Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh

"A. Schulze" <sca@andreasschulze.de> Wed, 16 January 2019 18:17 UTC

Return-Path: <sca@andreasschulze.de>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B537B130E1C for <doh@ietfa.amsl.com>; Wed, 16 Jan 2019 10:17:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.3
X-Spam-Level:
X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=andreasschulze.de header.b=gN0zN2fE; dkim=pass (2048-bit key) header.d=andreasschulze.de header.b=qjpaWPXi
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1DxCM9VOr-0K for <doh@ietfa.amsl.com>; Wed, 16 Jan 2019 10:16:57 -0800 (PST)
Received: from mta.somaf.de (mta.somaf.de [IPv6:2001:470:77b3:103::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACC22130E0E for <doh@ietf.org>; Wed, 16 Jan 2019 10:16:57 -0800 (PST)
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=andreasschulze.de; i=@andreasschulze.de; q=dns/txt; s=ed25519; t=1547662612; h=subject : to : references : from : message-id : date : mime-version : in-reply-to : content-type : content-transfer-encoding : subject : from : date; bh=sY+fbxp3LvF822WOTj/s5iWtTeUMufDEB6ljcqU5How=; b=gN0zN2fEq1SDI8qjUPSvfxL+kslciAfa2yT5UphFOD0XTfvqGW0HJqmB EfOK6Yqfm1dEAr5JDRaWIq2stsrXCg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=andreasschulze.de; s=20181220-DFA7; t=1547662612; x=1552662612; bh=sY+fbxp3LvF822WOTj/s5iWtTeUMufDEB6ljcqU5How=; h=Subject:To:References:From:Message-ID:Date:In-Reply-To: Content-Type:from:reply-to:subject:date:to:cc:content-type: message-id; b=qjpaWPXiQZmeLFelm9kw4rxhcPFkadOYnT6ZnQy20AWxS+Q8/N5LLIfzg2EboDWDm xhbFgfkA+g81tn1SKFIkH//OVpy9D3H32fHuipcapwNC3UApQU3F6BRZoDJJshpNcD UZggyrwbJS+naPRwon2fmlwqljIecCK4Hwd+Ljv5iJSLsskjR+QVNf4uf1Q7a2R2k8 Ezsvz/81viDrl/2auKkGRQ/v6Gf1IEH55CMLc9yBDp6BPljQWG/M33rPKRRlAInzEt zvChUem0doG/gC55hUp1qEWs3si5bWoShu9rXfuLr/mUMUUon8uh5P3oG69zPaq4vO uX14AQCbR6VNA==
To: doh@ietf.org
References: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org>
From: "A. Schulze" <sca@andreasschulze.de>
Openpgp: preference=signencrypt
Message-ID: <6f2860bd-2a7f-01b5-2ec9-9667d71e3f38@andreasschulze.de>
Date: Wed, 16 Jan 2019 19:16:14 +0100
MIME-Version: 1.0
In-Reply-To: <8999D6F3-600E-4F1A-903C-10F8CAA6E4F3@icann.org>
Content-Type: text/plain; charset=windows-1252
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/vHHVesqi5nFLrT3j7wDv66Jfu2s>
Subject: Re: [Doh] Request for the DOH WG to adopt draft-hoffman-resolver-associated-doh
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Jan 2019 18:17:01 -0000


Am 16.01.19 um 01:25 schrieb Paul Hoffman:
> So, does this WG want to adopt this as a work item?

Hello,

adopt "DoH Servers by TXT" using unbound is fairly simple.
Maybe someone could verify that config.

unbound.conf:
	# option 1:
	# resolver that understands this protocol but has no associated DoH server
	server:
	 local-data: 'resolver-associated-doh.arpa. TXT ""'

	# option 2:
	# resolver that understands this protocol and has one associated DoH server
	server:
	 local-data: 'resolver-associated-doh.arpa. TXT "https://doh.example/"'

	# option 3:
	# resolver that understands this protocol and has multiple associated DoH server
	server:
	 local-data: 'resolver-associated-doh.arpa. TXT "https://doh01.example/"'
	 local-data: 'resolver-associated-doh.arpa. TXT "https://doh02.example/"'

The second suggestion "DoH Servers by Addresses" isn't attractive to me.
Getting a certificate for an IP isn't common these days.

https://IPADDRESSGOESHERE/ -> Ask your favorite CA to issue a certificate for "IPADDRESSGOESHERE"...

also: 
 * https://[2001:db8::53]/ -> Address in []
 * Certificate SAN Entry   -> Address without []
can this work with IPv6? I simply never tried that...

I agree with Ralf on defining something similar for DoT, too

Andreas