Subject: My worries about the DHCP Relay Agent Information Option

From: Harald Tveit Alvestrand <[email-masked]>
Date: Fri, 12 Feb 1999 03:17:52 -0500 (EST)

I have reviewed the "DHCP Relay Agent Information Option", and must
admit that I do not like it.

My worries are not so much about the Relay Agent Information Option
itself (although specifying Yet Another Option Without Security is
kind of worrisome), but about the deployment model for Internet service
suggested and faciliated by this memo.

The distinguishing characteristics of this scenario are:

- The DHCP client and the DHCP server are controlled by different
  organizations, who do not necessarily trust each other fully.
  The client is at a "customer", the server is at an "ISP".
- More than one host at the customer site, interconnected by LAN
- Connectivity device ("modem") directly connected to the customer LAN
- Several customers on one Logical IP Subnet managed by the ISP.
- IP address assignment done at ISP central office.

The connection technologies suggested include (from 3.3):

- Dial-up
- ATM
- Cable (presumably CATV networks)
- Frame Relay (3.1)
- X.25

There are two worrisome aspects of this; one is a cost/reliability one,
and the other one is in security; the security is more important.

Cost/reliability first:

- When using dial-up, the customer MUST make a telephone call to boot
  his PC before accessing another device, such as a net-connected printer.
  If the remote server is busy, telephone service is out of order, or
  anything else is broken, his LAN will not work.

I already know people who hate their Windows boxes because they incur
a call setup charge from their autodial router when they boot - the
Windows box does some interesting DNS queries at boot.
The scheme suggested here would make that call required.
(Local call setup charges in Norway are around USD 0.07)

I would think that it's appropriate to add something like this:

  "Reliability concerns dictate that this scenario should ONLY be used
  when the CO connection is expected to be available 100% of the time.
  It is NOT appropriate for use with analog modem connections, and MAY
  be inapplicable to ISDN and switched ATM".

Now to the security issue.

- Since several customers share the same Logical IP Subnet, a naive
  implementation will let them SEE EACH OTHERS' BROADCAST PACKETS.

  This means that if any of them
  use (for instance) the filesystem export facilities in Windows 98 with
  permissions appropriate for in-house use, all other customers on the same
  LIS will get enough information to access those devices.

- Since several customers share the same logical subnet, it seems logical
  that they see each others' DHCP requests. It is then trivial to spoof
  a reply in such a way that "interesting" services can be redirected through
  another customer's site, leading to "interesting" cases of man-in-the-middle
  attacks.

- If the "obvious" filter rules for disallowing packets between customers
  are applied, one may easily get the silly state where you are able to
  contact any Internet site in the whole world, EXCEPT your neighbour's
  house.
  (Don't laugh - I know ISPs who have done exactly that in other contexts!)

I would prefer to see this document revised to have a rather draconian
security section, saying something like:

- This deployment scenario MUST have appropriate inter-customer firewalls.
  The firewalls erected MUST ensure that two customers sharing a LIS
  cannot see each others' broadcast packets by default, yet are able
  to communicate no worse than the connection to other parts of the
  Internet.

- Note that the scheme gives absolutely no protection against all the
  normal attacks that can be launched against a DHCP client.
  Since the area the DHCP request/response crosses is larger, and includes
  more than one trust environment, care must be taken to ensure that
  it's reasonably hard for a customer to launch denial-of-service or
  security attacks against other customers of the same service.

What do people think?

                  Harald A

-- 
Harald Tveit Alvestrand, Maxware, Norway
[email-masked]

---

From: Thomas Narten <[email-masked]>
Date: Wed, 31 Mar 1999 16:33:29 -0500 (EST)

This is a repost of an earlier message. This issue was also discussed
in Minneapolis. What's the WG's action plan? This document is currently
stuck within the IESG pending resolution.

Thomas

------- Forwarded Message

From: Harald Tveit Alvestrand <[email-masked]>
To: [email-masked]
Cc: [email-masked], [email-masked]
Date: Fri, 12 Feb 1999 08:48:24 +0100
Subject: My worries about the DHCP Relay Agent Information Option

- Dial-up
- ATM

Cost/reliability first:

What do people think?

                  Harald A

------- End of Forwarded Message