Re: [DNSOP] draft-ietf-dnsop-refuse-any: points from Richard Gibson

[Richard Gibson <[e-mail]>]

On Wed, Jul 26, 2017 at 2:24 PM, Joe Abley <[e-mail]> wrote:

>
> On 26 Jul 2017, at 13:28, Richard Gibson <[e-mail]> wrote:
>
> > The need for such a signal also came up recently in
> https://tools.ietf.org/html/draft-wkumari-dnsop-multiple-
> responses-05#section-10 . But in this case particularly, middleboxes
> should be a complete non-issue... anyone expecting QTYPE=ANY passthrough is
> already asking for trouble.
>
> We may be imagining different things by "middlebox" -- I think you're
> thinking of a resolver, whereas I'm thinking more broadly about stateful
> inspection, firewalls, ALGs, proxies, forwarders, etc. I think there's an
> entirely reasonable and observable expectation that QTYPE=ANY passthrough
> works in that broader sense. Mark's <https://www.ietf.org/
> proceedings/92/slides/slides-92-dnsop-7.pdf> was an easy-to-find example
> of trouble in the real world.
>

Yes, color me corrected on vocabulary but unconvinced on interference...
those slides seem to mostly demonstrate noncompliance by name servers
theirselves with respect to EDNS data in queries, whereas the data I'm
suggesting would only appear in responses.

I will plan to add text to acknowledge the lack of signalling but not to
> change the mechanism to introduce any. People should throw rocks if that
> seems bad.


That works. And I'm all out, so you're safe from me.

> 2. Section 4.1 appears to have some errors in grammar and use RFC 2119
> terms, and should be reworded (removals in strikethrough, additions in
> bold):
>
> Strikethrough and bold, eh? OK. :-) Suggestions are good, many thanks!
>

Ha! I'll use Markdown conventions in the future.