Subject: I-D ACTION:draft-ietf-dhc-subnet-option-02.txt

From: [email-masked] (by way of Ralph Droms <[email-masked]>)
Date: Tue, 15 Jun 1999 08:20:47 -0400 (EDT)

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Dynamic Host Configuration Working Group
of the IETF.

	Title		: The Subnet Selection Option for DHCP
	Author(s)	: G. Waters
	Filename	: draft-ietf-dhc-subnet-option-02.txt
	Pages		: 5
	Date		: 14-Jun-99
	
This memo defines a new DHCP option for selecting the subnet on which
to allocate an address. This option would override a DHCP server's
normal methods of selecting which subnet on which to allocate an
address for a client.

A URL for this Internet-Draft is:

http://www.ietf.org/internet-drafts/draft-ietf-dhc-subnet-option-02.txt

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-dhc-subnet-option-02.txt".

A list of Internet-Drafts directories can be found in

http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-dhc-subnet-option-02.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
Content-Type: text/plain
Content-ID:	<[email-masked]>

ENCODING mime
FILE /internet-drafts/draft-ietf-dhc-subnet-option-02.txt

<ftp://ftp.ietf.org/internet-drafts/draft-ietf-dhc-subnet-option-02.txt>

---

From: [email-masked] (by way of Ralph Droms <[email-masked]>)
Date: Wed, 16 Jun 1999 23:40:18 -0400 (EDT)

message sent to [email-masked] by [email-masked] follows.
--------------------------------------------------------------
5. Security Considerations

   DHCP currently provides no authentication or security mechanisms.
   Potential exposures to attack are discussed is section 7 of the
   protocol specification [RFC2131].

does this not protocol not open up a new security risk, requesting on an
arbitrary subnet?

randy

---

From: Ted Lemon <[email-masked]>
Date: Thu, 17 Jun 1999 00:18:10 -0400 (EDT)

> does this not protocol not open up a new security risk, requesting on an

I'm not sure that the incremental risk is substantial.   I suppose it
makes it possible for an address-pool exhaustion DoS attack to be more
complete, but other than that, what benefit do I obtain by acquiring
an IP address on a subnet to which I'm not connected?   We already
have to deal with the address-pool exhaustion DoS attack, so I don't
see any reason to think of this as a significant new concern.

			       _MelloN_

---

From: "Glenn Waters" <[email-masked]>
Date: Thu, 17 Jun 1999 09:59:38 -0400 (EDT)

although it is probably useful to at least mention this issue in the
security section.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Ted
> Lemon
> Sent: Thursday, June 17, 1999 00:20
> To: Multiple recipients of list
> Subject: Re: I-D ACTION:draft-ietf-dhc-subnet-option-02.txt
>
>
>

---

From: Ted Lemon <[email-masked]>
Date: Thu, 17 Jun 1999 10:56:36 -0400 (EDT)

> although it is probably useful to at least mention this issue in the

Definitely.

			       _MelloN_