Subject: [dhcwg] dhcpv6-24: Reconfigure

From: Thomas Narten <[email-masked]>
Date: Wed, 15 May 2002 13:05:57 -0400

One IESG member has asked:

> 19. DHCP Server-Initiated Configuration Exchange

> reconfigure messages provide such a wonderful opportunity for
> attack.  and they are sent unicast "using an IPv6 unicast address
> of sufficient scope belonging to the DHCP client."

> possibly, the server could have intially provided a nonce that the
> client retains for validation.  but this precludes redundant server
> setups etc.

My response:

An interesting suggestion. Actually, it may not preclude this.  The
idea behind the Reconfigure is that the server that has state about
clients sends unicast Reconfigures to that client. It is not intended
to be used to allow any old DHC server to prod a client. So requiring
that the server also include a nonce may be OK. 
 
Question to the WG: should this be added? It would add some additional
defense against improper Reconfigure.

Thoughts?
 
Thomas

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: "Bernie Volz (EUD)" <[email-masked]>
Date: Wed, 15 May 2002 12:17:47 -0500

This certainly is an interesting idea. (Redundant server setups would likely need to exchange other information so they could also exchange the nonce).

But, what about simply suggesting that DHCP authentication be used? Or is that considered too weak?

Anyway to make sure I understand this, you would recommend a "Reconfiguration Nonce" option that the server would send the client in a Reply (such as to a Request or Rebind). The client would save this option and only accept a Reconfigure if the server sent that same "Reconfiguration Nonce" option in the Reconfigure message?

Note: Perhaps any Reply from a server could contain this as it may want to change its nonce?

x.x Reconfiguration Nonce Option

   A server sends the Reconfiguration Nonce option to a client in a Reply
   to a Request and Rebind. The client is responsible for saving the
   reconfiguration-nonce in order to validation reconfiguration requests
   from the server. The server also sends the Reconfiguration Nonce option
   in a Reconfigure message and the client only accepts the Reconfigure
   message if the nonce matches the one received in a Reply.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |      OPTION_INTERFACE_ID      |         option-len            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   .                                                               .
   .                     reconfiguration-nonce                     .
   .                                                               .
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      option-code          OPTION_INTERFACE_ID (18)

      option-len           Length of reconfiguration-nonce field

      reconfiguration-nonce An opaque value of arbitrary length generated
                           by the server

- Bernie

-----Original Message-----
From: Thomas Narten [mailto:[email-masked]]
Sent: Wednesday, May 15, 2002 1:06 PM
To: [email-masked]
Subject: [dhcwg] dhcpv6-24: Reconfigure

My response:

Thoughts?
 
Thomas

---

From: "Bound, Jim" <[email-masked]>
Date: Wed, 15 May 2002 15:30:00 -0400

I am fine with this if my coauthors are and the wg.
/jim