Re: [Doh] A question on the mix of DNS and HTTP semantics

[Ted Hardie <[e-mail]>]

In-line

On Sun, Mar 18, 2018 at 11:18 AM, Patrick McManus <[e-mail]>
wrote:

>
>
> On Sun, Mar 18, 2018 at 4:43 PM, Stephane Bortzmeyer <[e-mail]>
> wrote:
>
>> On Sat, Mar 17, 2018 at 10:42:08AM -0700,
>>  Ted Hardie <[e-mail]> wrote
>>  a message of 182 lines which said:
>>
>> > Similarly, it was not clear to me whether a response like 451 could
>> > contain a UDP wireformat body and, if so, what it would be.  If it
>> > contains no body, the DNS implementation might continue attempting
>> > to query for the information.  If it contains a REFUSED RCODE, in
>> > contrast, it would see a policy-based error.
>>
>> That's an interesting example. If a DoH server replies 451, does it
>> mean that access to this DoH service is blocked, for policy reasons,
>> or that access to this specific DNS data is blocked, for policy
>> reasons? In other words, can a HTTP response from a DoH server depend
>> on the QNAME? (Or on the tuple {QCLASS, QTYPE, QNAME}?)
>>
>>
> Unfortunately I don't think HTTP is going to clarify for you why HTTP is
> giving the 451 - all you know is that the response body is not the answer
> to your DoH request. The 451 could be based on anything in the HTTP request
> - which includes the query params and the message body as well as the path
> and origin. So you don't know what was wrong with the request in
> particular. So it could imo be as general as the hostname or as specific as
> a qtype.
>
> But I can say concretely that the message body of the 451 isn't going to
> clear that up in anything other than a human readable way.
>
>
The message body may not be able to answer this question completely, but it
can clarify at the DNS level that this was REFUSED.  The semantics of that
are much closer to 451's meaning than producing no DNS-level response at
all (which maps to "query did not complete" if I understand it correctly).

Ted



> -P
>
>
>