[dnssd] mDNS Proxy Security Concerns Omitted

[Douglas Otis <[e-mail]>]

Dear Hosnieh,

Sorry for the delayed response.  As previously discussed on the dnssd mailing-list and at the last meeting, publishing mDNS information in DNS removes a level of protection from devices needing isolation from direct Internet access. Enterprise and modern home networks anticipate multiple Internet links with configurations unable to propagate mDNS packets or able to scale multicast within enterprise environments.  Nevertheless publishing routable address in DNS introduces concerns omitted from the requirements draft.

Use of overlay networks permit a safe automatic assignment strategy offering assured protection for those devices unable to handle direct Internet access.  An overlay network might leverage Unique Local Unicast Addresses defined by RFC4193 such as FD00::/8.

| 7 bits |1|   40 bits   |   16 bits     |                64 bits               |
+--------+-+-------------+---------------+--------------------------------------+
| Prefix |L| Global ID   | Subnet ID     |             Interface ID             |
+--------+-+-------------+---------------+--------------------------------------+

There are many devices unable to handle direct Internet access and yet respond with their routable IP address over mDNS.  Printers represent a large install base where such a problem exists, although some can handle such access.

Most consumer grade routers either allow or disallow all IPv6 incoming connections.  This restriction inhibits use of multiple Internet access links when initial incoming packets are blocked. Employing an overlay network that simplifies network boundary conditions allows border devices to be robust by enabling a lightweight filtering method, as apposed to use of cryptography, as with VPNs for example.  Also, when bootstrapping an auto configuration process, it is not safe to assume necessary certificates have been deployed and coordinated by disparate manufactures when exchanging packets beyond the local network.

Regards,
Douglas Otis