Subject: [DNSOP] Fwd: I-D Action: draft-song-dns-wireformat-http-02.txt

From: Davey Song <[email-masked]>
Date: Mon, 21 Mar 2016 18:43:02 +0800

We have updated the draft as follows:

* fixed typos
* made "transport:" always required
* mentioned the possibility to use DNS over HTTP in a browser, if you
really want to
* made the language stronger when talking about the 2-byte length label in
TCP
* expanded the security considerations. We go through RFC 3552, but do not
find it applies much since we're basically just layering on HTTP.
* give a explanation why using POST and try to answer the questions from
the mailing list.
* call for a Well-Know URI like /.well-known/dns-over-http. But I think It
is still open for future edition.
* add a co-author who contributed the first implementation and details of
this protocol.

Thanks to Bob Harold and Paul Hoffman for review. I'm sorry for wrongly
using dismissive words and may offending many people in the discussions.
Thanks for reminding me this as well.

Best regards,
Davey

---------- Forwarded message ----------
From: <[email-masked]>
Date: Mon, Mar 21, 2016 at 6:07 PM
Subject: I-D Action: draft-song-dns-wireformat-http-02.txt
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

        Title           : DNS wire-format over HTTP
        Authors         : Linjian Song
                          Paul Vixie
                          Shane Kerr
                          Runxia Wan
        Filename        : draft-song-dns-wireformat-http-02.txt
        Pages           : 9
        Date            : 2016-03-21

Abstract:
   This memo introduces a way to tunnel DNS data over HTTP.  This may be
   useful in any situation where DNS is not working properly, such as
   when there is middlebox misbehavior.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-song-dns-wireformat-http/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-song-dns-wireformat-http-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-song-dns-wireformat-http-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Shane Kerr <[email-masked]>
Date: Mon, 21 Mar 2016 16:25:59 +0100

Davey,

Thanks! Some expanded comments from me, inline below...

At 2016-03-21 18:43:02 +0800

> * made "transport:" always required

We had it implicitly optional if a client was using the protocol
directly (rather than converting a stub resolver DNS packet). However
this was quite correctly pointed out to be silly, so now we are always
explicit about it.

> * mentioned the possibility to use DNS over HTTP in a browser, if you

It really doesn't make sense to use this technology in a browser, but I
grudgingly admit that it is *possible*, for someone very determined.

> * made the language stronger when talking about the 2-byte length label in

I've tried 2x to make this clearer now. If this one is still confusing
then I either need to ask someone else to write this or I'll delete
this completely, do some tequila shots, and then try from scratch in a
new state of mind. ;)

> find it applies much since we're basically just layering on HTTP.

If anyone has recommendations for a document that we can refer to which
covers security problems with DNS, HTTP, or TLS, that would be great.
Right now I resorted to saying "yeah, any problems in DNS, HTTP, or TLS
can be a problem here too" without references, because they do not
appear to exist.

> is still open for future edition.

Yes, I was unsure whether this makes sense. To be clear, I am not
opposed to the "/.well-known" approach, I'm just curious if it is
actually widely used.

> * add a co-author who contributed the first implementation and details of

An international man of mystery. ;)
 
> Thanks to Bob Harold and Paul Hoffman for review. 

Yes, thank you!

I also note that someone pointed out that DNS over HTTP requires more
data, which can be a problem on slow links. I honestly hadn't really
considered this because the main concern when we were testing this was
extra RTT and the related latency. I admit this could be an issue for
some use cases. Is this important enough to merit some discussion in
the document?

Cheers,

--
Shane