Re: [Doh] [Ext] Fallback to untrusted DOH servers

[Ted Lemon <[e-mail]>]

Tom, it might be worth calling this working group's attention to the discussion that Cullen and I had a the DHC working group meeting a couple of years ago where Cullen was concerned because the working group didn't want to add certain DHCPv6 options, and the working group hadn't clearly articulated why that was.

The answer is that DHCP is good for configuring clients with options in cases where the motivation of the network operator and the consumer of a service or configuration provided by DHCP are in alignment, and not when they are not.   So for example you should never configure a host's SMTP submit server using DHCP, because the network operator may have motives other than being helpful for wanting to relay your SMTP traffic.

On the other hand, the network operator doesn't really have any motivation for sending you a wrong subnet mask, and while they may be interested in snooping your DNS traffic, the fact is that you need a DNS resolver to use the network unless you're going to do full recursive resolution on the host, so you pretty much have to either trust the network operator in this case.   IIRC Cullen rather effectively bashed me over the head with this example.

My point is that the DNS resolver is actually a very chancy example of a sensible DHCP option, and the more you think of the DNS resolver as a trusted service and the less you think of it as network infrastructure, the less sense it makes to configure it with DHCP (or, for that matter, ND).

Configuring a DoH server with DHCP seems to me, as I mentioned in a previous comment, to be a pretty questionable idea.   I do not support this work, because I think that it is counter to the goals of DoH generally.   The goal of DoH is to subvert the network operator's intentions with respect to DNS traffic.   That's completely incompatible with configuring DoH with DHCP (or RA).

The inability to reach your configured, trusted DoH server from the local network is an attack on the host.   You are trusting the thing that is attacking you to provide you with configuration information.   That just doesn't make sense.

If you really want to do this, the first step is to clearly state the threat model that you are addressing by providing DoH in this way, and to discuss all the threat models you are _not_ addressing by doing so.   And then compare this to the threat model that DoH-without-DHCP addresses, and see if there is actually any value added by the other solution.

It may be that there is value in automatically configuring DoH servers using network infrastructure.   If that's the case, we should try to clearly understand what the trust model is for such a configuration before proceeding to design the bits on the wire. :)