Re: [Add] New Version Notification for draft-pauly-add-resolver-discovery-01.txt

On Tue, 28 Jul 2020 at 13:52, Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:

> On Mon, Jul 27, 2020 at 07:51:04PM -0400,
>  Ted Lemon <mellon@fugue.com> wrote
>  a message of 234 lines which said:
>
> > This sounds like you are just asking for the equivalent of an HTTP
> > 451 response.
>
> And it exists, in draft-ietf-dnsop-extended-error.
>
> 4.16.  Extended DNS Error Code 15 - Blocked
>
>    The server is unable to respond to the request because the domain is
>    blacklisted due to an internal security policy imposed by the
>    operator of the server resolving or forwarding the query.
>
> 4.17.  Extended DNS Error Code 16 - Censored
>
>    The server is unable to respond to the request because the domain is
>    blacklisted due to an external requirement imposed by an entity other
>    than the operator of the server resolving or forwarding the query.
>    Note that how the imposed policy is applied is irrelevant (in-band
>    DNS filtering, court order, etc).
>
> 4.18.  Extended DNS Error Code 17 - Filtered
>
>    The server is unable to respond to the request because the domain is
>    blacklisted as requested by the client.  Functionally, this amounts
>    to "you requested that we filter domains like this one."
>
> 4.19.  Extended DNS Error Code 18 - Prohibited
>
>    An authoritative server or recursive resolver that receives a query
>    from an "unauthorized" client can annotate its REFUSED message with
>    this code.  Examples of "unauthorized" clients are recursive queries
>    from IP addresses outside the network, blacklisted IP addresses,
>    local policy, etc.
>

https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04 conveys
the resolver information, it includes the reasons for performs filtering:

   malwareblocking:  The DNS server offers malware blocking service.
         If access to domains is blocked on threat data, the parameter
         value is set to 'true'.  Note that some of the commonly known
         types of malware are viruses, worms, trojans, bots, ransomware,
         backdoors, spyware, and adware.

      phishingblocking:  The DNS server offers phishing blocking
         service.  If access to phishing domains is blocked, the
         parameter value is set to 'true'.

      policyblocking:  If access to domains is blocked due to an
         internal policy imposed by the operator of the DNS server, the
         parameter value is set to 'true'.  Note that the extended error
         code "Blocking" defined in Section 4.16 of
         [I-D.ietf-dnsop-extended-error
<https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04#ref-I-D.ietf-dnsop-extended-error>]
identifies access to domains is
         blocked due to an policy by the operator of the DNS server.

      censoredblocking:  If access to domains is blocked due to an
         external requirement imposed by an external entity, the
         parameter value is set to 'true'.  Note that the extended error
         code "Censored" defined in Section 4.17 of
         [I-D.ietf-dnsop-extended-error
<https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04#ref-I-D.ietf-dnsop-extended-error>]
identifies access to domains is
         blocked based on a requirement from an external entity.
         Similar to the definition of "Censored" blocking in
         [I-D.ietf-dnsop-extended-error
<https://tools.ietf.org/html/draft-reddy-add-server-policy-selection-04#ref-I-D.ietf-dnsop-extended-error>],
this version of the
         specification does not distinguish blocking from regulatory
         bodies (e.g., Law Enforcement Agency) vs.  arbitrary blocking.

Cheers,
-Tiru

>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>