[dnssd] Opsdir last call review of draft-ietf-dnssd-hybrid-07

Joel Jaeggli <joelja@bogus.com> Mon, 23 October 2017 06:02 UTC

MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: Joel Jaeggli <joelja@bogus.com>
To: ops-dir@ietf.org
Cc: dnssd@ietf.org, ietf@ietf.org, draft-ietf-dnssd-hybrid.all@ietf.org
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <150873853892.24503.4725209571775987336@ietfa.amsl.com>
Date: Sun, 22 Oct 2017 23:02:18 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnssd/As55r8QdzAZHUytMVsQVyACmlyA>
Subject: [dnssd] Opsdir last call review of draft-ietf-dnssd-hybrid-07

Reviewer: Joel Jaeggli
Review result: Has Nits

I reviewed this draft draft-ietf-dnssd-hybrid-07 on behalf of the operations
and management area directorate.

While the security considerations do address the problem of  information
leakage from publishing information in DNS zones that may be resolvable from
outside the administrative zone that they are intended to be used in, I think
the reverse zone and in particular the IPv4 reverse zone are particularly
subject to this problem. if the nameservers serving the reverse zone are those
to which the public ipv4 prefix is delegated then is is possible to walk the
zone, trolling for hosts that may not otherwise be easy to identify (because
you do not know apriori what services they might be advertising).  This might
identify particular hosts, but it also might be used to identify subnets  in
which  dynamic allocation occur or where hosts come and go. I think it would be
desirable to provide explanatory texts on the potential dangers of exposing the
reverse zones in particular.

[dnssd] Opsdir last call review of draft-ietf-dns… Joel Jaeggli