Re: [Masque] Unified CONNECT-IP document

On Thu, Oct 21, 2021 at 1:44 PM Ben Schwartz <bemasc@google.com> wrote:

> I like it!
>

Thanks Ben! Responses inline.
David

Some minor notes:
>
> After fighting with URI Templates for the past week or two, I'm less fond
> of them than previously.  For example, they are specified to be unicode (in
> unspecified representation), so any system for processing them needs to
> consider unicode issues, even though this is almost always irrelevant.  In
> DoH, I think they've mostly been more trouble than they're worth: despite
> their enormous flexibility, all deployments that I'm aware of have just
> tacked "{?dns}" onto the end of the URL.
>
> I would consider specifying fixed query parameters and leaving it at
> that.  That would also allow a single URL to be used for CONNECT,
> CONNECT-UDP, and CONNECT-IP, which seems valuable.
>
> If URI templates are a must, I think we need some tweaks to harmonize
> CONNECT-IP and CONNECT-UDP (e.g. "target" vs. "target_host").  A single
> template could work for both!  You'll also probably want to copy RFC 8484's
> prohibition on templating the origin.
>

Our idea here was to align with CONNECT-UDP, but your points apply equally
there. I think our options for both CONNECT-IP and CONNECT-UDP are:
1) represent proxy via URI templates (what both drafts have today)
2) represent proxy via URL, and use explicit query parameters to convey
host/port/etc information
3) represent proxy via URL, and use HTTP headers to convey host/port/etc
information

Having recently implemented URI templates, I agree that there be dragons in
(1). Between (2) and (3), I think that (3) is easier to implement and
reason about personally.

> If the target is a hostname, the server is expected to perform DNS
> resolution to determine which route(s) to advertise to the client.
>
> This is fascinating, but perhaps underspecified.  I think the proxy SHOULD
> return route advertisements for _all_ addresses for the target name (in all
> families).  Then the client can implement racing and failover as
> appropriate.  (Also, some clients have policies that depend on whether two
> hostnames resolve to _overlapping_ RRSets, which requires them to learn all
> the addresses.)
>

I'm not sure I follow, can you elaborate?

> The Start IP Address MUST be strictly lesser than the End IP Address.
>
> I think this is an error.  It should be <=.
>

Indeed, nice catch. I fixed it in the editor's copy.

On Thu, Oct 21, 2021 at 1:52 PM David Schinazi <dschinazi.ietf@gmail.com>
> wrote:
>
>> Thank you for all your work editing this document, Tommy.
>> I'm personally very happy that we landed on a joint proposal that all of
>> the known CONNECT-IP enthusiasts are happy with.
>> I'd love to hear the WG's thoughts on this draft.
>>
>> David
>>
>> On Thu, Oct 21, 2021 at 9:31 AM Tommy Pauly <tpauly=
>> 40apple.com@dmarc.ietf.org> wrote:
>>
>>> Hello MASQUE WG,
>>>
>>> I’ve been working with the authors of the various CONNECT-IP protocol
>>> proposals (draft-cms-masque-connect-ip, draft-kuehlewind-masque-connect-ip)
>>> to write a shared document. We’ve just published the -00 version!
>>>
>>> https://www.ietf.org/archive/id/draft-age-masque-connect-ip-00.html
>>>
>>> We believe this represents the core functionality that various use cases
>>> need for IP proxying. It allows proxying of full IP packets, and focuses on
>>> defining options about assigning, routing, and filtering out the common
>>> fields in the IP protocol headers (source and destination addresses, IP
>>> version, IP protocol). Work on compressing, handling ICMP, etc, is left to
>>> future documents.
>>>
>>> Please take a look at the document. It would be great to discuss this at
>>> IETF 112, and see if the WG thinks this can be adopted as our starting
>>> point.
>>>
>>> Best,
>>> Tommy
>>>
>>> Begin forwarded message:
>>>
>>> *From: *internet-drafts@ietf.org
>>> *Subject: **New Version Notification for
>>> draft-age-masque-connect-ip-00.txt*
>>> *Date: *October 21, 2021 at 9:22:16 AM PDT
>>> *To: *Alex Chernyakhovsky <achernya@google.com>, David Schinazi <
>>> dschinazi.ietf@gmail.com>, Magnus Westerlund <
>>> magnus.westerlund@ericsson.com>, Mirja Kuehlewind <
>>> mirja.kuehlewind@ericsson.com>, Tommy Pauly <tpauly@apple.com>
>>>
>>>
>>> A new version of I-D, draft-age-masque-connect-ip-00.txt
>>> has been successfully submitted by Tommy Pauly and posted to the
>>> IETF repository.
>>>
>>> Name: draft-age-masque-connect-ip
>>> Revision: 00
>>> Title: IP Proxying Support for HTTP
>>> Document date: 2021-10-21
>>> Group: Individual Submission
>>> Pages: 20
>>> URL:
>>> https://www.ietf.org/archive/id/draft-age-masque-connect-ip-00.txt
>>> Status:
>>> https://datatracker.ietf.org/doc/draft-age-masque-connect-ip/
>>> Html:
>>> https://www.ietf.org/archive/id/draft-age-masque-connect-ip-00.html
>>> Htmlized:
>>> https://datatracker.ietf.org/doc/html/draft-age-masque-connect-ip
>>>
>>>
>>> Abstract:
>>>   This document describes a method of proxying IP packets over HTTP.
>>>   This protocol is similar to CONNECT-UDP, but allows transmitting
>>>   arbitrary IP packets, without being limited to just TCP like CONNECT
>>>   or UDP like CONNECT-UDP.
>>>
>>>
>>>
>>>
>>> The IETF Secretariat
>>>
>>>
>>>
>>> --
>>> Masque mailing list
>>> Masque@ietf.org
>>> https://www.ietf.org/mailman/listinfo/masque
>>>
>> --
>> Masque mailing list
>> Masque@ietf.org
>> https://www.ietf.org/mailman/listinfo/masque
>>
>