Re: [dhcwg] status of draft-ietf-dhc-agent-subnet-selection

The message from the relay agent to the server uses the relay agent's 
address as the source address.  The relay agent modifies and sends the DHCP 
message as the payload in a UDP message that appears to originate from the 
relay agent.  Section 4 of RFC1542 gives more details.  The difference 
between DHCPv4 and DHCPv6 is in the way in which the client message is 
processed by the relay agent (in DHCPv6, the message is encapsulated in a 
new message generated by the relay agent).

Yes, IPsec cannot be used from the client to the server.  The proposal for 
the use of IPsec under consideration here is to protect the message as it 
travels between the relay agent and the server.  The primary purpose is to 
protect any relay agent options, addressing an issue raised by the original 
relay option spec (RFC3046), which assumes no security is needed between 
the relay agent and the server.

- Ralph

At 02:35 PM 10/9/2002 -0400, Thomas Narten wrote:
> > If I squint my eyes and stand back far enough, I don't see that the DHCPv4
> > case is different.
>
>Conceptually similar, details are different.
>
> > While the relay agent is relaying a message on behalf
> > of the client, it really is relaying that message in an independent UDP
> > message, in which the source address belongs to the relay agent.
>
>Isn't the source address of the packet that of the client (and not the
>relay agent)? This makes a huge differences with regards to IPsec.
>
>Even worse, the client has no IP address yet, so the relayed packet
>has no source address...
>
>This can't be made to work trivially with stock IPsec. You'd need
>extensions I'd suspect, defeating much of the purpose of trying to use
>IPsec.
>
>Note that the above also factored into why DHC needed something
>specific to DHC rather than trying to somehow use IPsec.
>
>Thomas

_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg