Subject: Re: [dns-privacy] Operating System API support for DNS security policy

From: Rob Sayre <[email-masked]>
Date: Tue, 20 Aug 2019 19:34:38 -0700

> Would the following be a fair summary of the discussion?
> 1) There is some support for the idea it would be useful for APIs to allow
> an application to at least know, and perhaps influence, what DNS security
> features will be used if it makes a DNS request via the operating system.
> 2) The getaddrinfo() API in RFC3493 doesn't provide this capability.

Isn't the getaddrinfo() API defined by POSIX?

<https://pubs.opengroup.org/onlinepubs/9699919799/functions/getaddrinfo.html

"The Open Group Base Specifications Issue 7, 2018 edition
IEEE Std 1003.1-2017 (Revision of IEEE Std 1003.1-2008)
Copyright © 2001-2018 IEEE and The Open Group"

thanks,
Rob

---

From: Mark Andrews <[email-masked]>
Date: Wed, 21 Aug 2019 13:48:43 +1000

It was defined by the IETF and taken up by POSIX.  It’s designed to be extensible.

There is absolutely nothing preventing extensions which pass in trust anchors or
requiring that answers validate as secure.  Just use your imagination.

e.g. add trust anchors to hints.

Mark

> On 21 Aug 2019, at 12:34 pm, Rob Sayre <[email-masked]> wrote:
> 
> <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getaddrinfo.html>
> 
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: [email-masked]

---

From: Rob Sayre <[email-masked]>
Date: Tue, 20 Aug 2019 20:50:28 -0700

On Tue, Aug 20, 2019 at 8:48 PM Mark Andrews <[email-masked]> wrote:

> It was defined by the IETF and taken up by POSIX.
>

OK. Can you expand on that? It looks like POSIX claims to define the API.

thanks,
Rob

---

From: Iain Sharp <[email-masked]>
Date: Wed, 21 Aug 2019 08:28:07 +0000

Yes, I would be interested if someone can explain the relationship between Posix and IETF in this regard, and why the information appears in two places. It is something that is unclear to me.

Iain

From: dns-privacy <[email-masked]> On Behalf Of Rob Sayre
Sent: 21 August 2019 04:50
To: Mark Andrews <[email-masked]>
Cc: [email-masked]
Subject: Re: [dns-privacy] Operating System API support for DNS security policy

On Tue, Aug 20, 2019 at 8:48 PM Mark Andrews <[email-masked]<mailto:[email-masked]>> wrote:
It was defined by the IETF and taken up by POSIX.

thanks,
Rob

---

From: Brian Haberman <[email-masked]>
Date: Wed, 21 Aug 2019 08:06:35 -0400

Hi Iain,

> Yes, I would be interested if someone can explain the relationship between Posix and IETF in this regard, and why the information appears in two places. It is something that is unclear to me.

It is a bit of a convoluted relationship. Generally, POSIX deals with
defining the APIs for UNIX OSes. Part of that involves defining the APIs
related to networking (e.g., socket(), getaddrinfo(), ...).

The IETF has published a number of "API" RFCs that describe enhancements
that the IETF community would like to see in the POSIX suite of APIs.
Once the IETF has agreed to those enhancements and published an RFC, the
advocates for those APIs then engage with the OpenGroup to try and get
them to take up the standardization of those new/updated APIs. In some
cases, they do and in others, they don't. The advanced socket API for
IPv6 is a good example of the latter.

I view any API defined by the IETF as an "informational" request to the
OpenGroup to standardize an API with the documented capabilities. What I
don't understand is why the IETF does not have a liaison relationship
with the OpenGroup to facilitate the development of the appropriate APIs
for the technologies defined in the IETF. That is a question better
suited for someone on the IAB.

Not sure if that clarifies things or not...

Regards,
Brian