Subject: [Doh] Proposal: DNS configuration string

From: Mateusz Jończyk <[email-masked]>
Date: Sun, 2 Jun 2019 11:44:17 +0200

Hello,

Currently, there are multiple ways of resolving DNS queries:

  * old port-53 DNS,
  * DNS over TLS,/
  * DNS over HTTPS.

Some of these accept additional parameters, such as server certificate
information (which may be necessary when using local DoH / DoT servers). These
parameters are server-specific --- when configuring multiple servers, each of
them may need different certificate information.

I would argue that it would be beneficial to embed all such parameters into a
single server specification string. The user would be able to copy-paste them,
for example from the website of their chosen DNS resolver, a file provided by
their sysadmin or from their router configuration GUI. A DHCP server could
advertise the string in a single field. Additionally, an application could pass
the whole string to a DNS-handling library. That way the application would not
have to implement support for all DNS configuration parameters on its own (with
complex GUIs) and new parameters (or even new DNS resolver types) could be
supported by the program after a library upgrade. This would also simplify
configuration file structure (allowing for a single server per line).

Some examples [3]:

  * *doh://dnsserver.example.net/dns-query{?dns};***ip=1.2.3.4*;root-***cert=***zdYsea0CQufOmBpLdLfu/q3tOOdxbBCuZNhAa+YuQWo*

  * *dns://1.2.3.4;valid-for=_nodot,.some-company*

I would like to propose to use a semicolon ';' as the separator between a
resolver address (or an URI template) and resolver parameters. Theoretically, a
DoH URI Template could contain a semicolon, but that should be very rare [1]. In
such cases, the semicolon would be percent-encoded as "%3B".

Parameter explanation:

  * *ip* - IP of the DoH resolver, used for bootstrapping,
  * *root-cert* - fingerprint of the root certificate of the DoH server
    (specified in a similar way as in HTTP certificate pinning),
  * *valid-for *- which domain names should be resolved by this server: in this
    example all names that do not contain a dot ("*_nodot*") [4] as well as all
    domains that end with "*.some-company*".

What do You think?

Greetings,

Mateusz

[1] A URI segment that begins with a semicolon is called a *path parameter*. An
example (taken from [2]) would be:

        *http://www.mysite.com/admin/UpdateUserServlet;jsessionid=OI24B9ASD7BSSD*

The URI template specification (RFC6570) supports expansion of path parameters
with a syntax like:

        *http://example.com/**{;who}*

[2] https://doriantaylor.com/policy/http-url-path-parameter-syntax

[3] The DoH specification requires that:

    "This protocol MUST be used with the https scheme URI [RFC7230]."

but I assume that using "doh://" does not break this as the statement is really
concerned with using encryption and not the "https://" string.

[4] The first character is intentionally "_" because it cannot exist in valid
domain names.

---

From: Mark Nottingham <[email-masked]>
Date: Mon, 3 Jun 2019 08:53:00 +1000

Why not just convey this separately -- why does it have to be in the URL?

> On 2 Jun 2019, at 7:44 pm, Mateusz Jończyk <[email-masked]> wrote:
> 
> Signed PGP part
> Hello,
> 
> 	• old port-53 DNS,
> 	• DNS over TLS,/
> 	• DNS over HTTPS.
> Some of these accept additional parameters, such as server certificate information (which may be necessary when using local DoH / DoT servers). These parameters are server-specific --- when configuring multiple servers, each of them may need different certificate information.
> 
> I would argue that it would be beneficial to embed all such parameters into a single server specification string. The user would be able to copy-paste them, for example from the website of their chosen DNS resolver, a file provided by their sysadmin or from their router configuration GUI. A DHCP server could advertise the string in a single field. Additionally, an application could pass the whole string to a DNS-handling library. That way the application would not have to implement support for all DNS configuration parameters on its own (with complex GUIs) and new parameters (or even new DNS resolver types) could be supported by the program after a library upgrade. This would also simplify configuration file structure (allowing for a single server per line).
> 
> Some examples [3]:
> 
> 	• doh://dnsserver.example.net/dns-query{?dns};ip=1.2.3.4;root-cert=zdYsea0CQufOmBpLdLfu/q3tOOdxbBCuZNhAa+YuQWo
> 	• dns://1.2.3.4;valid-for=_nodot,.some-company
> I would like to propose to use a semicolon ';' as the separator between a resolver address (or an URI template) and resolver parameters. Theoretically, a DoH URI Template could contain a semicolon, but that should be very rare [1]. In such cases, the semicolon would be percent-encoded as "%3B".
> 
> Parameter explanation:
> 
> 	• ip - IP of the DoH resolver, used for bootstrapping,
> 	• root-cert - fingerprint of the root certificate of the DoH server (specified in a similar way as in HTTP certificate pinning),
> 	• valid-for - which domain names should be resolved by this server: in this example all names that do not contain a dot ("_nodot") [4] as well as all domains that end with ".some-company".
> What do You think?
> Greetings,
> 
> Mateusz
> 
> 
> 
> 
> 
> [1] A URI segment that begins with a semicolon is called a path parameter. An example (taken from [2]) would be:
> 
>         http://www.mysite.com/admin/UpdateUserServlet;jsessionid=OI24B9ASD7BSSD
> 
> The URI template specification (RFC6570) supports expansion of path parameters with a syntax like:
> 
>         http://example.com/{;who}
> 
> but I assume that using "doh://" does not break this as the statement is really concerned with using encryption and not the "https://" string. 
> 
> [4] The first character is intentionally "_" because it cannot exist in valid domain names.
> 
> 
> 
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Mateusz Jończyk <[email-masked]>
Date: Mon, 3 Jun 2019 17:47:31 +0200

There are many configuration parameters involved in DoH.
After encapsulating them in a single string, it is easier for the user
to set a custom DoH resolver, among other benefits (which I
elaborated on in the original e-mail).

W dniu 03.06.2019 o 00:53, Mark Nottingham pisze:

>> Some of these accept additional parameters, such as server certificate information 
>> (which may be necessary when using local DoH / DoT servers). These parameters are 
>> server-specific --- when configuring multiple servers, each of them may need 
>> different certificate information.
>>
>> their sysadmin or from their router configuration GUI. A DHCP server could advertise 
>> the string in a single field. Additionally, an application could pass the whole 
>> string to a DNS-handling library. That way the application would not have to 
>> implement support for all DNS configuration parameters on its own (with complex 
>> GUIs) and new parameters (or even new DNS resolver types) could be supported by 
>> the program after a library upgrade. This would also simplify configuration file 
>> structure (allowing for a single server per line).
>>
>> Some examples [3]:
>>
>> I would like to propose to use a semicolon ';' as the separator between 
>> a resolver address (or an URI template) and resolver parameters. Theoretically, 
>> a DoH URI Template could contain a semicolon, but that should be very rare [1]. In such cases, the semicolon would be percent-encoded as "%3B".
>>
>> Parameter explanation:
>>
>> 	• root-cert - fingerprint of the root certificate of the 
>> DoH server (specified in a similar way as in HTTP certificate pinning),
>> 	• valid-for - which domain names should be resolved by this 
>> server: in this example all names that do not contain a dot ("_nodot") [4] as well as all domains that end with ".some-company".
>>
>> What do You think?
>>
>> Greetings,
>>
>> Mateusz
>>
>>
>>
>>
>>

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 4 Jun 2019 08:17:43 +1000

> elaborated on in the original e-mail).

I understand that -- my question was why that configuration needs to be conveyed as part of the URL template's syntax, rather than in a structure (perhaps a string) that contains the URL template. Structuring a URL like that violates BCP190.

For example, instead of:

 dns://1.2.3.4;valid-for=_nodot,.some-company

You could use:

 dns://1.2.3.4 valid-for=_nodot,.some-company

Because a space isn't valid in a URL (or template), it's not making the assumption that the structure you're usurping is "very rare" -- such assumptions don't hold at Internet scale.

(If you don't like space, there are a lot of other characters that are invalid in URLs that could be used as a delimiter, or you could embed the URL template in another structured format, e.g., JSON or XML).

Cheers,

>>> [2] 
>>> https://doriantaylor.com/policy/http-url-path-parameter-syntax
>>> 
>>> 
> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh