Subject: RE: [dhcwg] Clarification proposed for RFC 3046

From: "Kostur, Andre" <[email-masked]>
Date: Mon, 10 Mar 2003 12:08:31 -0800

OK, to resurrect this discussion, I've consolodated all of the suggestions
supplied by Ralph, Ted, Bernie, and myself.  Here's the amended proposal:

RFC 3046, as currently written, seems to downplay the use of a Client
Identifier 
in distinguishing between DHCP clients.  For example, in section 4.0, RFC
3046 
states: 

   "Client Identifier Spoofing 

      By using the agent-supplied Agent Remote ID option, the untrusted 
      and as-yet unstandardized client identifier field need not be used 
      by the DHCP server." 

This is a much different statement than what RFC 2131 has to say about 
using Client Identifiers in distinguishing between DHCP clients: 

   "If the client 
   supplies a 'client identifier', the client MUST use the same 'client 
   identifier' in all subsequent messages, and the server MUST use that 
   identifier to identify the client." 

Note that 2131 says "MUST" and 3046 says "need not be used".  These two 
seem to be contrary to each other.  So I propose the following changes 
to RFC 3046. 

In section 4.0: 

Change the text: 

   DHCP Address Exhaustion 

      In general, the DHCP server may be extended to maintain a database 
      with the "triplet" of 

            (client IP address,  client MAC address,  client remote ID) 

      The DHCP server SHOULD implement policies that restrict the number 
      of IP addresses to be assigned to a single remote ID. 

to the following: 

    Client Identification

       The DHCP server may be extended to maintain a database
       with the "triplet" of

             (client IP address,  client unique identifier,  client remote
ID)

       The "client unique identifier" is defined in section 4.2 of RFC 2131.
       A DHCP server MUST use the rules specified in Section 4.2 of RFC
       2131 to determine the client unique identifier.

    DHCP Address Exhaustion

       The DHCP server SHOULD implement policies that restrict the number of
       IP addresses to be assigned to a single Remote Agent ID, independent
of
       the client unique identifiers.

Also in section 4.0: 

Change the text: 

   Client Identifier Spoofing 

      By using the agent-supplied Agent Remote ID option, the untrusted 
      and as-yet unstandardized client identifier field need not be used 
      by the DHCP server. 

   MAC Address Spoofing 

      By associating a MAC address with an Agent Remote ID, the DHCP 
      server can prevent offering an IP address to an attacker spoofing 
      the same MAC address on a different remote ID. 

to the following: 

   Client Unique Identifier Spoofing 

      As a client unique identifier (RFC 2131) may easily be spoofed, the
use of 
      the Remote Agent ID and client unique identifier by the server to
identify 
      a client make spoofing another client's client unique identifier
meaningless 
      unless the spoofed client is also at the same remote agent ID. 

And since we're talking about 3046, there's a typo in section 1.2 (DHCP is 
shown as DCHP in the second line).  The current text: 

   DHCP broadcast replies can be routed to only the proper circuit, 
   avoiding, say, the replication of the DCHP reply broadcast onto 
   thousands of access circuits; 

should be changed to: 

   DHCP broadcast replies can be routed to only the proper circuit, 
   avoiding, say, the replication of the DHCP reply broadcast onto 
   thousands of access circuits;