Subject: Re: [dhcwg] draft-ietf-dhc-dhcpv6-opt-netboot-07/8 and RFC 2817/8

From: Alfred Hönes <[email-masked]>
Date: Fri, 8 Jan 2010 15:32:22 +0100 (MEZ)

Vincent Zimmer wrote:

> Yes.   There are a plurality of security considerations possibly.
> Given the state of DHCP security and our attempt to have some
> behavior parity with IPV4 netboot, we were not intending exhaustive
> treatment of this subject area.
>
> You are correct Thomas that HTTP-S was added based upon the
> suggestion of a Lucent engineer during IETF74 dhc session in SF
> as a possibility.

The draft says (unchanged in -08):

     ... a protocol like HTTPS (see [RFC2817] and [RFC2818]) ...

My primary argument was that the term "HTTPS" (and the 'https' URI
scheme) are commonly only related to RFC 2818 (Informational),
whereas the protocol described in RFC 2817 (Proposed Std) is very
different -- it defines an in-band HTTP method "CONNECT" to establish
a secure TLS tunnel _inside_ an existing HTTP session, i.e. typically
(by default) using a server listening on TCP port 80.
Note that there's a third protocol dubbed "S-HTTP" described in the
Experimental RFC 2660.
To my knowledge, neither RFC 2817 nor RFC 2660 are in widespread use.

Unfortunately there's no 'official' popular abbreviation for the
protocol defined in RFC 2817 and users and admins have been educated
by the market that HTTP security comes with HTTPS and 'https' URIs.
Are you sure in quoting "HTTP-S" that the engineer meant RFC 2817 ?

The current text IMHO is misleading as it seems to indicate that
RFC 2817 and RFC 2818 _both_ relate to HTTPS (with default port 443).
Notwithstanding the (independent) question of the applicability and
utility of certificate-based protocol layers like TLS for securing
network traffic performed by low-level (boot ROM) firmware; that
potential misconception needs to be addressed in the draft text.

One possibility for clarification would be to replace the above
text snippet by:

       ... protocols like HTTPS (see [RFC2818]) or TLS within HTTP
   (see [RFC2817]) ...

Kind regards,
  Alfred Hönes.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+

---

From: "Zimmer, Vincent" <[email-masked]>
Date: Fri, 8 Jan 2010 07:48:31 -0800

Yes, I see your point now.   I agree on the clarification language you've proposed, too.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, January 08, 2010 6:32 AM
To: Zimmer, Vincent; [email-masked]
Cc: [email-masked]
Subject: Re: [dhcwg] draft-ietf-dhc-dhcpv6-opt-netboot-07/8 and RFC 2817/8

Kind regards,
  Alfred HÎnes.

--

---

From: Thomas Huth <[email-masked]>
Date: Mon, 11 Jan 2010 17:50:53 +0100

>      ... a protocol like HTTPS (see [RFC2817] and [RFC2818]) ...
[...]
>        ... protocols like HTTPS (see [RFC2818]) or TLS within HTTP

Ok, I can change that with the next update. But since this is just a small
update, I'd like to collect more feedback first.

Ted, could you please start another "last call" for our draft? I think the
draft is OK now (apart from that HTTPS sentence), so it would be great to
have another last call now.)

Mit freundlichen Grüßen / Kind regards,
   Thomas Huth
                                                                           
    IBM Deutschland                 Vorsitzender des Aufsichtsrats:        
    Research & Development GmbH     Martin Jetter                          
    Schönaicher Str. 220            Geschäftsführung: Dirk Wittkopp        
    71032 Böblingen                 Sitz der Gesellschaft: Böblingen       
    Tel.: +49-7031-16-2183          Registergericht: Amtsgericht           
                                    Stuttgart, HRB 243294

---

From: Ted Lemon <[email-masked]>
Date: Mon, 11 Jan 2010 09:53:28 -0800

The authors of the netboot draft believe it is ready for publication, with the exception of some small edits that have been proposed on the mailing list, and have asked for a last call.

Please read the draft if you haven't already and indicate whether you favor it or oppose it.   If you don't care, you may say so, but it's not required.

The last call will expire next Monday, Jan. 18.

---

From: Thomas Huth <[email-masked]>
Date: Tue, 12 Jan 2010 11:19:33 +0100

Ted Lemon <[email-masked]> wrote on 11/01/2010 18:53:28:
>
> The authors of the netboot draft believe it is ready for
> publication, with the exception of some small edits that have been
> proposed on the mailing list, and have asked for a last call.
>
> Please read the draft if you haven't already and indicate whether
> you favor it or oppose it.   If you don't care, you may say so, but
> it's not required.
>

Thanks Ted.

Just to avoid confusion, the latest version of our draft is 08 and not 07
as indicated by the title of this mail:

http://tools.ietf.org/html/draft-ietf-dhc-dhcpv6-opt-netboot-08

---

From: "Zimmer, Vincent" <[email-masked]>
Date: Tue, 19 Jan 2010 08:54:10 -0800

I support having this draft go forward.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Ted Lemon
Sent: Monday, January 11, 2010 9:53 AM
To: [email-masked] WG
Subject: [dhcwg] WGLC on draft-ietf-dhc-dhcpv6-opt-netboot-07

_______________________________________________
dhcwg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dhcwg

---

From: Ted Lemon <[email-masked]>
Date: Tue, 19 Jan 2010 10:46:27 -0700

> The authors of the netboot draft believe it is ready for publication, with the exception of some small edits that have been proposed on the mailing list, and have asked for a last call.

We got dead silence in response to this working group last call.   Does this mean that nobody wants a netboot option for DHCPv6, or is there something wrong with the draft?

---

From: Marty Connor <[email-masked]>
Date: Tue, 19 Jan 2010 16:08:29 -0500

On 1/19/10 12:46 PM, Ted Lemon wrote:
> We got dead silence in response to this working group last call.
> Does this mean that nobody wants a netboot option for DHCPv6, or is
> there something wrong with the draft?

Hi Ted,

I've taken a look at

and it seems fine.

Right now our gPXE network booting software (IPv4) allows URIs in
filenames and root-paths and permits SAN (iSCSI and AoE), tftp, http,
https, and ftp booting.

We are working on IPv6 support, and what's in the drafts seems like
logical extensions to current practice.

I'm sending a pointer to this draft to our developers lists for
comments, and will let you know what additional feedback I get.

Best Regards,

/ Marty /

Project Leader, Etherboot Project
http://etherboot.org/
http://rom-o-matic.net/

---

From: Thomas Narten <[email-masked]>
Date: Tue, 19 Jan 2010 17:35:36 -0500

>  there something wrong with the draft?

Please advance the draft.  It is needed. It is ready (I just reread it
again).

Also, over the last few months, I consulted with some of our internal
folk who implement this sort of stuff in firmware. They were fine with
the current approach.

Thomas

---

From: Bud Millwood <[email-masked]>
Date: Wed, 20 Jan 2010 09:41:54 +0100

On Monday 11 January 2010, Ted Lemon wrote:
> The authors of the netboot draft believe it is ready for publication, with
> the exception of some small edits that have been proposed on the mailing
> list, and have asked for a last call.
>
> Please read the draft if you haven't already and indicate whether you favor
> it or oppose it.   If you don't care, you may say so, but it's not
> required.

I just re-read it and I think it looks good, so I support advancing this.

- Bud

Bud Millwood
Weird Solutions, Inc.
http://www.weird-solutions.com
tel: +46 8 758 3700
fax: +46 8 758 3687