Subject: [dhcwg] Clarification proposed for RFC 3046

From: "Kostur, Andre" <[email-masked]>
Date: Thu, 16 Jan 2003 16:04:55 -0800

RFC 3046, as currently written, seems to downplay the use of a Client
Identifier
in distinguishing between DHCP clients.  For example, in section 4.0, RFC
3046
states:

   "Client Identifier Spoofing

      By using the agent-supplied Agent Remote ID option, the untrusted
      and as-yet unstandardized client identifier field need not be used
      by the DHCP server."

This is a much different statement than what RFC 2131 has to say about
using Client Identifiers in distinguishing between DHCP clients:

   "If the client
   supplies a 'client identifier', the client MUST use the same 'client
   identifier' in all subsequent messages, and the server MUST use that
   identifier to identify the client."

Note that 2131 says "MUST" and 3046 says "need not be used".  These two
seem to be contrary to each other.  So I propose the following changes
to RFC 3046.

In section 4.0:

Change the text:

   DHCP Address Exhaustion

      In general, the DHCP server may be extended to maintain a database
      with the "triplet" of

            (client IP address,  client MAC address,  client remote ID)

      The DHCP server SHOULD implement policies that restrict the number
      of IP addresses to be assigned to a single remote ID.

to the following:

   DHCP Administrative Controls

	  A DHCP server needs to use some unique identifier to associate a
	  client with its lease.  A DHCP server MUST use the same logic as
	  specified in Section 4.2 of RFC 2131 with the addition that the
	  remote ID MUST also be used in the unique identifier.  

        The DHCP server SHOULD implement policies that restrict the number
	  of IP addresses to be assigned to a single remote ID.

Also in section 4.0:

Change the text:

   Client Identifier Spoofing

      By using the agent-supplied Agent Remote ID option, the untrusted
      and as-yet unstandardized client identifier field need not be used
      by the DHCP server.

   MAC Address Spoofing

      By associating a MAC address with an Agent Remote ID, the DHCP
      server can prevent offering an IP address to an attacker spoofing
      the same MAC address on a different remote ID.

to the following:

   Client Identifier Spoofing

      By associating a Client Identifier with an Agent Remote ID, the DHCP
      server can prevent offering an IP address to an attacker spoofing
	the same Client Identifier on a different Agent Remote ID.

   MAC Address Spoofing

      Similar to Client Identifier Spoofing, by associating a MAC address
      with an Agent Remote ID, the DHCP server can prevent offering an IP
      address to an attacker spoofing the same MAC address on a different
      Agent Remote ID.

And since we're talking about 3046, there's a typo in section 1.2 (DHCP is
shown as DCHP in the second line).  The current text:

   DHCP broadcast replies can be routed to only the proper circuit,
   avoiding, say, the replication of the DCHP reply broadcast onto
   thousands of access circuits;

should be changed to:

   DHCP broadcast replies can be routed to only the proper circuit,
   avoiding, say, the replication of the DHCP reply broadcast onto
   thousands of access circuits;

---

From: Ted Lemon <[email-masked]>
Date: Thu, 16 Jan 2003 18:27:33 -0600

>           of IP addresses to be assigned to a single remote ID.

How about this:

   DHCP Address Exhaustion

      The DHCP server may be extended to maintain a database
      with the "triplet" of

            (client IP address,  client unique identifier,  client 
remote ID)

      The DHCP server SHOULD implement policies that restrict the number
      of IP addresses to be assigned to a single remote ID.   A DHCP 
server
       MUST use the same logic as specified in Section 4.2 of RFC 2131 to
       determine the client unique identifier.

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Ralph Droms <[email-masked]>
Date: Sat, 18 Jan 2003 11:11:27 -0500

Following up on Ted's suggestion, how about the following, which puts the 
qualifier about the client unique identifier closer to the definition:

    Client Identification

             (client IP address,  client unique identifier,  client remote ID)

       The "client unique identifier" is defined in section 4.2 of RFC 2131.
       A DHCP server MUST use the rules specified in Section 4.2 of RFC
       2131 to determine the client unique identifier.

    DHCP Address Exhaustion

       The DHCP server SHOULD implement policies that restrict the number of
       IP addresses to be assigned to a single remote ID, independent of the
       client unique identifiers.

Also, I think the following text also needs to be reviewed:

    MAC Address Spoofing

The text about "Client Identifier Spoofing" can be deleted.  In the text 
about "MAD Address Spoofing", I suggest replacing "MAC Address" with 
"Client Unique Identifier" throughout.

- Ralph

At 06:27 PM 1/16/2003 -0600, Ted Lemon wrote:
>             (client IP address,  client unique identifier,  client remote ID)
>
>       of IP addresses to be assigned to a single remote ID.   A DHCP server

---

From: Ted Lemon <[email-masked]>
Date: Mon, 20 Jan 2003 19:12:43 -0800

> Following up on Ted's suggestion, how about the following, which puts 
> the qualifier about the client unique identifier closer to the 
> definition:

I'm not sure how your text differs from what I suggested, but it looks 
fine to me, and as you can probably gather I wasn't very attached to 
what I wrote, so I don't feel the need to know what you changed.   :')

> The text about "Client Identifier Spoofing" can be deleted.  In the 
> text about "MAD Address Spoofing", I suggest replacing "MAC Address" 
> with "Client Unique Identifier" throughout.

That sounds fine to me.