Re: [dnssd] The DNSSD WG has placed draft-sctl-service-registration in state "Call For Adoption By WG Issued"

[Ted Lemon <[e-mail]>]

The only reason I think it would be a serious problem for a service to
register an IP address other than its own is that it could be used as a way
to wedge in an attack.

What I mean regarding .arpa is that mDNS literally just multicasts updates
to x.y.z.q.in-addr.arpa. over mDNS.   So it's completely bypassing DNS
delegation of authority.   This will work just fine as long as the server
processing the update is able to be authoritative for the subdomain of
in-addr.arpa corresponding to its address space.   The real sticky wicket
is that you can't update two zones in the same update, but that's not
really what you were talking about.   IOW, it has to be in-addr.local in
the update, but it can be in-addr.arpa in the zone.

On Thu, Jul 12, 2018 at 4:49 PM, Toke Høiland-Jørgensen <[e-mail]>
wrote:

> Ted Lemon <[e-mail]> writes:
>
> > It seems like the client should just keep maintaining whatever records
> > it maintains. If the server doesn't take some updates, then the client
> > can just keep trying. Otherwise the client has to somehow model the
> > state of the server, which seems unnecessary.
>
> Yeah, agreed.
>
> > As for A and AAAA records, this is an open question: how to handle it.
> > Is it a problem to allow a client to update arbitrary A and AAAA
> > records? The restriction of only updating the one that corresponds to
> > the source address used to send the update is there because we have
> > some reasonable assurance that the client actually has that address.
> > We could have some hack where we use the neighbor table to notice that
> > several addresses are associated with the same layer 2 address, but
> > that seems like not what we want to do.
>
> Why is it a problem that a client registers other addresses for its
> A(AAA) records? As long as it can't update the addresses of another name
> it can't spoof that service; if it sets another device's address as it's
> own name, it is just spoofing itself? It could be a problem for PTRs, of
> course, but not for A(AAA)?
>
> Maybe this could also be something that is left up to the registration
> server as a matter of policy? An example policy could be "only 1 address
> per subnet per name" or something... But since a client can just
> generate an infinite number of new names, I'm not really sure that buys
> much either...
>
> > mDNS seems to just use .arpa. I don't know how/if that works, but I
> > definitely don't see how to make it work with the DNS protocol.
>
> Wait, don't see how to make what work with the DNS protocol?
>
> -Toke
>