Subject: Re: LLMNR authorized range

From: Bernard Aboba <[email-masked]>
Date: Sat, 20 Mar 2004 03:47:00 -0800 (PST)

[Joshua Graessley] said:

The current solution of using TCP with a TTL of 1 makes the "authorized
range" pretty simple to understand. Addresses in the authorized range are
those that the host knows about. This highlights a problem with the
current LLMNR draft. If there are two subnets overlaid on a local network
and the hosts are unaware of the opposite subnet, LLMNR will make it
impossible to resolve names of some devices on the same link just because
they exist on a different subnet.

[Ted Lemon] replied:
I guess I don't understand why this is a problem. A host that
you can't talk to without going through a router isn't "local." Why would
we expect this to work?

[Mika Liljeberg] said:
As far as I can see, that is only a problem with PTR queries, which
often fail anyway. And I'd wager overlaid subnets are not a very common
configuration. Do you think this is something we need to worry about?

[Bernard Aboba] In practice, I don't believe this issue will arise.
Section 1 says:

"The assumption is that if a network has a gateway,
then the network is able to provide DNS server configuration."

Therefore in the "overlapping subnet" case LLMNR
assumes that the host has DNS configuration. From early
on, LLMNR has assumed that the gateway supports the
resolution of the names of local hosts using DHCPv4 and
dynamic DNS update. However, this assumption cannot be
made for IPv6 at this point.

So if we are talking about multiple subnets on a link in
IPv4, then a conventional DNS query will be sent first,
and local names can be resolved by the gateway. If we are
talking about IPV6, then Router Advertisement enables
the host to become aware of the multiple subnets,
so that TCP-based queries can be sent on the local
link, rather than forwarded by a router.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Markku Savela <[email-masked]>
Date: Sat, 20 Mar 2004 14:23:14 +0200

> From: Bernard Aboba <[email-masked]>
> 
> ... If we are

Terminology confusion? What subnets are in RA? RA can have multiple
prefixes to be used on the link (if L=1), but they are not subnets.

---

From: Joshua Graessley <[email-masked]>
Date: Mon, 22 Mar 2004 10:40:10 -0800

Based on prior discussions and reading the draft, I was under the 
impression that if a DNS query fails (response with answercount of zero 
or a response with an error of NXDOMAIN), the query would be performed 
using LLMNR.

It seems very plausible that someone might setup their computers to 
respond to LLMNR queries for names such as josh.llmnr or 
josh.thisdomainmustfailtoresolve. This would allow someone to locally 
refer to their computers by name no matter what the local addresses are 
and whether or not a DNS server is available. This would also be 
perfectly valid according to the current LLMNR spec. In this valid 
scenario, if there are multiple subnets on the same local network, 
LLMNR will fail.

-josh

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 23 Mar 2004 15:14:16 +0900

Josh;

> In this valid 
> scenario, if there are multiple subnets on the same local network, LLMNR 
> will fail.

With IPv6, there is no reason not to share all the prefixes of
a link by all the hosts on the link, which means there is
only a single subnet.

						Masataka Ohta