[Masque] Comments on draft-age-masque-connect-ip-01

[Eric Rescorla <[e-mail]>]

This document seems like a reasonable starting point. Good to see
the authors converging. Some technical comments below.

Overall, I wonder if we should actually forbid the client from
using IP addresses in packets when the target is specified.
That would avoid goofy situations in which the client does

   CONNECT 192.0.2.1

And then sends to 192.0.2.2.


S 4.1.

   target:  The variable "target" contains a hostname or IP address of a
      specific host to which the client wants to proxy packets.  If the
      "target" variable is not specified, the client is requesting to
      communicate with any allowable host.  If the target is an IP
      address, the request will only support a single IP version.  If
      the target is a hostname, the server is expected to perform DNS
      resolution to determine which route(s) to advertise to the client.
      The server SHOULD send a ROUTE_ADVERTISEMENT capsule that includes
      routes for all usable resolved addresses for the requested
      hostname.

This treatment of DNS names seems like it's going to create a lot of
additional complexity: for instance, how does the client know which IP
to put in the dst field. You don't specify that the
ROUTE_ADVERTISEMENT MUST *only* include valid addresses. For instance,
suppose that the DNS name resolves to

  192.0.2.1
  192.0.2.2
  192.0.2.4 <-- No 192.0.2.3!
  192.0.2.5
  192.0.2.6
  192.0.2.7

and the server advertises 192.0.2.1-192.0.2.7.

Given that this is an IP layer mechanism, I would simply remove the
DNS option; clients can always do DNS over the tunnel.



S 4.2.
Is the server required to send ADDRESS_ASSIGN? If not, what is the
client supposed to use as it's source address? Also, what happens
if you only get a v6 address but need to talk to a v4 endpoint,
or vice versa.


S 4.2.3.
You should probably say something here about how in many cases
you shouldn't trust a ROUTE_ADVERTISEMENT. For instance, it's
incoherent for an ordinary consumer VPN client to start
advertising routes.