DNS Push Notifications
draft-ietf-dnssd-push-25

[Ballot comment]
Thanks for this well-written document!

What are the privacy considerations to zone content owners (e.g.,
machine owners listed in a zone) about the availability of near-realtime
information tracking their changes?

Can we have a discussion of padding policy to attempt to preserve the
privacy of push transactions?

Section 1.2

Do we need to give a reference for the BSD Sockets API?  (I honestly
forget what we did for other documents referencing it.)

Section 3

Perhaps we should put quotation marks around statements taken from RFC
8490 (so as to avoid the appearance that we are duplicating normative
requirements made in that document).

Section 5

  server in this protocol specification.  Additional security measures
  such as client authentication during TLS negotiation MAY also be
  employed to increase the trust relationship between client and
  server.

Do we want to say anything about the validation procedures for that
client authentication, maybe RFC 6125 with a DNS-ID check, or would that
be too restrictive?

Section 6.1

  In many contexts, the recursive resolver will be able to handle Push
  Notifications for all names that the client may need to follow.  Use
  of VPN tunnels and split-view DNS can create some additional
  complexity in the client software here; the techniques to handle VPN
  tunnels and split-view DNS for DNS Push Notifications are the same as
  those already used to handle this for normal DNS queries.

Is there a good reference discussing these techniques?

Section 6.2.1

  The MESSAGE ID field MUST be set to a unique value, that the client
  is not using for any other active operation on this DSO session.  For

Isn't this already mandated by 8490?

(Hmm, the interaction of TLS early data's replayability and MESSAGE ID
uniqueness might require some thought.  But the MESSAGE ID uniqueness is
within a DSO session, not global, so that may not make a difference.)

Section 6.3.1

  The other header fields MUST be set as described in the DSO spec-
  ification [RFC8490].  The DNS OPCODE field contains the OPCODE value
  for DNS Stateful Operations (6).  The four count fields MUST be zero,
  and the corresponding four sections MUST be empty (i.e., absent).

We may not need the 2119 terms for the requirements duplicated from
8490.

  For collective remove notifications, if CLASS is not 255 (ANY) and
  TYPE is not 255 (ANY) then for the given name this deletes all
  records of the specified type in the specified class.

(et seq) What does it mean to "delete a record", from the recipient's
point of view?  (How does the server communicate that the RRset's
contents have changed to a completely disjoint value -- delete plus add?)

  a SUBSCRIBE request, subject to the usual established DNS case-
  insensitivity for US-ASCII letters.  If the TYPE in the SUBSCRIBE
  request was not ANY (255) then the TYPE of the record must match the
  TYPE given in the SUBSCRIBE request.  If the CLASS in the SUBSCRIBE

nit: we switch from using the indefinite article to the definite article
with "SUBSCRIBE request", which is a bit jarring since we don't give a
great indication of what distinguishes the definite case.

Section 6.5

It's not entirely clear to me that we need quite this much detail about
discovery proxy operations, in order to motivate RECONFIRM.

If we're going to talka bout Apple's dns_sd.h API (which I have somewhat
mixed feelings about to begin with), we should have a reference for it.

Section 7.1

  Deployment recommendations on the appropriate key lengths and cypher
  suites are beyond the scope of this document.  Please refer to TLS
  Recommendations [RFC7525] for the best current practices.  Keep in

Please cite this as BCP 195.

Section 7.4

  servers.  The server may keep TLS state with Session IDs [RFC8446] or
  operate in stateless mode by sending a Session Ticket [RFC5077] to

5077 was made obsolete by 8446; from the practical side of tings there
is no wire-visible distinction between stateful session IDs and
stateless session tickets.

Section 10.2

I think RFC 7858 needs to be normative.

Likewise, RFC 8310.

[Ballot comment]
— Section 6.7 —

  When a
  client terminates an individual subscription (via UNSUBSCRIBE) or all
  subscriptions on that DSO session (by ending the session) it is
  signaling to the server that it is longer interested in receiving
  those particular updates.

Typo: It shoud be “it is no longer interested”.

[Ballot comment]
Reference Nits:
-- Section 6.2.1.  Please add a citation for “US-ASCII”

-- Section 6.5.  Please add a citation for “apple dns_sd.h API”

Editorial Nits:
-- Section 2.  Editorial. s/poor imitations/imitation/

-- Section 6.  Typo. s/the the/the/

[Ballot comment]
Thanks for this well-written document!

One small comment on the idle handling: The DSO idle timeout does not "apply" as long as there is at least one active subscription. That mean the connection can be idle for a long time if not change appears. Should this document say something about use of keep-alives in this situation? RFC8490 specifies keep-alives handling as well but it could be good to mention this explicitly in this document as well. Further I was wondering if actually DSO keep-alives should be used or if the lower layer TCP keep-alives would be more efficient/appropriate.

Other, smaller comments:

1) Minor comment on normative language in section 3:
  "Generally, as described in the DNS Stateful Operations specification
  [RFC8490], a client must not keep a session to a server open
  indefinitely if it has no subscriptions (or other operations) active
  on that session.  A client MAY close a session as soon as it becomes
  idle, and then if needed in the future, open a new session when
  required.  Alternatively, a client MAY speculatively keep an idle
  session open for some time, subject to the constraint that it MUST
  NOT keep a session open that has been idle for more than the
  session's idle timeout (15 seconds by default) [RFC8490]."
I assume the first "must" is not normative because this is normatively specified in RCC8490. However, if this is reason the last "MUST NOT" should also be lower case.

2) Section 5: Tail Loss Probe (TLP) [I-D.dukkipati-tcpm-tcp-loss-probe]"
dukkipati-tcpm-tcp-loss-probe was merged into draft-ietf-tcpm-rack-05. Maybe mention TCP RACK instead of TLP anyway.

3) Section 6.7:
  "If the session is forcibly closed at the TCP level by sending a RST
  from either end of the connection, data may be lost and TLS session
  resumption of this session will not be possible."
I would think that TLS session resumption might still be possible even if a RST is received (as long as the TLS handshake was completed and the client received a session ticket). Or what's the assumption here?

4) Section 6.8:
"The interval between successive DNS queries for the same name, type and
  class SHOULD be at least the minimum of: 900 seconds (15 minutes), or
  two seconds more than the TTL of the answer RRset."
Would it maybe make sense to specify also a hard limit, e.g. "MUST NOT be less than 3 seconds (see RFC8085)", or would that maybe give a wrong impression that 3 seconds seems to be an acceptable value...?

5) One minor comment/question on the references:
And why is draft-ietf-dnssd-hybrid not cited by draft name but as [DisProx] instead?

(Via drafts-lastcall@iana.org): IESG/Authors/WG Chairs:

The IANA Functions Operator has completed its review of draft-ietf-dnssd-push-20. If any part of this review is inaccurate, please let us know.

The IANA Functions Operator has a question about one of the actions requested in the IANA Considerations section of this document.

The IANA Functions Operator understands that, upon approval of this document, there are two actions which we must complete.

IANA also understands that the RCODES listed in Table 1 in Section 6.2.2 are not requests for new registrations but uses of the existing RCODE registry on the Domain Name System (DNS) Parameters registry page located at:

https://www.iana.org/assignments/dns-parameters/

First, in the Service Name and Transport Protocol Port Number Registry located at:

https://www.iana.org/assignments/service-names-port-numbers

the following service name will be registered as follows:

Service Name: _dns-push-tls._tcp
Transport Protocol(s): tcp
Assignee: IESG .
Contact: IETF Chair
Description: DNS Push Notification Service Type
Reference: [ RFC-to-be ]

NOTE: According to RFC 6335, Section 5.1, service names MUST be no more than 15 characters long. Please let us know if the service name should be updated.

Second, in the DSO Type Codes registry on the Domain Name System (DNS) Parameters registry page located at:

https://www.iana.org/assignments/dns-parameters/

four, new registrations are to be made as follows:

Type: [ TBD-at-Registration ]
Name: SUBSCRIBE
Early Data:
Status:
Reference: [ RFC-to-be ]

Type: [ TBD-at-Registration ]
Name: PUSH
Early Data:
Status:
Reference: [ RFC-to-be ]

Type: [ TBD-at-Registration ]
Name: UNSUBSCRIBE
Early Data:
Status:
Reference: [ RFC-to-be ]

Type: [ TBD-at-Registration ]
Name: RECONFIRM
Early Data:
Status:
Reference: [ RFC-to-be ]

IANA understands that the authors have requested that the values 0x0040, 0x0041, 0x0042 and 0x0043 be used for these registrations. These requested values are in the Expert Review portion of the DSO Type Codes registry. We will initiate the required Expert Review via a separate request. Expert review will need to be completed before your document can be approved for publication as an RFC.

IANA Question --> what are the intended entries for "Early Data" and "Status" for these new registrations?

The IANA Functions Operator understands that these are the only actions required to be completed upon approval of this document.

Note:  The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is meant only to confirm the list of actions that will be performed.

Thank you,

Sabrina Tanamal
Senior IANA Services Specialist

The following Last Call announcement was sent out (ends 2019-07-05):

From: The IESG
To: IETF-Announce
CC: tjw.ietf@gmail.com, dnssd-chairs@ietf.org, dnssd@ietf.org, Tim Wicinski , draft-ietf-dnssd-push@ietf.org, evyncke@cisco.com
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (DNS Push Notifications) to Proposed Standard


The IESG has received a request from the Extensions for Scalable DNS Service
Discovery WG (dnssd) to consider the following document: - 'DNS Push
Notifications'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2019-07-05. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the beginning of
the Subject line to allow automated sorting.

Abstract


  The Domain Name System (DNS) was designed to return matching records
  efficiently for queries for data that are relatively static.  When
  those records change frequently, DNS is still efficient at returning
  the updated results when polled, as long as the polling rate is not
  too high.  But there exists no mechanism for a client to be
  asynchronously notified when these changes occur.  This document
  defines a mechanism for a client to be notified of such changes to
  DNS records, called DNS Push Notifications.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-dnssd-push/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-dnssd-push/ballot/


No IPR declarations have been submitted directly on this I-D.

(1) Document reviewed: draft-ietf-dnssd-push-12
    This document is Standards Track.

(2)

Technical Summary

  The Domain Name System (DNS) was designed to return matching records
  efficiently for queries for data that is relatively static.  When
  those records change frequently, DNS is still efficient at returning
  the updated results when polled, as long as the polling rate is not
  too high.  But there exists no mechanism for a client to be
  asynchronously notified when these changes occur.  This document
  defines a mechanism for a client to be notified of such changes to
  DNS records, called DNS Push Notifications.


Working Group Summary

  The significant thing was the initial version of the draft had both protocols
  and process.  The decision was made after discussion with DNSOP, to split
  this work into a separate draft and the protocol work into
  draft-ietf-dnsop-session-signal, which is now RFC8490.

Document Quality

  The documents is of good quality.  There currently is some non-published
  implementations.  The reviews on this document were vigorous and thorough.

Personnel:

  Document Shepherd is Tim Wicinski
  Area Director is Terry Manderson

(3) The Document Shepherd did a through review looking for editorial issues, as
well as technical issues.

(4) The Document Shepherd has no concerns about the depth or breath of reviews.

(5) This document was reviewed by DNSOP working group, as there is some overlap
in working group participants.  The major outcome was to split the document into
two drafts, this one and the ietf-dnsop-session-signaling draft which is now RFC8490.

(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the
IESG should be aware of? For example, perhaps he or she is uncomfortable
with certain parts of the document, or has concerns whether there really
is a need for it. In any event, if the WG has discussed those issues and
has indicated that it still wishes to advance the document, detail those
concerns here.

(7)  The Authors have confirmed that any and all IPR disclosures have
    been filed, which are currently none.

(8) There are No IPR disclosures on this document


(9) WG Consensus of this document is solid.

(10)  No Appeals have been filed and no extreme discontent has been registered.


(11) With version -19, there are no outdated references in this document.


(12) No formal reviews needed

(13) All references have been identified as either normative or informative

(14) With version -19, there are no longer unpublished normative drafts.


(15) With version -19, there are no longer downward normative references in this document.



(16) Publication of this document will not change the status of any RFCs.


(17) the IANA section is consistent

(18) No new IANA registries.

(19) No Automated checks other than NITs

(1) Document reviewed: draft-ietf-dnssd-push-12
    This document is Standards Track.

(2)

Technical Summary

  The Domain Name System (DNS) was designed to return matching records
  efficiently for queries for data that is relatively static.  When
  those records change frequently, DNS is still efficient at returning
  the updated results when polled, as long as the polling rate is not
  too high.  But there exists no mechanism for a client to be
  asynchronously notified when these changes occur.  This document
  defines a mechanism for a client to be notified of such changes to
  DNS records, called DNS Push Notifications.


Working Group Summary

  The significant thing was the initial version of the draft had both protocols
  and process.  The decision was made after discussion with DNSOP, to split
  this work into a separate draft and the protocol work into
  draft-ietf-dnsop-session-signal, currently working its way through DNSOP.

Document Quality

  The documents is of good quality.  There currently is some non-published
  implementations.  The reviews on this document were vigorous and thorough.

Personnel:

  Document Shepherd is Tim Wicinski
  Area Director is Terry Manderson

(3) The Document Shepherd did a through review looking for editorial issues, as
well as technical issues.

(4) The Document Shepherd has no concerns about the depth or breath of reviews.

(5) This document was reviewed by DNSOP working group, as there is some overlap
in working group participants.  The major outcome was to split the document into
two drafts, this one and the ietf-dnsop-session-signaling draft which is working
its way through DNSOP.

(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the
IESG should be aware of? For example, perhaps he or she is uncomfortable
with certain parts of the document, or has concerns whether there really
is a need for it. In any event, if the WG has discussed those issues and
has indicated that it still wishes to advance the document, detail those
concerns here.

(7)  The Authors have confirmed that any and all IPR disclosures have
    been filed, which are currently none.

(8) There are No IPR disclosures on this document


(9) WG Consensus of this document is solid.

(10)  No Appeals have been filed and no extreme discontent has been registered.


(11) With version -19, there are no outdated references in this document.


(12) No formal reviews needed

(13) All references have been identified as either normative or informative

(14) With version -19, there are no longer unpublished normative drafts.


(15) With version -19, there are no longer downward normative references in this document.



(16) Publication of this document will not change the status of any RFCs.


(17) the IANA section is consistent

(18) No new IANA registries.

(19) No Automated checks other than NITs

(1) Document reviewed: draft-ietf-dnssd-push-12
    This document is Standards Track.

(2)

Technical Summary

  The Domain Name System (DNS) was designed to return matching records
  efficiently for queries for data that is relatively static.  When
  those records change frequently, DNS is still efficient at returning
  the updated results when polled, as long as the polling rate is not
  too high.  But there exists no mechanism for a client to be
  asynchronously notified when these changes occur.  This document
  defines a mechanism for a client to be notified of such changes to
  DNS records, called DNS Push Notifications.


Working Group Summary

  The significant thing was the initial version of the draft had both protocols
  and process.  The decision was made after discussion with DNSOP, to split
  this work into a separate draft and the protocol work into
  draft-ietf-dnsop-session-signal, currently working its way through DNSOP.

Document Quality

  The documents is of good quality.  There currently is some non-published
  implementations.  The reviews on this document were vigorous and thorough.

Personnel:

  Document Shepherd is Tim Wicinski
  Area Director is Terry Manderson

(3) The Document Shepherd did a through review looking for editorial issues, as
well as technical issues.

(4) The Document Shepherd has no concerns about the depth or breath of reviews.

(5) This document was reviewed by DNSOP working group, as there is some overlap
in working group participants.  The major outcome was to split the document into
two drafts, this one and the ietf-dnsop-session-signaling draft which is working
its way through DNSOP.

(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the
IESG should be aware of? For example, perhaps he or she is uncomfortable
with certain parts of the document, or has concerns whether there really
is a need for it. In any event, if the WG has discussed those issues and
has indicated that it still wishes to advance the document, detail those
concerns here.

(7)  The Authors have confirmed that any and all IPR disclosures have
    been filed, which are currently none.

(8) There are No IPR disclosures on this document


(9) WG Consensus of this document is solid.

(10)  No Appeals have been filed and no extreme discontent has been registered.


(11) With version -19, there are no outdated references in this document.


(12) No formal reviews needed

(13) All references have been identified as either normative or informative

(14) With version -19, there are no longer unpublished normative drafts.


(15) With version -19, there are no longer downward normative references in this document.



(16) Publication of this document will not change the status of any RFCs.


(17) the IANA section is consistent

(18) No new IANA registries.

(19) No Automated checks other than NITs

Since draft-ietf-dnssd-push already had successfully completed WGLC, and there was no opposition to the latest changes, we're declaring this WGLC successful. The document will be submitted to the IESG for publication shortly.