Subject: [dhcwg] IETF 77 minutes published.

From: Ted Lemon <[email-masked]>
Date: Thu, 6 May 2010 16:43:43 -0400

If you gave a presentation in the dhc meeting at IETF 77, please review the minutes for your action items.   If you were at the meeting and participated, please review the notes for accuracy.   If you were not at the meeting and are interested in what happened, please read the notes to find out.

I'm sorry the minutes took so long.   As you're probably aware, a five-ton elephant named IPv6 deployment is sitting on John's head right now, and I had a ton of travel to do right after IETF, so things didn't go quite as planned, but I'm slowly working my head out from underwater, and who knows, John's elephant may eventually get up and wander off.

http://www.ietf.org/proceedings/10mar/minutes/dhc.txt

---

From: Xu Xiaohu <[email-masked]>
Date: Fri, 07 May 2010 17:05:54 +0800

Hi all,

According the WG co-chair suggestion, here I will reiterate the motivation
of draft-xu-ipv6-ra-dhcp-server-option-00 and solicit more comments in the
mailing-list.
  
IMHO, using unicast for stateless DHCP message exchange can bring us at
least two benefits as follows: 

1) It can eliminate the latencies imposed by relay agents and prevent the
clients from receiving and processing redundant responses from multiple DHCP
servers. 

    As stated in Section 1.1 of RFC3315,
   "Once the client has determined the address of a server, it may under
   some circumstances send messages directly to the server using
   unicast."

   In addition, as stated in Section 18.1 of RFC 3315,
      "Use of unicast may avoid delays due to the relaying of messages by
      relay agents, as well as avoid overhead and duplicate responses by
      servers due to the delivery of client messages to multiple
      servers.  Requiring the client to relay all DHCP messages through
      a relay agent enables the inclusion of relay agent options in all
      messages sent by the client.  The server should enable the use of
      unicast only when relay agent options will not be used."

>From the above two quotes from RFC3315, we can conclude that the use of
unicast is appreciated in some appropriate scenarios.

2) The security threat of using rogue DHCP server/relay agent can be
mitigated to some extent by using unicast, especially in the wireless
environment. Of course, this benefit is largely based on the presumption
that the rogue IPv6 Router Advertisement problem [I-
D.draft-ietf-v6ops-rogue-ra-00] has been solved successfully.

   As said in Section 21 of RFC 3315,
   "Some network administrators may wish to provide authentication of the
   source and contents of DHCP messages.  For example, clients may be
   subject to denial of service attacks through the use of bogus DHCP
   servers, or may simply be misconfigured due to unintentionally
   instantiated DHCP servers."

By using the unicast mode, at least the off-path attacks can be eliminated.
If somebody wants to prevent the on-path attack further, the DHCP server
could use CGA and attach a signature on the messages it sends out. If this
on-path attack prevention feature is desirable, it can be included in the
next revision.

By the way, thanks a lot to those people who have given us many valuable
comments during the IETF77 meeting, we will consider them seriously in the
next revision.

Best wishes,
Xiaohu

> -----邮件原件-----
> 发件人: [email-masked] [mailto:[email-masked]] 代表 Ted
> Lemon
> 发送时间: 2010年5月7日 4:44
> 收件人: DHC Working Group
> 主题: [dhcwg] IETF 77 minutes published.
> 
> If you gave a presentation in the dhc meeting at IETF 77, please review
the
> minutes for your action items.   If you were at the meeting and
participated,
> please review the notes for accuracy.   If you were not at the meeting and
are
> interested in what happened, please read the notes to find out.
> 
> I'm sorry the minutes took so long.   As you're probably aware, a five-ton
> elephant named IPv6 deployment is sitting on John's head right now, and I
had
> a ton of travel to do right after IETF, so things didn't go quite as
planned,
> but I'm slowly working my head out from underwater, and who knows, John's
> elephant may eventually get up and wander off.
> 
> _______________________________________________
> dhcwg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dhcwg