Subject: Re: [dhcwg] New Version Notification - draft-ietf-pcp-dhcp-10.txt

From: Ted Lemon <[email-masked]>
Date: Tue, 1 Apr 2014 10:22:43 -0400

On Apr 1, 2014, at 3:47 AM, <[email-masked]> <[email-masked]> wrote:
> * the recommendations from the dhc wg to change the format of the dhcov4 option and to use distinct names for each option. Bernie reviewed the updated text before publication. 
> * the genarea review.
> * the suggestion from IANA to include some missing information in the IANA section.

You seem to have missed the gen-art review request to add a reference for IPv6-encoded IPv4 addresses.

Unfortunately there is one other problem which was present in the previous draft but which I did not notice until I was reviewing your changes just now: you specify new behavior for the DHCP server.   The relevant paragraph is this one from section 5:

   The DHCP server MAY be configurable with one or multiple Fully
   Qualified Domain Names (FQDNs) of the PCP server(s).  In such case,
   the DHCP server MUST resolve these FQDNs into one or a list of IP
   addresses.  If multiple FQDNs are configured to the DHCP server, the
   DHCP server MUST include multiple lists of PCP server IP addresses in
   the PCP server option (encoded as multiple OPTION_V6_PCP_SERVER or in
   the same OPTION_V4_PCP_SERVER); each of them carries one or a list of
   IP addresses that resulted from the FQDN resolution.  DHCPv4 servers
   supporting PCP server option MUST resolve any configured FQDNs into
   IPv4 addresses while DHCPv6 servers may resolve any configured FQDNs
   into IPv6 and/or IPv4 addresses.  If an IPv4 address is retrieved by
   the DHCPv6 server, the corresponding IPv4-mapped IPv6 address is
   included in OPTION_V6_PCP_SERVER.  If both IPv4 and IPv6 addresses
   are retrieved by the DHCPv6 server, these addresses are included in
   the same OPTION_V6_PCP_SERVER (IPv4 addresses are represented as
   IPv4-mapped IPv6 addresses).

The problem is that you have specified that the way the DHCP server differentiates between two PCP servers is through the FQDN, but the DHCP protocol specifications do not specify how DHCP servers are configured; by doing so here you are making a very significant change.

An additional problem is that current DHCPv6 servers can be expected to query only AAAA records when resolving FQDNs.   This isn't going to work for you, but the specification needs to be done carefully to avoid creating trouble in the future.

What you should say is probably something like this:

    Precisely how DHCP servers are configured to separate lists of
    IP addresses according to which PCP server they address is out
    of scope for this document.   However, DHCP servers MUST NOT
    treat IP addresses returned from a single FQDN lookup as belonging
    to more than one PCP server.

    DHCPv6 servers that implement this option and that can populate
    the option by resolving FQDNs will need a mechanism for indicating
    whether to query for A records or only AAAA records.   When a query
    returns A records, the IP addresses in those records are returned
    in the DHCP response as IPv4-mapped IPv6 addresses.

    Since this option requires support for IPv4-mapped IPv6 addresses,
    a DHCP server implementation will not be complete if it does not
    query for A records and represent any that are returned as
    IPv4-mapped IPv6 addresses in DHCP responses.   This behavior is
    neither required nor suggested for DHCPv6 options in general: it is
    specific to OPTION_V6_PCP_SERVER.  The mechanism whereby
    DHCPv6 implementations provide this functionality is beyond the scope
    of this document.

This still adds two requirements that weren't present in the base spec, but I think it's necessary to accomplish what you want.   The non-splitting requirement should already be the way DHCP servers operate.   The v4-mapped requirement is new functionality, but you can't specify in detail how it works without needlessly constraining implementations.   By stating what is required rather than specifically how to do it, I think you can sidestep that problem.

I'm sorry for adding yet another complication—the reason this is hard is because you are using a feature of the DHCP server that nobody has ever used before, and adding a new feature as well.   Arguably these are DHCP protocol extensions, and should have been done in DHC working group and then presented to you as a tool upon which you could base your option definition specification.  But at this point it's too late to go that route, so I am not going to suggest that we do so.   Hopefully the text you've added here can be folded into 3315bis, so that future specifications that want to do the same thing have better tools at their disposal for accomplishing it.

Of course, I am curious whether the DHC working group agrees with my proposal.   Comments?

---

From: <[email-masked]>
Date: Tue, 1 Apr 2014 16:41:20 +0200

HI Ted,

Please see inline.

Cheers,
Med

>-----Message d'origine-----
>De : Ted Lemon [mailto:[email-masked]]
>Envoyé : mardi 1 avril 2014 16:23
>À : BOUCADAIR Mohamed IMT/OLN
>Cc : [email-masked]; [email-masked]; DHC WG
>Objet : Re: New Version Notification - draft-ietf-pcp-dhcp-10.txt
>
>> * the recommendations from the dhc wg to change the format of the dhcov4
>option and to use distinct names for each option. Bernie reviewed the
>updated text before publication.
>> * the genarea review.

[Med] I didn't missed this one. A reference to mapped IPv4 addresses is already cited in Section 3.1 " IPv4-mapped IPv6 addresses (Section 2.5.5.2 of [RFC4291])". No need to cite it again in Section 3.2.

>
>Unfortunately there is one other problem which was present in the previous
>draft but which I did not notice until I was reviewing your changes just
>now: you specify new behavior for the DHCP server.   The relevant paragraph
>is this one from section 5:

[Med] This text was added when we abandoned to return a name to the client. One of the argument received at that time is that servers can resolve the name and return the results to the clients. The text is specific about the behavior of the name resolution because there are cases where client is only IPv6 while the PCP server is IPv4 (see the example of DS-lite cited in the draft).

>The problem is that you have specified that the way the DHCP server
>differentiates between two PCP servers is through the FQDN, but the DHCP
>protocol specifications do not specify how DHCP servers are configured; by
>doing so here you are making a very significant change.

[Med] Yes, that text was added because there is no dhc document that specifies how name resolutions is done and whether AAAA and/or A queries are to be achieved, etc. As I said above, this is a side effect of returning an address to the client instead of a name.

>
>An additional problem is that current DHCPv6 servers can be expected to
>query only AAAA records when resolving FQDNs.   This isn't going to work
>for you, but the specification needs to be done carefully to avoid creating
>trouble in the future.
>

[Med] This text seems OK to me. I have only one minor comment is that this is not specific to OPTION_V6_PCP_SERVER but can apply each time we need to provide a list of IP addresses to a dual-stack host connected via an IPv6-only connectivity using an encapsulation mode. I' suggest to remove the sentence starting with " This behavior is ...".

>
>This still adds two requirements that weren't present in the base spec, but
>I think it's necessary to accomplish what you want.   The non-splitting
>requirement should already be the way DHCP servers operate.   The v4-mapped
>requirement is new functionality, but you can't specify in detail how it
>works without needlessly constraining implementations.   By stating what is
>required rather than specifically how to do it, I think you can sidestep
>that problem.
>
>I'm sorry for adding yet another complication-the reason this is hard is
>because you are using a feature of the DHCP server that nobody has ever
>used before, and adding a new feature as well.   Arguably these are DHCP
>protocol extensions, and should have been done in DHC working group and
>then presented to you as a tool upon which you could base your option
>definition specification.  But at this point it's too late to go that
>route, so I am not going to suggest that we do so. Hopefully the text
>you've added here can be folded into 3315bis, so that future specifications
>that want to do the same thing have better tools at their disposal for
>accomplishing it.

 [Med] This works for me.

---

From: Ted Lemon <[email-masked]>
Date: Tue, 1 Apr 2014 10:45:26 -0400

> [Med] This text seems OK to me. I have only one minor comment is that this is not specific to OPTION_V6_PCP_SERVER but can apply each time we need to provide a list of IP addresses to a dual-stack…

What I am specifically trying to avoid is DHCPv6 servers simply doing A queries for all FQDN resolutions and returning IPv4-mapped IPv6 addresses in all cases.   This would be disastrous.   If some future option requires this functionality, it should refer either to this specification, or to 3315bis, assuming that 3315bis documents this capability.   But it absolutely cannot be enabled by default on all DHCPv6 options.

---

From: <[email-masked]>
Date: Tue, 1 Apr 2014 16:49:32 +0200

That's make sense too. 

Thanks.

Cheers,
Med

>Envoyé : mardi 1 avril 2014 16:45
>> [Med] This text seems OK to me. I have only one minor comment is that
>this is not specific to OPTION_V6_PCP_SERVER but can apply each time we
>need to provide a list of IP addresses to a dual-stack host connected via
>an IPv6-only connectivity using an encapsulation mode. I' suggest to remove
>the sentence starting with " This behavior is ...".
>
>What I am specifically trying to avoid is DHCPv6 servers simply doing A
>queries for all FQDN resolutions and returning IPv4-mapped IPv6 addresses
>in all cases.   This would be disastrous.   If some future option requires
>this functionality, it should refer either to this specification, or to
>3315bis, assuming that 3315bis documents this capability.   But it
>absolutely cannot be enabled by default on all DHCPv6 options.