Subject: Feedback on draft-ietf-dhc-leasequery-00.txt

From: Bernie Volz <[email-masked]>
Date: Sun, 26 Nov 2000 09:27:58 -0500

Kim/Rich:

This draft looks very good - I haven't read it cover-to-cover (skimmed
parts, read others).

You might want to reword section 6.3, in particular:

   In order to accommodate DHCPLEASEQUERY messages sent to a DHCP Fail-
   over secondary server [FAILOVER] when the primary server is down, the
   primary server MUST communicate the Relay Agent Information option
   (82) values to the secondary server via the DHCP Failover BNDUPD mes-
   sages.

This should really be written to indicate that either partner must do this,
not just the primary to the secondary. Especially with Load Balancing, this
must happen in both directions (whomever does the leasing must communicate
with the partner).

Also, what happens in the case of a lazy update not having made it to the
peer by the time a DHCPLEASEQUERY is received? If the secondary leased the
address to a client but has not send the BNDUPD to the primary, the primary
might respond with address not leased when it technically was leased.
Perhaps one solution is that the relay agent should really query the other
server as well should it get a DHCPACK without an associated client? Or,
another solution is to have a special response that indicates 'address owned
by partner, please check with it' - this could be done by the primary if the
requested IP address is in the 'backup' state (owned by secondary) and by
the secondary if the address is in the 'free' state (owned by primary).
Would likely require another option code though. Or, perhaps one could
overload the next server address (siaddr) with the failover partner's
address - the relay can then check to see if that address was the queried
DHCP server's or not, if not query that next server address (this does get a
bit tricky in multi-homed environments).

In section 7, Security, you might also suggest that DHCP servers be
configurable with a list of the ip-addresses of the devices allowed to
request DHCPLEASEQUERYs. While not a great security mechanism, it does
improve things somewhat. One could require that the giaddr is the same as
the UDP datagram's source address and that that address is in the list of
allowed addreses. (Adding the giaddr/source address check avoids nasty
denial of service attacks on both the DHCP server and relay-agent!)

- Bernie Volz