Re: [Masque] Unified CONNECT-IP document

[Ben Schwartz <[e-mail]>]

I like it!

Some minor notes:

After fighting with URI Templates for the past week or two, I'm less fond
of them than previously.  For example, they are specified to be unicode (in
unspecified representation), so any system for processing them needs to
consider unicode issues, even though this is almost always irrelevant.  In
DoH, I think they've mostly been more trouble than they're worth: despite
their enormous flexibility, all deployments that I'm aware of have just
tacked "{?dns}" onto the end of the URL.

I would consider specifying fixed query parameters and leaving it at that.
That would also allow a single URL to be used for CONNECT, CONNECT-UDP, and
CONNECT-IP, which seems valuable.

If URI templates are a must, I think we need some tweaks to harmonize
CONNECT-IP and CONNECT-UDP (e.g. "target" vs. "target_host").  A single
template could work for both!  You'll also probably want to copy RFC 8484's
prohibition on templating the origin.

> If the target is a hostname, the server is expected to perform DNS
resolution to determine which route(s) to advertise to the client.

This is fascinating, but perhaps underspecified.  I think the proxy SHOULD
return route advertisements for _all_ addresses for the target name (in all
families).  Then the client can implement racing and failover as
appropriate.  (Also, some clients have policies that depend on whether two
hostnames resolve to _overlapping_ RRSets, which requires them to learn all
the addresses.)

> The Start IP Address MUST be strictly lesser than the End IP Address.

I think this is an error.  It should be <=.


On Thu, Oct 21, 2021 at 1:52 PM David Schinazi <[e-mail]>
wrote:

> Thank you for all your work editing this document, Tommy.
> I'm personally very happy that we landed on a joint proposal that all of
> the known CONNECT-IP enthusiasts are happy with.
> I'd love to hear the WG's thoughts on this draft.
>
> David
>
> On Thu, Oct 21, 2021 at 9:31 AM Tommy Pauly <tpauly=
> [e-mail]> wrote:
>
>> Hello MASQUE WG,
>>
>> I’ve been working with the authors of the various CONNECT-IP protocol
>> proposals (draft-cms-masque-connect-ip, draft-kuehlewind-masque-connect-ip)
>> to write a shared document. We’ve just published the -00 version!
>>
>> https://www.ietf.org/archive/id/draft-age-masque-connect-ip-00.html
>>
>> We believe this represents the core functionality that various use cases
>> need for IP proxying. It allows proxying of full IP packets, and focuses on
>> defining options about assigning, routing, and filtering out the common
>> fields in the IP protocol headers (source and destination addresses, IP
>> version, IP protocol). Work on compressing, handling ICMP, etc, is left to
>> future documents.
>>
>> Please take a look at the document. It would be great to discuss this at
>> IETF 112, and see if the WG thinks this can be adopted as our starting
>> point.
>>
>> Best,
>> Tommy
>>
>> Begin forwarded message:
>>
>> *From: *[e-mail]
>> *Subject: **New Version Notification for
>> draft-age-masque-connect-ip-00.txt*
>> *Date: *October 21, 2021 at 9:22:16 AM PDT
>> *To: *Alex Chernyakhovsky <[e-mail]>, David Schinazi <
>> [e-mail]>, Magnus Westerlund <
>> [e-mail]>, Mirja Kuehlewind <
>> [e-mail]>, Tommy Pauly <[e-mail]>
>>
>>
>> A new version of I-D, draft-age-masque-connect-ip-00.txt
>> has been successfully submitted by Tommy Pauly and posted to the
>> IETF repository.
>>
>> Name: draft-age-masque-connect-ip
>> Revision: 00
>> Title: IP Proxying Support for HTTP
>> Document date: 2021-10-21
>> Group: Individual Submission
>> Pages: 20
>> URL:
>> https://www.ietf.org/archive/id/draft-age-masque-connect-ip-00.txt
>> Status:
>> https://datatracker.ietf.org/doc/draft-age-masque-connect-ip/
>> Html:
>> https://www.ietf.org/archive/id/draft-age-masque-connect-ip-00.html
>> Htmlized:
>> https://datatracker.ietf.org/doc/html/draft-age-masque-connect-ip
>>
>>
>> Abstract:
>>   This document describes a method of proxying IP packets over HTTP.
>>   This protocol is similar to CONNECT-UDP, but allows transmitting
>>   arbitrary IP packets, without being limited to just TCP like CONNECT
>>   or UDP like CONNECT-UDP.
>>
>>
>>
>>
>> The IETF Secretariat
>>
>>
>>
>> --
>> Masque mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/masque
>>
> --
> Masque mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/masque
>