Subject: Re: [dnsext] draft-vandergaast-edns-client-ip-00

From: Alfred Hönes <[email-masked]>
Date: Thu, 8 Apr 2010 16:20:22 +0200 (MESZ)

Beyond the ongoing discussion, I have concerns with the
compatibility of the proposal with DNSSEC.

If DNSSEC verification is done locally (at the stub resolver,
at a CPE edge router, etc.) but a "general" recursor is used
for the first stage of DNS resolution, there seem to be lots
of opportunities for getting RRSIGs inconsistent with the
'customized' RRsets served to the stub and verifier.

IMO, for various reasons DNSSEC verification is likely to become
of much greater importance for many (most?) Internet users shortly
than the fractional parts of seconds in web access the proponents
of this proposal claim to provide as a justification.

I'd like to see a draft revision that clearly explains how DNSSEC
will work with this idea before the question for adaption as a work
item is restated.

Further, regarding the claimed justification:

The delays induced by missing or poorly configured reverse DNS
entries and much too short TTL values (altogether holding off
firewall approval of access until sensical domain names are
available for logging and policy treatment, e.g. advertisement
and 'tracer/counter' suppression) exceed the claimed acceleration
by an order of magnitude (at least), and the time needed for the
user to read, check and deny (or accept) myriads of cookie
requests issued by many sites adds another magnitude.

Kind regards,
  Alfred.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+

---

From: Edward Lewis <[email-masked]>
Date: Thu, 8 Apr 2010 10:56:17 -0400

>compatibility of the proposal with DNSSEC.

I think there is no issue.

Let's say I have this:

For all IP addressed in 24.0.0.0/8

www.example.org  A  192.0.2.100

and for all other IP address:

www.example.org  A  192.0.2.200

Then I would use the same zone key to sign each record set and hand 
out the answer as appropriate.

www.example.org  A  192.0.2.100
www.example.org  RRSIG A ........ example.org.  12345 ...... sig1

and

www.example.org  A  192.0.2.200
www.example.org  RRSIG A ........ example.org.  12345 ...... sig2

(example.org. DNSKEY .... would have explicit 0.0.0.0/0&::/0 range)
The RRSIG & DS & etc. would be the same for the different records.

Same as we would do for split DNS using views.

I could elaborate, but let me try to get away with a quick response 
first to see of that makes sense.  (The answer lays in RFC 2181's 
trustworthiness ratings.)

>'customized' RRsets served to the stub and verifier.

If the RRSIGs are managed in the correct way - that is as part of an 
RRSet, then they won't be confused.

If a cache does not employ edns-client-ip, then it can't tell one 
answer from the next.  It is possible that the cache might see both 
(but how?) sets, but this is no different than a cache seeing an 
updated set today.  (The only difference is that there is wall clock 
data in the RRSIG - but one should not conflate that with serial 
numbers.  It is possible that a newer serial number could have RRSIGs 
with older times.)

>of this proposal claim to provide as a justification.

My estimation is that this is short changing the justification.  It's 
not just making the web browser faster, it's also helping to divide 
the load on data centers.

To be truthful, I don't know of a white paper that is sufficiently 
detailed to establish this in the "engineering plane".  However, it 
does seem to be playing well in the "press release plane."

>will work with this idea before the question for adaption as a work

That can be included.  DNSSEC issues are not unique to 
edns-client-ip, they crop up in tailoring responses based on load 
measurements and many other factors.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

Wouldn't it be nice if all of the definitions of equivalence were the same?

---

From: Jaap Akkerhuis <[email-masked]>
Date: Thu, 08 Apr 2010 17:09:57 +0200

YES!

And we seem to think a like about the pivacy issue.

	jaap

---

From: Jaap Akkerhuis <[email-masked]>
Date: Thu, 08 Apr 2010 17:27:04 +0200

Oops, Private mail escaped the asylum^Wkeyboard. Sorry.

	jaap
        
	Wouldn't it be nice if all of the definitions of equivalence
	were the same?

    YES!

    And we seem to think a like about the privacy issue.

	jaap