Re: [dnssd] Stephen Farrell's No Objection on draft-ietf-dnssd-requirements-05: (with COMMENT)

[Douglas Otis <[e-mail]>]

> On Mar 17, 2015, at 1:28 PM, Stephen Farrell <[e-mail]> wrote:
> 
> Signed PGP part
> 
> Hiya,
> 
> On 17/03/15 20:25, Tom Pusateri wrote:
> > I'm not sure I understand your scenario.
> >
> > Clients issue searches in the form of unicast DNS queries to DNS
> > servers (or proxies). This is the same as with wide-area bonjour.
> > Only now, this may cause the proxies to issue their own multicast
> > queries on a local network in order to ensure their cache is
> > current. The original client's searches are never broadcast further
> > than they were before. A bad actor would have to intercept the
> > unicast queries from the client (which may be TLS encoded). To do
> > this, the bad actor must have compromised some network device to do
> > this.
> 
> So I don't think the above is clear from the requirements draft,
> which is all I've so far read. It may be clear later that there's
> no significant new threat in this respect due to a specific design
> having been adopted, and if so that's good.
> 
> S.

Dear Stephen,

I have seen no consumer-level routers which offer IPv6 filtering, except 
in an “all-or-nothing” fashion, which makes sense given the practical 
limitations of memory and configuration.  Even high-end routers have no 
ability to track privacy extension IPv6 addresses, so no practical 
filtering methods currently exist.  That’s why it is so important to 
indicate in the draft that no routable address should be published in 
DNS without the active participation of the administrator.  Without this 
step, mDNS will publish routable addresses to devices which are not safe 
on the Internet, and can never be made safe.

It seems Tom described new infrastructure attempting to leverage mDNS as a 
method to update host resources in DNS.  There are many avenues permitting 
remote clients a means to query DNS information, where DNS-SD will not
secure this sensitive information.  When DNS contains IPv6 globally 
accessible addresses not practically blocked, distributing these addresses 
will expose devices that could be in a class of being permanently vulnerable 
to Internet access i.e. printers, baby monitors, infrastructure controls, etc.

Regards,
Douglas Otis