Re: [Int-dir] Review of draft-ietf-dhc-relay-server-security-02

Bernie, Tomek,

> On Jan 26, 2017, at 5:38 AM, Bernie Volz (volz) <volz@cisco.com> wrote:
> 
> Hi:
>  
> Thanks for the review Jouni (as Int-Dir coordinator and document coauthor).
>  
> Regarding the main issue and to extend Tomek’s comment …
>  
> We actually have used this text, but without the MUST, in 3315bis (the updated version has not been published as the coauthors are still working through the remaining open issues from the approximately 300 that we captured during the 3315bis WGLC back in August). We do expect to publish an updated version before the IETF-98 deadline (hopefully with all issues addressed, but we’ll see).
>  
> And, as Tomek explained, this idea here was to make this an OPTIONAL feature that vendors could implement (much like any new DHCP option) – but if we left the text as a SHOULD or similar, vendors could claim they supported it without actually implementing it. Thus, this document has a MUST. And, it does not update – but rather extends – 3315 and 1542.

Hmm.. I really do not like specification “games” like this. If you cannot justify a MUST into RFC3315bis, then trying to circumvent the fact in another document (that does not update the RFC3315 or RFC3315bis) should not be a Standards Track document. I could accept this as a BCP or a like.

- Jouni

>  o I would separate the new recommendation text for DHCPv4 and DHCPv6
> into their own respective section. Having just a one-liner statement
> "also applies to DHCPv4 [RFC1542].." is kind of confusing in a middle
> of very DHCPv6 specific text. I recon the DHCPv4 section would be
> short, but definitely more clear in that way.
>  
> BV> I’ll discuss this with Yogendra … I think we can just make this clearer by either breaking out this applicability text for v4/v6 into separate paragraphs. I don’t think there really should be a need to duplicate the main material – i.e., have separate sections which basically would be the same text on the IPsec items.
>  
> o Although it should be obvious, but I would explicitly point it out
> in the Security Considerations that the security model here is
> hop-by-hop. If there are multiple relays then there will be multiple
> IPsec tunnels as well.
>  
> BV> Sure, we can add that.
>  
> o Section 14:  s/section 14,/Section 14,
>  
> BV> OK, thanks for catching that.
>  
> Again, thanks.
>  
> -          Bernie
>  
> From: Tomek Mrugalski [mailto:tomasz.mrugalski@gmail.com] 
> Sent: Thursday, January 26, 2017 5:24 AM
> To: Jouni Korhonen <jounikor@gmail.com>; int-dir@ietf.org
> Cc: dhcwg@ietf.org; ietf@ietf.org; draft-ietf-dhc-relay-server-security.all@ietf.org
> Subject: Re: Review of draft-ietf-dhc-relay-server-security-02
>  
> W dniu 26.01.2017 o 07:45, Jouni Korhonen pisze:
> Reviewer: Jouni Korhonen
> Review result: Not Ready
>  
> Disclaimer: I have not followed recent DHC discussions to the extent
> that the existence this document was new to me.
>  
> Issues:
>  
> My issues with the document are the following. First, it actually
> updates a great deal of RFC3315 (Section 21.1) while there is
> RFC3315bis in progress. Why the DHCPv6 part of this document is not
> directly contributed to RFC3315bis work? There's even author overlap
> so there must be a good reason. Second, if there is a reason to keep
> the content of this document separate from RFC3315 body of work, at
> least this specification should then target to update RFC3315bis and
> not RFC3315.
> Hi Jouni,
> First of all, thanks for doing the review.
> 
> I will leave it up to the authors to provide further details on this, but with my shepherd hat on, let me explain that this omission was made on purpose. The decision was made to not update 3315 and not bundle this into 3315bis on purpose. If we did that, then every DHCP server would HAVE to support IPSec. This would make implementation, certification and deployment much more complex and this is something we wanted to avoid. With the current approach, operators can be specific whether they need relay server security (by requiring their vendors to support both 3315 and this document) or not (just 3315).
> 
> This is also explained in the write-up:
> (16) Will publication of this document change the status of any
> existing RFCs? Are those RFCs listed on the title page header, listed
> in the abstract, and discussed in the introduction? If the RFCs are not
> listed in the Abstract and Introduction, explain why, and point to the
> part of the document where the relationship of this document to the
> other RFCs is discussed. If this information is not in the document,
> explain why the WG considers it unnecessary.
>  
>   No. Even though this I-D introduces changes to RFC3315, the WG doesn't
>   want to enforce IPsec encryption on every DHCPv6 server. Therefore
>   it does not update RFC3315.
> 
> 
> Also, I'd like to clarify that 3315bis is not a wildcard that bundles every RFC related to DHCPv6 ever published. This document is 133 pages long and that size causes difficulties moving the work forward. We're thinking what are the things we can take out of it, rather what else we could add. The previous argument still stands here. We want to have the core spec and an additional RFC that people can point to when they require secure server-relay communication.
> 
> If that explanation is not acceptable for you, how do you propose to structure the text and possibly add updates 2131/3315 to achieve the goal or being a non-mandatory feature?
> 
> I'll let the authors comment on the nits.
> 
> Again, thanks for the review. It's good to receive one that shakes things up a bit once in a while :)
> Tomek
> 
> Other smaller nits:
>  
> o This document updates both RFC3315(bis) and RFC1542. Those are not
> reflected in the document title page and abstract. 
>  
> o I would separate the new recommendation text for DHCPv4 and DHCPv6
> into their own respective section. Having just a one-liner statement
> "also applies to DHCPv4 [RFC1542].." is kind of confusing in a middle
> of very DHCPv6 specific text. I recon the DHCPv4 section would be
> short, but definitely more clear in that way.
>  
> o Although it should be obvious, but I would explicitly point it out
> in the Security Considerations that the security model here is
> hop-by-hop. If there are multiple relays then there will be multiple
> IPsec tunnels as well.
>  
> o Section 14:  s/section 14,/Section 14,
>  
> o 
>  
>  
> 
> _______________________________________________
> Int-dir mailing list
> Int-dir@ietf.org
> https://www.ietf.org/mailman/listinfo/int-dir