Subject: [Doh] conflict between HTTP and DNS cache granularity

From: Petr Špaček <[email-masked]>
Date: Tue, 20 Mar 2018 00:21:50 +0100

Hello doh,

section 7.1.  Cache Interaction at the moment does not mention
difference between DNS and HTTP caching granularity.

Observations:
- DNS answer might contain more than 1 RR type (CNAME + original QTYPE)
- DNS TTL is per-RRset but HTTP caching header is per request, which in
terms of DoH means per DNS message (which potentially combines multiple
RRsets)

Thus the HTTP "TTL" has to be derived somehow, most likely using minimal
value from all RRsets present in the DNS message.

Without this limit a bad things will happen when DNS message "partially"
expires, which is not handled by DoH protocol itself and will be
detected late in the process on the DoH client side.

E.g. a browser receives cached DoH answer from a caching proxy. It
contains the same DNS message as before with following RRs and headers:
; Age = 20
www.example.com. 100 CNAME srv.example.net.
srv.example.net. 10      A 192.0.2.1

Now, the srv.example.net. A RR has TTL -10 seconds so its invalid and
client has to deal with it somehow. It is up to WG to decide whether
client should re-query for expired RRs by itself or if DoH server should
handle this by shortening TTLs so the client cannot encounter this
partial expiration ...

Well, mixing DNS and HTTP semantics is fun.

-- 
Petr Špaček  @  CZ.NIC

---

From: Patrick McManus <[email-masked]>
Date: Mon, 19 Mar 2018 23:23:49 +0000

section 6 tries to deal with this..

On Mon, Mar 19, 2018 at 11:21 PM, Petr Špaček <[email-masked]> wrote:

> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh
>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 22 Mar 2018 08:46:16 +0000

On Tue, Mar 20, 2018 at 12:21:50AM +0100,
 Petr Špaček <[email-masked]> wrote 

> value from all RRsets present in the DNS message.

Version -04 of the draft says "the smallest TTL in the Answer section
of the response", which seems more reasonable to me.