RFC 9532
HTTP Proxy-Status Parameter for Next-Hop Aliases
RFC 9532: HTTP Proxy-Status Parameter for Next-Hop Aliases 🦋
Okay bestie, so this is RFC 9532 ✨ and it's called "HTTP Proxy-Status Parameter for Next-Hop Aliases." It was written by T. Pauly from Apple, Inc. 🍎 It's on the Standards Track (so it's a real, official spec 💅) and it's dated January 2024. The ISSN is 2070-1721. It doesn't list anything it obsoletes or updates, so it's a fresh new vibe 🌸
Abstract ✨
So the main idea is that this doc defines a new parameter called next-hop-aliases for the HTTP Proxy-Status field 🎀 It carries the list of aliases and canonical names that an intermediary picked up during DNS resolution while it was getting set up to connect to the next hop 🧚
Status of This Memo 🌈
This is an Internet Standards Track document. 💜
This doc is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication 🫶 If you want more info on Internet Standards, check out Section 2 of RFC 7841.
Info about the current status, any errata, and how to give feedback is at https://www.rfc-editor.org/info/rfc9532 🦋
Copyright Notice 🎀
Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. 💅
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the date of publication. Please actually read these, because they lay out your rights and restrictions for this doc 🙈 Also, any Code Components pulled out of this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Revised BSD License ⭐
Table of Contents 🍓
1. Introduction
1.1. Requirements
2. next-hop-aliases Parameter
2.1. Encoding Special Characters
3. Implementation Considerations
4. Security Considerations
5. IANA Considerations
6. References
6.1. Normative References
6.2. Informative References
Author's Address1. Introduction ✨
So the Proxy-Status HTTP response field [PROXY-STATUS] lets intermediaries tell clients how they handled the request, right inside the HTTP responses 💖 It has a bunch of parameters that share info, like the name of the next hop.
[PROXY-STATUS] has a next-hop parameter that can hold a hostname, an IP address, or an alias of the next hop. The catch is that it only fits one item. So it can't be used to share a whole chain of aliases that got hit during DNS resolution when connecting to the next hop 😭
Knowing the full chain of names used during DNS resolution through CNAME records [DNS] is seriously useful for clients of forward proxies. Those are the clients asking to connect to a specific target hostname using the CONNECT method [HTTP] or UDP proxying [CONNECT-UDP]. CNAME records can be used to "cloak" hosts that do tracking or shady stuff behind more innocent-looking hostnames 🕵️♀️ And clients like web browsers use that chain of DNS names to shape behavior, like cookie usage policies [COOKIES] or blocking malicious hosts 🙅♀️
This document lets clients receive the CNAME chain of DNS names for the next hop by putting the list of names into a brand new next-hop-aliases Proxy-Status parameter 🦋
1.1. Requirements 🎀
Here's the official keyword bit, so pay attention 🫶 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. So lowercase versions are just regular words, no cap 💅
2. next-hop-aliases Parameter 🌸
Okay so the value of the next-hop-aliases parameter is a String [STRUCTURED-FIELDS] with one or more DNS names in a comma-separated list 💜 The list has all the alias names and canonical names that got received in CNAME records [DNS] while the next hop's hostname was being resolved using DNS. It MAY also include the original requested hostname itself ✨ The names ought to show up in the order they were received in DNS, for the sake of consistency 🧚 If there are multiple CNAME records in the chain, the first name in the next-hop-aliases list would be the value in the CNAME record for the original hostname. The final name in the list would be the name that ultimately resolved to one or more addresses 👑
The list of DNS names in the next-hop-aliases parameter uses a comma (",") as the separator between names. Note that if a comma is part of a name itself, the comma must be encoded as described in Section 2.1 🙈
Here's an example. Say there's a proxy "proxy.example.net" that gets these records when it does DNS resolution for the next hop "host.example.com":
host.example.com. CNAME tracker.example.com.
tracker.example.com. CNAME service1.example.com.
service1.example.com. AAAA 2001:db8::1The proxy could include this proxy status in its response:
Proxy-Status: proxy.example.net; next-hop="2001:db8::1";
next-hop-aliases="tracker.example.com,service1.example.com"This tells you that "proxy.example.net" used the IP address "2001:db8::1" as the next hop for this request, and it ran into the names "tracker.example.com" and "service1.example.com" in the DNS resolution chain 🍓 Also, while this example has both the next-hop and next-hop-aliases parameters, next-hop-aliases can totally be included without next-hop 💖
The proxy can also put the name of the next hop as the first item in the list 🌈 This is especially handy for reverse proxies, where clients wouldn't otherwise know the name of the next hop, and the next-hop header is used to convey an IP address instead.
Here's another example. Say there's a proxy "reverseproxy.example.net" that gets these records when it does DNS resolution for the next hop "host.example.com":
host2.example.com. CNAME service2.example.com.
service2.example.com. AAAA 2001:db8::2The proxy could include this proxy status in its response:
Proxy-Status: reverseproxy.example.net; next-hop="2001:db8::2";
next-hop-aliases="host2.example.com,service2.example.com"Lowkey important: the next-hop-aliases parameter only applies when DNS was used to resolve the next hop's name, and it doesn't apply in every situation 🙅♀️ Clients can use the info in this parameter to figure out how to use the connection established through the proxy, but they need to gracefully handle situations where this parameter isn't present 🫶
The proxy MAY send the empty string ("") as the value of the next-hop-aliases parameter to show that no CNAME records were encountered when resolving the next hop's name 🎀
2.1. Encoding Special Characters 🦋
Okay so DNS names usually just have alphanumeric characters and hyphens ("-"). But they're allowed to contain any character ([RFC1035], Section 3.1), including a comma 😭 To keep commas or other special characters in names from causing parsing chaos, any characters that appear in names in this list and don't belong to the set of URI unreserved characters ([RFC3986], Section 2.3) MUST be percent-encoded as defined in [RFC3986], Section 2.1 🔥
For example, take the DNS name "comma,name.example.com". Inside a next-hop-aliases parameter, it would get encoded like this:
Proxy-Status: proxy.example.net; next-hop="2001:db8::1";
next-hop-aliases="comma%2Cname.example.com,service1.example.com"A DNS name can also have a period character (".") inside a label instead of using it as a label separator 🧚 In that case, the period character MUST first be escaped as ".". Since the "" character itself gets percent-encoded, the name "dot.label.example.com" would be encoded inside a next-hop-aliases parameter like this:
Proxy-Status: proxy.example.net; next-hop="2001:db8::1";
next-hop-aliases="dot%5C.label.example.com,service1.example.com"When you parse this name, "dot%5C.label" MUST be treated as a single label 💜
Similarly, the "" character in a label MUST be escaped as "\" and then percent-encoded. Other uses of "" MUST NOT appear in the label after percent-decoding 🙈 For example, if there's a DNS name "backslash\name.example.com", it would first be escaped as "backslash\name.example.com" and then percent-encoded like this:
Proxy-Status: proxy.example.net; next-hop="2001:db8::1";
next-hop-aliases="backslash%5C%5Cname.example.com,s1.example.com"3. Implementation Considerations 🛠️
So to include the next-hop-aliases parameter, a proxy needs access to the chain of alias names and canonical names that were received in CNAME records 🌸
Implementations ought to know that the full chain of names might not be available in common DNS resolution APIs, like getaddrinfo [POSIX] 🙈 getaddrinfo does have an option for AI_CANONNAME ([RFC3493], Section 6.1), but that only returns the last name in the chain (the canonical name), not the alias names 😭
An implementation MAY include incomplete information in the next-hop-aliases parameter for cases where it can't include the full chain. For example, it could only include the canonical name if it can only use getaddrinfo as described above 🫶
4. Security Considerations 🚨
Okay, this part is serious, so listen up 💀 The next-hop-aliases parameter doesn't include any DNSSEC information, and it doesn't imply that DNSSEC was used. The info in the parameter can only be trusted to be valid insofar as the client trusts the proxy to provide accurate information. This info is meant to be used as a hint, and it SHOULD NOT be used for making security decisions about the identity of a resource accessed through the proxy ⚠️
Don't make security decisions off this parameter. It's a hint, not a guarantee.
Inspecting CNAME chains can help detect cloaking of trackers or malicious hosts 🕵️♀️ However, the CNAME records could be omitted by a recursive or authoritative resolver that's trying to hide this form of cloaking. In particular, recursive or authoritative resolvers can omit these records both for clients doing DNS name resolution directly and for proxies doing DNS name resolution on behalf of a client. A malicious proxy could also choose not to report these CNAME chains in order to hide the cloaking 😈 In general, clients can trust information included in (or not included in) the next-hop-aliases parameter only to the degree that the proxy, and any resolvers the proxy uses, are trusted 🔐
5. IANA Considerations 📋
This document registers the next-hop-aliases parameter in the "HTTP Proxy-Status Parameters" registry <https://www.iana.org/assignments/http-proxy-status> as shown in Table 1 🎀
+==================+=================================+===========+
| Name | Description | Reference |
+==================+=================================+===========+
| next-hop-aliases | A string containing one or more | RFC 9532 |
| | DNS aliases or canonical names | |
| | used to establish a proxied | |
| | connection to the next hop. | |
+------------------+---------------------------------+-----------+
Table 1: HTTP Proxy-Status Parameters Registry6. References 📚
The reference lists are coming up next in part 2 🫶
6.1. Normative References 📚✨
Okay bestie, these are the must-read sources the spec leans on so hard it literally can't function without them 💅 Here's the full shelf, every detail included:
[CONNECT-UDP]
Schinazi, D., "Proxying UDP in HTTP", RFC 9298,
DOI 10.17487/RFC9298, August 2022,
<https://www.rfc-editor.org/info/rfc9298>.
[DNS] Mockapetris, P., "Domain names - concepts and facilities",
STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987,
<https://www.rfc-editor.org/info/rfc1034>.
[HTTP] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke,
Ed., "HTTP Semantics", STD 97, RFC 9110,
DOI 10.17487/RFC9110, June 2022,
<https://www.rfc-editor.org/info/rfc9110>.
[PROXY-STATUS]
Nottingham, M. and P. Sikora, "The Proxy-Status HTTP
Response Header Field", RFC 9209, DOI 10.17487/RFC9209,
June 2022, <https://www.rfc-editor.org/info/rfc9209>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
Resource Identifier (URI): Generic Syntax", STD 66,
RFC 3986, DOI 10.17487/RFC3986, January 2005,
<https://www.rfc-editor.org/info/rfc3986>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[STRUCTURED-FIELDS]
Nottingham, M. and P. Kamp, "Structured Field Values for
HTTP", RFC 8941, DOI 10.17487/RFC8941, February 2021,
<https://www.rfc-editor.org/info/rfc8941>.6.2. Informative References 🔍🌸
These ones are the extra-credit reading 🧚 Not required to get the spec, but super useful if you want the full picture. Here's the list, unchanged:
[COOKIES] Barth, A., "HTTP State Management Mechanism", RFC 6265,
DOI 10.17487/RFC6265, April 2011,
<https://www.rfc-editor.org/info/rfc6265>.
[POSIX] IEEE, "IEEE Standard for Information Technology--Portable
Operating System Interface (POSIX(TM)) Base
Specifications, Issue 7", IEEE Std 1003.1-2017,
DOI 10.1109/IEEESTD.2018.8277153, January 2018,
<https://ieeexplore.ieee.org/document/8277153>.
[RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
November 1987, <https://www.rfc-editor.org/info/rfc1035>.
[RFC3493] Gilligan, R., Thomson, S., Bound, J., McCann, J., and W.
Stevens, "Basic Socket Interface Extensions for IPv6",
RFC 3493, DOI 10.17487/RFC3493, February 2003,
<https://www.rfc-editor.org/info/rfc3493>.Author's Address 💌🎀
Meet the author! Tommy Pauly, reachable at Apple, Inc. 🍎 Full contact details below, copied exactly:
Tommy Pauly
Apple, Inc.
Email: tpauly@apple.com📦 where this page comes from
- ietf: rfc9532 2024-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms