Re: [Doh] Eric Rescorla's No Objection on draft-ietf-doh-dns-over-https-13: (with COMMENT)

[Patrick McManus <[e-mail]>]

On Mon, Aug 13, 2018 at 4:16 PM, Paul Hoffman <[e-mail]> wrote:

>
>
> S 5.1.
>>
>>>      DoH servers MUST implement both the POST and GET methods.
>>>
>>>      When using the POST method the DNS query is included as the message
>>>      body of the HTTP request and the Content-Type request header field
>>>      indicates the media type of the message.  POST-ed requests are
>>>      smaller than their GET equivalents.
>>>
>>
>> Because? I assume b/c no encoding. With that said, it is not obvious
>> that this is true because (as shown below) you have to put content-
>> length and content-type in the POST version, so if you had a smallish
>> request, you might gt more expansion that way,
>>
>
> All DoH responses are at least about 17 bytes long (the 12-byte DNS
> message header plus the shortest possible domain name plus the type and
> class), much more typically at least 40 bytes with typical names and even a
> short answer. Base64 of that will be longer than the content length and
> content type. Normal answers will definitely be longer.
>


to clarify - the text is about requests, not responses.. which will be a
bit shorter that what Paul mentions in the dns-message part.

fwiw - the h2 hpack overhead here, which we expect is the common case - is
on the order of 4 bytes iirc.

I think we should resolve this just by hedging.. "are generally smaller
than their GET equivalents."



> S 6.1.
>>
>>>      The stale-while-revalidate and stale-if-error Cache-Control
>>>      directives ([RFC5861]) could be well-suited to a DoH implementation
>>>      when allowed by server policy.  Those mechanisms allow a client, at
>>>      the server's discretion, to reuse a cache entry that is no longer
>>>      fresh.  In such a case, the client reuses all of a cached entry, or
>>>      none of it.
>>>
>>
>> Is this a normative requirement or a statement of fact?
>>
>
> Not sure. Input from the HTTP crowd is welcome here.
>


it is a statement of fact about http - its drawn out a bit here because its
particularly relevant to DNS (as similar algorithms are considered
elsewhere in the DNS world as well), and therefore DoH implementors, when
considering whether they want to make use of conditional validations.