Subject: [saag] HTTPS everywhere question --- donated mirrors

From: Michael Richardson <[email-masked]>
Date: Thu, 04 Jun 2015 15:56:09 -0400

So you may know I mismanage www.tcpdump.org.

We have a half-dozen mirrors of the site (and code) around the world, all of
them donated.  100M of disk space or something...
Most answer to www.tcpdump.org as a virtual host, some have their own
URLs.  HTTP based virtual hosting is simple and cheap, and anyone can put up
a mirror using rsync, and then I put the A and AAAA records in along with an
extra name like www.us.tcpdump.org (hosted by wireshark).

Now, www.us.tcpdump.org shares a host with www.wireshark.org, and
https://www.wireshark.org also exists, and my impression is that some
browsers are now doing things like trying port-443, and if it works,
assuming that the same content is there. (No, you can't exactly try, because
I pulled that IP from www.tcpdump.org pending resolution)

Let's assume that I want to make this true (that www.tcpdump.org is
https-everywhere), we need at a minimum, universal SNI or I need to enable
this only when there is a unique v6 (because v4 is too scarce) available.

Okay, that solves the VirtualHost issue... but it seems that I still have
a certificate and private key issue.   I could buy certificates for all
sites, or... ? is there some technology I've missed?
I could go DANE with self-signed certificates, which has some advantage.

In theory, one could have a dozen TLSA RR in DNS, and fortunately they won't
clog up the apex; but in practice are browsers that support DANE smart enough
at this point to search all the records?  Going DANE assumes browsers new
enough to do SNI, which I guess is good.

I wish we had signed HTTP objects instead, so that I could just sign the web
site *contents*, and let the content distribution systems do their job, and
let me do mine.  (hey, the entire http site contents is also on github)
Privacy could be machine to machine, while authentication be browser to web
site owner...  {I'm allowed to dream, aren't I?}

I know that we have this issue with SMTP pointing MX records for example.com
at ISP mail.example.net, and the names not matching, and I guess we are doing
something there.

Am I missing some piece of the puzzle?  Some contemplated aspect of TLSA
which might let me say, "www.wireshark.org is an allowed name for
www.tcpdump.org"??

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: James Cloos <[email-masked]>
Date: Thu, 04 Jun 2015 20:00:38 -0400

>>>>> "MR" == Michael Richardson <[email-masked]> writes:

MR> We have a half-dozen mirrors of the site (and code) around the world, all of
MR> them donated.  100M of disk space or something...
MR> Most answer to www.tcpdump.org as a virtual host, some have their own
MR> URLs.  HTTP based virtual hosting is simple and cheap, and anyone can put up
MR> a mirror using rsync, and then I put the A and AAAA records in along with an
MR> extra name like www.us.tcpdump.org (hosted by wireshark).

MR> Let's assume that I want to make this true (that www.tcpdump.org is
MR> https-everywhere), we need at a minimum, universal SNI or I need to enable
MR> this only when there is a unique v6 (because v4 is too scarce) available.

[Apologies for any typos.  I'm in the process of re-learnin how to type;
left hand doesn't wok quite right anymore... -JimC]

For mirror netwoks like that you need to have each of them get their own
certs (or their own names) and have downloads redirect rom the main site
to mirrors with something like an http 302.

The main site an distribute the redirrecs using things like geoip or
(optionally weighted) round robin, or whatever.

There really isn't any other secure way to do it.

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 0x997A9F17ED7DAEA6

---

From: Martin Thomson <[email-masked]>
Date: Mon, 8 Jun 2015 11:35:49 -0700

> which might let me say, "www.wireshark.org is an allowed name for

Well... ACME will let wireshark.org get a certificate for tcpdump.org,
now that you have setup DNS.

If you want them to be able to use your name, then allow them to have
a certificate for it.

SNI is a problem, but you might decide that IE 6 and Android 2.2 users
aren't that important.  I know several people running services that
rely on SNI alone happily.

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 8 Jun 2015 19:18:00 +0000

> I pulled that IP from www.tcpdump.org pending resolution)

Assuming that port 443 is semantically identical to port 80 is
rather unwise.  Are browsers really doing that, or is the host in
question configured to publish alternative service access via 443?

> enough to do SNI, which I guess is good.

There are essentially no browsers that support DANE.  There are
some experimental plugins, but nothing mainstream anyone should
rely on.

> www.tcpdump.org"?

Unfortunately, HTTP does not use SRV records.  If HTTP had used
SRV records, and if browsers supported DANE, then the DANE SRV
draft (approved and in the RFC editor queue) would do precisely
what you want, in that each target host's own name from the SRV
record would be used for TLSA record lookup and any peername checks.

This is not how HTTPS works today.  There is no service indirection
via DNS for HTTP, so you have to do that at the application layer
via an HTTPS redirector (that can somehow guess which servers are
up and reachable by the client).

-- 
	Viktor.