Re: [Doh] meta qtypes

[Patrick McManus <[e-mail]>]

we need to be careful about recommending a blind tunnel (aspect) of using
HTTP by just disabling caches. That's not really great and doesn't meet the
DoH goals - HTTP has a rich language to control caching at its level which
I think can be well aligned with the DNS TTL architecture (and if no-cache
plays a role for some small part, that's fine.). There is document text
that already tries to discuss that in Section 6. Hopefully we can revise
that if necessary.

The text already contains a normative MUST NOT about using a http freshness
lifetimes that exceeds DNS based TTL lifetimes of the response. A DOH
server that cannot figure this out can comply with a freshness lifetime of
0 - but the goal here is not that a DOH server is a non-DNS-aware tunnel.

Please note the draft uses language about freshness lifetime instead of
normatively referencing cache-control for a reason (cc is used in "such as"
and in an example). There are a number of ways in HTTP to express this
concept and you want to be compatible with the existing definitions.

Perhaps it just needs an additional para indicating a response bearing a
negative answer needs a more pessimal algorithm (e.g. either not cachable
or the SOA approach)?



On Mon, Mar 19, 2018 at 9:49 AM, Miek Gieben <[e-mail]> wrote:

> [ Quoting <[e-mail]> in "Re: [Doh] meta qtypes..." ]
>
>> I think this draft should say "MUST not cache these responses".
>>>
>>
>> I have a less radical proposal:
>>
>> "DoH servers SHOULD return a Cache-Control header (RFC 7234, section
>> 5.2.2). They MAY send "Cache-control: no-cache" in all cases [if
>> they're lazy]. For positive
>> answers (ANCOUNT>0), if the DoH server returns "Cache-control:
>> max-age=N", the maximum age MUST be the TTL of the answer seen by the
>> Doh server. For negative answers (NXDOMAIN), if the DoH server returns
>> "Cache-control:
>> max-age=N", the maximum age MUST be calculated from the SOA record of
>> the zone (RFC 2308, section 3) [note it allows a server to return
>> "Cache-control: no-cache" only for NXDOMAIN]"
>>
>
> I agree that this works (but still leaves out RRSIGs).
>
> The (major) downside is that a DoH server doesn't just ship bytes anymore;
> it need to fully inspect the payload to make an informed cache TTL decision.
>
> Note: I'm fine with either - nocache or something along the lines Stephane
> proposes.
>
> /Miek
>
> --
> Miek Gieben
>