On 2012-06-18 10:51 AM, John Nagle wrote:
On 6/18/2012 3:48 AM, Gervase Markham wrote:
On 16/06/12 15:46, Zack Weinberg wrote:
I have remembered the security case for not honoring top-level A
records: it has to do with abbreviated DNS names used in intranets.
Suppose http://ai.example.com/ is an internal-use-only server for
example.com employees, whose computers have all been configured to retry
NXDOMAINs by tacking '.example.com' on the end,
Right. But that's handled at the DNS search level. "getaddrinfo",
given "ai", tries
ai - relative to local root, which is usually the
domain of the local machine minus the first
domain label
ai. - relative to global root.
Are you *sure* about this? My understanding is that the lookups happen
in exactly the opposite order, i.e. 'ai.' *first*, and
'ai.<localdomain>.' only if that fails.
zw
_______________________________________________
dev-security mailing list
dev-security@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security
