Subject: [dnsext] draft-bellis-dnsext-dnsproxy-00 - WG Item?

From: [email-masked]
Date: Tue, 4 Nov 2008 14:13:32 +0000

Given the positive feedback received on my draft, may I request that the 
DNSEXT WG adopt draft-bellis-dnsext-dnsproxy-00 ("DNS Proxy Implementation 
Guidelines") as a Working Group Document?

thanks,

Ray

-- 
Ray Bellis, MA(Oxon)
Senior Researcher in Advanced Projects, Nominet
e: [email-masked], t: +44 1865 332211

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Patrik Wallstrom <[email-masked]>
Date: Tue, 4 Nov 2008 16:33:16 +0100

> Guidelines") as a Working Group Document?

I believe that this work is important, given the low quality of DNS  
proxies in the wild. So yes, would like to see it adopted by the  
working group.

-- 
patrik_wallstrom->foodfight->[email-masked]>+46-733173956

---

From: Ólafur Guðmundsson /DNSEXT chair <[email-masked]>
Date: Tue, 04 Nov 2008 11:48:33 -0500

Dear colleagues,
This document http://tools.ietf.org/id/draft-bellis-dnsext-dnsproxy-00.txt
is within the WG scope.

If you support the adoption of this document AND are willing to work
towards its progress by reviewing it, please send message to that effect
to the mailing list.

By policy the WG needs at least 5 members to publicly support the document
before it can be adopted.

If you have suggestions/recommendations about the scope of the document this
is a great time for that discussion.

         Olafur (for the chairs)

---

From: "Avirneni, Srini" <[email-masked]>
Date: Tue, 4 Nov 2008 12:30:20 -0500

I support this document!  

I am glad that we can hopefully push this as community and not just one-on-one with the vendors. 

Regards,

Srini Avirneni

Distinguished Engineer

Product Engineering, NE&TO

Comcast Cable

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of Ólafur Guðmundsson /DNSEXT chair
Sent: Tuesday, November 04, 2008 11:49 AM
To: [email-masked]; [email-masked]
Subject: Re: [dnsext] draft-bellis-dnsext-dnsproxy-00 - WG Item?

Dear colleagues, 

        Olafur (for the chairs) 

thanks,

Ray

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: < http://ops.ietf.org/lists/namedroppers/ <http://ops.ietf.org/lists/namedroppers/> >

---

From: Nicholas Weaver <[email-masked]>
Date: Tue, 4 Nov 2008 09:37:27 -0800

> towards its progress by reviewing it, please send message to that  

ACK

> is a great time for that discussion.

The only one (which I've already mentioned) is bypassibility:  Unless  
the proxy is specifically implementing a security policy (an IDS  
rather than a NAT), the end resolver should be allowed to direct its  
own queries and bypass the proxy completely.

---

From: [email-masked]
Date: Tue, 4 Nov 2008 17:44:14 +0000

> own queries and bypass the proxy completely.

The good news, based on the tests that resulted in SAC035, is that of the 
24 units we tested we had negligible problems routing queries directly to 
pre-configured upstream resolvers.

One unit would initially only permit queries to the same servers as had 
been learned over WAN DHCP, but a firmware update resolved that.

Another unit had an occasional memory leak when handling large(ish) EDNS0 
packets, but otherwise worked fine.

That's why there's nothing in the draft about this at the moment, but I 
can't see that it would hurt to add something.

However, as you hint at, we must also be sensitive to the requirement that 
sometimes walled-gardens and other security policies mandate that the end 
user must use the proxy.  In those cases we should consider guidance as to 
how the proxy can help effect the walled-garden without interfering with 
DNSSEC and/or TSIG.

kind regards,

Ray

---

From: Shane Kerr <[email-masked]>
Date: Wed, 05 Nov 2008 23:46:48 +0100

Ólafur,

On Tue, 2008-11-04 at 11:48 -0500, Ólafur Guðmundsson /DNSEXT chair
wrote:
> 
> 
> Dear colleagues, 
> This document
> http://tools.ietf.org/id/draft-bellis-dnsext-dnsproxy-00.txt 
> is within the WG scope. 
> 

I support this document, and am willing to review it. It's a good start
to making the DNS protocols implementable by non-gurus.

--
Shane

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 7 Nov 2008 10:54:41 +0100

On Tue, Nov 04, 2008 at 11:48:33AM -0500,
 Ólafur Guðmundsson /DNSEXT chair <[email-masked]> wrote 
 a message of 94 lines which said:

> If you support the adoption of this document 

I do. The brokeness of most middleboxes is probably one of the main
problems of the Internet today. We cannot solve it overnight but we
can at least do our part by providing clear and up-to-date
documents. The I-D is a very good start.

> AND are willing to work towards its progress by reviewing it,

I hesitated here, giving the bad experience with dns-profile but, as
far as I know, I always kept my promises of reviewing (not of
authoring). So, YES again.