Subject: [dhcwg] draft-ietf-dhc-agent-subnet-selection-00.txt

From: Thomas Narten <[email-masked]>
Date: Thu, 27 Sep 2001 11:46:15 -0400

Overall, this document is probably close enough to being ready for
IETF Last Call. It would be good to add an IANA considerations section
though, since IANA will be looking for such a section during the IETF
last call. Any chance of getting this document revved quickly (i.e, in
the next couple of days)? If so, I'd like to delay the last call until
then. If this can't be done quickly, I'll go ahead and start the last
call anyay. Let me know either way.

Thomas

Comments:

>    The subnet-selection sub-option MAY be used by any DHCP relay agent

MAY not really needed. Implementation of the document itself is
optional, by definition.

   Servers supporting this sub-option MUST return an identical copy of
   the sub-option in the relay-agent-info option to any relay-agent that
   sends it.  Relay agents using this sub-option MUST discard DHCPOFFER
   or DHCPACK packets that do not contain this option in their associ-
   ated relay-agent-info options.

This is redundent text from RFC 3046. Either drop (isn't RFC 3046
clear enough on this point?), or put in a reference to RFC 3046,
making it clear that the above requirement is a generic requirement of
all relay agent options, and not one specific to this sub-option.

> 4.  Security

Append "Considerations" to the heading. :-)

>    DHCP currently provides no authentication or security mechanisms.
>    Potential exposures to attack are discussed is section 7 of the pro-
>    tocol specification [RFC 2131].  The subnet selection option allows a
>    relay agent to specify the subnet on which to allocate an address for
>    a DHCP client. This would allow a malicious DHCP client to perform a
>    more complete address-pool exhaustion attack since the client would
>    no longer be restricted to attacking address-pools on just its local
>    subnet. Under the current DHCP security model there are no methods
>    available to circumvent this type of attack.

Security considerations could be a bit better. I.e., say something
about *this* sub-option. But the text talks about the "client" (as in
the generic subnet option RFC 3011 case?) rather than the relay
agent. This could be better clarified. Also, isn't the relay agent
more trusted in many configurations than a client? If so, the issues
would seem to be different.

Document needs an IANA considerations section to provide IANA
with a heads up that they have an assignment to make.  E.g.,.,:

   IANA has assigned a value of TBD from the DHCP Relay Agent
   Sub-options space [RFC 3046] for the subnet selection sub-option
   defined in Section 3.

Thomas

_______________________________________________
dhcwg mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/dhcwg