Subject: RE: [dhcwg] Clarification proposed for RFC 3046

From: "Bernie Volz (EUD)" <[email-masked]>
Date: Mon, 20 Jan 2003 02:27:07 -0600

How about some additional clean-up ... what is the "client remote ID". This is not
defined in RFC 3046. Shouldn't it be "Remote Agent ID"?

And, "a single remote ID" should be "a single remote agent ID"?

Perhaps Client Identifier Spoofing should be changed instead of removed? How about:

      As a client unique identifier (RFC 3046) may easily be spoofed, the use of
      the remote agent ID and client unique identifier by the server to identify
      a client make spoofing another client's client unique identifier meaningless
      unless the spoofed client is also at the same remote agent ID.

Otherwise, I agree with the changes discussed so far.

- Bernie

-----Original Message-----
From: Ralph Droms [mailto:[email-masked]]
Sent: Saturday, January 18, 2003 11:11 AM
To: [email-masked]'
Subject: Re: [dhcwg] Clarification proposed for RFC 3046

Following up on Ted's suggestion, how about the following, which puts the 
qualifier about the client unique identifier closer to the definition:

    Client Identification

       The DHCP server may be extended to maintain a database
       with the "triplet" of

             (client IP address,  client unique identifier,  client remote ID)

       The "client unique identifier" is defined in section 4.2 of RFC 2131.
       A DHCP server MUST use the rules specified in Section 4.2 of RFC
       2131 to determine the client unique identifier.

    DHCP Address Exhaustion

       The DHCP server SHOULD implement policies that restrict the number of
       IP addresses to be assigned to a single remote ID, independent of the
       client unique identifiers.

Also, I think the following text also needs to be reviewed:

    Client Identifier Spoofing

       By using the agent-supplied Agent Remote ID option, the untrusted
       and as-yet unstandardized client identifier field need not be used
       by the DHCP server.

    MAC Address Spoofing

       By associating a MAC address with an Agent Remote ID, the DHCP
       server can prevent offering an IP address to an attacker spoofing
       the same MAC address on a different remote ID.

The text about "Client Identifier Spoofing" can be deleted.  In the text 
about "MAD Address Spoofing", I suggest replacing "MAC Address" with 
"Client Unique Identifier" throughout.

- Ralph

At 06:27 PM 1/16/2003 -0600, Ted Lemon wrote:
>>    DHCP Address Exhaustion
>>
>>       In general, the DHCP server may be extended to maintain a database
>>       with the "triplet" of
>>
>>             (client IP address,  client MAC address,  client remote ID)
>>
>>       The DHCP server SHOULD implement policies that restrict the number
>>       of IP addresses to be assigned to a single remote ID.
>>
>>to the following:
>>
>>    DHCP Administrative Controls
>>
>>           A DHCP server needs to use some unique identifier to associate a
>>           client with its lease.  A DHCP server MUST use the same logic as
>>           specified in Section 4.2 of RFC 2131 with the addition that the
>>           remote ID MUST also be used in the unique identifier.
>>
>>         The DHCP server SHOULD implement policies that restrict the number
>>           of IP addresses to be assigned to a single remote ID.
>
>
>How about this:
>
>    DHCP Address Exhaustion
>
>       The DHCP server may be extended to maintain a database
>       with the "triplet" of
>
>             (client IP address,  client unique identifier,  client remote ID)
>
>       The DHCP server SHOULD implement policies that restrict the number
>       of IP addresses to be assigned to a single remote ID.   A DHCP server
>       MUST use the same logic as specified in Section 4.2 of RFC 2131 to
>       determine the client unique identifier.
>
>_______________________________________________
>dhcwg mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/dhcwg

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Ted Lemon <[email-masked]>
Date: Mon, 20 Jan 2003 19:13:49 -0800

>       unless the spoofed client is also at the same remote agent ID.

RFC3046 doesn't define a client unique identifier - I think you mean 
RFC2131.   Otherwise, looks fine.