Subject: Re: [DNSOP] draft-ietf-dnsop-rfc7816bis: hopefully ready for WG Last Call

From: Tony Finch <[email-masked]>
Date: Wed, 14 Oct 2020 19:15:10 +0100

A few questions and suggestions:

Section 3, algorithm step 5: what is a "hidden QTYPE"?

Also step 5, a NOERROR answer can be positive or negative, so I think it
should be made clear that this is about a non-NXDOMAIN negative cache
entry. (RFC 2308 calls these "NODATA".)

Step 6, what is the "minimised QTYPE"? The term is defined by implication
in section 2, but a reader can't find the definition by searching for the
term.

Step 6b, again NOERROR can be positive or negative. I think either this
needs to be more specific, or it should explicitly say it covers both
cases.

Step 6c, CHILD might not be the full original QNAME at this point, so it's
only correct to stop on NXDOMAIN here if the resolver is doing RFC 8020
strict NXDOMAIN.

Editorial suggestion: the wall of text in section 2 could do with some
subheadings or bullet points. It would be helpful to make a more clear
separation between rationale/discussion and normative text.

I'm not a fan of the term "aggressive" since it sounds unpleasantly
fighty. And I'm not sure how it helps a reader to understand this draft:
AIUI angry vs friendly is supposed to be about the QTYPE used for
truncated query names; the algorithm in section 3 does not depend on this
choice, so I don't know why it is specifically the nasty algorithm. And
section 2 seems to imply the existence of a nice algorithm but there isn't
a specification of it. And why is the choice of QTYPE emotional, but the
number of labels to add is not?

Both section 5 and section 6 seem to be about performance, the problems
and possible benefits, but only the possible benefits count as performance
considerations. I think the question of how many labels to add on each
iteration should be a core part of QNAME minimization, described in
section 2.

(I keep expecting the Oxford spelling "minimize"...)

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Fitzroy: Northerly or northeasterly 3 to 5, becoming variable 4 or less in
west, then southerly 5 or 6 in northwest. Moderate, occasionally rough at
first in northeast. Showers. Good.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 19 Oct 2020 18:48:10 +0200

On Wed, Oct 14, 2020 at 07:15:10PM +0100,
 Tony Finch <[email-masked]> wrote 

> Section 3, algorithm step 5: what is a "hidden QTYPE"?

The original QTYPE, which may be "hidden" by a substitution to another
QTYPE (see section 2 "a QTYPE selected by the resolver to hide the
original QTYPE"). This was not in RFC 7816. Would you prefer we settle
on "original QTYPE"?

> Step 6, what is the "minimised QTYPE"?

The opposite of "hidden QTYPE", it is the QTYPE choosen by the
resolver (NS was recommended in RFC 7816, but it is A in 7816-bis).

---

From: Ralph Dolmans <[email-masked]>
Date: Thu, 22 Oct 2020 13:49:12 +0200

Hi Tony,

Thanks for your feedback, appreciated!

> Section 3, algorithm step 5: what is a "hidden QTYPE"?

The QTYPE in the incoming query. We made the text more consistent and
now always use "original QTYPE".

> entry. (RFC 2308 calls these "NODATA".)

NOERROR can indeed be positive and negative, which is intentional. Also
when you have a positive cache result in this step you know that there
is no delegation at this level and therefore can add an extra label.

I'm ok with making it more clear by explicitly saying that it can be
both positive and negative.

> in section 2, but a reader can't find the definition by searching for the

The QTYPE selected by the resolver to do QNAME minimisation. We now
changed it to "selected QTYPE" to hopefully make it easier to understand.

> needs to be more specific, or it should explicitly say it covers both

Both cases indeed. Made that more explicit in the text.

> only correct to stop on NXDOMAIN here if the resolver is doing RFC 8020

Agree. And without RFC8020 support you should go back to step 3. Added
to the text.

> separation between rationale/discussion and normative text.

I don't have a strong opinion on separating between rationale and
normative text. Adding subheadings is a good suggestion.

> number of labels to add is not?

This is a leftover from an older version. There now is only one way to
do QNAME minimisation, so no need to name it. We removed the
"aggressive" references.

> iteration should be a core part of QNAME minimization, described in

I'm ok with moving the text from section 5 to a subsection of 2.

Thanks!
-- Ralph

---

From: Tony Finch <[email-masked]>
Date: Thu, 22 Oct 2020 21:55:00 +0100

Stephane Bortzmeyer <[email-masked]> wrote:
>  Tony Finch <[email-masked]> wrote:
>

I don't have a preference for any particular term, just that terminology
should be defined and used in a consistent way throughout the spec, so
that if you grep the draft for "hidden" (or whatever) you can find out
what what it means, and you can easily find every place where it is
relevant. ("elegant variation" is a bad thing in technical writing.)

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Great Orme Head to the Mull of Galloway: West 4, backing southwest 5 to 7,
veering west 4 to 6 later. Slight or moderate. Rain for a time, showers later.
Good, occasionally moderate.

---

From: Tony Finch <[email-masked]>
Date: Thu, 22 Oct 2020 23:12:17 +0100

> Thanks for your feedback, appreciated!

Thanks for the response!

I thought of another thing:

Some of the points in section 5 (on limiting the number of queries and the
performance downsides) should be discussed in section 7 (security
considerations). In particular QNAME minimization can amplify query volume
so it can be abused to make random subdomain attacks worse, though that
can be mitigated by RFC 8020 NXDOMAIN.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
the quest for freedom and justice can never end

---

From: Ralph Dolmans <[email-masked]>
Date: Fri, 23 Oct 2020 12:25:09 +0200

> can be mitigated by RFC 8020 NXDOMAIN.

Mentioning it in the security considerations makes sense. Note that
RFC8020 won't help you here when the answer is synthesized using a
wildcard, which is also why the example in section 5 has a wildcard
record. Happy to make this more explicit in the text.

Thanks,
Ralph