Subject: Re: comments on krb-dns-locate draft

From: Derek Atkins <[email-masked]>
Date: 17 Dec 1999 20:17:39 -0500

"Paul Leach (Exchange)" <[email-masked]> writes:

> > -----Original Message-----
> > From: Derek Atkins [mailto:[email-masked]]
> > Sent: Friday, December 17, 1999 4:32 PM
> > To: Paul Leach (Exchange)
> > Cc: 'Derek Atkins'; [email-masked]'; 'Ken Hornstein'; Jonathan
> > Trostle; [email-masked]
> > Subject: Re: comments on krb-dns-locate draft
> > 
> > 
> > "Paul Leach (Exchange)" <[email-masked]> writes:
> > 
> > > > -----Original Message-----
> > > > From: Derek Atkins [mailto:[email-masked]]
> > > > Sent: Friday, December 17, 1999 7:09 AM
> > > > 
> > > > User            Cl-App          DNS-C           DNS-S
> > > > "telnet foo" ---->
> > > >                  "foo"----------->
> > > >                                  "foo"----------->
> > > >                                  "foo.baz.com"--->
> > > >                                  "foo.bar.com"--->
> > > >                   <---------------<------------"foo.tim.org A 
> > > > 10.2.3.4"
> > > > 
> > > > At this point, the client will ask for a ticket to 
> > "host/foo.tim.org",
> > > > because it has to find the FQDN somehow (and the only way 
> > is via the
> > > > DNS result).
> > > 
> > > No, it will ask for a ticket for "host/foo.bar.com", 
> > because that's what it
> > > knows from what the user specified and from local 
> > trustworthy configuration
> > > data. If a trusted third party, the KDC admin, has put an 
> > entry in the KDB
> > > for "host/foo.bar.com" associating it with a key that the 
> > server at 10.2.3.4
> > > also knows, then the connection will succeed and mutual 
> > authentication will
> > > happen, and everything will be cool. In your example, the 
> > bogus server will
> > > not know the key, the mutual auth will fail and so will the 
> > attempted
> > > exploit.
> > > 
> > > Paul
> > 
> > Paul, how can the app do that?  The app has no way to know that
> > "foo.bar.com" was the 'successful' hostname lookup; it doesn't have
> > access to the 'resolv.conf' realm search list.  Also, there is
> > currently no API for an app to determine that information from the DNS
> > client.  All that 'telnet' gets back is that "foo.tim.org" was the
> > successful completion for "foo."  What API do you think there is that
> > can return this information?
> 
> gethostbyname().
> 
> It returns a HOSTENT:
> 
> struct hostent {
>     char FAR *       h_name;
>     char FAR * FAR * h_aliases;
>     short            h_addrtype;
>     short            h_length;
>     char FAR * FAR * h_addr_list;
> };
>  
> Members
> h_name 
> Official name of the host (PC).If using the DNS or similar resolution
> system, it is the Fully Qualified Domain Name (FQDN) that caused the server
> to return a reply. If using a local hosts file, it is the first entry after
> the IP address. 
> h_aliases 
> A NULL-terminated array of alternate names. 
> h_addrtype 
> The type of address being returned. 
> h_length 
> The length, in bytes, of each address. 
> h_addr_list 
> A NULL-terminated list of addresses for the host. Addresses are returned in
> network byte order. The macro h_addr is defined to be h_addr_list[0] for
> compatibility with older software. 
> 
> Paul 

Right...  And gethostbyname() just returns the (insecure) information
returned from the DNS Server, which you claim not to trust.  The
hostent structure does not get filled with any client data.  In my
example, the hostent returned would be:

struct hostent {
    char FAR *       h_name;		"foo.tim.org"
    char FAR * FAR * h_aliases;		NULL
    short            h_addrtype;	AF_INET?
    short            h_length;		4
    char FAR * FAR * h_addr_list;	10.2.3.4, NULL
};

This is what I'm saying, the telnet application has no way to know
that the resolver tried "foo.bar.com", because the hostent will get
the (forged) hostname of "foo.tim.org", and that's what get's
returned.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/      PP-ASEL      N1NWH
       [email-masked]                        PGP key available
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Jonathan Trostle <[email-masked]>
Date: Fri, 17 Dec 1999 17:31:50 -0800

>the (forged) hostname of "foo.tim.org", and that's what get's

In this case the search list must contain only one completion element,
until the client has an API that will also return the foo.bar.com name.

Jonathan

---

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Fri, 17 Dec 1999 17:08:58 -0800

gethostbyname().

It returns a HOSTENT:

struct hostent {
    char FAR *       h_name;
 
Members
h_name 

Paul