Re: HTTP Proxy-Status Parameter for Next-Hop Aliases

[Erik Nygren <[e-mail]>]

I'd agree that HTTP makes more sense since this seems generally useful for
proxies.

I'd be in-favor of the HTTP WG doing this.  I think it will be important
to loop in DNSOP and/or the new DNS Directorate in as well since there
may be some important corner-cases from them to consider.

Some thoughts also opened at:
https://github.com/tfpauly/privacy-proxy/issues/229
https://github.com/tfpauly/privacy-proxy/issues/230

1) Per draft-ietf-dnsop-svcb-https-11 section 3.2 clients MUST send the
final TargetName to proxies:
https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-11#section-3.2
Proxies themselves shouldn't be doing SVCB/HTTPS RR lookups to get A/AAAA
records.
As such, draft-pauly-httpbis-alias-proxy-status only needs to look at CNAME
chains.

2) Is any special handling needed for exposing DNAMEs? Or are those not
visible to resolver libraries.  I think the latter, but not sure.

These might also be worth considering, although we might decide they are
too much complexity:

3) One of the use-cases for draft-pauly-httpbis-alias-proxy-status may be
for influencing connection coalescing behaviors. Since some clients use "is
the IP address that the proxy is connecting to overlapping with the
rrset(s) used by other connections" having the full IP address rrset lists
for A and AAAA responses might be worthwhile.

4) We may want to allow listing all IP addresses tried before establishing
the connection. (eg, a TCP proxy might implement happy eyeballs and/or
fail-over between multiple IP addresses.) Knowing which others were tried
but not used (when possible) might help for some of the abuse/use cases.

Best, Erik





> Hello HTTP,
>
> Following up on this discussion, I presented this at Masque at IETF 115, and got the feedback that this would be fit more in HTTP, and also that it should just be a simpler proxy-status parameter to include only the alias name chain (generally, the CNAME chain).
>
> I’ve revised the document, and it’s super short — just defining a “next-hop-aliases” parameter, which is a list of names.
>
> https://www.ietf.org/archive/id/draft-pauly-httpbis-alias-proxy-status-00.htmlhttps://datatracker.ietf.org/doc/draft-pauly-httpbis-alias-proxy-status/
>
> There was also discussion in the meeting about having more work on broader solutions to get rich and complex DNS information back from proxies, but I’d like to get this simple proxy-status parameter registered separately. I’d appreciate people’s reviews and thoughts.
>
> Thanks,
> Tommy
>
> On Oct 12, 2022, at 4:02 PM, Mark Nottingham <[e-mail] <[e-mail]?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>> wrote:
>
> Speaking personally -- I don't have any strong feelings either way, as long as appropriate communication happens. If the use cases are for non-MASQUE proxying too (and it seems like they are), that might tilt it slightly towards HTTP.
>
> Cheers,
>
>
>> On 11 Oct 2022, at 2:46 am, Tommy Pauly <[e-mail] <[e-mail]?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>> wrote:
>>
>> Hi HTTP,
>>
>> I wanted to share this draft with this group, which I’ve initially started discussion on in MASQUE.
>>
>> It’s a simple parameter addition to proxy-status, to let the proxy send back the IP and CNAME/alias chain it used to reach the next hop. This is useful for clients of CONNECT/CONNECT-UDP proxies that want to apply policies to specific IPs and CNAMEs (for tracker detection, cookie rules, etc).
>>
>> In addition to any reviews and feedback on the technical content, we’d like to know if this is something that the HTTPbis WG would like to own, or if it is fine letting the work happen in MASQUE and get review from HTTP.
>>
>> Best,
>> Tommy
>>
>>> Begin forwarded message:
>>>
>>> From: Tommy Pauly <tpauly=[e-mail] <tpauly=[e-mail]?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>>
>>> Subject: [Masque] HTTP Proxy-Status Parameter for DNS Information
>>> Date: October 4, 2022 at 12:29:33 PM PDT
>>> To: [e-mail] <[e-mail]?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>
>>>
>>> Hello MASQUErs,
>>>
>>> I wanted to share this document with this group, since it is mainly applicable to MASQUE-style (CONNECT/CONNECT-UDP) proxies.
>>>
>>> Right now, when a client connects to a TCP or UDP server via the proxy using a hostname in the request, it doesn’t perform its own DNS, and thus doesn’t learn about the IP address of the server it ultimately is connected to, or the CNAME / AliasMode chain that was used to get to the IP address of the server. That’s generally fine, but there are use cases where clients may want to know the IP address or CNAMEs to detect cases where trackers are performing CNAME cloaking, etc.
>>>
>>> So, this is a very simple proposal to define a new, optional proxy-status parameter that can let MASQUE-style proxies tell clients about the IP address and CNAME chain from DNS.
>>>
>>> https://www.ietf.org/archive/id/draft-pauly-masque-dns-proxy-status-00.html
>>>
>>> This certainly does not solve all of the use cases where clients may want to know more DNS details (SVCB/HTTPS records for ECH, alpn support, etc), and I expect more work to be needed for those use cases. However, I believe this extra bit of information is something that is incrementally useful, easy to implement, and simple to define.
>>>
>>> Thoughts and feedback welcome!
>>>
>>> Thanks,
>>> Tommy
>>>
>>>> Begin forwarded message:
>>>>
>>>> From: [e-mail] <[e-mail]?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>
>>>> Subject: New Version Notification for draft-pauly-masque-dns-proxy-status-00.txt
>>>> Date: October 4, 2022 at 11:01:29 AM PDT
>>>> To: Tommy Pauly <[e-mail] <[e-mail]?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>>
>>>>
>>>>
>>>> A new version of I-D, draft-pauly-masque-dns-proxy-status-00.txt
>>>> has been successfully submitted by Tommy Pauly and posted to the
>>>> IETF repository.
>>>>
>>>> Name:		draft-pauly-masque-dns-proxy-status
>>>> Revision:	00
>>>> Title:		HTTP Proxy-Status Parameter for DNS Information
>>>> Document date:	2022-10-04
>>>> Group:		Individual Submission
>>>> Pages:		5
>>>> URL:            https://www.ietf.org/archive/id/draft-pauly-masque-dns-proxy-status-00.txt
>>>> Status:         https://datatracker.ietf.org/doc/draft-pauly-masque-dns-proxy-status/
>>>> Html:           https://www.ietf.org/archive/id/draft-pauly-masque-dns-proxy-status-00.html
>>>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-pauly-masque-dns-proxy-status
>>>>
>>>>
>>>> Abstract:
>>>>  This document defines an HTTP Proxy-Status Parameter that contains
>>>>  the IP address and CNAME chain received over DNS that was used to
>>>>  establish the connection to the next hop.
>>>>
>>>> Discussion Venues
>>>>
>>>>  This note is to be removed before publishing as an RFC.
>>>>
>>>>  Source for this draft and an issue tracker can be found at
>>>>  https://github.com/tfpauly/privacy-proxy.
>>>>
>>>>
>>>>
>>>>
>>>> The IETF Secretariat
>>>>
>>>>
>>>
>>> --
>>> Masque mailing list
>>> [e-mail] <[e-mail]?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>
>>> https://www.ietf.org/mailman/listinfo/masque
>>
>
> --
> Mark Nottingham   https://www.mnot.net/
>