Re: [Spasm] CAA erratum 4515

[Jacob Hoffman-Andrews <[e-mail]>]

Cool, sounds like we are now on the same page, and can start talking in
more subjective terms.

On 03/10/2017 02:51 PM, Ryan Sleevi wrote:
>
>     1. Policy set by user-facing domain owner for their own hostnames.
>     2. Blanket policy set by CDN for hostnames they operate on their
>     customers' behalf.
>     3. Policy set by CDN for their own hostnames, which share the same
>     base domain as the CNAME targets used in (2).
>
I think (1) is easily handled by both tree-climbing and
non-tree-climbing implementations.

Both (2) and (3) are handled by both tree-climbing and non-tree-climbing
implementations with deployment of two CAA records. If the policies
happen to be the same, tree climbing allows the CDN to economize on CAA
records by deploying just one, on their base domain.

However, I think the policies are not likely to be the same. The
feedback we've gotten so far from Patrick is that Cloudflare is unlikely
to implement (2) because, like most CDNs and hosting providers, they are
effectively a Mixed-management setup.

So, what if a CDN wants to implement (3), but specifically avoid (2)?
This is very easy in the non-tree-climbing world: they set a single CAA
record on their base domain. In the tree-climbing world, it's very hard.
The CDN would need to specify a restrictive CAA record on their base
domain, and then another CAA record that specifies "Nevermind,
everything is allowed again" on their CNAME target, in order to block
tree-climbing to their root domain.

As far as I can see, RFC 6844 doesn't define a "Nevermind, everything is
allowed" CAA record. I think you could achieve the effect by creating a
CAA record containing a random tag that is not otherwise used, and
setting the critical bit to 0. But this is pretty hacky. Do you see a
better way to implement "(3) but not (2)" in the tree-climbing world?

>>     If domain operators wish to operate with their own policy, and
>>     support customers with the same policy (on the domains the domain
>>     operator operates), while allowing their customers to operate
>>     with their own policy on the customer domains, the trampoline is
>>     necessary.
>     I don't think this case is significantly different than the above.
>     One policy gets set on the CDN's base domain, while the other
>     policy gets set on the CNAME target. If those policies happen to
>     be the same, that's fine.
>
>
> Fair point here as well. The complexity then comes from whether this
> reflects current deployment, or whether it reflects a point of
> deployment which would have to change to support. I think this is what
> you've identified in (2).
Is the question here whether CNAME targets are generally subdomains or
base domains? In my experience, almost always subdomains.