Subject: Re: [dnsext] DNS-AS RRTYPE PARAMETER ALLOCATION

From: Ray Bellis <[email-masked]>
Date: Wed, 10 Feb 2016 12:26:38 +0000

Wolfgang,

I've been appointed as the designated expert to review your RRTYPE
application per RFC 6895.

In principle the application is OK, and it's highly desirable that you
avoid use of TXT.

Within my remit however I do have some concerns over the name of the RRTYPE:

- the term "authoritative" has a particular meaning in the DNS
  protocol, and "authoritative source" is a commonly used term
  too.  Typing "dns authoritative source" into Google already
  produces 75,000 results, none that I could see relating to
  your project.

- using "DNS" within the RRTYPE name seems redundant - we're
  already in the DNS.

- the letters "AS" are also commonly used to refer to a BGP
  "Autonomous System".

[FWIW, when I first saw your requested mnemonic in the subject of your
application I was expecting to see an application for an RRTYPE to
represent a BGP AS number!]

Also missing is any explicit statement that the intended wire and
presentation format are identical to that of a TXT record.
Consideration should also be given to what happens if the data does not
fit within a single 255 octet "character-string" sub-field.

Incidentally, the "CISCO-CLS=" prefix in the RDATA would appear to be
redundant when you get your own RRTYPE, and if it's expected that other
vendors would use this then I suggest that you either omit it or use
something more neutral.

At a higher level I have concerns about the overall use case  that
should be addressed if you plan to document "DNS Authoritative Source"
in an Internet Draft (although I don't expect these to be a factor in my
decision as they're probably outside the scope of RFC 6895):

-  why DNS?  How does the client know what domain names are
   supposed to be looked up?

-  if the "Application Name" is the primary key, why not incorporate
   that into the domain name?

  - (corollary) is it expected that a client would want to (or even
    be allowed to) obtain information about all known applications at
    a domain with a single DNS query?

-  what about DNS Security?  What happens in your SDN if someone
   manages to poison a record?

The decision will be reached within two weeks of today, and before
approval the explicit linking to the TXT record format must be resolved.

I urge you to reconsider your project name of "DNS Authoritative Source"
as being a clash with existing terminology. I'm not currently inclined
to reject the application on that basis of the requested DNSAS mnemonic,
but welcome community feedback on that issue.

kind regards,

Ray Bellis

---

From: Ray Bellis <[email-masked]>
Date: Wed, 10 Feb 2016 15:54:19 +0000

For reference, since the requester didn't send the application to
dnsext, the application can be seen at:

<https://mailarchive.ietf.org/arch/msg/dns-rrtype-applications/JS5ReajNvATcqE9SNYOjlXfxBCE>

with the filled-in template at:

<https://mailarchive.ietf.org/arch/attach/dns-rrtype-applications/txtlyD1DI.txt>

Ray

---

From: "Wolfgang Riedel (wriedel)" <[email-masked]>
Date: Sat, 13 Feb 2016 20:36:38 +0000

Hi Ray,

may thanks for your reply.

I consultant with some colleagues and were good with filing a new request and replace the mnemonic = DNSAS with mnemonic = AVC as you suggested.
Also some answer to your question inline.

For all other on list, if you’re looking for more details on DNS-AS please have look at http://dns.as.org

Thank you,
Wolfgang

> On 10 Feb 2016, at 13:26PM, Ray Bellis <[email-masked]> wrote:
> 
> Wolfgang,
> 

yes I agree and we have chosen the wording by intension to outline that we leverage the authoritative name server as a sigle source of truth for application metadata.

> - using "DNS" within the RRTYPE name seems redundant - we’re already in the DNS.

agree

> - the letters "AS" are also commonly used to refer to a BGP "Autonomous System”.

agree

> represent a BGP AS number!]

it’s not so far off given that BGP expresses routing policy intend and DNS-AS metadata for application policy intend

> fit within a single 255 octet "character-string" sub-field.

OK will adress this

> vendors would use this then I suggest that you either omit it or use

yes good catch and I agree and will remove this

> decision as they're probably outside the scope of RFC 6895):

at this time there are not plans to submit this as an Internet Draft

> -  why DNS?

Readily available tool - already leveraged to identify an application by DNS-NAME

> How does the client know what domain names are supposed to be looked up?

it’s a function of an DNS-AS client which snoop DNS request as an trigger and raises it’s own query for a DNS-AS Resource Record to get the metadata to enforce policy later

>   that into the domain name?

This ‘could be done’ - but most customers don’t or won’t always identify what application is running on a server via it’s FQDN.

>    a domain with a single DNS query?

there is nothing confidential inside a DNS-AS resource record.
The key is that it it authoritative!

>   manages to poison a record?

what happens if I haven't done my homework and didn’t secure and harden my DNS infrastructure ;-)
If DNS is compromised you have bigger problems than how a network element chooses mark and service (queue) for a given application...

> but welcome community feedback on that issue.

yes will file a new request for mnemonic = AVC