Subject: [Add] VPN requirements are the empty set

From: "Martin Thomson" <[email-masked]>
Date: Wed, 09 Sep 2020 12:41:33 +1000

https://github.com/ietf-wg-add/draft-add-requirements/issues/23

Based on the text in the VPN section (3.3) of the requirements draft, I believe that VPNs aren't special.  Mostly they are like any other network configured resolver discovery.  Even the explicit configuration of names for which the resolver applies is not that special (Section 4 is devoted to this idea, but more on that later).

This section can be reduced to a paragraph under Section 3.1 explaining this equivalence.

---

From: tirumal reddy <[email-masked]>
Date: Wed, 9 Sep 2020 17:02:23 +0530

Hi Martin,

Thanks for the detailed review. Please see inline.

On Wed, 9 Sep 2020 at 08:12, Martin Thomson <[email-masked]> wrote:

> Based on the text in the VPN section (3.3) of the requirements draft, I
> believe that VPNs aren't special.

Yes but VPN already has a mechanism to provide the internal domain names
for split DNS. I am not aware of any such mechanism for other networks
other than the discussion of using PvD to convey the internal domain names
discussed in
https://tools.ietf.org/html/draft-ietf-intarea-provisioning-domains-11.

In VPN because of the existing relationship, secure discovery is possible
(unlike Home networks). I guess the only requirement is to mandate secure
discovery for encrypted DNS resolvers hosted by the VPN provider.

Cheers,
-Tiru

> Mostly they are like any other network configured resolver discovery.
> Even the explicit configuration of names for which the resolver applies is
> not that special (Section 4 is devoted to this idea, but more on that
> later).
>
> --
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 9 Sep 2020 17:34:32 +0000

On Sep 9, 2020, at 4:32 AM, tirumal reddy <[email-masked]> wrote:
>> Based on the text in the VPN section (3.3) of the requirements draft, I believe that VPNs aren't special. 
> 
> Yes but VPN already has a mechanism to provide the internal domain names for split DNS. I am not aware of any such mechanism for other networks other than the discussion of using PvD to convey the internal domain names discussed in https://tools.ietf.org/html/draft-ietf-intarea-provisioning-domains-11. 

You are correct, but why does that mean that it should be called out as different? It is still "network-provided", where the VPN is the network.

--Paul Hoffman

---

From: tirumal reddy <[email-masked]>
Date: Thu, 10 Sep 2020 12:39:23 +0530

On Wed, 9 Sep 2020 at 23:04, Paul Hoffman <[email-masked]> wrote:

> You are correct, but why does that mean that it should be called out as
> different? It is still "network-provided", where the VPN is the network.
>

Yes, the DNS resolver is hosted by the VPN provider. The special mention
should be to call out the difference with other networks.

-Tiru

---

From: "Martin Thomson" <[email-masked]>
Date: Thu, 10 Sep 2020 17:21:49 +1000

On Thu, Sep 10, 2020, at 17:09, tirumal reddy wrote:
> Yes, the DNS resolver is hosted by the VPN provider. The special 
> mention should be to call out the difference with other networks.

That's not special though.  All the special-ness there is bound up in the VPN-ness, not the DNS aspects.  Any special mention should be to point out the similarities, which are relevant, not the differences, which are not.

---

From: tirumal reddy <[email-masked]>
Date: Thu, 10 Sep 2020 13:14:44 +0530

On Thu, 10 Sep 2020 at 12:52, Martin Thomson <[email-masked]> wrote:

> That's not special though.  All the special-ness there is bound up in the
> VPN-ness, not the DNS aspects.  Any special mention should be to point out
> the similarities, which are relevant, not the differences, which are not.
>

Agreed on pointing out the similarities but don't get why the differences
should not be discussed ?

-Tiru