Subject: User class: last changes

From: [email-masked]
Date: Wed, 7 Jun 2000 17:05:35 +0100

Here are the changes I made to the draft in response to Thomas' comments
(and Barr's suggestion) so that people in this mailing list can have a
quick check if they wish.

* Format of the option

The format of this option is as follows:

	 Code   Len   Value
	+-----+-----+---------------------  . . .  --+
	| 77  |  N  | User Class Data ('Len' octets) |
	+-----+-----+---------------------  . . .  --+

where Value consists of zero or more instances of User Class Data.
Each instance of User Class Data is formatted as follows:

	 UC_Len_i     User_Class_Data_i
	+--------+------------------------  . . .  --+
	|  L_i   | Opaque-Data ('UC_Len_i' octets)   |
	+--------+------------------------  . . .  --+

Each User Class value (User_Class_Data_i) is indicated as an opaque
field.
The value in UC_Len_i does not include the length field itself
and MUST be non-zero.
Let m be the number of User Classes carried in the option. The
length of the option as specified in Len must be the sum of the
lengths of each of the class names plus m:
Len= UC_Len_1 + UC_Len_2 + ... + UC_Len_m + m. 
If any instances of User Class Data are present, the minimum
value of Len is two (Len = UC_Len_1 + 1 = 1 + 1 = 2).

The Code for this option is 77.

* IANA Considerations

Option 77, which IANA has already assigned for this purpose,
should be used as the User Class Option for DHCP.

* Security Considerations

DHCP currently provides no authentication or security 
mechanisms.  Potential exposures to attack are discussed
is section 7 of the protocol specification [1].
This lack of authentication mechanism means that a DHCP server
cannot check if a client or user is authorised to use a
given User Class.
This introduces an obvious vulnerability when using the User
Class option. For example, if the User Class is used to give
out special IP addresses that have better QoS associated with
them (as described in section 1), there is no way to authenticate
a client and it is therefore impossible to check if a client is
authorised to use such an IP address.

Jerome

---

From: Ted Lemon <[email-masked]>
Date: Wed, 07 Jun 2000 09:38:55 -0700

> quick check if they wish.

Nice!   This makes it a lot clearer - although I think it was complete
before, it's even better now.   :')

			       _MelloN_