[dhcwg] Re: Renumbering DNS with stateless DHCPv6 - bug?

[Tim Chown <[e-mail]>]

On Tue, Nov 18, 2003 at 12:55:12PM -0500, Thomas Narten wrote:
> 
> note that there are issues with unicast reconfigure. During the IESG
> review of the DHCv6 spec, concerns were raised about the
> appropriateness of _requiring_ that all nodes have an open port on
> which DHC messages could be sent. This is viewed as a security
> issue. E.g., for security reasons, some sites require that clients
> have no open ports on which they are listening for arbitrary packets
> from anyone. Consequently, the DHCPv6 spec was revised to make the use
> of this feature more of a negotiation between the client and
> server. See the RFC for details.

There may be other methods to give the hint for a (RFC2462) client to send 
a new (options) request to the (stateless) DHCP server.   This might involve
something in an RA, some new form of Reconfigure message (although I can see
this isn't favoured, it is specified for stateful servers to use), or some
other method.

> Personally, I think something along the lines of Bernie's suggestion
> seems the simplest. E.g., just define a lifetime that applies to all
> options that don't themselves have a lifetime.  Client can then
> recheck at appropriate intervals.

A timer is an improvement; at least then the timer could be tuned down a
bit like DNS TTL for a planned renumbering event, or for simpler events
like adding a new NTP server or changing the DNS search path.

Attached is a draft that I've just submitted describing the problem
statement.  Vijay and Stig are both working on proposals for solutions.
It would be great to get your input on those based on the IESG discussion
experience (for example on the security requirements).

The problem/gap is a bit broader then just site renumbering, so the draft
name is not ideal.

Tim