Re: [OPSAWG] [dhcwg] [Add] 🔔 WG LC: RADIUS Extensions for Encrypted DNS

[[e-mail]]

Re-,

Thanks for the feedback. 

I submitted a new version which takes into account the comments received so far: https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-add-encrypted-dns-04. 

Please let me know if I missed any of the comments. Thanks.

Cheers,
Med

> -----Message d'origine-----
> De : Alan DeKok <[e-mail]>
> Envoyé : lundi 17 octobre 2022 14:51
> À : Bernie Volz <[e-mail]>
> Cc : BOUCADAIR Mohamed INNOV/NET <[e-mail]>;
> [e-mail]; Joe Clarke (jclarke) <[e-mail]>; opsawg
> <[e-mail]>; ADD Mailing list <[e-mail]>;
> [e-mail]
> Objet : Re: [dhcwg] [Add] [OPSAWG] 🔔 WG LC: RADIUS Extensions for
> Encrypted DNS
> 
> On Oct 17, 2022, at 7:41 AM, Bernie Volz <[e-mail]> wrote:
> > I was thinking more to put this restriction on the dhcp server,
> when it makes use of the Radius attribute to respond to a client.
> I have no issue with it being limited at configuration too, but
> the dhcp server should also make sure only a limited set of
> options are sent to client.
> >
> > Leaving this wide open causes issues as it may be miss used to
> inject things that really shouldn’t be.
> 
>   I agree.  There should be a limited set of options which are
> allowed, perhaps via a registry.
> 
> > Looking at it again, it is also unclear how a dhcp server is to
> use information. For example, does the server use options from
> this information before its own configuration or only if it has no
> configuration (I suspect the former, as this is more
> client/request specific).
> 
>   That should be made explicit in the draft.  I don't have
> opinions either way, but your point makes sense.
> 
> > And from RFC7037, there is
> >
> > 169        DNS-Server-IPv6-Address     [RFC6911]
> >
> > Does this mean someone could now place the DNS server option
> into your new Radius attribute instead of using this attribute to
> have the server map it to the DHCP option?
> 
>   If it's allowed by the registry, presumably, yes.  RFFC 6911
> says that those RADIUS attributes can appear multiple times.  So
> presumably it doesn't matter much if the DNS server information
> appears once in a RADIUS attribute, and separately in a DHCPv6-
> Options attribute.  They can all be added to the packets.
> 
>   i.e. if the administrator of the system configures something
> weird, the systems should just do what's asked.
> 
>   Anything past basic filtering is complex to define, and complex
> to implement.  And arguably doesn't have a lot of extra value.
> 
>   Alan DeKok.


_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.