0200
Message-ID: <CAKXHy=f3juZY7yuToqwj0oiJRA4s7BVKXSKN6Ox6zuN7PQVwpQ@mail.gmail.com>
To: dnsop WG <dnsop@ietf.org>
Cc: Joe Abley <jabley@hopcount.ca>, Jacob Hoffman-Andrews <jsha@eff.org>, Richard Barnes <rlb@ipv.sx>
Content-Type: multipart/alternative; boundary="001a114091a8bcd0c8055625d0db"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/BnG1iWh_KH6bPVzjVfq6TOdeJdw>
Subject: Re: [DNSOP] Status of "let localhost be localhost"?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Aug 2017 08:41:43 -0000

On Wed, Aug 2, 2017 at 3:44 PM, Mike West <mkwst@google.com> wrote:

> On Wed, Aug 2, 2017 at 3:38 PM, Richard Barnes <rlb@ipv.sx> wrote:
>
>> It seems like the desired behavior for the DNS infrastructure here is the
>> same as for .onion -- return NXDOMAIN.  After all, these are queries that
>> should never leave the end host, so anything not on the host should handle
>> them as an error.
>>
>> cf. https://tools.ietf.org/html/rfc7686#section-2
>>
>
> I'm pretty sure this is what the draft we're discussing attempts to do.
> See #2 under https://tools.ietf.org/html/draft-west-let-localhost-b
> e-localhost-03#section-3. It could be more explicit about the response,
> however... I can address that in a -04 if folks agree with the approach.
>
> (I also wonder whether it would be a better idea to reframe this draft as
> something akin to the "onion" RFC: that is, defining the behavior as a
> stand-alone document rather than monkey-patching RFC 6761.)
>

I poked at the draft a bit over the weekend, reworking it into a
stand-alone document in https://tools.ietf.org/html/
draft-west-let-localhost-be-localhost-04. I think it ends up being clearer
overall, and hopefully y'all agree.

Regarding the outstanding question of DNSSEC and insecure delegations, this
new draft takes the same approach as the ".onion" RFC, as Richard
suggested. I'm willing to run with whatever the group agrees upon on this
point, but this seems like a reasonable approach that's both simple to
explain and consistent with existing recommendations.

Feedback on that new draft would be very welcome indeed!

-mike