Re: [dhcwg] AD Evaluation: draft-ietf-dhc-dhcpv6-unknown-msg

[Brian Haberman <[e-mail]>]

On 2/3/14 9:48 AM, Ted Lemon wrote:
> On Feb 3, 2014, at 9:17 AM, Brian Haberman <[e-mail]>
> wrote:
>> Hmm... The text above talks about messages from servers to relays. 
>> Would these messages be coming from servers *not* identified in
>> the relay's configuration?  That is, do you envision relays seeing
>> messages from servers that the relay is not configured to use for
>> received client messages?  If not, shouldn't the guidance be that
>> relays should silently drop them?  If they can receive messages
>> from servers they don't know about, the relays will forward these
>> messages to *other* servers and they should drop them.
> 
> Yes, I had a bit of a think about that when replying to your review
> yesterday, and thought about it some more just now.   I don't think
> we can address that here—we don't know what these messages will look
> like, or even if they will be defined, so trying to anticipate their
> security implications is a bit futile.   I think the language I
> proposed is adequate for the time being, and does the right thing in
> the case of unknown messages.   E.g., a server implemented according
> to the existing spec would not do a bad thing with such a message,
> because it wouldn't recognize it, and the document defining that
> message ought to specify how the server should handle it in the case
> you've described.

Ok.

> 
>> Almost sounds like DHCP needs a capabilities negotiation between
>> servers and relays. :)
> 
> Perish the thought.  :)

Duly noted.

> 
>> If the pairing of a client and relay agent is not expected, this
>> may not be an issue.
> 
> It's certainly a plausible configuration—I've even proposed something
> like this in homenet.   But I think that the way this would work
> would again be something that could be documented in the spec
> describing how it works.   And homenet doesn't seem very interested
> in solving the problem this way anyway.
> 

Ok. Just wanted to check.

When a new version pops out, I will review it and start IETF LC.

Regards,
Brian