Subject: [DNSOP] Fw: New Version Notification for draft-shane-review-dns-over-http-00.txt

From: Shane Kerr <[email-masked]>
Date: Tue, 8 Dec 2015 14:11:16 +0100

DNS colleagues,

As I mentioned a while ago, we have been working on a document to
describe the various ways of (ab)using HTTP to transmit DNS traffic. We
have finished a -00 draft, and I would appreciate it if you had a look
and see if it makes sense.

If the working group thinks that it makes sense for this forum, then I
am happy to ask for adoption here. I am also fine to pursue this as an
independent submission of there is no interest! :)

Cheers,

--
Shane

Subject: New Version Notification for draft-shane-review-dns-over-http-00.txt
From: [email-masked] (by way of Shane Kerr <[email-masked]>)
To: "Shane Kerr" <[email-masked]>, "Runxia Wan" <[email-masked]>, "Linjian Song" <[email-masked]>, "Davey Song" <[email-masked]>
Date: Mon, 07 Dec 2015 18:26:52 -0800

A new version of I-D, draft-shane-review-dns-over-http-00.txt
has been successfully submitted by Shane Kerr and posted to the
IETF repository.

Name:		draft-shane-review-dns-over-http
Revision:	00
Title:		A review of implementation DNS over port 80/443
Document date:	2015-12-07
Group:		Individual Submission
Pages:		7
URL:            https://www.ietf.org/internet-drafts/draft-shane-review-dns-over-http-00.txt
Status:         https://datatracker.ietf.org/doc/draft-shane-review-dns-over-http/
Htmlized:       https://tools.ietf.org/html/draft-shane-review-dns-over-http-00

Abstract:
   The default DNS transport uses UDP on port 53.  There are many
   motivations why users or operators may prefer to avoid sending DNS
   traffic in this way.  A common solution is to use port 80 or 443;
   with plain TCP, TLS-encrypted TCP, or full HTTP(S).  This memo
   reviews the possible approaches and delivers some useful information
   for developers.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: 神明達哉 <[email-masked]>
Date: Tue, 8 Dec 2015 11:01:16 -0800

At Tue, 8 Dec 2015 14:11:16 +0100,

> and see if it makes sense.

I've read the draft.  I think it contains some useful information, but
I don't have a particular opinion on whether this should be adopted as
a dnsop wg document - I'm not sure if it fits the charter of the wg.

Some comments on the draft (mostly editorial):

- Section 1

   o  Case 2: Clients may want to chose a resolver other than the one
      locally available.

  This doesn't necessarily seem to lead to DNS/HTTP; unless packets
  using port 53 are blocked, clients can freely use other resolvers.
  So isn't it essentially the same as case 1?

- Section 2.1

   [...]  The
   difference between port 80 and 443 is that the traffic of port 80 is
   usually intercepted as HTTP traffic while the traffic of port 443 is
   usually considered to be encrypted, [...]

  I first thought 'intercepted' should probably be 'interpreted'.  On
  reading toward the end of the doc I now see that is actually the
  intent, but to avoid such confusion it might help if you say, e.g.
  'usually intercepted as HTTP traffic for purposes as deeper
  inspection'

- Section 2.2 s/coming/becoming/ ?

   [...]  Second, it
   prevents resolvers from coming amplifier of reflection attack.

- Section 2.4 s/cause/because/ ?

   [...]  The support of DNSSEC might also be a
   problem cause the response usually do not contain RR records with the
   answer, making it impossible for a client to validate the reply.

--
JINMEI, Tatuya