Subject: [Add] Thoughts on a DoH (and DoT) BCP?

From: <[email-masked]>
Date: Wed, 3 Jul 2019 19:41:15 +0000

There are many challenges facing enterprise and internet service provider / operator networks that intend to deploy and operate DoH (and DoT) resolver services. The IETF should consider developing a BCP which documents these concerns and provide appropriate guidance. Some of these issues include:

-          server performance & measurement considerations

-          network performance, capacity and resilience planning

-          impact on existing infrastructure: load balancers, captive portals, NAT, proxies and on-net content caches/CDNs

-          CPE provisioning - first connection set-up

-          CPE DoH proxy and certificate options

-          Interactions between applications and OS/Kernel DNS settings

-          providing DoH and DoT services in split DNS environments

-          authentication requirements for DoH and DoT resolvers

-          management of TLS sessions at DNS query rates - ticket duration, restarts, etc.

-          minimising TLS overheads for DoT and DoH traffic

-          protection of application-specific DoH and DoT resolver configuration

I'd be willing to work on a BCP on this topic. Is anyone else? What other key issues should be considered?

Andy Fidler
[email-masked]<mailto:[email-masked]>

This email contains information from BT that might be privileged or confidential. And it's only meant for the person above. If that's not you, we're sorry - we must have sent it to you by mistake. Please email us to let us know, and don't copy or forward it to anyone else. Thanks.
We monitor our email systems and may record all our emails.
British Telecommunications plc
R/O : 81 Newgate Street, London EC1A 7AJ
Registered in England: No 1800000

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 3 Jul 2019 21:47:07 +0100

Hiya,

On 03/07/2019 20:41, [email-masked] wrote:
> There are many challenges facing enterprise and internet service
> provider / operator networks that intend to deploy and operate DoH
> (and DoT) resolver services. The IETF should consider developing a
> BCP which documents these concerns and provide appropriate guidance.

I think there are definitely things to figure out such as those
you list below and maybe more. I figure the upcoming BoF would
be a real success if we could identify a subset of those on which
both people who like, and people who dislike, DoH/DoT wanted to
work. E.g split horizon seems to me to be an area where we have
common interests in figuring something out regardless of one's
opinions of DoH/DoT or ADD more generally.

FWIW, I (not very confidently;-) suspect it may be that breaking
the putative work into such chunks and prioritising those where
we guess progress can be made in the IETF may be more effective
than trying to develop one BCP to cover all the issues. Some of
the issues don't really seem to me to be such that we could get
to rough consensus in the near-term - but maybe a bit of working
on easier stuff, together with however things outside the IETF
evolve, could change that over not too much time.

Cheers,
S.

> Some of these issues include:
> 
> -          impact on existing infrastructure: load balancers, captive
> portals, NAT, proxies and on-net content caches/CDNs
> 
> Andy Fidler [email-masked]<mailto:[email-masked]>
> 
> This email contains information from BT that might be privileged or
> confidential. And it's only meant for the person above. If that's not
> you, we're sorry - we must have sent it to you by mistake. Please
> email us to let us know, and don't copy or forward it to anyone else.
> Thanks. We monitor our email systems and may record all our emails. 
> British Telecommunications plc R/O : 81 Newgate Street, London EC1A
> 7AJ Registered in England: No 1800000
> 
> 
>

---

From: Brian Haberman <[email-masked]>
Date: Thu, 4 Jul 2019 10:29:15 -0400

> There are many challenges facing enterprise and internet service provider / operator networks that intend to deploy and operate DoH (and DoT) resolver services. The IETF should consider developing…

Please remember that there is already an operationally-focused BCP draft
for DoT.

https://datatracker.ietf.org/doc/draft-ietf-dprive-bcp-op/

Regards,
Brian

---

From: Barry Greene <[email-masked]>
Date: Fri, 5 Jul 2019 05:07:03 -0500

The issues that Andrew is bring up would take that dprive-bcp draft in a totally different direction. Is this want you want? Would the authors be open to the change?

> On Jul 4, 2019, at 9:29 AM, Brian Haberman <[email-masked]> wrote:
> 
> Signed PGP part
> 
>

---

From: Brian Haberman <[email-masked]>
Date: Mon, 8 Jul 2019 09:21:56 -0400

Hi Barry,

> The issues that Andrew is bring up would take that dprive-bcp draft in a totally different direction. Is this want you want? Would the authors be open to the change?

My reason for pointing out the dprive BCP is to make sure everyone is
aware of that document.

As for the content... It is a dprive WG document, so it is subject to
consensus-based changes. Neither I, as dprive co-chair, nor the draft
authors have any more influence over the content than any other IETF
participant.

What I don't want is for 2 BCPs from different WGs to conflict with one
another, hence the pointer.

Regards,
Brian

---

From: <[email-masked]>
Date: Wed, 10 Jul 2019 11:50:40 +0000

Thanks Barry / Brian for highlighting the dprive-bcp-draft, I agree we should not have two BCPs from different WGs conflicting with one another. Let us discuss this in the 15min BoF slot we have allocated for overlap with existing chartered work in DPRIVE, DOH and DNSOP.

On the potential topics list for a DoH BCP which areas do you believe are already covered in the DPRIVE draft and/or ongoing DPRIVE work?  Which areas do you believe are not covered and should be considered by the ADD BoF?

Thanks,

Andy

[email-masked]

-----Original Message-----
From: Add [mailto:[email-masked]] On Behalf Of Brian Haberman
Sent: 08 July 2019 14:22
To: Barry Greene <[email-masked]>
Cc: [email-masked]
Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP?

Hi Barry,

> The issues that Andrew is bring up would take that dprive-bcp draft in a totally different direction. Is this want you want? Would the authors be open to the change?

My reason for pointing out the dprive BCP is to make sure everyone is aware of that document.

As for the content... It is a dprive WG document, so it is subject to consensus-based changes. Neither I, as dprive co-chair, nor the draft authors have any more influence over the content than any other IETF participant.

What I don't want is for 2 BCPs from different WGs to conflict with one another, hence the pointer.

Regards,
Brian

>> Please remember that there is already an operationally-focused BCP 
>> draft for DoT.
>>

---

From: <[email-masked]>
Date: Wed, 10 Jul 2019 11:55:40 +0000

Stephen,

On subset topics for the BoF, apart from split horizon, which other topics do you think will and won't get support and why?

Thanks,

Andy

[email-masked]

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]] 
Sent: 03 July 2019 21:47
To: Fidler,AJH,Andy,TQG R <[email-masked]>; [email-masked]
Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP?

Hiya,

On 03/07/2019 20:41, [email-masked] wrote:
> (and DoT) resolver services. The IETF should consider developing a BCP 
> which documents these concerns and provide appropriate guidance.

I think there are definitely things to figure out such as those you list below and maybe more. I figure the upcoming BoF would be a real success if we could identify a subset of those on which both people who like, and people who dislike, DoH/DoT wanted to work. E.g split horizon seems to me to be an area where we have common interests in figuring something out regardless of one's opinions of DoH/DoT or ADD more generally.

FWIW, I (not very confidently;-) suspect it may be that breaking the putative work into such chunks and prioritising those where we guess progress can be made in the IETF may be more effective than trying to develop one BCP to cover all the issues. Some of the issues don't really seem to me to be such that we could get to rough consensus in the near-term - but maybe a bit of working on easier stuff, together with however things outside the IETF evolve, could change that over not too much time.

Cheers,
S.

---

From: Brian Haberman <[email-masked]>
Date: Tue, 16 Jul 2019 13:35:16 -0400

Hi Andy,

> On the potential topics list for a DoH BCP which areas do you believe are already covered in the DPRIVE draft and/or ongoing DPRIVE work?  Which areas do you believe are not covered and should be c…

From a DoT perspective, I think ADD could focus on:

- split DNS
- TLS session management
- TLS overhead minimization

Some of the last two are covered in the DoT spec
(https://tools.ietf.org/html/rfc7858#section-5)

Regards,
Brian

---

From: <[email-masked]>
Date: Wed, 24 Jul 2019 08:51:11 +0000

Chris, Andy,

regarding your call for call for inputs yesterday, we would support this work and be happy to contribute on some of these items.
 
I think the IETF should provide guidance to ISPs/operators on how this may impact their cache sever infrastructures and ultimately how we can deploy the technology. I share the concerns expressed at the mic by Barbara and others regarding the operational issues related to this. 

Regards,

Philippe Fouquart
Orange Labs Networks

From: Add [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, July 03, 2019 9:41 PM
To: [email-masked]
Subject: [Add] Thoughts on a DoH (and DoT) BCP?

Andy Fidler
[email-masked]

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Rob Sayre <[email-masked]>
Date: Wed, 24 Jul 2019 01:59:17 -0700

On Wed, Jul 24, 2019 at 1:51 AM <[email-masked]> wrote:

>  I share the concerns expressed at the mic by Barbara and others regarding
> the operational issues related to this.
>

Everyone's concerns should be considered. But that doesn't make the IETF
the ITU.

thanks,
Rob

---

From: Rob Sayre <[email-masked]>
Date: Wed, 24 Jul 2019 02:19:28 -0700

On Wed, Jul 24, 2019 at 1:59 AM Rob Sayre <[email-masked]> wrote:

>>  I share the concerns expressed at the mic by Barbara and others
>> regarding the operational issues related to this.
>>
>

 More constructively, maybe the ITU is the perfect place for these
discussions!

The folks from BT, AT&T, Orange, etc can all discuss their policies in some
other venue, and I think that would be great.

thanks,
Rob

---

From: <[email-masked]>
Date: Wed, 24 Jul 2019 10:10:13 +0000

Rob, 

Thanks for this. I’m a bit hesitant to draw this to what seems to be somewhat off-topic, but only on the point of terminology and I'll stop: the issues discussed in Chris’s presentation yesterday don’t seem to be policy-related to me, they’re operational, at least from an ISP’s perspective. 

One example of what is “policy” however, is what was referred to as “Honouring the IANA root on the public Internet” in Jim’s presentation on “DoH Client & Server Behaviour”, but I’d surprised anyone of those you listed would consider the ITU to be the appropriate remit for this. I wouldn’t. 

Regards,
Philippe 

From: Rob Sayre [mailto:[email-masked]] 
Sent: Wednesday, July 24, 2019 11:19 AM
To: FOUQUART Philippe TGI/OLN
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP?

On Wed, Jul 24, 2019 at 1:59 AM Rob Sayre <[email-masked]> wrote:
On Wed, Jul 24, 2019 at 1:51 AM <[email-masked]> wrote:
 I share the concerns expressed at the mic by Barbara and others regarding the operational issues related to this. 

Everyone's concerns should be considered. But that doesn't make the IETF the ITU.

 More constructively, maybe the ITU is the perfect place for these discussions!

The folks from BT, AT&T, Orange, etc can all discuss their policies in some other venue, and I think that would be great.

thanks,
Rob

---

From: Lars Eggert <[email-masked]>
Date: Wed, 24 Jul 2019 06:24:35 -0400

Rob,

> The folks from BT, AT&T, Orange, etc can all discuss their policies in some other venue, and I think that would be great.

please keep the discussion professional.

IETF results strongest when they receive the broadest possible input and review. This is often a difficult and sometimes painful (and long) process, but in the end, this is what makes our output stronger and more relevant than that of many other organizations.

Lars

---

From: Rob Sayre <[email-masked]>
Date: Wed, 24 Jul 2019 03:35:17 -0700

On Wed, Jul 24, 2019 at 3:24 AM Lars Eggert <[email-masked]> wrote:

> > The folks from BT, AT&T, Orange, etc can all discuss their policies in
> some other venue, and I think that would be great.
>

Oh, yes, I'm very aware that "operational concerns" are very important. I
thought some other venue might be better, though.

thanks,
Rob

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 24 Jul 2019 16:38:35 -0400

On Wed, Jul 24, 2019 at 08:51:11AM +0000,
 [email-masked] <[email-masked]> wrote 
 a message of 88 lines which said:

> regarding your call for call for inputs yesterday, we would support
> this work and be happy to contribute on some of these items.

Part of it is already done. For instance, the message you quote
mentions "authentication requirements for DoH and DoT resolvers" which
are already covered in the RFCs standardizing DoTH.

---

From: <[email-masked]>
Date: Thu, 25 Jul 2019 02:59:58 +0000

As Jim mentions, the core DoH protocol is done.
But Stephane (below) raised authentication of resolvers, saying that was also done. Is it?

RFC8484 simply says that RFC2818 authentication occurs, i.e. that the certificate matches the name in the configured DoH URI template.

If this DoH URI template was automatically discovered from the local network, and has the name dns.mcdonalds.com, how is the client system to know that the user trusts McDonalds? It feels like there's a step missing where the user grants trust to particular providers. Unless it is documented somewhere that I haven't seen.

Chris

-----Original Message-----
From: Stephane Bortzmeyer <[email-masked]> 
Sent: 24 July 2019 16:39
To: [email-masked]
Cc: Fidler,AJH,Andy,TQG R <[email-masked]>; Box,C,Chris,TLW1 R <[email-masked]>; [email-masked]
Subject: Re: [Add] Thoughts on a DoH (and DoT) BCP?

Part of it is already done. For instance, the message you quote mentions "authentication requirements for DoH and DoT resolvers" which are already covered in the RFCs standardizing DoTH.