Subject: LLMNR Issue 71 (AD Review): Configuration

From: Bernard Aboba <[email-masked]>
Date: Thu, 2 Sep 2004 10:47:50 -0700 (PDT)

The list of current LLMNR issues and resolutions is available here:
http://www.drizzle.com/~aboba/DNSEXT/llmnrissues.html

The text of Issue 71 is enclosed below.  The proposed resolution is as
follows:

In Section 2, change:

"   [1] No manual or automatic DNS configuration has been
        performed.  If an interface has been configured with DNS
       server address(es),  then LLMNR SHOULD NOT be used as the
       primary name resolution mechanism on that interface, although
       it MAY be used as a name resolution mechanism of last resort."

To:

"  [1] No manual or automatic DNS configuration has been
       performed.  If any interface has been configured with DNS
       server address(es), then LLMNR SHOULD NOT be used as the
       primary name resolution mechanism, although it MAY be used
       as a secondary name resolution mechanism."

In Section 3.1, change:

"Unless unconfigured hosts periodically retry configuration, an outage in
the DNS configuration mechanism will result in hosts continuing to use
LLMNR even once the outage is repaired.  Since LLMNR only enables
linklocal name resolution, this represents an unnecessary degradation in
capabilities.  As a result, it is recommended that hosts without a
configured DNS server periodically attempt to obtain DNS configuration.
For example, where DHCP is used for DNS configuration, [RFC2131]
recommends a maximum retry interval of 64 seconds.  In the absence of
other guidance, a default retry interval of one (1) minute is
RECOMMENDED."

To:

"An outage in the DNS configuration mechanism may result
in hosts continuing to use LLMNR even once the outage is repaired.  Since
LLMNR only enables linklocal name resolution, this represents a
degradation in capabilities.  As a result, hosts without a configured DNS
server may wish to periodically attempt to obtain DNS configuration if
permitted by the configuration mechanism in use.  In the absence of other
guidance, a default retry interval of one (1) minute is
RECOMMENDED."

Change:

"  For example, if the configured DNS server responds
to AAAA RR queries sent over IPv4 or IPv6 with an authoritative name error
(RCODE=3), then it will not be possible to resolve the names of IPv6-only
hosts.  In this situation, LLMNR over IPv6 can be used for local name
resolution."

To:

"  For example, if the configured DNS server responds to
all AAAA RR queries sent over IPv4 or IPv6 with an authoritative name
error (RCODE=3), then it will not be possible to resolve the names of
IPv6-only hosts.  In this situation, LLMNR over IPv6 can be used for local
name resolution."

-------------------------------------------------------------------------
Issue 71: Configuration
Submitter: Thomas Narten
Submitter email address: [email-masked]
Date first submitted: August 27, 2004
Reference:
Document: LLMNR-34
Comment type: T
Priority: S
Section:  Various
Rationale/Explanation of issue:

> [1] No manual or automatic DNS configuration has been
> performed. If an interface has been configured with DNS
> server address(es), then LLMNR SHOULD NOT be used as the
> primary name resolution mechanism on that interface, although
> it MAY be used as a name resolution mechanism of last resort.

DNS server addresses are not what I'd consider "per-interface"
information.

> Unless unconfigured hosts periodically retry configuration, an outage
> in the DNS configuration mechanism will result in hosts continuing to
> use LLMNR even once the outage is repaired. Since LLMNR only enables
> linklocal name resolution, this represents an unnecessary degradation
> in capabilities. As a result, it is recommended that hosts without a
> configured DNS server periodically attempt to obtain DNS
> configuration. For example, where DHCP is used for DNS
> configuration, [RFC2131] recommends a maximum retry interval of 64
> seconds. In the absence of other guidance, a default retry interval
> of one (1) minute is RECOMMENDED.

Again, this seems simplistic. You should not go back to your DHC
server every 64 seconds if has given you parameters other than DNS.

> For example, if the configured DNS server responds to AAAA RR queries
> sent over IPv4 or IPv6 with an authoritative name error (RCODE=3),
> then it will not be possible to resolve the names of IPv6-only hosts.
> In this situation, LLMNR over IPv6 can be used for local name
> resolution.

seems to narrow. Getting RCODE=3 for one query, can't be generalized
to say AAAA is not supported at all by that server.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>