Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal for transport indication in draft-ietf-dnsop-dns-wireformat-http
Paul Vixie <paul@redbarn.org> Wed, 04 April 2018 14:54 UTC
Return-Path: <paul@redbarn.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D46F712D958; Wed, 4 Apr 2018 07:54:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.911
X-Spam-Level:
X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pxYwdkA3jQld; Wed, 4 Apr 2018 07:54:22 -0700 (PDT)
Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DD0412D94F; Wed, 4 Apr 2018 07:54:22 -0700 (PDT)
Received: from [10.0.5.44] (unknown [38.100.27.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 323257594C; Wed, 4 Apr 2018 14:54:20 +0000 (UTC)
Message-ID: <5AC4E70C.7020003@redbarn.org>
Date: Wed, 04 Apr 2018 07:54:04 -0700
From: Paul Vixie <paul@redbarn.org>
User-Agent: Postbox 5.0.25 (Windows/20180328)
MIME-Version: 1.0
To: Ray Bellis <ray@bellis.me.uk>
CC: dnsop@ietf.org, doh@ietf.org
References: <152168039295.5550.9572034766968749020.idtracker@ietfa.amsl.com> <CAAObRXLm3c-p9rZkn6H6tcEoh3-UT5JW06NXQ_FMyyr2NFMmyw@mail.gmail.com> <23219.33838.166003.614689@gro.dd.org> <CAAObRX+xF5SwVd3x3iXSWd-A0Kpr_ubbOJzn0yTrSk8pc+tm6Q@mail.gmail.com> <23219.56569.2064.711002@gro.dd.org> <CA+nkc8ANQh2wAr6==eNuM82mbD+E2ELzHGizdqF_sGdY-kkOqg@mail.gmail.com> <5AB3E3B7.3080607@redbarn.org> <69AA6C5D-D348-4956-8A31-FE1EC3A2042E@icann.org> <CABkgnnX2jGY_JpVbqJuQdDVUyVzsuM_2CDg4nppfqQHZQm0F+w@mail.gmail.com> <CAAObRXKHhk51DxNt5uiYB0gunJ=DNde2j9FJSU=Ky2m4Q1UkhQ@mail.gmail.com> <CABkgnnVL0XaUDS-WzDGaN9-kLx9p3x1+UVuWhvx=Zyo5oRos+w@mail.gmail.com> <19BED07A-942E-4A46-93A6-09770083EFF9@icann.org> <CABkgnnX-=n-reO9yjA8a2pHAD+JtoS5wX1w-dXMnDFdt4HXu-g@mail.gmail.com> <23236.18671.182273.977633@gro.dd.org> <28199575-e2e2-6966-fe17-f678f9f397f3@bellis.me.uk> <5AC4C2F7.7050906@redbarn.org> <3630b151-9628-235e-a5b1-c838b777d9d2@bellis.me.uk>
In-Reply-To: <3630b151-9628-235e-a5b1-c838b777d9d2@bellis.me.uk>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/Yujco5y_eS9xQhzuUglDvNQg1Ms>
Subject: Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal for transport indication in draft-ietf-dnsop-dns-wireformat-http
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 04 Apr 2018 14:54:24 -0000
ray, i won't engage on the question, should i want to do this. the working group mantra is interoperability -- as in, if you want to do this, here's an interoperable way. i'm not asking that the working group ratify the intent, or recommend the method. (as went ECS.) the proxy is transparent. we list it in resolv.conf or as a forwarder. it regenerates the queries on the far side. it has to differentiate between tcp and udp because the unmodified client is making strategy decisions and implementing those using that transport choice. this is not a service. DOH is a service. this is a proxy, which i would like to have be interoperable. please don't ask me to change what i want to build; that would be out-of-scope. paul re: Ray Bellis wrote: > On 04/04/2018 13:20, Paul Vixie wrote: > >> tcp and udp are the two ways a query might have reached the >> initiating proxy, and that distinction is the only thing the >> responding proxy needs to know. > > I disagree, I don't think that transport protocols should continue to be > used as things that should be used for policy decisions. > > Per my previous message, they were a suitable proxy (no pun intended) > for "this came from an unspoofable address", or "this channel can handle > large responses" but there are other ways to achieve that now that > aren't strictly transport. > > For example, presence of EDNS cookies satisfies the "unspoofable > address" and therefore would permit RRL to be skipped for that client, > but "UDP with Cookies" isn't a transport. > > [I appreciate that this isn't the best example because that cookie > *might* get all the way through to the backend server anyway. But it > also might not]. > >> if DOH becomes a standard transport, then we could add that >> identifier as well -- but i don't think a client capable of DOH is >> going to be using this particular proxy method. > > We already have DNS-over-TLS, DNS-over-DTLS, and folks are working on > DNS-over-QUIC too. None of those are true "transports", but server > operators may wish to make policy decisions based on the resulting > meta-properties of them. > > Ray > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop -- P Vixie
- [DNSOP] Fwd: New Version Notification for draft-i… Davey Song
- Re: [DNSOP] Fwd: New Version Notification for dra… Richard Gibson
- Re: [DNSOP] Fwd: New Version Notification for dra… Dave Lawrence
- Re: [DNSOP] Fwd: New Version Notification for dra… Davey Song
- Re: [DNSOP] Fwd: New Version Notification for dra… Bob Harold
- Re: [DNSOP] Fwd: New Version Notification for dra… Davey Song
- Re: [DNSOP] Fwd: New Version Notification for dra… Dave Lawrence
- Re: [DNSOP] Fwd: New Version Notification for dra… Paul Vixie
- Re: [DNSOP] Fwd: New Version Notification for dra… Bob Harold
- Re: [DNSOP] Fwd: New Version Notification for dra… Paul Vixie
- [DNSOP] Alternate proposal for transport indicati… Paul Hoffman
- Re: [DNSOP] Alternate proposal for transport indi… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Hoffman
- Re: [DNSOP] Alternate proposal for transport indi… Davey Song
- Re: [DNSOP] [Doh] [Ext] Re: Alternate proposal fo… Davey Song
- Re: [DNSOP] [Doh] [Ext] Re: Alternate proposal fo… Paul Hoffman
- Re: [DNSOP] [Doh] Alternate proposal for transpor… Martin Thomson
- Re: [DNSOP] [Doh] Alternate proposal for transpor… Ray Bellis
- Re: [DNSOP] [Doh] Alternate proposal for transpor… Davey Song
- Re: [DNSOP] [Doh] Alternate proposal for transpor… Martin Thomson
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Hoffman
- Re: [DNSOP] [Doh] Alternate proposal for transpor… Dave Lawrence
- Re: [DNSOP] [Doh] Alternate proposal for transpor… Ted Lemon
- Re: [DNSOP] [Doh] Alternate proposal for transpor… Davey Song
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Martin Thomson
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Dave Lawrence
- Re: [DNSOP] [Doh] [Ext] Re: Alternate proposal fo… Davey Song
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ray Bellis
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ray Bellis
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ray Bellis
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ted Lemon
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ted Lemon
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ted Lemon
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ben Schwartz
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ted Lemon
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ted Lemon
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ted Lemon
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Paul Vixie
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Ted Lemon
- Re: [DNSOP] [Ext] Re: [Doh] Alternate proposal fo… Tony Finch
- Re: [DNSOP] [Doh] [Ext] Re: Alternate proposal fo… Martin Thomson