Re: [kitten] Kerberos Service Discovery using DNS

[Simo Sorce <[e-mail]>]

On Fri, 2015-03-06 at 16:43 -0500, Greg Hudson wrote:
> On 03/05/2015 12:57 PM, Nathaniel McCallum wrote:
> > http://datatracker.ietf.org/doc/draft-mccallum-kitten-krb-service-discovery/
> 
> I'm on board with this in general. 

I like it too.

>  Some specific issues to be hashed out:
> 
> 1. URL formats for basic RFC 4120 over UDP/TCP
> 
> The draft uses udp://hostname[:port] and tcp://hostname[:port] for
> these.  The IANA registry notes some application-specific precedent for
> the use of a "udp" scheme but there is no formal spec for it, and there
> is no registration for "tcp" at all.  Obviously these URI schemes are
> very context-dependent; a generic application such as a web browser
> would have no idea what to do with a TCP or UDP URL.  On the other hand,
> we are also proposing a very context-specific use of HTTP for MS-KKDCP,
> and there is a ton of precedent for that (basically any kind of RPC over
> HTTP).
> 
> 2. UDP/TCP preference
> 
> Some implementation guidance may be necessary on this.  Implementations
> are currently used to having their own preference of UDP versus TCP,
> perhaps based on the packet size.
> 
> The current draft does allow the URI records to express no preference of
> UDP versus TCP; one can simply give them the same priority and don't use
> weights.  But if the URI records express a preference, should a client
> always honor that preference, or can it ignore it--say, if the packet is
> large?

I think the client SHOULD use the URI order in preference, but MAY
override it if it knows that the packet size will make it impossible to
use the URI preferred method. (Ie if the URI makes UDP preferred but the
client knows the size for the specific exchange is going to be too large
for UDP, it may decide to do straight TCP/MS-KKDCP instead).

> 3. Precedence of URI versus SRV
> 
> Discussion elsewhere suggested that the URI records, if present, should
> have precedence over SRV records; if a client finds URI records, it
> shouldn't do SRV lookups.  The draft should probably say that explicitly.

+1

> 4. Security considerations
> 
> MS-KKDCP can offer security benefits for Kerberos traffic because it
> uses TLS.  These added protections are mostly lost if unsecured URI
> records are used to discover the proxy URL.  This is not a deal-breaker
> as there are other reasons to use a proxy, but we should explicitly
> state this in the security considerations.

True, but DNSSEC may help in this case, so it is not that weak, should
be pointed out anyway.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York