Subject: RE: [dhcwg] dhc WG last call on "Domain Suffix Option for DHCPv6"

From: "Bernie Volz \(volz\)" <[email-masked]>
Date: Thu, 15 Dec 2005 07:50:05 -0500

While I think you'd be far wiser to not mention DNS Updates at all, this
does weaken the draft because then the question comes up as to why is
the option needed?
 
So, you're in a catch-22 in that if you leave DNS updates in, it is
obvious that much about DNS updates is still missing and you need to say
"magic happens" or there is no DNS update security OR you have a lot
more work to do to figure out how to communicate more information so the
updates can happen.
 
- Bernie

________________________________

	From: CTO YAN Renxiang
[mailto:[email-masked]] 
	Sent: Thursday, December 15, 2005 3:19 AM
	To: Bernie Volz (volz); [email-masked];
[email-masked]
	Subject: RE: [dhcwg] dhc WG last call on "Domain Suffix Option
for DHCPv6"

	Hi, Bernie and Francis,

	I am still wondering about the issue of security. I want to say
some extra words to clarify.
	 
	Suppose a case where some home devices connecte to access
network through a home gateway, and home gateway includes an embedding
DHCP server, DNS server, and DHCP client (which used to get IPv6 prefix
and "domain suffix" from access gateway, i.e. BRAS). 
	 
	The DNS update security issues may exist in the following
procedures:
	 
	(1) DHCP server in home gateway perform DNS update to local DNS
server for home devices using FQDNv6 option. The security issues has
been mentioned in FQDNv6 option, as follows,
	   
	   Unauthenticated updates to the DNS can lead to tremendous
confusion,
	   through malicious attack or through inadvertent
misconfiguration.
	   Administrators should be wary of permitting unsecured DNS
updates to
	   zones which are exposed to the global Internet.  Both DHCPv6
clients
	   and servers SHOULD use some form of update request origin
	   authentication procedure (e.g., Secure DNS Dynamic Update
[10]) when
	   performing DNS updates.
	 
	(2) In order to "link" two DNS server, home gateway's DNS server
and Up-level DNS server, home gateway need to perform DNS update to
up-level DNS server by adding a NS record in it. There DOES exist
security issue here. This can be solved using different way. I prefer it
piggybacked by DHCP session between home gateway and access node,
beacuse DHCP session is secure, home gateway should be authenticated
before (or along with) initating DHCP session.
	 
	RGs,
	-Renxiang

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Ted Lemon <[email-masked]>
Date: Thu, 15 Dec 2005 11:41:17 -0700

> does weaken the draft because then the question comes up as to why is

So add this text:

The domain suffix option for DHCPv6 is used by the DHCPv6 server to tell the 
DHCPv6 client the domain suffix that the DHCPv6 server administrator has 
specified for that DHCPv6 client.

The reason I say this is that as I've mentioned in private email, I think that 
this option has more uses than just for DNS updates, and I don't see any 
reason therefore to specify that as the purpose for this option.   Whereas 
clearly in any use of this option, it's going to be for the client to learn 
from the server what the server thinks its domain is.   I can't think of any 
reason why the client would ever send this option to the server.