Subject: Re: [DNSOP] New Version Notification for draft-bellis-dnsop-xpf-00.txt

From: "Peter van Dijk" <[email-masked]>
Date: Fri, 10 Feb 2017 13:52:16 +0100

Hello Ray,

On 6 Jan 2017, at 23:02, Ray Bellis wrote:

> On 06/01/2017 18:43, Wessels, Duane wrote:
>
>> The idea of "X-Forwarded-For" for DNS makes me nervous, but it is
>> probably inevitable.
>>
>> It is of course quite similar to EDNS client subnet, except that
>> there is no masking and the client cannot opt-out.  Might be worth
>> saying in your document why EDNS client subnet wouldn't work for this
>> purpose.
>
> I believe that dnsdist / PowerDNS is already (ab)using the ECS option
> for this purpose.
>
> The intent in part is to provide a separate option so that "real" ECS
> can pass unhindered.  [ not that I think ECS is a good idea, but some
> folks want it, c'est la vie ]

Indeed, dnsdist uses ECS to pass the actual client IP to the real 
backend DNS server. And indeed, this gets confusing when there is also 
‘real’ ECS. So thank you for writing this draft, it will be very 
useful!

However, both in ECS, and now in XPF, we do not get client’s port 
number. With increasing CGNAT deployment, this makes it impossible to 
distinguish clients once a request has passed through a proxy, like 
dnsdist or a TLS frontend.

Can you please consider adding a port number field?

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/

---

From: Ray Bellis <[email-masked]>
Date: Fri, 10 Feb 2017 13:12:45 +0000

> Can you please consider adding a port number field?

I see where you're coming from, but I'm not inclined to add it (yet) for
a couple of reasons:

1.  CGNAT is evil ;-)

2.  If I add this, then folks will want other transport related fields
   (indeed I already had at least one other person suggest this).

Are the server side ACLs etc that need to be able to identify the client
so fine grained that they'd really give different treatment to different
clients arriving from the same CGN IP address?

This is probably something that the WG should consider if (or hopefully
when) this becomes a WG item.

kind regards,

Ray

---

From: "Peter van Dijk" <[email-masked]>
Date: Fri, 10 Feb 2017 14:26:00 +0100

Hello Ray,

> I see where you're coming from, but I'm not inclined to add it (yet) 

You have my full agreement on that! However, it is also a reality that 
we have to deal with today.

>    (indeed I already had at least one other person suggest this).

I suggest weighing every such request individually - saying yes to ports 
is no reason to say yes to something else :)

> clients arriving from the same CGN IP address?

Sadly, yes. In ISP networks, there may be policy differences per 
subscriber, and given CGNAT the DNS server can only identify the 
subscribers by their IP+port.

> when) this becomes a WG item.

I encourage WG adoption in any case!

Kind regards,