Subject: Re: [Doh] [Dnsmasq-discuss] Implementation of DOH in dnsmasq

From: Geert Stappers <[email-masked]>
Date: Wed, 20 Jun 2018 10:57:56 +0200

On Wed, Jun 20, 2018 at 10:11:53AM +0200, Nicolas Cavallari wrote:
> On 14/06/2018 22:32, Kurt H Maier wrote:
> > On Thu, Jun 14, 2018 at 09:38:42PM +0200, Mateusz Jo??czyk wrote:
> >>
> >> How difficult would it be to add support to DNS over HTTP/2.0 in dnsmasq, for
> >> example in constrained environments like home routers?
> >>
> > 
> > This should be handled with a wrapper program.  HTTP/2.0 is an enormous
> > and ill-defined specification and it would not be appropriate to bolt it
> > directly into dnsmasq.  A dedicated HTTP/2.0 daemon can talk to dnsmasq
> > on the backend to provide this service.  Home routers are not
> > particularly constrained in this regard, since they generally have web 
> > services running to begin with.
> 
> It's much more than that. To be secure, TLS requires time, entropy and a CA
> list. Many home routers fails at having all three, or require the DNS to get
> time and CAs...
> 
> >> Please send any replies to the DoH mailing list at <[email-masked]>.
> > 
> > Why?
> 
> Because by doing so you will be subjected to the various IETF policies that
> applies to anyone participating on the IETF mailing list, which includes
> copyright grants, patents disclosure and other things that should be read by a
> lawyer.
> 

No new text, just doing the
} Please send any replies to the DoH mailing list at <[email-masked]>.

Groeten
Geert Stappers
Subscriber of mailinglist [email-masked]
-- 
Leven en laten leven

---

From: Mateusz Jończyk <[email-masked]>
Date: Fri, 29 Jun 2018 17:33:30 +0200

>> list. Many home routers fails at having all three, or require the DNS to get

DOH server certificate could be provided together with the DOH server IP.

Thank You. So, as has been said above, implementing HTTP/2.0 may be more
difficult then implementing HTTP/1.1.

I would therefore propose to add the following text to the DOH draft (at the end
of section "HTTP/2"):

	However, older versions of the HTTP standard are simpler to implement,
	and have enough capabilities for limited capability servers on embedded
	devices so DOH clients SHOULD be able to use DOH servers that support
	only older version(s) of the HTTP standard, such as HTTP/1.0 {{RFC1945}}
	and HTTP/1.1 {{RFC7230 - RFC7235}}.

>>>> Please send any replies to the DoH mailing list at <[email-masked]>.

I asked this just for the sake of convenience.

Greetings,
Mateusz Jończyk