diff --git a/draft-dkg-dprive-demux-dns-http.md b/draft-dkg-dprive-demux-dns-http.md index 734358df347febfd59095eaa1748b718f2aded66..ed07944e748e7810ac20bac147358183f13a581a 100644 --- a/draft-dkg-dprive-demux-dns-http.md +++ b/draft-dkg-dprive-demux-dns-http.md @@ -30,6 +30,7 @@ informative: RFC6840: RFC6895: RFC7301: + RFC7540: RFC7830: RFC7858: I-D.ietf-dnsop-dns-wireformat-http: @@ -49,7 +50,6 @@ normative: RFC2136: RFC5234: RFC7230: - RFC7540: --- abstract @@ -96,7 +96,7 @@ has been established, the rest of the stream is committed to one or the other interpretation. This document provides proof that a demultiplexer can robustly -distinguish HTTP/1.1 from DNS on the basis of the content of the +distinguish HTTP/1.x from DNS on the basis of the content of the first few bytes of the client's stream alone. A DNS client that knows it is talking to a server which is this @@ -108,9 +108,9 @@ decide to use. This document limits its discussion to HTTP/1.x over TCP or TLS or some other classical stream-based protocol (it excludes HTTP over -QUIC, for example, and HTTP/2 or later). Likewise, it considers only -the TCP variant of DNS (and excludes DNS over UDP or any other -datagram transport). +QUIC, for example, and HTTP/2 {{RFC7540}} or later). Likewise, it +considers only the TCP variant of DNS (and excludes DNS over UDP or +any other datagram transport). Terminology ----------- @@ -149,11 +149,12 @@ HTTP/2 is not always client-speaks-first ---------------------------------------- While this demultiplexing technique functions for HTTP/1.0 and -HTTP/1.1, it does not work for HTTP/2 because HTTP/2 is not guaranteed -to be a client-speaks-first protocol. In the event that HTTP/2 is to -be transported over TLS, the ALPN token negotiated in the TLS session -is "h2", which allows the server to know as soon as the handshake is -complete that it can start pushing data to the client. +HTTP/1.1, it does not work for HTTP/2 {{RFC7540}} because HTTP/2 is +not guaranteed to be a client-speaks-first protocol. In the event +that HTTP/2 is to be transported over TLS, the ALPN token negotiated +in the TLS session is "h2", which allows the server to know as soon as +the handshake is complete that it can start pushing data to the +client. A standard DNS-over-TLS client connecting to a server that might be multiplexing DNS with HTTP on the same listener MUST NOT indicate an