IETF Logo Mail Archive

Re: [Doh] Eric Rescorla's No Objection on draft-ietf-doh-dns-over-https-13: (with COMMENT)

Patrick McManus <pmcmanus@mozilla.com> Mon, 13 August 2018 21:44 UTC

Return-Path: <pmcmanus@mozilla.com>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 01AF31310DE; Mon, 13 Aug 2018 14:44:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.233
X-Spam-Level:
X-Spam-Status: No, score=-1.233 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_SOFTFAIL=0.665, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jmXSc48nItBl; Mon, 13 Aug 2018 14:44:23 -0700 (PDT)
Received: from linode64.ducksong.com (linode6only.ducksong.com [IPv6:2600:3c02::f03c:91ff:fe6e:e8da]) by ietfa.amsl.com (Postfix) with ESMTP id 272F01310F0; Mon, 13 Aug 2018 14:44:23 -0700 (PDT)
Received: from mail-oi0-f43.google.com (mail-oi0-f43.google.com [209.85.218.43]) by linode64.ducksong.com (Postfix) with ESMTPSA id 5444D3A019; Mon, 13 Aug 2018 17:44:19 -0400 (EDT)
Received: by mail-oi0-f43.google.com with SMTP id m11-v6so30028056oic.2; Mon, 13 Aug 2018 14:44:19 -0700 (PDT)
X-Gm-Message-State: AOUpUlE1RfHc4kwR61ZELWmSTpuqWWHdEQXEU8zsltBU3WzuVVj3TcBU 99VOW1kRvzkeGdXNhsdoALbx/tOLnFYkBjI3Eck=
X-Google-Smtp-Source: AA+uWPyFwj9vi3eJLu4BqrfDS8WJyc7EgEHovWKtubLGa8edJP4yQLJ5AxVi2J0HbxKbNZaTMNEhde3BuqjBz2sMHtE=
X-Received: by 2002:aca:e80c:: with SMTP id f12-v6mr21327566oih.38.1534196659077; Mon, 13 Aug 2018 14:44:19 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a4a:4a43:0:0:0:0:0 with HTTP; Mon, 13 Aug 2018 14:44:17 -0700 (PDT)
In-Reply-To: <CABcZeBOR7b_wmuWXj+QPLAo2TO5QATnDu=TDjXT6CUNoSKdAQg@mail.gmail.com>
References: <153418872923.25024.16784643673174920377.idtracker@ietfa.amsl.com> <451ADADC-1315-4227-A144-7CF7C1E1E666@vpnc.org> <CABcZeBOR7b_wmuWXj+QPLAo2TO5QATnDu=TDjXT6CUNoSKdAQg@mail.gmail.com>
From: Patrick McManus <pmcmanus@mozilla.com>
Date: Mon, 13 Aug 2018 17:44:17 -0400
X-Gmail-Original-Message-ID: <CAOdDvNog+MdWejH9XFyiypm9E1yyVrKZBJeZAi5qHehYT=s7pg@mail.gmail.com>
Message-ID: <CAOdDvNog+MdWejH9XFyiypm9E1yyVrKZBJeZAi5qHehYT=s7pg@mail.gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
Cc: Paul Hoffman <paul.hoffman@vpnc.org>, The IESG <iesg@ietf.org>, draft-ietf-doh-dns-over-https@ietf.org, DoH WG <doh@ietf.org>, doh-chairs@ietf.org
Content-Type: multipart/alternative; boundary="000000000000e14b0a057357fe3c"
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/Tch3LNY-9EkTCb0tMti8P2t3dtw>
Subject: Re: [Doh] Eric Rescorla's No Objection on draft-ietf-doh-dns-over-https-13: (with COMMENT)
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Aug 2018 21:44:26 -0000

On Mon, Aug 13, 2018 at 4:27 PM, Eric Rescorla <ekr@rtfm.com> wrote:

>
>
>> S 4.
>>>
>>>>      offers an unsolicited response that appears to be a valid answer
>>>> to a
>>>>      DNS query.  This specification does not extend DNS resolution
>>>>      privileges to URIs that are not recognized by the DoH client as
>>>>      configured URIs.  Such scenarios may create additional operational,
>>>>      tracking, and security hazards that require limitations for safe
>>>>      usage.  A future specification may support this use case.
>>>>
>>>
>>> I am having some trouble understanding what you are prohibiting here.
>>>
>>
>> I send an query to https://www.ekrexample.com/ over HTTP/2. During that
>> HTTP/2 session, I get a DoH request/response pair from that origin.
>> https://www.ekrexample.com/ is not in the list of configured URIs
>> allowed for DoH for this client. I MUST NOT do anything with that DoH
>> request/response.
>>
>
> How would you get a DoH request/response pair from that origin? Via push?
>

The text primarily envisions push, but I believe a application/dns-message
response to a 'pull' request could create havoc if placed in a DNS cache
(not an HTTP cache) automagically because of the media type (independent of
the URI requested). Dns responses contain the dns question, so this isn't
impossible.

v2.8.7 | Report a Bug | By Email