Re: [Doh] A question on the mix of DNS and HTTP semantics

[Ted Hardie <[e-mail]>]

For some reason, I am seeing Ben's reply, but not Patrick's mail.  Replying
to this as a result.

On Sun, Mar 18, 2018 at 3:19 AM, Ben Schwartz <[e-mail]> wrote:

>
>
> On Sun, Mar 18, 2018 at 5:22 AM, Patrick McManus <[e-mail]>
> wrote:
>
>> Hi Ted, thanks for writing this down. I think I understand it a bit
>> better now.
>>
>> I think the most relevant point is that DoH is the use of HTTP as a
>> substrate. As a user of HTTP RFC7231 is very relevant (HTTP status codes)
>>
>>
>> On Sat, Mar 17, 2018 at 5:42 PM, Ted Hardie <[e-mail]> wrote:
>>
>>>   In particular, the HTTP semantics for redirection (e.g. HTTP response
>>> 307 or 308) and client error (e.g. HTTP response 403 or 451) may be
>>> difficult to map back into DNS errors when the target is a traditional DNS
>>> client.
>>>
>>>
>> 7231 defines 2xx as success.. If your code is not 2xx then your DoH
>> request did not succeed and you can feel confident in saying that you do
>> not have a dns response to the dns request that was made in the http
>> request. Conversely, a 2xx response needs to carry a DNS reply to your DNS
>> request. (now that can be a DNS failure - nxdomain, etc, but the 2xx at the
>> HTTP level is saying a valid DNS response to your request is contained
>> therein.. i.e. DoH has succeeded).
>>
>>
Saying something in the document like "only 2xx response codes will carry
response bodies with DNS UDP wireformat" would be a short and sweet way of
saying that in the document, if there is working group consensus that this
is true.  Based on my conversations yesterday, I am not sure that there is
complete consensus on this point, though there may very well be rough
consensus.

However, I don't think this formulation is quite enough:


> As noted above, if you don't end this process with a 2xx you don't have a
> DNS response to the DNS query of the original request - the transport has
> failed.
>

A pure transport failure may result in a retry.  There are some of these
responses which strongly indicate that such a retry will result in failures
(e.g. 403).  If you do not synthesize some message to the DNS client about
the type of failure,  and the server does not provide one, what part of the
system avoids the retry?

Ted