Subject: [mdnsext] mDNS "bastion" instead of multicast forwarding

From: Brian Dickson <[email-masked]>
Date: Tue, 6 Nov 2012 18:07:44 -0500

I concur (emphatically) with the recommendation against any kind of Layer-3
activity (routing/forwarding raw multicast stuff).

I think a useful area to explore, instead, would be the notion from
firewall-land of a "bastion host", which has presence on multiple
links/subnets, and is mDNS-cognizant, and acts as some kind of proxy.

The devil, undoubtedly, is in the details.

The details that matter would be:
- zero config behavior that is sensible
- user administrative controls that allow good things
- preventing (at all costs) any exposure to user-supplied configurations
that can break a network
- scalable behavior that supports multiple use cases

And the basic primitive functionality would be:
An mDNS "thing" that is able to "speak" on two subnets, and which has mDNS
data concerning both subnets, which acts as some kind of mDNS "proxy" to
mDNS "clients" and "servers" on those subnets.

I think the how and what of all aspects of that can be worked out; the
question is, is this sufficient to facilitate the goals, and backward
compatible enough?

One final thought - for the other group (don't remember specifically what
the WG acronym is - the "lightswitch" folks), would being able to talk
unicast to such a proxy, meet all the needs so as to avoid implementing
multicast?

Brian

---

From: Michael Richardson <[email-masked]>
Date: Tue, 06 Nov 2012 20:45:29 -0500

>>>>> "Brian" == Brian Dickson <[email-masked]> writes:
    Brian> I think a useful area to explore, instead, would be the
    Brian> notion from firewall-land of a "bastion host", which has
    Brian> presence on multiple links/subnets, and is mDNS-cognizant,
    Brian> and acts as some kind of proxy.

avahi does this now.
It suffers from loops if there are multiple machines on both networks.
(for instance, two laptops with both wired and wireless)

The point is that this bastion host has to solve all the same problems
that the layer-3 multicast protocols have already solved.

-- 
Michael Richardson
-on the road-

---

From: Brian Dickson <[email-masked]>
Date: Tue, 6 Nov 2012 23:30:08 -0500

> that the layer-3 multicast protocols have already solved.
I'm thinking not of a "normal" host, but rather something doing
resolution/caching, like a router or maybe a specialized box, with
connections on multiple links.

Even if there were more than one such box, with both boxes on both links,
the idea is that they would recognize each other and "do the right thing".
(I think there is some stuff along those lines for a single broadcast
domain for mDNS as it is.)

Does that make more sense?

It presumes that there is already-solved bits in mDNS that cold be extended
to the multiple-links scenario.

Brian