Subject: [dhcwg] Possible contradiction between dhc-agent-vpn-id and rfc 3046?

From: "Kostur, Andre" <[email-masked]>
Date: Thu, 17 Feb 2005 08:59:47 -0800

In the vpn-id draft there's the text:

   In some cases, a DHCP server may use the virtual-subnet-selection
   sub-option to inform a relay agent that a particular DHCP client is
   associated with a particular VPN.  It does this by sending the
   virtual-subnet-selection sub-option with the appropriate information
   to the relay agent in the relay-agent-information option.  If the
   relay agent is unable to honor the DHCP server's requirement to place
   the DHCP client into that VPN it MUST drop the packet and not send it
   to the DHCP client.

This seems to indicate that the DHCP server may insert a vpn-id into opt 82,
even if the relay didn't have one to begin with.  However, from RFC 3046:

   DHCP servers claiming to support the Relay Agent Information option
   SHALL echo the entire contents of the Relay Agent Information option
   in all replies.  Servers SHOULD copy the Relay Agent Information
   option as the last DHCP option in the response.  Servers SHALL NOT
   place the echoed Relay Agent Information option in the overloaded
   sname or file fields.  If a server is unable to copy a full Relay
   Agent Information field into a response, it SHALL send the response
   without the Relay Information Field, and SHOULD increment an error
   counter for the situation.

This reads to me that the server is to "blindly" echo the contents of option
82, and isn't to mess with the contents.
_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Ted Lemon <[email-masked]>
Date: Thu, 17 Feb 2005 15:08:00 -0700

On Feb 17, 2005, at 9:59 AM, Kostur, Andre wrote:
> This reads to me that the server is to "blindly" echo the contents of 
> option 82, and isn't to mess with the contents.

No, it doesn't say that.   I agree that your interpretation makes 
sense, and is probably what was intended, but RFC3046 doesn't 
explicitly say the server can't add anything to the relay agent 
options, so since it's not explicitly forbidden, I'd say it's 
implicitly permitted.

However, I think it might be good to write something up to clarify this 
point.   Given that the VPN ID draft has a use for server-originated 
relay agent sub-options, and given that in general it certainly makes 
sense for the server to be able to communicate with the relay agent, 
it's worth explicitly saying how it should be done, because there's 
definitely room for confusion.