Subject: Re: Summary of LLMNR Last Call

From: Bernard Aboba <[email-masked]>
Date: Mon, 19 Sep 2005 13:48:21 -0700 (PDT)

>extensions because they _think_ that they have mDNS available when they 
>actually do not, which, when combined with LLMNR's default behavior of 
>querying the DNS first, will result in a larger number of .local lookups 
>in the global DNS. 

Today more than 95% of all users on the Internet do not have mDNS or LLMNR
available.  If these users were to type a ".local" name into their Web 
browsers, this would generate a bogus DNS query.  This is not a new 
problem, and it relates to DNS resolver behavior, not to LLMNR. 
It is certainly possible to insert text in Section 3 saying "don't send 
DNS queries for .local".  However, if the goal is to change the 
behavior of DNS resolver implementations (whether they support LLMNR 
or not) this doesn't make much sense. 

>Security concerns have been raised about the fact that applications on 
>hosts that implement LLMNR will not be able to tell if a response has 
>come from the DNS or from a local lookup.

May I remind you that this is not a new problem.  For at least twenty 
years, Internet hosts have implemented multiple name resolution 
mechanisms in a way that has been transparent to applications. For 
example, Microsoft Windows systems support both DNS and NetBIOS name 
resolution mechanisms today.  The way in which NetBIOS names 
and DNS FQDNs are distinguished is that the DNS resolver does not send 
queries for single-label names; these names are assumed to be NetBIOS 
names, and so are resolved only via NetBIOS.  To my knowledge, no issue 
has arisen from this. 

>This security concern does not seem to be adequately explored and 
>addressed in the LLMNR specification. At the very minimum, it should be 
>carefully explored in the security considerations section so that 
>implementers and users can be aware of these concerns.

The LLMNR specification specifies a mechanism for link local name 
resolution.  It also discusses potential policies for the sending of link 
local queries, as well as security mechanisms (IPsec, TSIG, DNSSEC) 
available for ensuring the integrity and authenticity of responses.  
What it does not do is to mandate a particular policy.  For example, the 
document could say "By default send LLMNR implementations SHOULD 
only send queries for single-label names unless security mechanisms 
(IPsec, TSIG, DNSSEC) are supported."  However, in the past there has not 
been consensus for this.  For example, it has been argued that within an 
adhoc network secured at layer 2, where all hosts are trusted, LLMNR 
queries may be safely sent for any FQDN. 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>