Subject: RE: Relayed lease extension

From: Bernie Volz <[email-masked]>
Date: Thu, 27 Apr 2000 15:45:43 -0400

I wonder whether a solution to this is to send the response back to the
sender's IP address. In other words, just use the "from" information in
the recvfrom call in the sendto. In "normal" UDP applications, that is
what is done (such as for DNS and NFS).

One might consider a slight deviation of that for added security and
that is to check that the from address is either (a) the ciaddr of the
client or (b) the giaddr. If neither, drop the packet as it likely is
spoofed (this doesn't really prevent spoofing as the sender could simply
set giaddr to its address).

- Bernie Volz

Message-ID: <[email-masked]>
Date: Thu, 27 Apr 2000 12:34:27 -0700
From: Wim Janssen <[email-masked]>
Organization: Alcatel Telecom
To: DHCPv4 discussion list <[email-masked]>
Subject: Relayed lease extension

All,

I wanted to get some feedback from the group on the following:

What should a DHCP server do when it receives a request to extend an 
existing lease, and with 'giaddr' filled in?

Should it unicast to the client (ciaddr) or to the relay agent (giaddr)?

The idea behind this is a client/relay agent in one big box,
asking for leases on behalf of PPP users. In this case, lease extensions
should not be sent back to the PPP user, but to the relay agent.

Note that the RFC 'assumes' that lease extensions are unicasted between 
client and server, without any intervention from a relay agent.
("this message will be unicast ...")

RFC 2131 tells us:

4.1 Constructing and sending DHCP messages (p. 21 & 22)

   ...
   If the 'giaddr' field in a DHCP message from a client is non-zero,
   the server sends any return messages to the 'DHCP server' port on the
   BOOTP relay agent whose address appears in 'giaddr'. 
   ...

But also on p. 30:

   Clients send DHCPREQUEST messages as follows:

   ...
   o DHCPREQUEST generated during RENEWING state:

      'server identifier' MUST NOT be filled in, 'requested IP address'
      option MUST NOT be filled in, 'ciaddr' MUST be filled in with
      client's IP address. In this situation, the client is completely
      configured, and is trying to extend its lease. This message will
      be unicast, so no relay agents will be involved in its      ^^^^
      transmission.  Because 'giaddr' is therefore not filled in, the
      DHCP server will trust the value in 'ciaddr', and use it when
      replying to the client.
    ...

Thanks for any feedback,

Wim

--
Wim Janssen
Alcatel Telecom                          http://www.alcatel.com
Tel : 1 (408) 935 3130                   Fax : 1 (408) 941 1818
Email : [email-masked] || [email-masked]

---

From: Wim Janssen <[email-masked]>
Date: Thu, 27 Apr 2000 13:23:12 -0700

> what is done (such as for DNS and NFS).

This would be OK for me. The only problem perhaps is that there are lots
of DHCP servers working differently ...

> One might consider a slight deviation of that for added security 

... and it may introduce a possible security leak.

> and

The added security check should not be done if you have a RAS with multiple 
network cards acting as a relay agent. The 'giaddr' could be a hint for 
the server to fetch IP addresses from its pools. But it doesn't need 
to be the source address of the packet, since the DHCP server could 
very well be sitting on another interface of the RAS. Usually an 
application should take the 'best' IP address to reach the server, no?

Wim