Communicating Proxy Configurations in Provisioning Domains

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 29 December 2023.¶

Copyright Notice

Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

HTTP proxies that use the CONNECT method Section 9.3.6 of [HTTP] (often referred to as "forward" proxies) allow clients to open connections to hosts via a proxy. These typically allow for TCP stream proxying, but can also support UDP proxying [CONNECTUDP] and IP packet proxying [CONNECTIP]. Such proxies are not just defined as hostnames and ports, but can use URI templates [URITEMPLATE].¶

In order to make use of multiple related proxies, clients need a way to understand which proxies are associated with one another.¶

Client can also benefit from learning about additional information associated with the proxy to optimize their proxy usage, such knowing that a proxy is configured to only allow access to a limited set of next hops.¶

These improvements to client behavior can be achieved through the use of Provisioning Domains. Provisioning Domains (PvDs) are defined in [PVD] as consistent sets of network configuration information, which can include proxy configuration details Section 2 of [PVD]. [PVDDATA] defines a JSON [JSON] format for describing Provisioning Domain Additional Information, which is an extensible dictionary of properties of the Provisioning Domain.¶

This document defines two mechanisms to use PvDs to help clients understand how to use proxies:¶

1. A way to fetch PvD Additional Information associated with a proxy URI, which allows defining a limited set of DNS zones that are accessible through the proxy Section 2.¶
2. A way to associate one or more proxy URIs with a known PvD to allow clients to learn about other proxies when they already know about a proxy PvD or network-provided PvD Section 3.¶

2. Accessing PvD Additional Information for proxies

This document defines a way to fetch PvD Additional Information associated with a particular proxy resource. This PvD describes the properties of the network accessible through the proxy.¶

:method = GET
:scheme = https
:authority = proxy.example.org
:path = /masque
accept = application/pvd+json

:method = GET
:scheme = https
:authority = proxy.example.org
:path = /
accept = application/pvd+json

:method = GET
:scheme = https
:authority = proxy.example.org
:path = /masque
accept = application/pvd+json

:status = 200
content-type = application/pvd+json
content-length = 135

{
  "identifier": "proxy.example.org.",
  "expires": "2023-06-23T06:00:00Z",
  "prefixes": [],
  "dnsZones": ["internal.example.org"]
}

3. Enumerating proxies within a PvD

PvD Additional Information can also be used to list proxies that are associated with a particular PvD. This association represents availability of a proxy, but does not indicate any policy of the PvD that requires clients to use a proxy or not.¶

This document defines a new PvD Additional Information key, proxies, that is an array of strings that is a list of proxy URIs (or URI templates [URITEMPLATE]). The new key is registered in Section 5.¶

The kind of proxy is implied by the URI scheme and any template variables. For example, since UDP proxying [CONNECTUDP] has the URI template variables target_host and target_port, the URI "https://proxy.example.org:4443/masque{?target_host,target_port}" implies that the proxy supports UDP proxying.¶

:method = GET
:scheme = https
:authority = company.example.org
:path = /.well-known/pvd
accept = application/pvd+json

:status = 200
content-type = application/pvd+json
content-length = 222

{
  "identifier": "company.example.org.",
  "expires": "2023-06-23T06:00:00Z",
  "prefixes": ["2001:db8:cafe::/48"],
  "proxies": ["https://proxy.example.org","https://proxy.example.org/masque{?target_host,target_port}"]
}

4. Security Considerations

Configuration advertised via PvD Additional Information, such DNS zones or associated proxies, can only be safely used when fetched over a secure TLS-protected connection, and the client has validated that that the hostname of the proxy, the identifier of the PvD, and the validated hostname identity on the certificate all match.¶

5. IANA Considerations

This document registers a new key in the "Additional Information PvD Keys" registry.¶

JSON Key: proxies¶

Description: Array of proxy URIs associated with this PvD¶

Type: Array of strings¶

Example: ["https://proxy.example.com", "https://proxy.example.com/masque{?target_host,tcp_port}"]¶

Author's Address