Subject: RE: [dhcwg] Leasequery: should it be standardized?

From: "Woundy, Richard" <[email-masked]>
Date: Fri, 7 Mar 2003 17:18:35 -0700

Folks,

I don't know the outcome of this thread, after the flurry of comments in
support of the DHCP Lease Query functionality -- which included some useful
comments to improve the next draft version.

Today, as a fairly large cable service provider, I use DHCP Lease Query
between distinct vendors of DHCP servers and DOCSIS CMTS relay agents, where
it provides great value -- preventing IP address theft among subscribers. In
places where I cannot yet deploy this technology, some legitimate
subscribers have to use some ugly workarounds (e.g. continuously pinging the
first-hop router) in order to defend their legitimately-assigned DHCP
address lease. The Lease Query functionality exists in multiple vendor DHCP
server implementations and multiple vendor (CMTS) relay agent
implementations. Today, these vendors tend to use the documentation of the
Lease Query protocol from the Cisco website.

While I believe that Lease Query should be standardized within the DHC WG, I
am not sure I would refer to this functionality as "access control".
Performing source IP address verification is one small piece of router
access control. To see the full ugliness of access control from the DiffServ
perspective, see RFC 3289 -- this extent of functionality is way beyond the
charter of DHC.

I don't think we should extend Lease Query to be a generic DHCP server
lookup protocol. For example, if a non-relay agent needs to know the lease
database information from a DHCP server, it should query the DHCP Server MIB
<http://www.ietf.org/internet-drafts/draft-ietf-dhc-server-mib-08.txt> --
which incidentally I believe now is ready for WG last-call.

So perhaps some re-wording of the problem statement, and perhaps some
pruning of functionality that has crept into the draft, is in order.

I am sorry I did not respond to this thread sooner, but I have been
overwhelmed with other IETF discussion threads. DiffServ and DHCP Server MIB
come immediately to mind. ;^)

-- Rich

P.S. I remember the original intent of Lease Query -- since I first pitched
the Lease Query idea (aka "Third-Party DHCP") back in April 1998,
<http://www.ietf.org/proceedings/98mar/98mar-edited-51.htm#P6021_315505>. In
fact, I still have the original slide deck on my laptop. ;^)

-----Original Message-----
From: Kim Kinnear [mailto:[email-masked]]
Sent: Wednesday, February 26, 2003 12:37 PM
To: [email-masked]
Cc: Ralph Droms; Thomas Narten; Kim Kinnear
Subject: [dhcwg] Leasequery: should it be standardized?

Folks,

We have come to something of a impasse on the leasequery draft,
and I need *your* support if you believe we should continue to
pursue this draft.

===============================================================
Without considerable support from the DHC WG, we will halt work
on the leasequery draft and all attempts to bring this work to
standard status.
===============================================================

If you believe that there is any value in standardizing the
leasequery capability, please at least respond to this list ASAP
with your positive support.

If you have the time and expertise, please read the rest of this
email and see if you can offer cogent arguments as to why this is
work that the DHC working group should be pursuing.

If we don't standardize the leasequery capability, each vendor of
access concentrators and DHCP products that wish to use this
approach will then need to work together (possibly in some other
forum) to try to get their products to be compatible.  Of course,
it may well be that we are the only folks who see this as a
useful capability, and so that may not be an issue at all.

Thanks -- Kim

-----------------------  Summary -----------------------

In case you haven't been following the email between Thomas
Narten and myself, he has been questioning the problem statement
of the leasequery draft.  Ralph proposed a new problem statement,
but Thomas feels that this whole capability is questionable.

You are invited to respond to Thomas' arguments, which I have
distilled as follows:

  1.  Doing anything in the DHC WG like supporting "access
  control in router type devices" is out of scope for the working
  group, and doesn't fit its current charter.

  2.  Access control in router type devices is not well enough
  understood to be sure that:

	a) leasequery is the right solution.

	b) any DHC-based approach is the "right" approach to
	solve this problem.

  3.  Until we are sure of 2(a), then we should not proceed with
  this work (I believe that this statement is implicit in Thomas'
  comments.)

-----------------------  Background ---------------------------

Here is Ralph's proposed problem statement:

   Router-type devices which want to enforce some level of access
   control over which IP addresses are allowed on their links
   need to maintain information concerning IP<-MAC/client-id
   mappings.  One way in which these devices can obtain
   information about IP<-MAC/client-id bindings is through "DHCP
   gleaning", in which the device extracts useful information
   from DHCP messages exchanged between hosts and DHCP servers.

   However, these devices don't typically have stable storage
   sufficient to keep this information over reloads.  There may
   be additional information that is useful to the device that
   cannot be obtained through DHCP gleaning.  The leasequery
   request message described in this document allows a device to
   obtain information about IP<-MAC/client-id bindings from a
   DHCP server.  This information may include currently active
   bindings, bindings involving previously assigned addresses for
   which the lease on the address has expired and static bindings
   for devices that are otherwise configured and not using DHCP
   for address assignment.

Thomas' concerns center on the second paragraph above, and he says:

   Note, that above is pretty vague and doesn't say what
   information the access device needs.  It's hard to look at the
   problem statement and say "yes, I understand the boundaries of
   the problem" and then "and the solution seems like a good
   match for the problem".

   Popping up a level, how is it even appropriate for the DHC WG
   to be doing work on "access control in router type devices"?
   One can argue that work of this broad a scope is well
   out-of-scope for this WG (e.g., look at the recently approved
   charter).  I'm far from clear that work of this scope should
   be done in DHC or that the problem is well enough understood
   to conclude that DHC lease query is the right solution or that
   any DHC-based solution is the right one.  What about routers
   wanting to do access control that don't use DHC, for instance?

   And note, I'm not raising these issue just to be a PITA. These
   are questions that I expect that the IESG would ask if I
   brought the document forward.  Thus, I need to have reasonable
   responses to those questions.  Otherwise, I can predict the
   likely outcome.

My response to Thomas was:

   This approach to access control was developed by joint work
   with the folks building our access concentrators and several
   of us in the DHCP implementation group.  They found that the
   functionality delivered to actual users was of sufficient
   value to those users to be worth the cost of engineering this
   particular solution.  We supported them in moving the
   implementation forward.

   The solution was not based on the charter of the DHC working
   group either then or now -- it was based on a rather pragmatic
   approach to meeting the needs of users, which it has seemed to
   do.  In my view at least, it fits within spirit of the DHC WG
   activities, and was a logical extension of the those
   activities.

   It isn't a comprehensive approach to any sort of security (nor
   was it designed to be such) -- it is a supporting piece of
   technology to one limited form of access control.

Thanks for your interest in the leasequery capability.

Kim

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Richard Johnson <[email-masked]>
Date: Mon, 10 Mar 2003 20:21:24 -0800

... A little late, but ...

Definitely, we should proceed with it.  It's currently in use in a 
number of places.  I know our own cable modem code uses it.  We've also 
heard customers describe network designs where it would come in useful.

Just my $0.02.

/raj

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 11 Mar 2003 14:51:47 +0100 (CET)

> I agree ... we don't want to restart this process. There's a lot of good
> reasons why DHCP should be used - it is after all DHCP information. The
> existing framework is fine regardless of whether the devices and
> applications already knew dhcp.

Bernie,

As I understand Thomas' concerns part of the issue is that
the draft talks about leasequery being used when there isn't a DHCP lease.
Thus it's expanded to be able to ask questions about MAC/IP addresses
in general.

I think that distinction is quite important.
Arguing that DHCP be used to query information about DHCP leases
is one thing.
Arguing that DHCP is the right protocol to use to query about MAC/IP address
related information is a rather different thing.

   Erik

---

From: "Bernie Volz (EUD)" <[email-masked]>
Date: Tue, 11 Mar 2003 09:00:43 -0600

Erik:

I don't disagree with your and Thomas' concerns, and I probably didn't read earlier dialogues carefully enough. Ralph and I spoke about this issue at Connectathon and I now understand the specific concern.

I think DHCP should be used as it is today and the lease query may be used to extract that information. If the DHCP server has information regarding client reservations (or whatever you want to call fixed address assignments), there is no reason it can not report on those exactly as it would for any other lease. Whether the client uses DHCP to obtain its information or has static configuration is immaterial - the point is the that client *COULD* use DHCP and would get the information.

In this case, as DHCP provides the client no indication that this is a reservation, I don't think lease query should either. So, I would be all for removing that indication from lease query.

I also think that lease query should not recommend steps to add these reservations to the server if there is no intention of these clients ever using DHCP. But, I also feel that lease query should not prevent someone from doing this - it should simply be silent on the issue as this is a usage issue and not a standards issue. If a vendor wants to recommend doing this (and I can see reasons why they would), they could.

- Bernie

-----Original Message-----
From: Erik Nordmark [mailto:[email-masked]]
Sent: Tuesday, March 11, 2003 8:52 AM
To: Bernie Volz (EUD)
Cc: 'Mark Stapp'; Steve Gonczi; [email-masked]
Subject: RE: [dhcwg] Leasequery: should it be standardized?

Bernie,

   Erik

---

From: "Woundy, Richard" <[email-masked]>
Date: Wed, 12 Mar 2003 16:42:06 -0700

I *almost* agree with Bernie's email below.
 
I agree that the Lease Query spec should not force a DHCP server operator to
put reservations into the server, and not force the DHCP server to support
such reservations, solely for making Lease Query work with such
reservations.
 
Although I agree in flexibility in reservation handling, I think we also
need to ensure full multi-vendor interoperability for Lease Query clients
(e.g. relay agents) and servers. That's the point of IETF standardization,
right?
 
A relay agent might choose (for simplicity of implementation) to use DHCP
Lease Query as its sole external source of MAC/IP address information.
Alternatively, a relay agent might choose to use DHCP Lease Query for DHCP
lease information only, and use other mechanisms (e.g. local configuration,
local routing state, remote MIB) for other MAC/IP address information. A
specific, realistic example of another mechanism would be Reverse Path
Forwarding. An access concentrator may be able to verify the source IP
address of an upstream datagram by noting that the source IP address belongs
to a particular IP subnet which has a particular nexthop IP gateway in the
IP forwarding table, and the nexthop IP gateway maps to particular location
information that can be discovered by DHCP Lease Query and/or by local
configuration.
 
We may have an interoperability problem if a relay agent expects only DHCP
lease information in a Lease Query response, but gets other information
(e.g. reservation information) in a response. This will lead to problems if
the access concentrator expects to query other sources of information (e.g.
a MIB) upon the failure of a Lease Query message -- and if the other
source(s) would have responded with different IP/MAC address information
than the (reservation in the) Lease Query response.
 
-- Rich

-----Original Message-----
From: Bernie Volz (EUD) [mailto:[email-masked]]
Sent: Tuesday, March 11, 2003 10:01 AM
To: 'Erik Nordmark'
Cc: 'Mark Stapp'; Steve Gonczi; [email-masked]
Subject: RE: [dhcwg] Leasequery: should it be standardized?

Erik: 

I don't disagree with your and Thomas' concerns, and I probably didn't read
earlier dialogues carefully enough. Ralph and I spoke about this issue at
Connectathon and I now understand the specific concern.

I think DHCP should be used as it is today and the lease query may be used
to extract that information. If the DHCP server has information regarding
client reservations (or whatever you want to call fixed address
assignments), there is no reason it can not report on those exactly as it
would for any other lease. Whether the client uses DHCP to obtain its
information or has static configuration is immaterial - the point is the
that client *COULD* use DHCP and would get the information.

In this case, as DHCP provides the client no indication that this is a
reservation, I don't think lease query should either. So, I would be all for
removing that indication from lease query.

I also think that lease query should not recommend steps to add these
reservations to the server if there is no intention of these clients ever
using DHCP. But, I also feel that lease query should not prevent someone
from doing this - it should simply be silent on the issue as this is a usage
issue and not a standards issue. If a vendor wants to recommend doing this
(and I can see reasons why they would), they could.

- Bernie 

-----Original Message----- 
From: Erik Nordmark [ mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Tuesday, March 11, 2003 8:52 AM 
To: Bernie Volz (EUD) 
Cc: 'Mark Stapp'; Steve Gonczi; [email-masked] 
Subject: RE: [dhcwg] Leasequery: should it be standardized? 

Bernie, 

   Erik