Subject: RE: [dhcwg] Clarification on RFC 2131 and RFC 3046

From: "Kostur, Andre" <[email-masked]>
Date: Wed, 15 Jan 2003 09:14:58 -0800

I think you're misunderstanding my question.  At no point have I suggested
that the DHCP server uses the remote ID as the only piece of information
used to distinguish a client.  

RFC 2131, section 4.2 dictates that a DHCP server must use the Client
Identifier (if supplied, CHADDR if it's not) to identify a client.

RFC 3046, section 4.0 suggests that the DHCP server uses the CHADDR and
Remote ID to identify a client.  Both pieces are used to prevent end-users
from spoofing CHADDRs, but does not acknowledge that the Client ID must (or
should) be used if the client supplied it.

My question (rephrased):

Let's look at the block diagram in RFC 3046 (so we have a common point of
reference):

                   +---------------+                          |
     Central       |   Circuit     |-- ckt 1--- Modem1-- Host-|- Host A
     LAN     |     |   Access      |                     Lan  |- Host B
             |     |   Unit 1      |                          |- Host C
             |-----|               |--                        |
             |     |(relay agent)  |...
+---------+  |     +---------------+
|  DHCP   |--|
| Server  |  |
+---------+  |
             |
             |     +---------------+
+---------+  |     |   Circuit     |-- ckt 1--- Modem2-- Host--- Host D
| Other   |  |     |   Access      |                     Lan
| Servers |--|-----|   Unit 2      |
|  (Web,  |  |     |               |-- ckt 2--- Modem3-- Host--- Host E
|   DNS)  |  |     |(relay agent)  |...                  Lan
|         |        +---------------+
+---------+

Again, let's assume that Host D needs to have multiple IP addresses assigned
to it.  Perhaps that end-user is purchasing VoIP services from one ISP,
Digital Video from a second ISP, and WebTV browsing from a third, and the
IPs for those services only go to certain IP blocks, so each component would
have it's own IP address.

When Host D makes the three requests, the packets arriving at the DHCP
server would be (other fields are uninteresting for the purposes of
discussion):

Packet 1: CHADDR == HostD, RemoteID == Modem2, GIADDR == CircuitAccessUnit2,
ClientID == HostD+VoIP

Packet 2: CHADDR == HostD, RemoteID == Modem2, GIADDR == CircuitAccessUnit2,
ClientID == HostD+DTV

Packet 3: CHADDR == HostD, RemoteID == Modem2, GIADDR == CircuitAccessUnit2,
ClientID == HostD+WebTV

Under RFC 2131, these three packets would be treated as three distinct
clients since each one has a distinct ClientID.  Under RFC 3046, those three
packets would be treated as coming from the same client, since it doesn't
encourage the use of the ClientID for identifying clients.

The reasoning that 3046 uses for ignoring the Client ID:

      By using the agent-supplied Agent Remote ID option, the untrusted
      and as-yet unstandardized client identifier field need not be used
      by the DHCP server.

Seems to be somewhat weak.  The issues of client ID spoofing are the same
ones that they touch on in discussing CHADDR spoofing:

      By associating a MAC address with an Agent Remote ID, the DHCP
      server can prevent offering an IP address to an attacker spoofing
      the same MAC address on a different remote ID.

If you replace "MAC address" with "Client ID", you would be offering the
same protection against ClientID spoofing.  By associating the Client ID
with the Remote ID, an end-user can only interfere with other devices on his
own network.

The point I'm trying to understand is why 3046 is downplaying, if not
removing the use of the Client Identifier in distinguishing between clients?

> -----Original Message-----
> From: Ted Lemon [mailto:[email-masked]]
> Sent: Tuesday, January 14, 2003 9:52 PM
> To: Kostur, Andre
> Cc: [email-masked]'
> Subject: Re: [dhcwg] Clarification on RFC 2131 and RFC 3046
> 
> 
> The remote ID is part of the relay agent information option, which is 
> sent by the *relay agent*, not by the client.   The client *never* 
> sends the relay agent information option, and thus *never* sends a 
> remote ID.   So if you are trying to identify the client, you 
> absolutely *cannot* use the remote ID to do it, because it 
> didn't come 
> from the client.
> 
> When RFC3046 talks about using the remote ID to identify a device, it 
> is not talking about the DHCP client - it is talking about the DHCP 
> relay agent.   The two RFCs are talking about different things, and 
> thus are not at all in conflict.
>

---

From: Ted Lemon <[email-masked]>
Date: Wed, 15 Jan 2003 12:36:39 -0600

> RFC 3046, section 4.0 suggests that the DHCP server uses the CHADDR 
> and Remote ID to identify a client.  Both pieces are used to prevent 
> end-users from spoofing CHADDRs, but does not acknowledge that the 
> Client ID must (or should) be used if the client supplied it.

*Yikes*!!!

Now I see what you're talking about.  There is some seriously bad 
language in RFC3046 that we didn't catch.   RFC3046 implies that the 
client identifier option is not what you should use to identify the 
client.   This is completely untrue.   In order for this to be true, 
RFC3046 would have to contain a statement saying that it updates 
certain aspects of RFC2131, and it does not contain any such statement. 
   I think the WG needs to rev RFC3046 to fix this language.   I'm sorry 
for being so obtuse about this.

Ralph?

:'}

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg