Re: [homenet] Adam Roach's No Objection on draft-ietf-homenet-dot-12: (with COMMENT)

[Adam Roach <[e-mail]>]

Thanks. Both changes look good to me.

/a

On 8/30/17 11:25, Ted Lemon wrote:
> Argh, I spaced out on doing these changes because the security review 
> was so extensive.   Sorry about that.   I'm making changes to my 
> version of the document, but I will refrain from further confusing the 
> datatracker—assuming that this document is approved tomorrow, I can 
> submit an update with these changes and any others that come up on the 
> telechat.
>
>> On Aug 28, 2017, at 11:18 PM, Adam Roach <[e-mail] 
>> <mailto:[e-mail]>> wrote:
>> Oh! That makes a lot more sense -- I should have chased down that 
>> section in 6761. I think what's tripping me up is the introduction in 
>> the homenet-dot draft: "This section defines the behavior of systems 
>> involved in domain name resolution when resolving queries for names 
>> ending with '.home.arpa.' (as per [RFC6761])." -- it would be clearer 
>> if it said something more like "This section reserves the 
>> '.home.arpa.' subdomain according to the procedures outlined in 
>> [RFC6761] section 4."
>
> The requirement to put this in the IANA considerations section is 
> actually probably a bad idea, because it would create a lot of 
> irrelevant chaff for the IANA to parse through.   I think it was 
> well-intended, but I've never actually seen it done this way in 
> previous RFC 6761 allocations.   That said, your basic point is 
> correct—there should be a better explanation of what's going on in 
> this section.   I've updated the introductory text for this section as 
> follows:
>
> This section specifies considerations for systems involved in domain 
> name resolution
> when resolving queries for names ending with '.home.arpa.'.  Each 
> items in this section
> addresses some aspect of the DNS or the process of resolving domain 
> names that would be
> affected by this special use allocation.  Detailed explanations of 
> these items can be
> found in <xref target="RFC6761"/>, Section 5.
>
>
>>>> With the explanation in section 6:
>>>>
>>>>   it may be useful for the resolver to identify different
>>>>   homenets on which it has resolved names
>>>>
>>>> Doesn't this mitigation in the security section require name resolution
>>>> libraries to recognize names that end in ".home.arpa." as special 
>>>> so that it
>>>> can treat them differently?
>>>
>>> Section 6 is talking about future work. If we come up with a way to 
>>> do this, then it would update this document, changing the normative 
>>> requirement.
>>
>>
>> To me, this reads as something that could be done unilaterally by the 
>> local resolver according to their own reasonable notion of what the 
>> proper mitigations might be here. I would suggest rephrasing to make 
>> it clearer that this suggestion pertains to _future_ work; e.g., "To 
>> prevent this from happening, future documents may define behavior 
>> that allows resolvers to identify and distinguish among different 
>> homenets on which they have resolved names, and take appropriate 
>> measures to avoid such confusion."
>>
>>
> Yup, that makes sense.   Proposed update:
>
>  To prevent this from happening, it could be useful for the resolver 
> to securely
>  differentiate between different homenets, and between identical names 
> on different
>  homenets.  However, a mechanism for doing this has not yet been 
> standardized, and
>  doing so is out of scope for this document.  It is expected that this 
> will be explored in
>  future work.
>
> OK?
>