Subject: [dane] Call for consensus for CNAME

From: Ondřej Surý <[email-masked]>
Date: Tue, 9 Aug 2011 22:44:24 +0200

Hi,

I hereby make a call for a consensus on the CNAME issue.

I am specifically asking you if you agree with current
contents of DANE protocol draft, which says that TLSA
queries and answers follows normal DNS resolution.

Please respond just with +1/-1, we already had a lengthy
discussion on the subject and it doesn't seem to develop
anywhere in last few days.  If you really feel an urge
to discuss it again, please read the threads from last
two weeks on the subject and make an follow-up there,
so we can keep this thread loud and clear.

And since we already had a discussion on the topic I would
like to close this issue next monday.	

Thanks,
--
 Ondřej Surý
 vedoucí výzkumu/Head of R&D department
 -------------------------------------------
 CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
 Americka 23, 120 00 Praha 2, Czech Republic
 mailto:[email-masked]    http://nic.cz/
 tel:+420.222745110       fax:+420.222745112
 -------------------------------------------

---

From: Matt McCutchen <[email-masked]>
Date: Tue, 09 Aug 2011 16:50:09 -0400

On Tue, 2011-08-09 at 22:44 +0200, Ondřej Surý wrote:
> anywhere in last few days.

-1.  FYI, I am working on a new proposed solution and plan to post it
(in a separate thread) by the end of the week.

-- 
Matt

---

From: Jakob Schlyter <[email-masked]>
Date: Tue, 9 Aug 2011 22:51:07 +0200

+1

---

From: Matthijs Mekking <[email-masked]>
Date: Tue, 09 Aug 2011 22:56:12 +0200

+1

On 08/09/2011 10:44 PM, Ondřej Surý wrote:
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>

---

From: Matt McCutchen <[email-masked]>
Date: Tue, 09 Aug 2011 17:05:57 -0400

> (in a separate thread) by the end of the week.

I should qualify this:

+1 to NOT specifying a special interaction between CNAME and TLSA.

-1 to closing ticket #24 (I have a different proposal to make).

-- 
Matt

---

From: Ondřej Surý <[email-masked]>
Date: Tue, 9 Aug 2011 23:12:47 +0200

> -1 to closing ticket #24 (I have a different proposal to make).

To clarify - this call is about closing issue #24.  Sorry for not
mentioning it in the call.

O.

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 9 Aug 2011 14:19:36 -0700

+1

--Paul Hoffman

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 9 Aug 2011 17:20:52 -0400

-1

-- 
Website: http://hallambaker.com/

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 9 Aug 2011 17:49:12 -0400

+1

-- 
Andrew Sullivan
[email-masked]

---

From: Paul Wouters <[email-masked]>
Date: Tue, 9 Aug 2011 18:14:25 -0400 (EDT)

+1

Paul

---

From: James Cloos <[email-masked]>
Date: Tue, 09 Aug 2011 19:31:32 -0400

>TLSA queries and answers follows normal DNS resolution.

+1

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 1024D/ED7DAEA6

---

From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 9 Aug 2011 19:49:12 -0400

+1

---

From: [email-masked]
Date: Wed, 10 Aug 2011 11:42:20 +0000

On Tue, Aug 09, 2011 at 11:12:47PM +0200, OndEej SurC= wrote:
> 
> To clarify - this call is about closing issue #24.  Sorry for notmentioning it in the call.

as far as i understand ...   +1

but I would like to see Matt's alternative - which may open #24+i  :)

/bill

---

From: Tony Finch <[email-masked]>
Date: Wed, 10 Aug 2011 18:07:11 +0100

+1

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Humber, Thames, Dover, Wight, Portland, Plymouth: Southwest 5 to 7, increasing
gale 8 for a time in Thames and Dover. Moderate or rough. Occasional rain.
Moderate or good, occasionally poor.

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 10 Aug 2011 13:32:14 -0700

+1 - way forward - I can live with this
-1 - current text - I am trying to figure out what I do and don't like and will be offering comments to the editors.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Ondrej Surý
> Sent: Tuesday, August 09, 2011 1:44 PM
> To: [email-masked]
> Subject: [dane] Call for consensus for CNAME
> 
> Hi,
> 
> I am specifically asking you if you agree with current contents of DANE
> protocol draft, which says that TLSA queries and answers follows normal DNS
> resolution.
> 
> Please respond just with +1/-1, we already had a lengthy discussion on the
> subject and it doesn't seem to develop anywhere in last few days.  If you
> really feel an urge to discuss it again, please read the threads from last two
> weeks on the subject and make an follow-up there, so we can keep this
> thread loud and clear.
> 
>  Ondrej Sur
>  vedouc  v zkumu/Head of R&D department
>  CZ.NIC, z.s.p.o.    --    Laboratore CZ.NIC

---

From: Martin Rex <[email-masked]>
Date: Thu, 11 Aug 2011 05:57:48 +0200 (MEST)

> mentioning it in the call.

+1   (I think).

I'll note that find the 2nd/middle example in
  http://tools.ietf.org/html/draft-ietf-dane-protocol-09#appendix-A.1

midly confusing:

   ; TLSA record is duplicated in target domain
   ;
   sub5.example.com.          IN CNAME sub6.example.com.
   _443_tcp.sub5.example.com. IN TLSA 2 0 308202c5308201ab...
   sub6.example.com.          IN A 10.0.0.0
   _443_tcp.sub6.example.com. IN TLSA 2 0 308202c5308201ab...

because I believe the _intersection_
 of clients asking for _443_tcp.sub5.example.com.
 and clients asking for _443_tcp.sub6.example.com.
ought to be empty.

-Martin

---

From: Ondřej Surý <[email-masked]>
Date: Thu, 11 Aug 2011 10:51:32 +0200

> of clients asking for _443_tcp.sub5.example.com.

True.

> and clients asking for _443_tcp.sub6.example.com.

Nope, you can have certificate for sub6.example.com. and clients
accessing sub6.example.com. will ask for _443_tcp.sub6.example.com.

The important thing is that _443_tcp.sub6.example.com. is not related
to sub5.example.com.

O.

---

From: Scott Schmit <[email-masked]>
Date: Thu, 11 Aug 2011 08:40:06 -0400

>  and clients asking for _443_tcp.sub6.example.com.

Stronger than that, no one should be querying for either TLSA record at
all.  The prefix should be "_443._tcp" and not "_443_tcp".

-- 
Scott Schmit

---

From: Martin Rex <[email-masked]>
Date: Thu, 11 Aug 2011 15:51:41 +0200 (MEST)

> >   _443_tcp.sub6.example.com. IN TLSA 2 0 308202c5308201ab...

btw. shouldn't there be a dot between port number an protocol?

     _443._tcp.sub5.example.com. IN TLSA 2 0 308202c5308201ab...
         ^
> accessing sub6.example.com. will ask for _443_tcp.sub6.example.com.

Of course, you can.

> The important thing is that _443_tcp.sub6.example.com. is not related

Yes.

I failed to explain what I meant...

What I meant to say is that for clients that want to connect to
sub5.example.com, the TLSA record _443._tcp.sub6.example.com
is _not_ a fallback / alternative.  That should only be of interest
to clients connecting to sub6.example.com.

-Martin

---

From: Ondřej Surý <[email-masked]>
Date: Thu, 11 Aug 2011 15:54:36 +0200

> all.  The prefix should be "_443._tcp" and not "_443_tcp".

Scott,

Good catch, thanks.  I believe this is just a typo.  Paul, Jakob, care to
fix that in next version of the draft?

Thanks,

---

From: Ondřej Surý <[email-masked]>
Date: Thu, 11 Aug 2011 15:58:26 +0200

>     _443._tcp.sub5.example.com. IN TLSA 2 0 308202c5308201ab...

Yep, I already pinged Paul and Jakob.

> to clients connecting to sub6.example.com.

That's correct.

O.

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 11 Aug 2011 15:59:29 +0200

> fix that in next version of the draft?

Yes, it is already fixed.

	jakob

---

From: Matt Larson <[email-masked]>
Date: Thu, 11 Aug 2011 11:15:34 -0400

+1

Matt

---

From: Leif Johansson <[email-masked]>
Date: Mon, 15 Aug 2011 09:21:48 +0200

+1

---

From: Ondřej Surý <[email-masked]>
Date: Mon, 15 Aug 2011 16:28:47 +0200

Hi,

seems like we have a strong consensus here:

+1
Ondřej Surý
Matthijs Mekking
Matt McCutchen (with follow-up on wildcards)
Paul Hoffman
Andrew Sullivan
Paul Wouters
James Cloos
Richard L. Barnes
Jakob Schlyter
Bill Manning
Tony Finch
Jim Schaad (with future comments on specific text)
Martin Rex
Matt Larson
Leif Johansson
Scott Schmit

-1
Phillip Hallam-Baker

neither -1 nor +1
Peter Koch

Based on this I am closing #24 and will work with Matt on opening
the wildcards when his proposal is ready.

O.

---

From: Matt McCutchen <[email-masked]>
Date: Mon, 15 Aug 2011 23:32:05 -0400

> the wildcards when his proposal is ready.

Umm... #24 includes wildcards.  Did you mean to split it up?

-- 
Matt