[Doh] special meta QTYPEs

Tony Finch <dot@dotat.at> Wed, 06 June 2018 14:49 UTC

Return-Path: <dot@dotat.at>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7860C130F69 for <doh@ietfa.amsl.com>; Wed, 6 Jun 2018 07:49:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level:
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ND72ylCIuhpJ for <doh@ietfa.amsl.com>; Wed, 6 Jun 2018 07:49:43 -0700 (PDT)
Received: from ppsw-31.csi.cam.ac.uk (ppsw-31.csi.cam.ac.uk [131.111.8.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C8C3F130F89 for <doh@ietf.org>; Wed, 6 Jun 2018 07:49:42 -0700 (PDT)
X-Cam-AntiVirus: no malware found
X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus
Received: from grey.csi.cam.ac.uk ([131.111.57.57]:44208) by ppsw-31.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.137]:25) with esmtps (TLSv1:ECDHE-RSA-AES256-SHA:256) id 1fQZkq-0003aY-Lz (Exim 4.91) for doh@ietf.org (return-path <dot@dotat.at>); Wed, 06 Jun 2018 15:49:40 +0100
Date: Wed, 06 Jun 2018 15:49:40 +0100
From: Tony Finch <dot@dotat.at>
To: doh@ietf.org
Message-ID: <alpine.DEB.2.11.1806061519020.10764@grey.csi.cam.ac.uk>
User-Agent: Alpine 2.11 (DEB 23 2013-08-11)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset="US-ASCII"
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/VSqHm0GCKaLPh96n41SfcayGnE8>
Subject: [Doh] special meta QTYPEs
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 06 Jun 2018 14:49:56 -0000

I think there needs to be some specific wording about query meta-types
(i.e. 128 <= QTYPE <= 255).

Meta-types can change the framing rules of the response, e.g. IXFR and
AXFR, so a DoH server needs to understand them even if it is implemented
as a mostly-blind proxy.

My DoH implementation generates its own NOTIMP response if it gets a query
with 128 <= QTYPE <= 254 (it allows QTYPE=*/ANY). The other meta type is
OPT, but it isn't special-cased because it's safe to proxy.

BIND returns FORMERR rather than NOTIMP for unknown meta-types; it
seems to reserve NOTIMP for known but deprecated types.

I think it is reasonable for an implementation to support TKEY or MAILA or
MAILB if it wishes. I don't think it's possible to fit AXFR or IXFR into
DoH because their responses involve multiple DNS messages.

Suggested wording:

    A DoH server MUST return a DNS error response, either RCODE=1 (format
    error) or RCODE=4 (not implemented) if it receives a request with an
    unknown meta-QTYPE between 128 and 254 inclusive. The meta-QTYPE 255
    (* or ANY) SHOULD be supported. The meta-QTYPEs 251 (IXFR) and 252
    (AXFR) MUST NOT be supported and the DoH server MUST return an error
    response.

    This is because meta-QTYPEs can affect the way a DNS response is
    framed; for example, AXFR and IXFR responses can span multiple DNS
    messages, whereas A DoH response can only contain one DNS message.

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
Humber: Variable mainly north, 3 or 4. Moderate at first in northwest,
otherwise slight. Fog patches. Moderate or good, occasionally very poor.