Re: [Doh] Subsection Server Push: unclear wording

[Ben Schwartz <[e-mail]>]

On Fri, May 11, 2018 at 8:18 AM Mateusz Jończyk <[e-mail]> wrote:

> Hello,
> The Server Push subsection now reads so:
>
>         Before using DOH response data for DNS resolution, the client MUST
>         establish that the HTTP request URI may be used for the DOH query.
> For
>         HTTP requests initiated by the DNS API client this is implicit in
> the
>         selection of URI. For HTTP server push ({{RFC7540}} Section 8.2)
> extra
>         care must be taken to ensure that the pushed URI is one that the
> client
>         would have directed the same query to if the client had initiated
> the
>         request.
>
> The first sentence is very misleading. The intention here was supposedly
> that
> the HTTP request URI is trusted by the client, not that it is working.
> This is
> clear by reading the commit that introduced the sentence:
>
> https://github.com/dohwg/draft-ietf-doh-dns-over-https/commit/2a4b0b835358d3c4517ae8a038bc86dcf0df04d2


Perhaps you are interpreting "may be used" to mean "is functional"?  Its
meaning here is "is permitted", i.e. permitted by the client
configuration.  I think that the following sentence makes this clear.


>
> Additionally, I do not understand it fully, but to me it seems that the
> situation described as "the pushed URI is one that the client would have
> directed the same query to if the client had initiated the request." would
> be
> very rare.
>
> Suppose that the client connects to example.com, and example.com tries to
> push a
> DNS resolution for foo.com. It seems (as I get it) that the client could
> only
> use the DNS resolution of foo.com when example.com is configured by the
> client
> as the chosen DNS API server. So, a pushed DNS resolution could only be
> used
> when contacting a HTTP server that at the same time is configured as a DNS
> API,
> which is exceedingly rare.
>
> Therefore, it would probably be better to specify that only a configured
> DNS API
> server may push DNS responses.
>
>
I think that is both the intent and the effect of this text.  The final
sentence operationalizes the notion of configuration in a way that reduces
ambiguity.


>
> On the other hand, it may happen that the DNS API server pushes additional
> responses to a DNS query. For example, when the DNS client requests an AAAA
> record for milk-and-pie.deviantart.com and it happens to be an alias for
> www.deviantart.com, the DNS API server may push a DNS resolution for
> www.deviantart.com. [1]
>
>
> Am I reading the text correctly here?
>
> Greetings,
> Mateusz Jończyk
>
> [1] I have to admit I do not know DNS well enough to know whether such
> server
> push could be beneficial and when.
> _______________________________________________
> Doh mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/doh
>