Re: [Masque] Unified CONNECT-IP document

> On Oct 21, 2021, at 2:11 PM, David Schinazi <dschinazi.ietf@gmail.com> wrote:
> 
> 
> 
> On Thu, Oct 21, 2021 at 2:05 PM Ben Schwartz <bemasc@google.com <mailto:bemasc@google.com>> wrote:
> 
> 
> On Thu, Oct 21, 2021 at 4:55 PM David Schinazi <dschinazi.ietf@gmail.com <mailto:dschinazi.ietf@gmail.com>> wrote:
> ... 
> I think our options for both CONNECT-IP and CONNECT-UDP are:
> 1) represent proxy via URI templates (what both drafts have today)
> 2) represent proxy via URL, and use explicit query parameters to convey host/port/etc information
> 3) represent proxy via URL, and use HTTP headers to convey host/port/etc information
>  
> Having recently implemented URI templates, I agree that there be dragons in (1). Between (2) and (3), I think that (3) is easier to implement and reason about personally.
> 
> That makes sense to me.  I don't have any strong preferences here; I just wanted to raise the issue.
> 
> Can I ask you to also raise the issue on GitHub? I think it makes sense to discuss this in the context of CONNECT-UDP at 112:
> https://github.com/ietf-wg-masque/draft-ietf-masque-connect-udp/issues/new <https://github.com/ietf-wg-masque/draft-ietf-masque-connect-udp/issues/new>
> 
> > If the target is a hostname, the server is expected to perform DNS resolution to determine which route(s) to advertise to the client.
> 
> This is fascinating, but perhaps underspecified.  I think the proxy SHOULD return route advertisements for _all_ addresses for the target name (in all families).  Then the client can implement racing and failover as appropriate.  (Also, some clients have policies that depend on whether two hostnames resolve to _overlapping_ RRSets, which requires them to learn all the addresses.)
> 
> I'm not sure I follow, can you elaborate?
> 
> Section 6.2 shows the proxy advertising a single IP address route for "server.example.com <http://server.example.com/>".  Section 4.1 says "route(s)", implying that the proxy might choose to advertise multiple routes to the target host, presumably because DNS resolution returned multiple A/AAAA records.
> 
> I see the current text as an implicit "MAY return all the IP addresses", and I'm suggesting an upgrade to SHOULD.
> 
> That makes sense to me. Esteemed co-authors, any thoughts on this?

Yes, I agree that it SHOULD return all addresses. I filed this: https://github.com/tfpauly/draft-age-masque-connect-ip/issues/37

Thanks,
Tommy
> 
> David 
> -- 
> Masque mailing list
> Masque@ietf.org
> https://www.ietf.org/mailman/listinfo/masque