Re: [dhcwg] AD Evaluation: draft-ietf-dhc-dhcpv6-unknown-msg

On Feb 3, 2014, at 9:52 AM 2/3/14, Brian Haberman <brian@innovationslab.net> wrote:

> 
> 
> On 2/3/14 9:48 AM, Ted Lemon wrote:
>> On Feb 3, 2014, at 9:17 AM, Brian Haberman <brian@innovationslab.net>
>> wrote:
>>> Hmm... The text above talks about messages from servers to relays. 
>>> Would these messages be coming from servers *not* identified in
>>> the relay's configuration?  That is, do you envision relays seeing
>>> messages from servers that the relay is not configured to use for
>>> received client messages?  If not, shouldn't the guidance be that
>>> relays should silently drop them?  If they can receive messages
>>> from servers they don't know about, the relays will forward these
>>> messages to *other* servers and they should drop them.
>> 
>> Yes, I had a bit of a think about that when replying to your review
>> yesterday, and thought about it some more just now.   I don't think
>> we can address that here—we don't know what these messages will look
>> like, or even if they will be defined, so trying to anticipate their
>> security implications is a bit futile.   I think the language I
>> proposed is adequate for the time being, and does the right thing in
>> the case of unknown messages.   E.g., a server implemented according
>> to the existing spec would not do a bad thing with such a message,
>> because it wouldn't recognize it, and the document defining that
>> message ought to specify how the server should handle it in the case
>> you've described.
> 
> Ok.
> 
>> 
>>> Almost sounds like DHCP needs a capabilities negotiation between
>>> servers and relays. :)
>> 
>> Perish the thought.  :)
> 
> Duly noted.
> 
>> 
>>> If the pairing of a client and relay agent is not expected, this
>>> may not be an issue.
>> 
>> It's certainly a plausible configuration—I've even proposed something
>> like this in homenet.   But I think that the way this would work
>> would again be something that could be documented in the spec
>> describing how it works.   And homenet doesn't seem very interested
>> in solving the problem this way anyway.

I have a less laissez-faire view, here, which is that we ought to disallow explicitly the deployment of a client and relay agent on the same device, with a recommendation that a specification for such a deployment needs to be written if the use case is realized.

- Ralph

>> 
> 
> Ok. Just wanted to check.
> 
> When a new version pops out, I will review it and start IETF LC.
> 
> Regards,
> Brian
> 
> _______________________________________________
> dhcwg mailing list
> dhcwg@ietf.org
> https://www.ietf.org/mailman/listinfo/dhcwg