Subject: The third poison (was Re: [dnsext] Re: draft-vandergaast-edns-client-ip-01)

From: Ted Hardie <[email-masked]>
Date: Wed, 2 Jun 2010 10:51:17 -0700

Just to clarify, there is another poison....

On Sat, May 29, 2010 at 2:18 PM, Nicholas Weaver
<[email-masked]> wrote:

> Pick your poison:
>
> a: Enable these tricks to work with 3rd party resolvers
>
> or
>
> b: Accept a world where third party resolvers WILL produce inferior results:
> http://www.sajalkayan.com/in-a-cdnd-world-opendns-is-the-enemy.html
>
>
> Can any of those who oppose this solution make a compelling explanation why B is preferable, because from as far as I can tell, ANY solution for A is opposed by a vocal portion of this group?
>

As a third option, you can make these DNS tricks opt-in from the node
originating
the query, rather than deciding for it what the right query should be.

Paul's point is that this is basically an addition to the q-tuple; this option
adds network topology to the q-tuple and asks the authoritative to
consider that in constructing the answer.  If we are to do that, I think
the right place to do it is at the node emitting the query.  First and foremost
because it is the only node that knows whether or not the node cares
about topology being used to construct the answer.  There are many
applications for which this data is not useful or important, and turning
it on only when needed is more efficient; if the originating node cares
about that efficiency it can use it only when the application requires it.

Second, the originating node may have data on what the appropriate
piece of topology to use to augment the q-tuple might be.  Given the
extent of tunneling used in the Internet today, this is not trivial.  To take
one example discussed before, a host with a mobile IP tunnel back to
a home network may consistently use the home network's DNS servers
but  use the outbound interface on the visited network to actually source
application traffic (to avoid triangle routing for jitter-sensitve traffic
like  VoIP traffic, for example).  If it can pass the home network
the visited network subnet it wishes to use, the home network's
DNS servers can use that to construct this augmented query.
Note that this particular use case applies even if the node originating
the query asks the authoritative server itself, using the tunnel interface
to source the DNS query.

Third, the node originating the query is the only node which can
reasonably determine whether providing topology is a privacy issue.
That issue has been discussed at length, but the opt-out nature
of the current solution remains deficient--there is no way for the
originating node to know whether the upstream is using this
option in the current case, so it must deal with adding this option.
That shifts a burden on to it for every query, to support the CDN's
value proposition--which is present at only some queries.

I understand that Nick and others believe that requiring opt-in
will mean this never deploys.  If the end-users or OS producers
actually see the value being asserted here, I think that deployment
could occur.  It also seems to me by far the better long term solution if
we do want topology (or anything else) include in the q-tuple.  The
node originating the q-tuple should originate any additional
constraints on the results it desires.  That just makes sense.

regards,

Ted Hardie

---

From: John Payne <[email-masked]>
Date: Wed, 16 Jun 2010 16:17:10 -0400

> the query, rather than deciding for it what the right query should be.

It is opt-in.... I don't get why you don't think it is.
Stub resolvers can add the option.
Stub resolvers that don't add the option can opt-in to a third-party resolver that does.

---

From: Ted Hardie <[email-masked]>
Date: Wed, 16 Jun 2010 13:50:05 -0700

> Stub resolvers that don't add the option can opt-in to a third-party resolver that does.

Uh, I think we disagree about who should be doing the opt-in.  The
proposed mechanism
at the time I made that comment had no way for the end system to tell
if the stub resolver
was using the option or not.  So they are forced to opt-out if they
don't want it, rather
than opt-in if they do.

I hope that's clear,

regards,

Ted