Re: [Doh] Proposal: DNS configuration string

[Mark Nottingham <[e-mail]>]

On 4 Jun 2019, at 1:47 am, Mateusz Jończyk <[e-mail]> wrote:
> 
> There are many configuration parameters involved in DoH. 
> After encapsulating them in a single string, it is easier for the user 
> to set a custom DoH resolver, among other benefits (which I 
> elaborated on in the original e-mail).

I understand that -- my question was why that configuration needs to be conveyed as part of the URL template's syntax, rather than in a structure (perhaps a string) that contains the URL template. Structuring a URL like that violates BCP190.

For example, instead of:

 dns://1.2.3.4;valid-for=_nodot,.some-company

You could use:

 dns://1.2.3.4 valid-for=_nodot,.some-company

Because a space isn't valid in a URL (or template), it's not making the assumption that the structure you're usurping is "very rare" -- such assumptions don't hold at Internet scale.

(If you don't like space, there are a lot of other characters that are invalid in URLs that could be used as a delimiter, or you could embed the URL template in another structured format, e.g., JSON or XML).

Cheers,

> 
> W dniu 03.06.2019 o 00:53, Mark Nottingham pisze:
> 
>> Why not just convey this separately -- why does it have to be in the URL?
>> 
>> 
>>> On 2 Jun 2019, at 7:44 pm, Mateusz Jończyk <[e-mail]>
>>>  wrote:
>>> 
>>> Signed PGP part
>>> Hello,
>>> 
>>> Currently, there are multiple ways of resolving DNS queries:
>>> 
>>> 	• old port-53 DNS,
>>> 	• DNS over TLS,/
>>> 	• DNS over HTTPS.
>>> Some of these accept additional parameters, such as server certificate information 
>>> (which may be necessary when using local DoH / DoT servers). These parameters are 
>>> server-specific --- when configuring multiple servers, each of them may need 
>>> different certificate information.
>>> 
>>> I would argue that it would be beneficial to embed all such parameters into a 
>>> single server specification string. The user would be able to copy-paste them, 
>>> for example from the website of their chosen DNS resolver, a file provided by 
>>> their sysadmin or from their router configuration GUI. A DHCP server could advertise 
>>> the string in a single field. Additionally, an application could pass the whole 
>>> string to a DNS-handling library. That way the application would not have to 
>>> implement support for all DNS configuration parameters on its own (with complex 
>>> GUIs) and new parameters (or even new DNS resolver types) could be supported by 
>>> the program after a library upgrade. This would also simplify configuration file 
>>> structure (allowing for a single server per line).
>>> 
>>> Some examples [3]:
>>> 
>>> 	• doh://dnsserver.example.net/dns-query{?dns};ip=1.2.3.4;root-cert=zdYsea0CQufOmBpLdLfu/q3tOOdxbBCuZNhAa+YuQWo
>>> 	• dns://1.2.3.4;valid-for=_nodot,.some-company
>>> 
>>> I would like to propose to use a semicolon ';' as the separator between 
>>> a resolver address (or an URI template) and resolver parameters. Theoretically, 
>>> a DoH URI Template could contain a semicolon, but that should be very rare [1]. In such cases, the semicolon would be percent-encoded as "%3B".
>>> 
>>> Parameter explanation:
>>> 
>>> 	• ip - IP of the DoH resolver, used for bootstrapping,
>>> 	• root-cert - fingerprint of the root certificate of the 
>>> DoH server (specified in a similar way as in HTTP certificate pinning),
>>> 	• valid-for - which domain names should be resolved by this 
>>> server: in this example all names that do not contain a dot ("_nodot") [4] as well as all domains that end with ".some-company".
>>> 
>>> What do You think?
>>> 
>>> Greetings,
>>> 
>>> Mateusz
>>> 
>>> 
>>> 
>>> 
>>> 
>>> [1] A URI segment that begins with a semicolon is called a path parameter. An example (taken from [2]) would be:
>>> 
>>>         
>>> http://www.mysite.com/admin/UpdateUserServlet;jsessionid=OI24B9ASD7BSSD
>>> 
>>> 
>>> The URI template specification (RFC6570) supports expansion of path parameters with a syntax like:
>>> 
>>>         
>>> http://example.com/
>>> {;who}
>>> 
>>> [2] 
>>> https://doriantaylor.com/policy/http-url-path-parameter-syntax
>>> 
>>> 
>>> [3] The DoH specification requires that:
>>> 
>>>     "This protocol MUST be used with the https scheme URI [RFC7230]."
>>> 
>>> but I assume that using "doh://" does not break this as the statement is really 
>>> concerned with using encryption and not the "https://" string. 
>>> 
>>> [4] The first character is intentionally "_" because it cannot exist in valid domain names.
>>> 
>>> 
>>> 
>>> 
>>> 
>> --
>> Mark Nottingham   
>> https://www.mnot.net/
>> 
>> 
>> 
>> 
> _______________________________________________
> Doh mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/doh

--
Mark Nottingham   https://www.mnot.net/