Subject: AI_SECURE_CANONNAME, AI_CANONNAME_SEARCH_* (Re: getaddrinfo() and searching)

From: Nicolas Williams <[email-masked]>
Date: Mon, 1 Oct 2007 11:43:10 -0500

What a timely thread.

I've recently concluded that we need an extension to getaddrinfo() along
these lines, but I'm looking for somewhat tighter and more generic
semantics.

My proposal is to add an AI_SECURE_CANONNAME flag with the following
semantics:

 - it MUST be used with AI_CANONNAME

 - if set in the hints then it will be set in the results IFF:

    - the resulting ai_canonname == the nodename given as input

      or

    - the resulting ai_canonname was obtained securely, such as from a
      write-protected local hosts file, via DNSSEC, or via any other
      acceptably secure name service

      or

    - the resulting ai_canonname == nodename + '.' + default domain from
      the resolver's configuration (i.e., the _first_ domain in the
      search list)

Additional flags modifying for controlling search behaviour would be
nice, such as:

 - AI_CANONNAME_SEARCH_ANY

   Accept canonical names formed by successively trying the given
   nodename suffixed with the domainnames from the resolver's search
   list.  If this flag is used in the input hints then it will be set in
   the result IFF the domainname used to qualify the given nodename was
   not the first domain in the search list.

 - AI_CANONNAME_SEARCH_PARENTS

   Like AI_CANONNAME_SEARCH_ANY, but skip domainnames in the search list
   which are not parents (or grandparents) of the preceding domainname
   on the list.

 - AI_CANONNAME_SEARCH_SIBLINGS

   Like AI_CANONNAME_SEARCH_PARENTS, but search sibling domains in the
   search list too.

 - AI_CANONNAME_SEARCH_DEFAULT

   Allow whatever AI_CANONNAME_SEARCH_* behaviour is locally configured
   as a default for this flag.  If this flag is used in the input hints
   then one of the above will be set in the result to indicate which
   search policy was configured and used.  This flag might be all the
   other AI_CANONNAME_SEARCH_* flags ORed together.

I'm still researching this proposal.  We might want one more flag to
indicate whether unsecured NXDOMAIN replies can be/were processed during
search list processing, say, AI_SECURE_CANONNAME_SEARCH.

And we might not care to have so many AI_CANONNAME_SEARCH_* flags, maybe
AI_CANONNAME_SEARCH_ANY will do.

Comments?

Nico
-- 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: [email-masked] (Jun-ichiro itojun Hagino)
Date: Tue, 2 Oct 2007 10:08:44 +0900 (JST)

> My proposal is to add an AI_SECURE_CANONNAME flag with the following

	do not try to implement policy into applications.  you will end up
	forced to (?) rewrite every existing applications.

itojun

---

From: Keith Moore <[email-masked]>
Date: Mon, 01 Oct 2007 23:35:02 -0400

> 	forced to (?) rewrite every existing applications.
perhaps, but having the policy be application-independent doesn't make
sense either.

---

From: Keith Moore <[email-masked]>
Date: Tue, 02 Oct 2007 00:12:40 -0400

Jun-ichiro itojun Hagino wrote:
>> 	it can be application-specific, without application modification.
>> 	check out "systrace" by Niels Provos.
>>     
it's useful but it really isn't flexible enough to remove the need for
applications to be able to specify policies.

Keith

---

From: [email-masked] (Jun-ichiro itojun Hagino)
Date: Tue, 2 Oct 2007 13:07:37 +0900 (JST)

itojun

---

From: [email-masked] (Jun-ichiro itojun Hagino)
Date: Tue, 2 Oct 2007 13:18:22 +0900 (JST)

> applications to be able to specify policies.

	i wonder how many command line options will be added to the
	applications once you start adding up policy stuff... sendmail.cf
	lookalike for every apps?

itojun

---

From: Keith Moore <[email-masked]>
Date: Tue, 02 Oct 2007 00:34:03 -0400

> 	lookalike for every apps?
well, I do think we need a policy specification language that lets
policies for use of the network be specified independently of the
application.   I just don't
think it will be sufficient for all applications.

---

From: "Gorsic, Bonnie L" <[email-masked]>
Date: Tue, 2 Oct 2007 08:04:02 -0700

It seems that policy should be scenario / use case / mission dependent,
and consequently apply to a number of applications. (And thus be
application independent). 

Bonnie L. Gorsic
Technical Fellow
SoS Architecture & Engineering
714-762-4906 (desk)

-----Original Message-----
From: Keith Moore [mailto:[email-masked]] 
Sent: Monday, October 01, 2007 8:35 PM
To: Jun-ichiro itojun Hagino
Cc: [email-masked]; [email-masked]
Subject: Re: AI_SECURE_CANONNAME, AI_CANONNAME_SEARCH_* (Re:
getaddrinfo()and searching)

Jun-ichiro itojun Hagino wrote:
>> What a timely thread.
>>
>> I've recently concluded that we need an extension to getaddrinfo() 
>> along these lines, but I'm looking for somewhat tighter and more 
>> generic semantics.
>>

---

From: Keith Moore <[email-masked]>
Date: Tue, 02 Oct 2007 12:52:13 -0400

> application independent). 
it's normal for policy to be different from one application to another. 
some applications are permitted by policy, others are forbidden, others
are permitted with restrictions. 

also, it is difficult to generalize policy specification to the point
that it can be independent of all applications, because sometimes there
is a subtle interaction between policy and the application.  for
example, many sites have mail filtering policies that hinge on
subtleties of SMTP protocol responses and DNS query results.  it doesn't
make sense to try to specify those in an application-independent fashion.

that said, a coarse specification of policy that could be applied to
some applications would still be useful.

Keith