[dnssd] Review of draft-ietf-dnssd-hybrid-02

[Tom Pusateri <[e-mail]>]

Overall, the -02 version is very good. Section 4.5.1 on DNS TTL limiting is very helpful for implementation. Also, the four modes of responding listed in section 4.6 on Answer Aggregation is a tremendous addition. Thanks for these.

In an earlier note to the mailing list, I reviewed an earlier version of this draft.

https://mailarchive.ietf.org/arch/msg/dnssd/a1eAnObKtaOjg7ju6-aOEZyRWfg

Some of the comments have been addressed and some have not. For Stuart’s convenience, I am listing all of the previous comments that still apply and adding some new ones so there is no need to go back and try to match old section numbers.

2. (3rd paragraph) - There is a pointer to [802.5] with no matching reference. Add http://xml2rfc.ietf.org/public/rfc/bibxml2/reference.IEEE.802-5.1995.xml

(new) 4.2 Domain Enumeration - I think using the term “home” domain is confusing with regards to homenet and a different term should be used.

(new) 4.2.2 (3rd paragraph) - the use of “configuration data” is ambiguous. I would like to see this be more specific.

4.3 Title “LDH" - The acronym LDH (Letter, Digit, Hyphen) is not defined or referenced anywhere. A reference to Section 2.2 of RFC 5890 should be included.

(new) 4.3 (5th paragraph) - “a Hybrid proxy should support having separate subdomains delegated to it”. This should say for the same link since proxies can already have separate subdomains across multiple links.

4.3, 4.4 - The example IP addresses should use documentation IPv4 address ranges as specified in RFC 5737.

4.4 (5th paragraph) - "(In the Apple "/usr/include/dns_sd.h" APIs, using ForceMulticast indicates that the DNSServiceQueryRecord() call should perform the query using Multicast DNS.)” - I don’t think this implementation detail is necessary.

4.5.2 - Since hybrid proxies can never know all of the possible records in the subdomain, it is not possible to build NSEC next record relations. Therefore, all NSEC records learned over mDNS (typically in the Additional Section) should be filtered in unicast DNS responses sent by the hybrid proxy.

(new) 5. DNS SOA - I would like to see an introductory paragraph explaining the hybrid proxy should respond to SOA record requests for each subdomain assigned to the hybrid proxy.

8.1 The hybrid proxy could also only provide sensitive records to authenticated users. But this is a general DNS problem and not a problem specific to the hybrid proxy. A reference to the work in DPRIVE that outlines DNS privacy issues might be appropriate (now published as RFC 7626).

Thanks,
Tom