Re: HTTP Proxy-Status Parameter for Next-Hop Aliases

Hi Erik,

Thanks for the review! Comments below.

> On Dec 1, 2022, at 9:34 AM, Erik Nygren <erik+ietf@nygren.org> wrote:
> 
> I'd agree that HTTP makes more sense since this seems generally useful for proxies.
> 
> I'd be in-favor of the HTTP WG doing this.  I think it will be important 
> to loop in DNSOP and/or the new DNS Directorate in as well since there
> may be some important corner-cases from them to consider.
> 
> Some thoughts also opened at:
> https://github.com/tfpauly/privacy-proxy/issues/229
> https://github.com/tfpauly/privacy-proxy/issues/230
> 
> 1) Per draft-ietf-dnsop-svcb-https-11 section 3.2 clients MUST send the final TargetName to proxies:
> https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-11#section-3.2
> Proxies themselves shouldn't be doing SVCB/HTTPS RR lookups to get A/AAAA records.
> As such, draft-pauly-httpbis-alias-proxy-status only needs to look at CNAME chains.

Thanks, I’ve removed the SVCB reference with this PR: https://github.com/tfpauly/privacy-proxy/pull/231
> 
> 2) Is any special handling needed for exposing DNAMEs? Or are those not visible to resolver libraries.  I think the latter, but not sure.

I’ve looked into this, and I believe this shouldn’t expose DNAMEs, from my understanding. The resolver library seems like it would normally just see the address records, or a synthesized CNAME record. Let me know if I’ve missed something there.

> 
> These might also be worth considering, although we might decide they are too much complexity:
> 
> 3) One of the use-cases for draft-pauly-httpbis-alias-proxy-status may be for influencing connection coalescing behaviors. Since some clients use "is the IP address that the proxy is connecting to overlapping with the rrset(s) used by other connections" having the full IP address rrset lists for A and AAAA responses might be worthwhile.

While the connection-coalescing use case is interesting, I think it is more complex and requires a way to request getting full sets of DNS RRs back. The approach of proxy-status is to describe what was connected to, and I don’t think it makes sense to add that information here. I certainly think there’s room for new headers that would allow clients to request specific DNS records from a proxy during CONNECT, but that is a much larger and less clearly scoped direction.

> 4) We may want to allow listing all IP addresses tried before establishing the connection. (eg, a TCP proxy might implement happy eyeballs and/or fail-over between multiple IP addresses.) Knowing which others were tried but not used (when possible) might help for some of the abuse/use cases.
> 
Again, I think this one would be out of scope (especially since this one parameter is now just about aliases). It’s something to consider going forward, though.

Best,
Tommy

> Best, Erik
> 
> 
> 
> 
> 
> 
> > Hello HTTP,
> > 
> > Following up on this discussion, I presented this at Masque at IETF 115, and got the feedback that this would be fit more in HTTP, and also that it should just be a simpler proxy-status parameter to include only the alias name chain (generally, the CNAME chain).
> > 
> > I’ve revised the document, and it’s super short — just defining a “next-hop-aliases” parameter, which is a list of names.
> > 
> > https://www.ietf.org/archive/id/draft-pauly-httpbis-alias-proxy-status-00.html
> https://datatracker.ietf.org/doc/draft-pauly-httpbis-alias-proxy-status/
> > 
> > There was also discussion in the meeting about having more work on broader solutions to get rich and complex DNS information back from proxies, but I’d like to get this simple proxy-status parameter registered separately. I’d appreciate people’s reviews and thoughts.
> > 
> > Thanks,
> > Tommy
> >
> > On Oct 12, 2022, at 4:02 PM, Mark Nottingham <mnot@mnot.net <mailto:mnot@mnot.net?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>> wrote:
> > 
> > Speaking personally -- I don't have any strong feelings either way, as long as appropriate communication happens. If the use cases are for non-MASQUE proxying too (and it seems like they are), that might tilt it slightly towards HTTP.
> > 
> > Cheers,
> > 
> > 
> >> On 11 Oct 2022, at 2:46 am, Tommy Pauly <tpauly@apple.com <mailto:tpauly@apple.com?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>> wrote:
> >> 
> >> Hi HTTP,
> >> 
> >> I wanted to share this draft with this group, which I’ve initially started discussion on in MASQUE.
> >> 
> >> It’s a simple parameter addition to proxy-status, to let the proxy send back the IP and CNAME/alias chain it used to reach the next hop. This is useful for clients of CONNECT/CONNECT-UDP proxies that want to apply policies to specific IPs and CNAMEs (for tracker detection, cookie rules, etc).
> >> 
> >> In addition to any reviews and feedback on the technical content, we’d like to know if this is something that the HTTPbis WG would like to own, or if it is fine letting the work happen in MASQUE and get review from HTTP.
> >> 
> >> Best,
> >> Tommy
> >> 
> >>> Begin forwarded message:
> >>> 
> >>> From: Tommy Pauly <tpauly=40apple.com@dmarc.ietf.org <mailto:tpauly=40apple.com@dmarc.ietf.org?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>>
> >>> Subject: [Masque] HTTP Proxy-Status Parameter for DNS Information
> >>> Date: October 4, 2022 at 12:29:33 PM PDT
> >>> To: masque@ietf.org <mailto:masque@ietf.org?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>
> >>> 
> >>> Hello MASQUErs,
> >>> 
> >>> I wanted to share this document with this group, since it is mainly applicable to MASQUE-style (CONNECT/CONNECT-UDP) proxies.
> >>> 
> >>> Right now, when a client connects to a TCP or UDP server via the proxy using a hostname in the request, it doesn’t perform its own DNS, and thus doesn’t learn about the IP address of the server it ultimately is connected to, or the CNAME / AliasMode chain that was used to get to the IP address of the server. That’s generally fine, but there are use cases where clients may want to know the IP address or CNAMEs to detect cases where trackers are performing CNAME cloaking, etc.
> >>> 
> >>> So, this is a very simple proposal to define a new, optional proxy-status parameter that can let MASQUE-style proxies tell clients about the IP address and CNAME chain from DNS.
> >>> 
> >>> https://www.ietf.org/archive/id/draft-pauly-masque-dns-proxy-status-00.html
> >>> 
> >>> This certainly does not solve all of the use cases where clients may want to know more DNS details (SVCB/HTTPS records for ECH, alpn support, etc), and I expect more work to be needed for those use cases. However, I believe this extra bit of information is something that is incrementally useful, easy to implement, and simple to define.
> >>> 
> >>> Thoughts and feedback welcome!
> >>> 
> >>> Thanks,
> >>> Tommy
> >>> 
> >>>> Begin forwarded message:
> >>>> 
> >>>> From: internet-drafts@ietf.org <mailto:internet-drafts@ietf.org?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>
> >>>> Subject: New Version Notification for draft-pauly-masque-dns-proxy-status-00.txt
> >>>> Date: October 4, 2022 at 11:01:29 AM PDT
> >>>> To: Tommy Pauly <tpauly@apple.com <mailto:tpauly@apple.com?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>>
> >>>> 
> >>>> 
> >>>> A new version of I-D, draft-pauly-masque-dns-proxy-status-00.txt
> >>>> has been successfully submitted by Tommy Pauly and posted to the
> >>>> IETF repository.
> >>>> 
> >>>> Name:  draft-pauly-masque-dns-proxy-status
> >>>> Revision: 00
> >>>> Title:  HTTP Proxy-Status Parameter for DNS Information
> >>>> Document date: 2022-10-04
> >>>> Group:  Individual Submission
> >>>> Pages:  5
> >>>> URL:            https://www.ietf.org/archive/id/draft-pauly-masque-dns-proxy-status-00.txt
> >>>> Status:         https://datatracker.ietf.org/doc/draft-pauly-masque-dns-proxy-status/
> >>>> Html:           https://www.ietf.org/archive/id/draft-pauly-masque-dns-proxy-status-00.html
> >>>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-pauly-masque-dns-proxy-status
> >>>> 
> >>>> 
> >>>> Abstract:
> >>>>  This document defines an HTTP Proxy-Status Parameter that contains
> >>>>  the IP address and CNAME chain received over DNS that was used to
> >>>>  establish the connection to the next hop.
> >>>> 
> >>>> Discussion Venues
> >>>> 
> >>>>  This note is to be removed before publishing as an RFC.
> >>>> 
> >>>>  Source for this draft and an issue tracker can be found at
> >>>>  https://github.com/tfpauly/privacy-proxy.
> >>>> 
> >>>> 
> >>>> 
> >>>> 
> >>>> The IETF Secretariat
> >>>> 
> >>>> 
> >>> 
> >>> -- 
> >>> Masque mailing list
> >>> Masque@ietf.org <mailto:Masque@ietf.org?Subject=Re%3A%20HTTP%20Proxy-Status%20Parameter%20for%20Next-Hop%20Aliases&In-Reply-To=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E&References=%3CBC9076D0-8F74-4D2D-B933-81BE5D1ED52B%40apple.com%3E>
> >>> https://www.ietf.org/mailman/listinfo/masque
> >> 
> > 
> > --
> > Mark Nottingham   https://www.mnot.net/
> >