Subject: Re: [dhcwg] Adoption Call for draft-fkhp-dhc-dhcpv6-pd-relay-requirements - Respond by Jan 14, 2020

From: "Ms. Li HUANG" <[email-masked]>
Date: Fri, 8 May 2020 23:05:54 +0800

22:59.hk S8  May 08 2020

"This is to allow client devices with duplicate DUIDs to
function on separate broadcast domains. "

when the rcf3315 replaced board machine owning local and dh pv6duid two of
mac.eth both, how the duid being counted on which eth.mac int please?

would such env, getting multiple nets v6 and mean timely recognizable from
a, multi dhcpv6 servers if in case ?

To oem over 2 times changed motherboard pc even unable shown up one if
mac.ehe info time, as 2 limited in the ipconfig space, how to be recognized
please?

So on circumstances ...

Sincerely
Li  HUANG

On Tue, Apr 28, 2020, 22:33 <[email-masked]> wrote:

> Hi Erik,
>
> I’m just going through the outstanding points on this draft and it seems
> your comment got overlooked. My apologies.
>
> There’s an change in the wording for G-5 (in response to a question from
> Bernie) that will be in the next update which might be relevant:
>
> If a device has multiple interfaces that implement
> a delegating relay function, the device SHOULD allow the same
> client identifier (DUID) to have active delegated prefix leases on
> more than one interface simultaneously, unless client DUID
> uniqueness is necessary for the functioning or security of the
> network.  This is to allow client devices with duplicate DUIDs to
> function on separate broadcast domains.
>
>
> To clear up your question, we could add the following new routing
> requirement:
>
> For devices with multiple interfaces implementing a delegating relay
> function:
> If a Relay-reply message is received containing an instance of
> OPTION_IAPREFIX with
> a prefix that already has an active lease /route on one interface, but
> with an
> interface identifier (e.g. the Link Address) that is for a different
> interface,
> then the relay should remove the existing lease / route and bind it to the
> new interface.
>
> Does that cover it for you?
>
> Thanks,
> Ian
>
> On 15. Jan 2020, at 02:03, Erik Kline <[email-masked]> wrote:
>
> I support adoption.
>
> I am confused about some things though.  Specifically related to 3.4 and
> 4.1 G-5.  Should the delegating relay support a client moving from one
> interface to another (presumably this just means honoring a request with
> previously allocated IA_PDs in it, updating the routes accordingly)?  I
> guess, what's the guidance for supporting a duplicate versus detecting a
> migration?
>
> [nits]
> S2.1: s/should be understand/should be understood/
>
> S2.1: s/specificcally/specifically/
>
> On Sun, Dec 29, 2019 at 8:03 AM Bernie Volz (volz) <[email-masked]> wrote:
>
>> Hello:
>>
>>
>>
>> As follow up from the IETF-106 DHC WG meeting, we are initiating the WG
>> call for adoption on
>> *https://datatracker.ietf.org/doc/draft-fkhp-dhc-dhcpv6-pd-relay-requirements/*
>> <https://datatracker.ietf..org/doc/draft-fkhp-dhc-dhcpv6-pd-relay-requirements/>
>> (DHCPv6 Prefix Delegating Relay). This document was presented at IETF-106 –
>> see
>> https://datatracker.ietf.org/meeting/106/materials/slides-106-dhc-dhcpv6-prefix-delegating-relay-00
>> .
>>
>>
>>
>> This starts the call for Adoption of this document. Please respond by
>> January 14, 2020.
>>
>>
>>
>> Thanks in advance for your consideration of whether the WG should or
>> should not adopt this document as a work item.
>>
>>
>>
>> And, Happy New Year!
>>
>>
>>
>>    - Tomek & Bernie
>>
>>
>> _______________________________________________
>> dhcwg mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/dhcwg
>>
>
> _______________________________________________
> dhcwg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dhcwg
>

---

From: Erik Kline <[email-masked]>
Date: Sun, 10 May 2020 12:14:05 -0700

Actually, I'm wondering now if there's no good answer to problem of a
{moving client | client spoofed} that doesn't involve some other
trusted information coming to the rescue.

That could be client authentication of some kind, but it could also be
"infrastructure operational guarantees".

I read the revised existing paragraph as saying that the Relay
maintains state such that {interface, MAC, DUID} is the "unique key"
that can be used to identify the state/state machine for a given
client.  This is required to address the problem identified in
-00,S3.4, IIUC.

I think the proposed text clarifies the security risk of trying to
support a client that moved interfaces on the BNG, say (for whatever
reason).  If the relay moved the existing traffic to a new interface
wouldn't that allow a spoofer to hijack an otherwise legitimate
client's prefix?

I think addressing my prior comment might just end up making
everything worse.  It's probably more secure to force a renumbering if
the client moves relay interfaces.  In short, it might be best to
ignore me.  =)

On Tue, Apr 28, 2020 at 7:33 AM <[email-masked]> wrote:
>
> Hi Erik,
>
> I’m just going through the outstanding points on this draft and it seems your comment got overlooked. My apologies.
>
> There’s an change in the wording for G-5 (in response to a question from Bernie) that will be in the next update which might be relevant:
>
> To clear up your question, we could add the following new routing requirement:
>
> For devices with multiple interfaces implementing a delegating relay function:
> If a Relay-reply message is received containing an instance of OPTION_IAPREFIX with
> a prefix that already has an active lease /route on one interface, but with an
> interface identifier (e.g. the Link Address) that is for a different interface,
> I am confused about some things though.  Specifically related to 3.4 and 4.1 G-5.  Should the delegating relay support a client moving from one interface to another (presumably this just means honoring a request with previously allocated IA_PDs in it, updating the routes accordingly)?  I guess, what's the guidance for supporting a duplicate versus detecting a migration?
>
> [nits]
>> As follow up from the IETF-106 DHC WG meeting, we are initiating the WG call for adoption on https://datatracker.ietf.org/doc/draft-fkhp-dhc-dhcpv6-pd-relay-requirements/ (DHCPv6 Prefix Delegating Relay). This document was presented at IETF-106 – see https://datatracker.ietf.org/meeting/106/materials/slides-106-dhc-dhcpv6-prefix-delegating-relay-00.
>>
>>
>>
>> This starts the call for Adoption of this document. Please respond by January 14, 2020.
>>
>>
>>
>> Thanks in advance for your consideration of whether the WG should or should not adopt this document as a work item.
>>
>>
>>
>> And, Happy New Year!
>>
>>
>>
>> Tomek & Bernie
>>
>>
>>

---

From: [email-masked]
Date: Mon, 11 May 2020 16:26:35 +0200

Hi,

Just to make sure I understand your question correctly, you are asking what happens when a client network interface card is swapped out, meaning that the MAC address changes, will the same prefix be delegated?

According to RFC8415 11.2, in this case the client DUID MUST remain unchanged, so it would be delegated the same prefix by the server assuming that there is still an active lease for the client with the old network interface, or the previously delegated lease is not leased to another client (in the case that the previous lease has expired).

Thanks,
Ian

> On 8. May 2020, at 17:05, Ms. Li HUANG <[email-masked]> wrote:
> 
> 22:59.hk <http://59.hk/> S8  May 08 2020
> 
> 
> 
> when the rcf3315 replaced board machine owning local and dh pv6duid two of mac.eth both, how the duid being counted on which eth.mac int please?
> 
> would such env, getting multiple nets v6 and mean timely recognizable from a, multi dhcpv6 servers if in case ?
> 
> To oem over 2 times changed motherboard pc even unable shown up one if mac.ehe info time, as 2 limited in the ipconfig space, how to be recognized please?
> 
> 
> So on circumstances ...
> 
> 
> 
> Sincerely
> Li  HUANG
> 
> 
> 
> On Tue, Apr 28, 2020, 22:33 <[email-masked] <mailto:[email-masked]>> wrote:
> Hi Erik,
> 
>> On 15. Jan 2020, at 02:03, Erik Kline <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> I support adoption.
>> 
>> On Sun, Dec 29, 2019 at 8:03 AM Bernie Volz (volz) <[email-masked] <mailto:[email-masked]>> wrote:
>> Hello:
>> 
>>  
>> 
>> As follow up from the IETF-106 DHC WG meeting, we are initiating the WG call for adoption on https://datatracker.ietf.org/doc/draft-fkhp-dhc-dhcpv6-pd-relay-requirements/ <https://datatracker.ietf..org/doc/draft-fkhp-dhc-dhcpv6-pd-relay-requirements/> (DHCPv6 Prefix Delegating Relay). This document was presented at IETF-106 – seehttps://datatracker.ietf.org/meeting/106/materials/slides-106-dhc-dhcpv6-prefix-delegating-relay-00 <https://datatracker.ietf.org/meeting/106/materials/slides-106-dhc-dhcpv6-prefix-delegating-relay-00>.
>> 
>>  
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/dhcwg <https://www.ietf.org/mailman/listinfo/dhcwg>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/dhcwg <https://www.ietf.org/mailman/listinfo/dhcwg>

---

From: "Ms. Li HUANG" <[email-masked]>
Date: Fri, 15 May 2020 16:20:22 +0800

Good Day Ian,

To keep the rcf3315, rcf8417 the DUID at its initial,  the the 2nd mac int
showing at local adapter one would be must create a prefix ull 128 ipv6
with the same prefix of duid one's as well set delay it like 2nd sub.mac -
parralled /sub.networking ?

Since the ipconfgure /all not shown the 3rd mac int space built in,  the
the same way as said above just put it to the 2nd relay.prefix according
mac use same the wan prefix of duid one's and list all of mac int at relay
prefix area would be fine?

How about for the pc having wifi mac x 2 to 3 interfaces processed as also
to the mobile 2x IMIE can be merged into the sg device configured somehow?

Appreciated your returning in advance...

Sincerely
Li HUANG

On Mon, May 11, 2020, 22:26 <[email-masked]> wrote:

> Hi,
>
> Just to make sure I understand your question correctly, you are asking
> what happens when a client network interface card is swapped out, meaning
> that the MAC address changes, will the same prefix be delegated?
>
> According to RFC8415 11.2, in this case the client DUID MUST remain
> unchanged, so it would be delegated the same prefix by the server assuming
> that there is still an active lease for the client with the old network
> interface, or the previously delegated lease is not leased to another
> client (in the case that the previous lease has expired).
>
> Thanks,
> Ian
>
>

---

From: "Ms. Li HUANG" <[email-masked]>
Date: Fri, 22 May 2020 18:28:18 +0800

18:22.hk S8 may 22 2020

to relay those not initial mac as  changed board and duid modified , wifi
adapters int, even mobile double mac  int,   the basic octet, hex, decimal
rule converted lladd correctly or ipconfig /all after isp Whatever scheme
doing as the not corresponding mac.bit part of ipv6 with tempv6, to  be put
under RALAY would be right?

Sincerely
Li HUANG

On Fri, May 15, 2020, 16:20 Ms. Li HUANG <[email-masked]> wrote:

>> when the rcf3315 replaced board machine owning local and dh pv6duid two
>> of mac.eth both, how the duid being counted on which eth.mac int please?
>>
>> would such env, getting multiple nets v6 and mean timely recognizable
>> from a, multi dhcpv6 servers if in case ?
>>