Subject: [dns-privacy] DNS over TLS and framing

From: Francis Dupont <[email-masked]>
Date: Thu, 13 Nov 2014 08:03:02 +0100

Does DNS over TLS use the TLS framing (aka TLS Record Protocol) or
does it prefix messages by a two byte length field as for DNS over TCP
(cf RFC 1035 4.2.2 TCP usage)? I believe it is the second but *no*
DNS over TLS proposal specify this point.

Thanks

[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 13 Nov 2014 06:41:26 -1000

> DNS over TLS proposal specify this point.

This is a good question, one that I realized needed to be answered after I turned in the -00 drafts. I came to the same conclusion, and will add the following wording to the three drafts:

The DNS message format uses the TCP version of the format, namely with the two-octet length at the beginning of each message, as described in Section 4.2.2 of RFC 1035.

--Paul Hoffman

---

From: John Heidemann <[email-masked]>
Date: Thu, 13 Nov 2014 09:28:17 -0800

>DNS over TLS proposal specify this point.

Good question.

draft-hzhwm-dprive-start-tls-for-dns-00
frames as per DNS over TCP, not TLS.

It says:

	   After TLS negotiation completes, the connection will be encrypted and
	   is now protected from eavesdropping and normal DNS queries SHOULD
	   take place.

I guess "normal DNS queries" should be "normal DNS queries (with
DNS-over-TCP framing as per RFC1035 section 4.2.2)" to be clearer.

This choice is consistent with the goal of minimal changes to existing
DNS software.  Once you negotiate TLS, you basically end up just calling
the TLS-specific read/write functions rather than standard read/write.

This approach is also consistent with other STARTTLS uses---they preserve
to "native" framing (like SMTP, RFC3207).

   -John Heidemann

---

From: "Mankin, Allison" <[email-masked]>
Date: Thu, 13 Nov 2014 18:23:41 +0000

Also: We'll want to add guidance here and/or in 5966bis though that helps implementations avoid sending a two byte TCP segment followed by another segment immediately. This came up during questions during John Dickinson's 5966bis presentation in DNSOP. 

> On Nov 13, 2014, at 7:28, "John Heidemann" <[email-masked]> wrote:
> 
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy