[Masque] DNS in connect-ip

[David Schinazi <[e-mail]>]

Hi fellow enthusiasts,

Some colleagues recently reached out to me asking about implementing
connect-ip into their platform as a VPN client, next to their IKEv2/IPsec
implementation. However, they rapidly found that connect-ip didn't have a
way to communicate DNS servers in-band, and that's a pretty important
feature that almost every VPN protocol supports. Back when we standardized
connect-ip, we had decided to not put it in RFC 9484 and that we'd do it
later as an extension. Now that there's implementer interest, I think it
would make sense for us to work on this. So I wrote up a quick draft about
this:
https://datatracker.ietf.org/doc/draft-schinazi-masque-connect-ip-dns/

The chairs have gracefully accepted that I present this in the as-time
presents section of the agenda today. I wouldn't expect anyone to have read
the draft by then, and I'll cover the overall idea in the presentation to
gauge interest, but I thought I'd still post it in case someone's bored
between now and the session later today.

Cheers,
David