Re: [DNSOP] [Ext] I-D Action: draft-ietf-dnsop-svcb-https-05.txt

[Eric Orth <[e-mail]>]

I have no strong opinions on any of the discussions regarding escaping in
presentation mode because I don't have much involvement in dealing with
presentation mode of DNS records.  The client I work with parses wire
format directly into its internal structures.

>From my wire-format-only perspective...

I strongly oppose breaking out the key/value pairs of the current proposal
into separate records within an RRSet.  The "independently meaningful"
records argument in favor of per-endpoint records isn't just some small
nice-to-have but is actually rather crucial to avoiding
inconsistent/missing-data issues that could easily become security issues.
Per-key/value records opens things up to too much error-proneness where the
separate records get cached separately (with potentially differing TTLs),
so there's a lot more room for clients to end up receiving/handling only
some parts of endpoint data without a clear indication that other parts are
missing.  Could be much more problematic than just getting a partial view
of the endpoint options.  Easily becomes a security issue, e.g. when a
client gets most of the records for an endpoint but misses the record
containing the ECH config.

I also oppose allowing multiple aliases within an RRSet.  This would allow
aliasing trees, unreasonably exploding the complexity/performance scope of
query followup logic in stubs and recursives.  In practice, I don't think
this would actually make multiple aliases useful because I would then
expect many stub/recursive implementations (including mine) to only make
followup queries down a single branch of the alias tree.

On Wed, May 12, 2021 at 3:42 AM Peter van Dijk <[e-mail]>
wrote:

> On Tue, 2021-05-11 at 18:26 +0200, libor.peltan wrote:
> >
> > May I be wrong, but I think that name, type, class and TTL are not
> repeated in one RRSet with multiple RData. Not in wire format and not
> necessarily even in zonefile. (?)
>
> Zone files allow you to leave some of those out on subsequent records. The
> wire format does not:
> https://datatracker.ietf.org/doc/html/rfc1035#section-4.1.3
>
> Kind regards,
> --
> Peter van Dijk
> PowerDNS.COM BV - https://www.powerdns.com/
>
> _______________________________________________
> DNSOP mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsop
>