Subject: Proposed resolution to LLMNR Issue 34

From: Bernard Aboba <[email-masked]>
Date: Thu, 1 May 2003 23:08:45 -0700 (PDT)

The proposed resolution to Issue 34 (see
http://www.drizzle.com/~aboba/DNSEXT/llmnrissues.html#Issue%2034
for details) is to replace Section 2.3 and 2.6 with the following:

"2.3.  Unicast queries and responses

Unicast queries SHOULD be sent when:

  a.  A sender repeats a query after it received a response
      with the TC bit set to the previous LLMNR multicast query, or

  b.  The sender's LLMNR cache contains an NS resource record that
      enables the sender to send a query directly to the hosts
      authoritative for the name in the query, or

  c.  The sender queries for a PTR RR.

If a TC (truncation) bit is set in the response, then the sender MAY use
the response if it contains all necessary information, or the sender MAY
discard the response and resend the query over TCP using the unicast
address of the responder.  The RA (Recursion Available) bit in the
header of the response MUST NOT be set.  If the RA bit is set in the
response header, the sender MUST ignore the RA bit.

Unicast LLMNR queries SHOULD be sent using TCP.  Responses to TCP
unicast LLMNR queries MUST be sent using TCP,  using the same connection
as the query.  If the sender of a TCP query receives a response not
using TCP, the response MUST be silently discarded.  Unicast UDP queries
MAY be responded to with an empty answer section and the TC bit set, so
as to require the sender to resend the query using TCP.  Senders MUST
support sending TCP queries, and Responders MUST support listening for
TCP queries. The Responder SHOULD set the TTL or Hop Limit settings on
the TCP listen socket to one (1) so that SYN-ACK packets will have TTL
(IPv4) or Hop Limit (IPv6) set to one (1). This prevents an incoming
connection from off-link since the Sender will not receive a SYN-ACK
from the Responder.

If an ICMP "Time Exceeded" message is received in response to a unicast
UDP query, or if TCP connection setup cannot be completed in order to
send a unicast TCP query, this is treated as a response that no records
of the specified type and class exist for the specified name (it is
treated the same as a response with RCODE=0 and an empty answer
section). The UDP sender receiving an ICMP "Time Exceeded" message
SHOULD verify that the ICMP error payload contains a valid LLMNR query
packet, which matches a query that is currently in progress, so as to
guard against a potential Denial of Service (DoS) attack. If a match
cannot be made, then the sender relies on the retransmission and timeout
behavior described in Section 2.6."

2.6.  Retransmissions

In order to avoid synchronization, LLMNR queries and responses are
delayed by a time uniformly distributed between 0 and 200 ms.

If an LLMNR query sent over UDP is not resolved within the timeout
interval (LLMNR_TIMEOUT), then a sender MAY repeat the transmission of
the query in order to assure that it was received by a host capable of
responding to it.  Since a multicast query sender cannot know beforehand
whether it will receive no response, one response, or more than one
response, it SHOULD wait for LLMNR_TIMEOUT in order to collect all
possible responses, rather than considering the multicast query answered
after the first response is received. A unicast query sender considers
the query answered after the first response is received, so that it only
waits for LLMNR_TIMEOUT if no response has been received.

LLMNR implementations SHOULD dynamically estimate the timeout value
(LLMNR_TIMEOUT) based on the last response received, on a per-interface
basis, using the algorithms described in [RFC2988], with a minimum
timeout value of 300 ms.  Retransmission of UDP queries SHOULD NOT be
attempted more than 3 times.  Where LLMNR queries are sent using TCP,
retransmission is handled by the transport layer."

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>