Re: HTTP Proxy-Status Parameter for Next-Hop Aliases

[Glenn Strauss <[e-mail]>]

On Wed, Nov 30, 2022 at 02:13:12PM -0800, Tommy Pauly wrote:
> Hello HTTP,
> 
> Following up on this discussion, I presented this at Masque at IETF 115, and got the feedback that this would be fit more in HTTP, and also that it should just be a simpler proxy-status parameter to include only the alias name chain (generally, the CNAME chain).
> 
> I’ve revised the document, and it’s super short — just defining a “next-hop-aliases” parameter, which is a list of names.
> 
> https://www.ietf.org/archive/id/draft-pauly-httpbis-alias-proxy-status-00.html
> https://datatracker.ietf.org/doc/draft-pauly-httpbis-alias-proxy-status/
> 
> There was also discussion in the meeting about having more work on broader solutions to get rich and complex DNS information back from proxies, but I’d like to get this simple proxy-status parameter registered separately. I’d appreciate people’s reviews and thoughts.


My first impression is that this is similar to RFC 7239 Forwarded,
but in the reverse direction and more limited to a single hop.  Also,
RFC 9110 "Via" does not seem extensible enough for the proposed use.

Should Proxy-Status syntax be similar to Forwarded?
Should Proxy-Status permit more than one (forward) hop?

I like that Forwarded has extensible params per hop.
However, Forwarded is not permitted in response headers,
and is not recommended for use when TRACE is enabled.

https://datatracker.ietf.org/doc/html/rfc7239#section-4
RFC 7239 Forwarded
Section 4
"Forwarded" is only for use in HTTP requests and is not to be used in HTTP responses.

Cheers, Glenn


> > On Oct 12, 2022, at 4:02 PM, Mark Nottingham <[e-mail]> wrote:
> > 
> > Speaking personally -- I don't have any strong feelings either way, as long as appropriate communication happens. If the use cases are for non-MASQUE proxying too (and it seems like they are), that might tilt it slightly towards HTTP.
> > 
> > Cheers,
> > 
> > 
> >> On 11 Oct 2022, at 2:46 am, Tommy Pauly <[e-mail]> wrote:
> >> 
> >> Hi HTTP,
> >> 
> >> I wanted to share this draft with this group, which I’ve initially started discussion on in MASQUE.
> >> 
> >> It’s a simple parameter addition to proxy-status, to let the proxy send back the IP and CNAME/alias chain it used to reach the next hop. This is useful for clients of CONNECT/CONNECT-UDP proxies that want to apply policies to specific IPs and CNAMEs (for tracker detection, cookie rules, etc).
> >> 
> >> In addition to any reviews and feedback on the technical content, we’d like to know if this is something that the HTTPbis WG would like to own, or if it is fine letting the work happen in MASQUE and get review from HTTP.
> >> 
> >> Best,
> >> Tommy
> >> 
> >>> Begin forwarded message:
> >>> 
> >>> From: Tommy Pauly <tpauly=[e-mail]>
> >>> Subject: [Masque] HTTP Proxy-Status Parameter for DNS Information
> >>> Date: October 4, 2022 at 12:29:33 PM PDT
> >>> To: [e-mail]
> >>> 
> >>> Hello MASQUErs,
> >>> 
> >>> I wanted to share this document with this group, since it is mainly applicable to MASQUE-style (CONNECT/CONNECT-UDP) proxies.
> >>> 
> >>> Right now, when a client connects to a TCP or UDP server via the proxy using a hostname in the request, it doesn’t perform its own DNS, and thus doesn’t learn about the IP address of the server it ultimately is connected to, or the CNAME / AliasMode chain that was used to get to the IP address of the server. That’s generally fine, but there are use cases where clients may want to know the IP address or CNAMEs to detect cases where trackers are performing CNAME cloaking, etc.
> >>> 
> >>> So, this is a very simple proposal to define a new, optional proxy-status parameter that can let MASQUE-style proxies tell clients about the IP address and CNAME chain from DNS.
> >>> 
> >>> https://www.ietf.org/archive/id/draft-pauly-masque-dns-proxy-status-00.html
> >>> 
> >>> This certainly does not solve all of the use cases where clients may want to know more DNS details (SVCB/HTTPS records for ECH, alpn support, etc), and I expect more work to be needed for those use cases. However, I believe this extra bit of information is something that is incrementally useful, easy to implement, and simple to define.
> >>> 
> >>> Thoughts and feedback welcome!
> >>> 
> >>> Thanks,
> >>> Tommy
> >>> 
> >>>> Begin forwarded message:
> >>>> 
> >>>> From: [e-mail]
> >>>> Subject: New Version Notification for draft-pauly-masque-dns-proxy-status-00.txt
> >>>> Date: October 4, 2022 at 11:01:29 AM PDT
> >>>> To: Tommy Pauly <[e-mail]>
> >>>> 
> >>>> 
> >>>> A new version of I-D, draft-pauly-masque-dns-proxy-status-00.txt
> >>>> has been successfully submitted by Tommy Pauly and posted to the
> >>>> IETF repository.
> >>>> 
> >>>> Name:		draft-pauly-masque-dns-proxy-status
> >>>> Revision:	00
> >>>> Title:		HTTP Proxy-Status Parameter for DNS Information
> >>>> Document date:	2022-10-04
> >>>> Group:		Individual Submission
> >>>> Pages:		5
> >>>> URL:            https://www.ietf.org/archive/id/draft-pauly-masque-dns-proxy-status-00.txt
> >>>> Status:         https://datatracker.ietf.org/doc/draft-pauly-masque-dns-proxy-status/
> >>>> Html:           https://www.ietf.org/archive/id/draft-pauly-masque-dns-proxy-status-00.html
> >>>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-pauly-masque-dns-proxy-status
> >>>> 
> >>>> 
> >>>> Abstract:
> >>>>  This document defines an HTTP Proxy-Status Parameter that contains
> >>>>  the IP address and CNAME chain received over DNS that was used to
> >>>>  establish the connection to the next hop.
> >>>> 
> >>>> Discussion Venues
> >>>> 
> >>>>  This note is to be removed before publishing as an RFC.
> >>>> 
> >>>>  Source for this draft and an issue tracker can be found at
> >>>>  https://github.com/tfpauly/privacy-proxy.
> >>>> 
> >>>> 
> >>>> 
> >>>> 
> >>>> The IETF Secretariat
> >>>> 
> >>>> 
> >>> 
> >>> -- 
> >>> Masque mailing list
> >>> [e-mail]
> >>> https://www.ietf.org/mailman/listinfo/masque
> >> 
> > 
> > --
> > Mark Nottingham   https://www.mnot.net/
> > 
>