Subject: Re: [dhcwg] Re: AD review of draft-ietf-dhc-dhcpv6-opt-prefix-delegation-03.txt

From: Ralph Droms <[email-masked]>
Date: Fri, 08 Aug 2003 06:31:01 -0400

At 04:59 PM 7/24/2003 -0400, Thomas Narten wrote:
> > >I misread the above because "requesting router" is almost a proper
> > >name for a type of router as used in this document. But when I just
> > >read "intruder requesting router", it parses differently... That is
> > >what prompted my comment.
>
> > So, is "malicious requesting router" OK?
>
>I think it's confusing, but the "fix" of defining "Requesting Router"
>more formally and then using the capitalized term throughout may not
>be ideal either. But you are using "requesting router" in the formal
>sense in that sentence (and elsewhere in the document).
>
>Any other ideas?

Here's the definition from the "Terminology" section:

   requesting router The router that acts as a DHCP client and is
      requesting prefix(es) to be assigned.

Is the definition sufficiently formal?  Would it help to capitalize
"Requesting Router" here in the definition and throughout the doc?

> > Ah ... the word "assigned" is probably misleading.  "Configured"
> > might be a better word.
>
>But again, where is the requirement that they have an address (other
>than LL) be configured in order to use the prefix delegation option?
>If this is _really_ a requirement, the document should be more clear
>about that (and why).

The link local addresses are sufficient because the requesting and 
delegating routers share a link.  Would it help to restate that assumption 
(about a shared link):

    Because a requesting router and delegating routers are attached to the
    same link, they may be able to use IPsec with link-local addresses for
    authentication of DHCPv6 messages.

> > We can probably replace the next sentence ("The details...") with:
>
> >     The requesting and delegating routers use IPsec for authentication
> >     in the same way DHCPv6 servers and relay agents use IPsec as
> >     described in section 21.1 of the DHCPv6 specification.
>
>OK with me.

- Ralph

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Thomas Narten <[email-masked]>
Date: Fri, 08 Aug 2003 06:56:12 -0400

> "Requesting Router" here in the definition and throughout the doc?

I think so.

>     authentication of DHCPv6 messages.

This seems like an unreasonable requirement. I can see this being the
case sometimes, but I would not expect it to be required and I don't
believe the document ever makes this claim. I would assume that this
option be used in all the same situations whenever DHC can be used (in
terms of placement of client and server).

Thomas

---

From: Ralph Droms <[email-masked]>
Date: Fri, 08 Aug 2003 10:38:51 -0400

> > "Requesting Router" here in the definition and throughout the doc?

OK.

>This seems like an unreasonable requirement.

What requirement does the "this" refer to?

>I can see this being the

---

From: Thomas Narten <[email-masked]>
Date: Fri, 08 Aug 2003 10:44:03 -0400

> What requirement does the "this" refer to?

That that requesting and delegating router must share a link. DHCP
doesn't require that, and I don't recall the document ever saying or
implying this for this option.

Thomas

---

From: Ralph Droms <[email-masked]>
Date: Fri, 08 Aug 2003 10:46:04 -0400

BTW, the most recent version of this specification is
draft-ietf-dhc-dhcpv6-opt-prefix-delegation-04.txt, published on June 6, 2003.

- Ralph

---

From: Ole Troan <[email-masked]>
Date: Fri, 08 Aug 2003 15:57:08 +0100

Thomas,

> implying this for this option.

you are correct that the document doesn't say that the requesting and
delegating routers have to be on the same link.

the issue one has to consider is with regards to whom is going to
inject a route for the delegated prefix into the delegator's routing
system. if the routers are directly connected the delegating router
can inject a route on behalf of the requesting router. if you use a
relay agent it becomes a bit more tricky. we didn't want to require a
dynamic routing protocol between the requesting and delegating
routers.

one might use a relay but then this issue needs to be resolved, we've
defined it out of scope for the document so far, are you all right
with that?

cheers,
Ole

---

From: Thomas Narten <[email-masked]>
Date: Fri, 08 Aug 2003 11:02:36 -0400

> delegating routers have to be on the same link.

I would assume that  making such a requirement would be not
appropriate, because it would effectively restrict DHC itself...

> dynamic routing protocol between the requesting and delegating

Can we be silent on the issue? It might in general be easier to get
routes injected properly if the two routers share the same link. But
there are other ways of doing this. Since this document doesn't in
general even say anything about route injection, saying little or
nothing on this seems OK to me.

Thomas

---

From: Ole Troan <[email-masked]>
Date: Fri, 08 Aug 2003 16:18:37 +0100

Thomas,

> appropriate, because it would effectively restrict DHC itself...

it would certainly make these options more of a special case than fit
nicely into the DHCP model as they do now.

> nothing on this seems OK to me.

agree, there are as you say many ways of doing route injection, and
exploring them all in detail doesn't seem feasible for this document.

two options, either we remove the below paragraph altogether, and if
ever DHCP with IPsec gets defined elsewhere that would also apply to
these options, or we change the paragraph to say that if the
requesting and delegated routers have configured addresses or are
directly connected then IPsec may be used.

   Because a requesting router and delegating routers must each have
   at least one assigned IPv6 address, the routers may be able to use
   IPsec for authentication of DHCPv6 messages.  The details of using
   IPsec for DHCPv6 are under development.

cheers,
Ole

---

From: Thomas Narten <[email-masked]>
Date: Fri, 08 Aug 2003 11:26:07 -0400

> directly connected then IPsec may be used.

IPsec can be used whenever  the two nodes have addresses and  can set
up an SA between each . I don't see why one needs to mention anything
beyond that (e.g, saying directly connected)

>    IPsec for DHCPv6 are under development.

I'm OK with the "may". But (as I thought I'd mentioned before), the
words "because a RR and DR must each have at least one assigned IPv6
address" make me nervous because I'm not sure what is meant (or if
something is meant that I don't think is correct).

If they mean addresses other than LL, that is not a
requirement. Presumably this option can be used when booting and
obtaining addresses, i.e., as DHC is intended to be used.

Can you say something like:

    If the requesting router and delegating routers have addresses
    configured that allow them to communicate directly with each
    other, they may be able to use IPsec for authentication of DHCPv6
    messages.  The details of using IPsec for DHCPv6 are under
    development.

Thomas

---

From: Ole Troan <[email-masked]>
Date: Fri, 08 Aug 2003 16:44:59 +0100

Thomas,

> beyond that (e.g, saying directly connected)

agree.

> something is meant that I don't think is correct).

just trying to say what you've so eloquently said below.

>     messages.  The details of using IPsec for DHCPv6 are under

yes, well put.

cheers,
Ole