Subject: RE: [dhcwg] dhc WG last call on "Domain Suffix Option for DHCPv6"

From: "CTO YAN Renxiang" <[email-masked]>
Date: Thu, 15 Dec 2005 16:18:43 +0800

Hi, Bernie and Francis,
 
I am still wondering about the issue of security. I want to say some extra words to clarify.
 
Suppose a case where some home devices connecte to access network through a home gateway, and home gateway includes an embedding DHCP server, DNS server, and DHCP client (which used to get IPv6 prefix and "domain suffix" from access gateway, i.e. BRAS). 
 
The DNS update security issues may exist in the following procedures:
 
(1) DHCP server in home gateway perform DNS update to local DNS server for home devices using FQDNv6 option. The security issues has been mentioned in FQDNv6 option, as follows,
   
   Unauthenticated updates to the DNS can lead to tremendous confusion,
   through malicious attack or through inadvertent misconfiguration.
   Administrators should be wary of permitting unsecured DNS updates to
   zones which are exposed to the global Internet.  Both DHCPv6 clients
   and servers SHOULD use some form of update request origin
   authentication procedure (e.g., Secure DNS Dynamic Update [10]) when
   performing DNS updates.
 
(2) In order to "link" two DNS server, home gateway's DNS server and Up-level DNS server, home gateway need to perform DNS update to up-level DNS server by adding a NS record in it. There DOES exist security issue here. This can be solved using different way. I prefer it piggybacked by DHCP session between home gateway and access node, beacuse DHCP session is secure, home gateway should be authenticated before (or along with) initating DHCP session.
 
RGs,
-Renxiang
_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Francis Dupont <[email-masked]>
Date: Thu, 15 Dec 2005 10:39:48 +0100

In your previous mail you wrote:

   I am still wondering about the issue of security. I want to say some
   extra words to clarify.

   Suppose a case where some home devices connecte to access network
   through a home gateway, and home gateway includes an embedding DHCP
   server, DNS server, and DHCP client (which used to get IPv6 prefix and
   "domain suffix" from access gateway, i.e. BRAS).

=> you should split the update issue into direct tree and reverse
tree updates:
 - for the direct tree there is no need at all to use a "domain
   suffix" related to the ISP, so the home network can (should!) be
   made autonomous and obviously the DHPC client on the home gateway
   can only use the "domain prefix" for the name of its interface to
   the ISP... a very marginal issue.
 - for the reverse tree its base can be derived from the delegated
   prefix so I don't understand what is the "domain suffix" for
   in this context.
So I can't see any security issue.

   (1) DHCP server in home gateway perform DNS update to local DNS server

=> what is the local DNS server?

   for home devices using FQDNv6 option. The security issues has been
   mentioned in FQDNv6 option, as follows,

=> but the FQDNv6 option has nothing to do with dynamic DNS updates
so this text should be removed.

   (2) In order to "link" two DNS server, home gateway's DNS server and
   Up-level DNS server,

=> why do you want to link them? Delegation of prefixes and delegation
of direct domains have only in common the word "delegation"!

   home gateway need to perform DNS update to up-level
   DNS server by adding a NS record in it. There DOES exist security issue
   here. This can be solved using different way. I prefer it piggybacked by
   DHCP session between home gateway and access node, beacuse DHCP session
   is secure, home gateway should be authenticated before (or along with)
   initating DHCP session.
   
=> two (other) comments:
 - you can't create a zone with a dynamic DNS update
 - DHCP is not the right tool to perform any authentication in this
   context, the authentication is done by the NAS and DHCP relies on this
   using a mix of:
    draft-ietf-dhc-v6-relay-radius-01.txt
    draft-salowey-radext-delegated-prefix-01.txt
    draft-droms-dhc-dhcpv6-agentopt-delegate-00.txt

Regards

[email-masked]

---

From: Ted Lemon <[email-masked]>
Date: Thu, 15 Dec 2005 11:35:52 -0700

On Thursday 15 December 2005 01:18, CTO YAN Renxiang wrote:
> Up-level DNS server, home gateway need to perform DNS update to up-level
> DHCP session between home gateway and access node, beacuse DHCP session is
> secure, home gateway should be authenticated before (or along with)
> initating DHCP session.

So are you suggesting that the DHCP server at the internet service provider 
should do the update for the NS record, or that the DHCP server in the home 
gateway should do the update for the NS record?