Re: [dhcwg] I-D Action: draft-boucadair-dhcwg-rfc4014-update-00.txt

[[e-mail]]

Hi Alan, 

Please see inline. 

Cheers,
Med

> -----Message d'origine-----
> De : Alan DeKok <[e-mail]>
> Envoyé : mercredi 19 octobre 2022 15:43
> À : BOUCADAIR Mohamed INNOV/NET <[e-mail]>
> Cc : [e-mail]
> Objet : Re: [dhcwg] I-D Action: draft-boucadair-dhcwg-rfc4014-
> update-00.txt
> 
> On Oct 17, 2022, at 8:52 AM, [e-mail] wrote:
> > [Med] This is equivalent to implementations such as:
> https://www.juniper.net/documentation/us/en/software/junos/subscri
> ber-mgmt-sessions/topics/topic-map/dhcp-options-radius-
> server.html.
> 
>   Yes.  There are a few other vendors doing the same thing.
> 
>   So if it's useful... it should be standardized.
> 
> >>  I think it may be best to forbid DHCPv4-Options from being
> carried
> >> inside of the RADIUS Attributes Sub-option.
> >
> > [Med] If we forbid this, how a relay agent can then relay, e.g.,
> the encrypted DNS information received from a RADIUS server to a
> DHCP serve? This is no an RSOO, but RADIUS data.
> 
>   Hmm... true.
> 
>   Maybe just add a note saying that nesting things twice is a bad
> idea?

[Med] The nesting will be experienced only when a relay interacts with a RADIUS server, which is a deployment choice. Note that nesting can already be present with multiple layers of relays (with or without RSOOs). We already have two guards to control which options can be enclosed (the IANA registration with an Expert review + a local policy) and make sure the feature is used when justified. I think that's already sufficient. 

> 
>   i.e. RADIUS packets with DHCP-Options and then RADIUS attributes
> inside of that is NOT RECOMMENDED
> 
>    and DHCP packets with RADIUS attributes and the DHCP-Options
> inside of that is NOT RECOMMENDED
> 
>   Alan DeKok.


_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.