>3) This protocol is a bit loaded with options and features. It
>supports a number of different queries, leaves a fair amount of
>flexibility in how such information is obtained (e.g., proxies are
>supported) and is rather easily extensible, including in proprietary
>ways. The IANA Considerations Section indicates that anyone can obtain
>code points to extend the protocol as they please without the need for
>even a basic sanity review. As one reviewer noted:
I can't agree more. The initial proposal was simple and robust
(which was just a name lookup). I personally think Qtypes other than
"Node name" are unnecessary.
>More detailed comments from various reviewers:
>
>Many application implementations do a reverse DNS lookup on an IP
>address to learn the DNS Name of the connecting system. This name is
>then used to make access control decisions. Some may believe that this
>mechanism can be used to replace the reverse lookup. However this
>introduces a new security vulnerability, which is to say that a bogus
>host could connect to a service and when queried with this protocol it
>would provide the DNS Name that the server is expecting and therefore
>make an inappropriate access control decisions.
This part, I have a major objection.
This view is completely opposite from concerns raised in
draft-ietf-dnsop-inaddr-required-03.txt - DNS PTR records should
not be used as sort-of authenticity, therefore, it is not recommended
to be used as an access control mechanism.
In my understanding, the threat imposed by malicious responses to
ICMPv6 node information query (Qtype = node name) is equal to
setting up DNS PTR records without forward zone administrators'
knowing. For instance, anyone can set up DNS PTR records that returns
"www.ietf.org". Similarly, anyone can respond with ICMPv6 node
information reply with "www.ietf.org".
itojun
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page: http://playground.sun.com/ipng
FTP archive: ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [EMAIL PROTECTED]
--------------------------------------------------------------------
