Subject: agent-options-08

From: Eric Michelsen <[email-masked]>
Date: Wed, 23 Feb 2000 09:14:06 -0800

Why the prohibition against modifying BOOTP requests (sec 2.1, par 2)?  The
clients may be old, and may issue BOOTP instead of DHCP.  Since the
Agent-information is for the benefit of the access device and the DHCP
server, why disrupt existing deployments of BOOTP clients, when the agent
and server don't care?

As an access equipment vendor, I have several scenarios where the access
equipment has the knowledge of Circuit ID, etc., but is not acting at a
protocol layer that allows it to actually *be* a DHCP relay agent.  These
applications require that upstream Relay Agents accept requests where the
"agent-information" is present, but giaddr = 0.  Because servers and agents
"know" if they require circuit IDs or not, I don't see any security benefit
to requiring *relay agents* to discard such requests (sec 2.1, par 3).  A
better statement would be that "devices inserting 'agent-information' must
remove any pre-existing 'agent-information', to prevent spoofing."

The intent of sec 2.1, par 6 is not clear to me: why would the sname or file
fields have agent-information options in them, and why shouldn't the access
device remove them?

The intent of sec 2.1, par 8 is not clear to me: for security, the access
device certainly WILL enforce valid agent-information, whether this document
requires it or not.  But what is the intent here?  Along with this, sec 2.2,
par 4, DHCP servers may indeed require the agent-options field to be
present.  Anything else may be a potential security weakness.

Sec 2.1.1, for clarity: why would a relay agent receive a relayed request?
Doesn't the original relay-agent forward the request by unicast directly to
the server?

Sec 3.2, I think the "remote-ID" should be clarified, for the case of
PVC-like connections to the premise (e.g., DSL), the remote-ID may be an
identifier of the physical line (essentially, all the circuit-ID
suggestions, plus the additional suggestions given).  From the descriptions,
it seems like servers interpret remote-ID as the definitive client
identification, and circuit-ID may be interesting, but not necessarily
definitive.
-------------------------------------------
Eric L. Michelsen, Copper Mountain Networks