Subject: Re: [dhcwg] [Technical Errata Reported] RFC8415 (6269)

From: "Bernie Volz (volz)" <[email-masked]>
Date: Thu, 3 Sep 2020 15:11:28 +0000

FYI – I removed the RFC Errata System email address from this.

> Another option would be to require the client to honor the “Server Unicast” option from the transaction to which the Reconfigure applies.

I’m not sure this would be needed as I think the language in RFC8415 already encourages use of the Server Unicast if received, possible to use (i.e., client has address of sufficient scope it can use as source), applies to server (i.e. from Server Identifier matches – this isn’t actually clearly stated anywhere if I recall but of course makes sense), and message permits?

I think however that the problem is that for Reconfigure is that it could come from a completely different server than the “original transaction” was from.

I really wonder how large an issue this is and how frequently Server Unicast is even used. Perhaps in retrospect, a feature we might have considered removing.

  *   Bernie

From: Ted Lemon <[email-masked]>
Sent: Monday, August 31, 2020 1:21 PM
To: Bernie Volz (volz) <[email-masked]>
Cc: RFC Errata System <[email-masked]>; [email-masked]; [email-masked]; Andrew Yourtchenko (ayourtch) <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; [email-masked]; Eric Vyncke (evyncke) <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Technical Errata Reported] RFC8415 (6269)

On Aug 31, 2020, at 10:46 AM, Bernie Volz (volz) <[email-masked]<mailto:[email-masked]>> wrote:
While we could debate whether to allow Server Unicast option in a Reconfigure message itself, I think it best not to do this as it could be a security risk (though perhaps it is marginal if the attacker already knows the nonce). But that would be a change over the existing specification as best I can determine.

Another option would be to require the client to honor the “Server Unicast” option from the transaction to which the Reconfigure applies.

---

From: Ted Lemon <[email-masked]>
Date: Thu, 3 Sep 2020 11:19:02 -0400

> I really wonder how large an issue this is and how frequently Server Unicast is even used. Perhaps in retrospect, a feature we might have considered removing.

I’d be surprised if it’s used—it’s a knob you’d have to configure that doesn’t make things work better. IIRC we put it in because not everybody agreed that just requiring multicast always was a good move.

---

From: "Bernie Volz (volz)" <[email-masked]>
Date: Thu, 3 Sep 2020 15:24:13 +0000

That’s my guess as well.

Perhaps Tim W has some data as to whether it is used or not (and whether it is even tested).

If it isn’t used / implemented, may also be difficult to confirm interop.

Anyway, perhaps something to consider as part of the “full” Standard work to see if we need a post-8415.

  *   Bernie

From: Ted Lemon <[email-masked]>
Sent: Thursday, September 3, 2020 11:19 AM
To: Bernie Volz (volz) <[email-masked]>
Cc: [email-masked]; [email-masked]; Andrew Yourtchenko (ayourtch) <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Eric Vyncke (evyncke) <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Technical Errata Reported] RFC8415 (6269)

On Sep 3, 2020, at 11:11 AM, Bernie Volz (volz) <[email-masked]<mailto:[email-masked]>> wrote:
I really wonder how large an issue this is and how frequently Server Unicast is even used. Perhaps in retrospect, a feature we might have considered removing.

---

From: Timothy Winters <[email-masked]>
Date: Thu, 3 Sep 2020 11:38:42 -0400

Hi Bernie,

IPv6 Ready DHCPv6 Logo has never had a test for this, so I have no idea
what the support is for general DHCPv6 Clients/Servers.

At QACafe we see about 50% of the Home Gateways support it as we have a
test for verifying it.

~Tim

On Thu, Sep 3, 2020 at 11:24 AM Bernie Volz (volz) <[email-masked]> wrote:

>    - Bernie
> *From:* Ted Lemon <[email-masked]>
> *Sent:* Thursday, September 3, 2020 11:19 AM
> *To:* Bernie Volz (volz) <[email-masked]>
> *Cc:* [email-masked]; [email-masked]; Andrew
> Yourtchenko (ayourtch) <[email-masked]>; [email-masked];
> [email-masked]; [email-masked]; Eric Vyncke (evyncke) <
> [email-masked]>; [email-masked]; [email-masked];
> [email-masked]
> *Subject:* Re: [Technical Errata Reported] RFC8415 (6269)
>
>
>
> I really wonder how large an issue this is and how frequently Server
> Unicast is even used. Perhaps in retrospect, a feature we might have
> considered removing.
>
>
>
> I’d be surprised if it’s used—it’s a knob you’d have to configure that
> doesn’t make things work better. IIRC we put it in because not everybody
> agreed that just requiring multicast always was a good move.
>
>
>
>
>

---

From: "Bernie Volz (volz)" <[email-masked]>
Date: Thu, 3 Sep 2020 15:42:23 +0000

Ok, thanks .. useful information. And, the client/server seem to be able to interoperate so that is good.

  *   Bernie

From: Timothy Winters <[email-masked]>
Sent: Thursday, September 3, 2020 11:39 AM
To: Bernie Volz (volz) <[email-masked]>
Cc: Ted Lemon <[email-masked]>; [email-masked]; [email-masked]; Andrew Yourtchenko (ayourtch) <[email-masked]>; [email-masked]; [email-masked]; [email-masked]; Eric Vyncke (evyncke) <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: [Technical Errata Reported] RFC8415 (6269)

Hi Bernie,

IPv6 Ready DHCPv6 Logo has never had a test for this, so I have no idea what the support is for general DHCPv6 Clients/Servers.

At QACafe we see about 50% of the Home Gateways support it as we have a test for verifying it.

~Tim

On Thu, Sep 3, 2020 at 11:24 AM Bernie Volz (volz) <[email-masked]<mailto:[email-masked]>> wrote:
That’s my guess as well.

  *   Bernie

From: Ted Lemon <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, September 3, 2020 11:19 AM
To: Bernie Volz (volz) <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Andrew Yourtchenko (ayourtch) <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; Eric Vyncke (evyncke) <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Technical Errata Reported] RFC8415 (6269)

---

From: Michael Richardson <[email-masked]>
Date: Thu, 03 Sep 2020 15:42:58 -0400

> what the support is for general DHCPv6 Clients/Servers.

To be clear, you don't test clients or servers for this, but...

    > At QACafe we see about 50% of the Home Gateways support it as we have a

I guess the home gateway is using this as a DHCPv6 client on it's WAN side?
Or?   so there must be some server that supports it, or is it always your
compliance test server that answers?

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Michael Richardson <[email-masked]>
Date: Thu, 03 Sep 2020 15:40:53 -0400

> work to see if we need a post-8415.

Good point. So marking this errata as basically something to deprecate would
be a good record to keep.

---

From: Timothy Winters <[email-masked]>
Date: Thu, 3 Sep 2020 15:46:43 -0400

> To be clear, you don't test clients or servers for this, but...
Correct.

> compliance test server that answers?
DHCP Client on the WAN side using a test tool.  No Interoperability.

---

From: Michael Richardson <[email-masked]>
Date: Thu, 03 Sep 2020 17:00:50 -0400

>> To be clear, you don't test clients or servers for this, but...

okay.
Forgive me for being dense.

    > DHCP Client on the WAN side using a test tool.  No Interoperability.

You run your test client on the WAN side against servers, and you find that
none of the servers answer unicast when asked to.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Timothy Winters <[email-masked]>
Date: Fri, 4 Sep 2020 08:32:16 -0400

Hi Michael,

No, the test server that sends the option in the Advertise to the WAN
client's Solicit.

    step 4.  Verify client sends Solicit message
    step 5.  Respond to first Solicit message with Advertise containing
             Server Unicast Option (12)
    step 6.  Verify client sends valid Renew message
    step 7.  Verify Renew message in Step 6 is sent to the address in
             the Server Unicast Option (12).

We only see about half the gateways we test support this.

~Tim