Re: [dnssd] UTF8 use in DNS populated by mDNS

[Douglas Otis <[e-mail]>]

On Nov 20, 2014, at 2:11 PM, Andrew Sullivan <[e-mail]> wrote:

> Hi,
> 
> On Wed, Nov 19, 2014 at 04:50:39PM -0800, Douglas Otis wrote:
>> If UTF-8 is to be permitted in DNS populated using mDNS inputs, a
>> superset of rules directly and indirectly established to support
>> safe use of IDNA labels are necessary, otherwise omitting such
>> requirements would permit trivial spoofing.  The requirements should
>> include IDNA2008 considerations that restrict permitted code points.
> 
> In which part of the DNS-SD name do you want these restrictions?  I
> think there is considerable discussion of the different parts of those
> names in the draft I discussed in Honolulu.
> 
> Note that there is _already_ a standard for putting "UTF-8 labels" in
> the DNS (going back to STD 13 and reiterated by RFC 2181).  In effect,
> they're not "UTF-8 labels" but rather series of octets.

Dear Andrew,

DNS-SD generates:
'Service Instance Name = <Instance> . <Service> . <Domain>'

While there are restrictions on code points that define 'Instance' per RFC5198 with an additional stipulation not to include values between 0x00-0x1F and 0x7F, how the 'Domain' portion is determined is far less clear.  This is a concern when derived from easily spoofed multicast mDNS responses.  It is important a visual selection process does its best to preclude trivial domain spoofing which might resolve malicious sources.  

>> It seems some advocate use of spaces in a domain name label be
>> permitted.  Even this minor change may confuse users about the
>> specific domain when seen with respect to commandline based
>> applications.
> 
> This is already permitted, of course, just like anything else in
> labels.
> 
> But as I guess is plain from my work on the mdns-dns compatibility
> I-D, I do think there is a long-term problem here, which is why I
> recommend the minimal interoperable subset.

The concern is specifically with visually deceptive resources.  Limitations on what is allowed should ensure against abuse of right-to-left and left-to-right issues for example.  Some TLDs protect users with additional rules enforced by registrars that extend beyond those imposed by IDNA2008.  Allowing naive UTF-8 publication of mDNS resources into DNS without conversion to A-labels permitted for DNS suggests there will be an even greater need to qualify what appears to be external actually resides within the Internet.  A step facilitated by imposing use of ugly A-labels within local publication should also better guard against cache abuse as well.

Regards,
Douglas Otis