[Doh] Proposal: DNS configuration string

[Mateusz Jończyk <[e-mail]>]

There are many configuration parameters involved in DoH.
After encapsulating them in a single string, it is easier for the user
to set a custom DoH resolver, among other benefits (which I
elaborated on in the original e-mail).

W dniu 03.06.2019 o 00:53, Mark Nottingham pisze:

> Why not just convey this separately -- why does it have to be in the URL?
>
>> On 2 Jun 2019, at 7:44 pm, Mateusz Jończyk <[e-mail]> wrote:
>>
>> Signed PGP part
>> Hello,
>>
>> Currently, there are multiple ways of resolving DNS queries:
>>
>> 	• old port-53 DNS,
>> 	• DNS over TLS,/
>> 	• DNS over HTTPS.
>> Some of these accept additional parameters, such as server certificate information 
>> (which may be necessary when using local DoH / DoT servers). These parameters are 
>> server-specific --- when configuring multiple servers, each of them may need 
>> different certificate information.
>>
>> I would argue that it would be beneficial to embed all such parameters into a 
>> single server specification string. The user would be able to copy-paste them, 
>> for example from the website of their chosen DNS resolver, a file provided by 
>> their sysadmin or from their router configuration GUI. A DHCP server could advertise 
>> the string in a single field. Additionally, an application could pass the whole 
>> string to a DNS-handling library. That way the application would not have to 
>> implement support for all DNS configuration parameters on its own (with complex 
>> GUIs) and new parameters (or even new DNS resolver types) could be supported by 
>> the program after a library upgrade. This would also simplify configuration file 
>> structure (allowing for a single server per line).
>>
>> Some examples [3]:
>>
>> 	• doh://dnsserver.example.net/dns-query{?dns};ip=1.2.3.4;root-cert=zdYsea0CQufOmBpLdLfu/q3tOOdxbBCuZNhAa+YuQWo
>> 	• dns://1.2.3.4;valid-for=_nodot,.some-company
>>
>> I would like to propose to use a semicolon ';' as the separator between 
>> a resolver address (or an URI template) and resolver parameters. Theoretically, 
>> a DoH URI Template could contain a semicolon, but that should be very rare [1]. In such cases, the semicolon would be percent-encoded as "%3B".
>>
>> Parameter explanation:
>>
>> 	• ip - IP of the DoH resolver, used for bootstrapping,
>> 	• root-cert - fingerprint of the root certificate of the 
>> DoH server (specified in a similar way as in HTTP certificate pinning),
>> 	• valid-for - which domain names should be resolved by this 
>> server: in this example all names that do not contain a dot ("_nodot") [4] as well as all domains that end with ".some-company".
>>
>> What do You think?
>>
>> Greetings,
>>
>> Mateusz
>>
>>
>>
>>
>>
>> [1] A URI segment that begins with a semicolon is called a path parameter. An example (taken from [2]) would be:
>>
>>         http://www.mysite.com/admin/UpdateUserServlet;jsessionid=OI24B9ASD7BSSD
>>
>> The URI template specification (RFC6570) supports expansion of path parameters with a syntax like:
>>
>>         http://example.com/{;who}
>>
>> [2] https://doriantaylor.com/policy/http-url-path-parameter-syntax
>>
>> [3] The DoH specification requires that:
>>
>>     "This protocol MUST be used with the https scheme URI [RFC7230]."
>>
>> but I assume that using "doh://" does not break this as the statement is really 
>> concerned with using encryption and not the "https://" string. 
>>
>> [4] The first character is intentionally "_" because it cannot exist in valid domain names.
>>
>>
>>
>>
> --
> Mark Nottingham   https://www.mnot.net/
>
>