Re: [Doh] TSIG, Padding and "Age:"

[Ray Bellis <[e-mail]>]

On 21/05/2019 07:11, Mark Delany wrote:

> Section 9 of RFC8484 (DoH) says "servers can also add DNS padding [RFC7830] if
> the DoH client requests it in the DNS query".
> 
> However section 3.4 of RFC2845 (TSIG) says that essentially the whole message is
> protected by the hash calculation (bar a few irrelevant odds and sods) which
> means that a DoH server adding padding will break the TSIG message digest.
> 
> Therefore is it correct to say that a DoH server cannot add padding if the DNS
> message contains a TSIG RR?

That's correct.

> If TSIG is in play - and I don't really know until someone here confirms it -
> does the TSIG constraint on message modification also conflict with Section 5.1
> of RFC8484 which states: "DoH clients MUST account for the Age response header
> field's value" ... and modify TTLs?

Also correct.

> I tell ya. Once you step into the waters of modifying in-flight DNS messages it
> seems like crocodiles all the way down.

This is not news :(

Ray