Re: [Doh] Draft -09 and WGLC #2

[Andrew Sullivan <[e-mail]>]

On Mon, May 28, 2018 at 09:40:02PM -0400, Patrick McManus wrote:
> ,
> 
> 
>        DNS API clients MUST account for the Age response header's value
>        ([RFC7234]) when calculating the DNS TTL of a response.  For example,
>        if a RRset is received with a DNS TTL of 600, but the Age header
>        indicates that the response has been cached for 250 seconds, the
>        remaining lifetime of the RRset is 350 seconds.
> 
> 
>     the TTL.  What this passage means is that the data that comes in to a
>     DNS API client _is not_ suitable to hand straight to the local stub
>     subsystem: instead, some additional processing MUST be performed in
>     order to ensure that TTLs are not accidentally extended by accident.
> 
> 
> That's not only what it means, it seems to me that's what it says :)

No, that's what it implies, but it's not what it says.  That's
actually what I'm complaining about.  The DNS is the swamp it is
partly because of the number of places in STD13 that depend on
implication rather than instruction for people to do the right thing.
A contract programmer with an alloted 18 hours will spend exactly 18
hours, at most, to do this.  So let's make it explicit.

Perhaps this: "remaining lifetime …seconds.  DNS API clients SHOULD
NOT pass along the received DNS RRset without decrementing the TTL to
match the remaining lifetime.  Doing so may accidentally prolong the
lifetime of a cached DNS RRset, and therefore ought not to be passed
along without strong evidence that the requesting client will process
the resulting cached entries correctly."

That's awkward and needs some work.  But it's at least explicit.

A

-- 
Andrew Sullivan
[e-mail]