[dhcwg] Trust model of Client FQDN option

Hi,

(not subscribed..)

I'm not sure the v4 or v6 DHC FQDN client options address the problem
of the trust model for the update content sufficiently well.  I'd even
go as far to say that it might create a false sense of security.

The issue is that as the DNS server will be configured to trust the
DHCP server for these updates, how could the DHCP server ensure that
the Client is authorized to insert that FQDN -> IP mapping.  This is
basically deemed outside of the scope of the spec, without providing
the means in the spec to do that properly.

A suggestion is that the DHCP server includes policy information which
updates would be acceptable.  I do not think this addresses the real 
problem: if such policy is available, why does the client need to send 
the FQDN in the first place -- the DHCP server should just be 
configured to update the FQDN corresponding to a particular client to 
map to the IP address of that client; the client doesn't need to 
specify it if this will need to be included in the policy 
configuration in any case.  So, in this kind of scenario, you 
shouldn't actually need the Client FQDN option here, just the magic in 
the DHCP server to update the IP address of a particular client 
automatically.

Therefore, the client should probably be able to insert a TSIG or some
other signature which the DHCP server could use for updating; this
would authorize the update (in case TSIG validation succeeds) or not
without manually configured policy lists.

(A reason why DHCP server could update the FQDN to the DNS server
might be that the ISP wants to restrict access to the DNS updates to a
smaller number of hosts.)

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg