From 045f77b63c0097a73a4fa4dcb238c277f0eb9c65 Mon Sep 17 00:00:00 2001 From: Erik Nygren Date: Tue, 30 Mar 2021 14:41:09 -0400 Subject: [PATCH 1/6] Trying to recreate a pull-request --- draft-proxied-svcb-headers.md | 1 - 1 file changed, 1 deletion(-) diff --git a/draft-proxied-svcb-headers.md b/draft-proxied-svcb-headers.md index b4634608..8f6a6685 100644 --- a/draft-proxied-svcb-headers.md +++ b/draft-proxied-svcb-headers.md @@ -562,5 +562,4 @@ which they should use. # Appendix: Additional Examples {#examples} - *TODO*: Add additional examples. From e9d3ea1f9d3af3eeb8433ea8b4b68aadcf179855 Mon Sep 17 00:00:00 2001 From: Erik Nygren Date: Mon, 5 Apr 2021 14:32:08 -0400 Subject: [PATCH 2/6] Update draft-proxied-svcb-headers.md Co-authored-by: Mike Bishop --- draft-proxied-svcb-headers.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/draft-proxied-svcb-headers.md b/draft-proxied-svcb-headers.md index 807edf30..b1a157f1 100644 --- a/draft-proxied-svcb-headers.md +++ b/draft-proxied-svcb-headers.md @@ -28,7 +28,7 @@ author: This document defines a mechanism to utilize Service Binding (SVCB and HTTPS) DNS records through HTTP proxies while using the proxies to perform the SVCB record lookups. This includes defining HTTP header -fields for the passing DNS metadata in HTTP responses. +fields for passing DNS metadata in HTTP responses. --- middle @@ -564,4 +564,3 @@ which they should use. *TODO*: Add additional examples. - From 5cc3bbeca5180b3fd72f3434a2160d3706982f40 Mon Sep 17 00:00:00 2001 From: Erik Nygren Date: Mon, 5 Apr 2021 14:52:33 -0400 Subject: [PATCH 3/6] Apply suggestions from code review Incorporating suggestions from Mike Bishop Co-authored-by: Mike Bishop --- draft-proxied-svcb-headers.md | 38 +++++++++++++++++------------------ 1 file changed, 18 insertions(+), 20 deletions(-) diff --git a/draft-proxied-svcb-headers.md b/draft-proxied-svcb-headers.md index b1a157f1..5335f267 100644 --- a/draft-proxied-svcb-headers.md +++ b/draft-proxied-svcb-headers.md @@ -48,7 +48,7 @@ in authority-form (and may use something closer to what is specified in rfc8441) and we should update accordingly. Clients using Service Binding (SVCB or HTTPS) records {{!SVCB=I-D.ietf-dnsop-svcb-https}} -need perform additional DNS resolutions prior to issuing a CONNECT* request, as clients +might need to perform additional DNS resolutions prior to issuing a CONNECT* request, as clients connect to the "alternative endpoint" specified by the SVCB record (Section 3.2 of {{SVCB}}), which includes a TargetName that may be distinct from the server name. @@ -57,16 +57,19 @@ target IP addresses. The records can be used to determine which application-leve are supported by an endpoint. These records also can include a TLS Encrypted Client Hello {{!I-D.ietf-tls-esni}} configuration, which can be used in protecting the end-to-end TLS handshake. -It is not always optimal for client that want to use SVCB to perform a separate +It is not always optimal for a client that wants to use SVCB to perform a separate DNS resolution prior to using a CONNECT* proxy, for a couple reasons: 1. The extra DNS lookup incurs a performance penalty in delaying the client's connection establishment, which might be wasted if there aren't any SVCB records present. 2. If the client is using the proxy for providing additional privacy, performing -DNS lookups not through the proxy might disclose the client's destination +DNS lookups without going through the proxy might disclose the client's destination to an additional party. +3. If DNS responses vary based on the client's network location, DNS lookups performed by the +client might not be appropriate for a connection made via the proxy. + This document specifies a mechanism for clients to utilize SVCB records through proxies supporting this specification while reducing the need for performing additional DNS lookups: @@ -79,12 +82,12 @@ for performing additional DNS lookups: document while opportunistically establishing connections. 3. Services with no SVCB records will be indicated as such - by the proxy, allowing clients can proceed with the opportunistically + by the proxy, allowing clients to proceed with the opportunistically established connection. For services with SVCB records, the proxy will provide enough information to allow clients to decide whether they can proceed with using the connection or whether the client needs to establish a new connection - through the proxy to the alternative endpoint specified + through the proxy to an alternative endpoint specified in a SVCB record. 4. For subsequent CONNECT* requests, clients provide information @@ -150,7 +153,7 @@ The item has the following parameters: a reasonable default. * params: Clients can optionally limit which SVCB parameters they'd like - to receive by optionally specifying this parameter. Its value MUST + to receive by specifying this parameter. Its value MUST be an inner-list whose members are sf-integer items. Each list member corresponds to the numeric version of an SvcParamKey. If not specified, proxies SHOULD return the full set of SVCB parameters @@ -158,7 +161,7 @@ The item has the following parameters: * version: Clients can optionally specify which versions of this specification they support. Its value MUST be an inner-list whose members are sf-string - values. This current draft specifies version "draft-01". + values. This draft specifies version "draft-01". * u: Clients can indicate whether they want DNS information about the IP address that the proxy connected to through this parameter. @@ -244,7 +247,8 @@ SVCB AliasMode record, proxy servers MUST resolve the TargetName of that AliasMode record to obtain a ServiceMode record. Both resolutions MUST use the same RR type specified in the "t" parameter of Proxy-DNS-Request. -Which records are returned in this header is determined by: + +Multiple factors influence which records are returned in this header: * If the SVCB DNS query name resolves to a SVCB ServiceMode record, only the ServiceMode records SHALL be included in the Proxy-DNS-SVCB @@ -292,8 +296,8 @@ A successful CONNECT response would include the following headers, if the client HEADERS :method = CONNECT :status = 200 -proxy-dns-svcb = "svc2.example.net.";priority=1;ttl=1800;key1=:aDIsaDM=:;key5=:MTIzLi4u:, - "svc.example.net.";priority=2;ttl=1800;key1=:aDI=:;key5=:YWJjLi4u: +proxy-dns-svcb = "svc2.example.net.";priority=1;ttl=1800;key1=:aDIsaDM=:;key5=:MTIz...:, + "svc.example.net.";priority=2;ttl=1800;key1=:aDI=:;key5=:YWJj...: ~~~ @@ -327,7 +331,7 @@ address, it MUST follow the canonical string form from {{!RFC5952}}. *TODO*: Is there an IPv4 canonical form RFC we should reference here? -If the hostname connected to by the proxy was a series of CNAMEs, +If the hostname connected to by the proxy aliased to one or more CNAMEs, these should be included at the front of the list, starting with the CNAME that the hostname resolved to and proceeding sequentially. @@ -343,7 +347,7 @@ Each item in the list has the following parameters: entry, containing the minimum TTL value across the CNAMEs. * o: The owner name of the DNS record MAY be included. - This this parameter is specified, its value MUST be an sf-string + If this parameter is specified, its value MUST be an sf-string whose value is the owner name of the record. @@ -489,14 +493,6 @@ Protocols specifying for SVCB-required clients will need to describe what clients should use in this case. -## Connection coalescing - -*TODO*: Do we want to include text on how clients -can also use Proxy-DNS-Used for connection coalescing? -(One thing missing there is the full set of IP addresses -to look for overlaps within an address family. I'm not -sure this is worth the complexity. Or do we remove this -sub-section entirely?) ## Interaction with Alt-Svc @@ -514,6 +510,8 @@ sub-section entirely?) ## HTTP Headers {#iana-header} +*TODO*: Move the registries below to the new HTTP-core registry. + This document registers the "Proxy-DNS-Request" and "Proxy-DNS-SVCB", headers in the "Permanent Message Header Field Names" <[](https://www.iana.org/assignments/message-headers)>. From 3ab0b48449e6c7c8c4a371590ca7f27549693f7c Mon Sep 17 00:00:00 2001 From: Erik Nygren Date: Mon, 5 Apr 2021 14:55:11 -0400 Subject: [PATCH 4/6] Update draft-proxied-svcb-headers.md Start an Acknowledgements section before we forget. --- draft-proxied-svcb-headers.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/draft-proxied-svcb-headers.md b/draft-proxied-svcb-headers.md index 5335f267..5237a389 100644 --- a/draft-proxied-svcb-headers.md +++ b/draft-proxied-svcb-headers.md @@ -558,6 +558,9 @@ there is a preferred alternative service that supports ECH which they should use. +# Acknowledgments + +Thank you to Mike Bishop, Chris Wood, and others for their feedback and suggestions on this draft. # Appendix: Additional Examples {#examples} From 803bc17a432e3184e87f9b4133ea1b44322980f2 Mon Sep 17 00:00:00 2001 From: Erik Nygren Date: Mon, 5 Apr 2021 14:56:04 -0400 Subject: [PATCH 5/6] Update draft-proxied-svcb-headers.md --- draft-proxied-svcb-headers.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/draft-proxied-svcb-headers.md b/draft-proxied-svcb-headers.md index 5237a389..94e7bf51 100644 --- a/draft-proxied-svcb-headers.md +++ b/draft-proxied-svcb-headers.md @@ -560,7 +560,9 @@ which they should use. # Acknowledgments -Thank you to Mike Bishop, Chris Wood, and others for their feedback and suggestions on this draft. +Thank you to Mike Bishop, Chris Wood, +and others for their feedback and suggestions on this draft. + # Appendix: Additional Examples {#examples} From b5d1935e6804df806dc386abbd7e794126d968b0 Mon Sep 17 00:00:00 2001 From: Erik Nygren Date: Mon, 5 Apr 2021 14:58:01 -0400 Subject: [PATCH 6/6] Update draft-proxied-svcb-headers.md --- draft-proxied-svcb-headers.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/draft-proxied-svcb-headers.md b/draft-proxied-svcb-headers.md index 94e7bf51..758c4834 100644 --- a/draft-proxied-svcb-headers.md +++ b/draft-proxied-svcb-headers.md @@ -163,7 +163,8 @@ The item has the following parameters: they support. Its value MUST be an inner-list whose members are sf-string values. This draft specifies version "draft-01". -* u: Clients can indicate whether they want DNS information about +* u: Clients can indicate whether they want DNS information (A, AAAA, + and CNAME records) about the IP address that the proxy connected to through this parameter. Its value MUST be an sf-boolean.