Subject: [Int-dir] DHCPv6 expert review of draft-ietf-opsec-dhcpv6-shield

From: Ted Lemon <[email-masked]>
Date: Mon, 1 Dec 2014 21:09:09 -0600

It would be nice to get a DHCPv6 expert to review this document.   Would the Directorate Coordinator please solicit a volunteer to do this?   What I'm looking for is someone to make sure the bits are done right, and that this doesn't have any operational holes relating to the specific functioning of the DHCPv6 protocol that the opsec folks might have missed.

Thanks!

P.S. Directorate participants, please don't undertake the review before being asked by the Directorate Coordinator.

---

From: Sheng Jiang <[email-masked]>
Date: Tue, 2 Dec 2014 03:15:15 +0000

Hi, Ted,

I can review it. What is the due time? Hope it is not too urgent.

Cheers,

Sheng

>-----Original Message-----
>From: Int-dir [mailto:[email-masked]] On Behalf Of Ted Lemon
>Sent: Tuesday, December 02, 2014 11:09 AM
>To: <[email-masked]>
>Subject: [Int-dir] DHCPv6 expert review of draft-ietf-opsec-dhcpv6-shield
>
>It would be nice to get a DHCPv6 expert to review this document.   Would
>the Directorate Coordinator please solicit a volunteer to do this?   What I'm
>looking for is someone to make sure the bits are done right, and that this
>doesn't have any operational holes relating to the specific functioning of the
>DHCPv6 protocol that the opsec folks might have missed.
>
>Thanks!
>
>_______________________________________________
>Int-dir mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/int-dir

---

From: Ralph Droms <[email-masked]>
Date: Tue, 2 Dec 2014 10:37:16 -0500

Directorate Coordinator - I'd be willing to review this doc.

- Ralph

PS Who is the Directorate Coordinator, anyway?

---

From: "Bernie Volz (volz)" <[email-masked]>
Date: Wed, 3 Dec 2014 06:22:48 +0000

Hi Ralph ... Great if you and Sheng can review. Thanks.

- Bernie (from iPad)

> On Dec 1, 2014, at 10:15 PM, Sheng Jiang <[email-masked]> wrote:
> 
> Hi, Ted,
>

---

From: Sheng Jiang <[email-masked]>
Date: Thu, 4 Dec 2014 01:28:42 +0000

Hi, Bernie,

Does this email mean you have asked Ralph and I to review this document as the Directorate Coordinator? What is the due time, then?

Cheers,

Sheng

>From: Bernie Volz (volz) [mailto:[email-masked]]
>Sent: Wednesday, December 03, 2014 2:23 PM
>To: Sheng Jiang
>Cc: Ted Lemon; <[email-masked]>
>Subject: Re: [Int-dir] DHCPv6 expert review of draft-ietf-opsec-dhcpv6-shield
>
>>> P.S. Directorate participants, please don't undertake the review before
>being
>>> asked by the Directorate Coordinator.
>>>

---

From: "Bernie Volz (volz)" <[email-masked]>
Date: Thu, 4 Dec 2014 02:52:35 +0000

Yes, please review. I do not have any more info than was in Ted's email. I guess for now, let's assume by Dec 12. If Ted needs it earlier, he will need to let you know.

Datatracker status is at http://datatracker.ietf.org/doc/draft-ietf-opsec-dhcpv6-shield/.

- Bernie (from iPad)

> On Dec 3, 2014, at 8:28 PM, Sheng Jiang <[email-masked]> wrote:
> 
> Hi, Bernie,
>

---

From: Ted Lemon <[email-masked]>
Date: Thu, 4 Dec 2014 12:38:57 -0500

> Yes, please review. I do not have any more info than was in Ted's email. I guess for now, let's assume by Dec 12. If Ted needs it earlier, he will need to let you know.

When I ask for a review, my general assumption is that people will volunteer to do it if they have time, and that the response will come back "soon."   I don't have a specific deadline for this document, but anything beyond Dec. 12 is probably too long just because it will fall off the radar.   If someone can review it, but can't get it done before Dec. 12., I can live with that as long as they do it.

Of course, I'm planning to go on vacation the following Monday, so if it comes out on Dec. 12 I may not actually benefit from the review until January 5.

---

From: Ralph Droms <[email-masked]>
Date: Thu, 4 Dec 2014 09:43:59 -0800

OK.  I'm in SJ, returning home tomorrow.  I have the review on my list of "stuff to keep me occupied" on the flight home.

- Ralph

---

From: Ted Lemon <[email-masked]>
Date: Thu, 4 Dec 2014 12:45:13 -0500

Thanks!

---

From: "Christopher LILJENSTOLPE" <[email-masked]>
Date: Thu, 04 Dec 2014 13:58:54 -0800

On 4 Dec 2014, at 9:43, Ralph Droms wrote:

> OK.  I'm in SJ, returning home tomorrow.  I have the review on my list 
> of "stuff to keep me occupied" on the flight home.

Thank's Ralph.

	Christopher

>>> Yes, please review. I do not have any more info than was in Ted's 
>>> email. I guess for now, let's assume by Dec 12. If Ted needs it 
>>> earlier, he will need to let you know.
>>
>> When I ask for a review, my general assumption is that people will 
>> volunteer to do it if they have time, and that the response will come 
>> back "soon."   I don't have a specific deadline for this document, 
>> but anything beyond Dec. 12 is probably too long just because it will 
>> fall off the radar.   If someone can review it, but can't get it done 
>> before Dec. 12., I can live with that as long as they do it.
>>
>> Of course, I'm planning to go on vacation the following Monday, so if 
>> it comes out on Dec. 12 I may not actually benefit from the review 
>> until January 5.
>>

--
李柯睿
Avt tace, avt loqvere meliora silentio
Check my PGP key here: http://www.asgaard.org/cdl/cdl.asc
Current vCard here: http://www.asgaard.org/cdl/cdl.vcf

---

From: Sheng Jiang <[email-masked]>
Date: Fri, 5 Dec 2014 00:56:26 +0000

My original plan was to review it next Wednesday (Dec. 10th). But one of my colleagues who supposes to have a half-day meeting with me today has just notified me that he cannot make it due to an urgent family issue. So, I can review it today. Even I cannot finish it today, my review can be expected before Dec. 8th, US Western time.

Regards,

Sheng

>From: Ted Lemon [mailto:[email-masked]]
>Sent: Friday, December 05, 2014 1:39 AM
>To: Bernie Volz
>Cc: Sheng Jiang; <[email-masked]>
>> Yes, please review. I do not have any more info than was in Ted's email. I
>guess for now, let's assume by Dec 12. If Ted needs it earlier, he will need to
>let you know.
>
>When I ask for a review, my general assumption is that people will volunteer
>to do it if they have time, and that the response will come back "soon."   I
>don't have a specific deadline for this document, but anything beyond Dec. 12
>is probably too long just because it will fall off the radar.   If someone can
>review it, but can't get it done before Dec. 12., I can live with that as long as
>they do it.
>
>Of course, I'm planning to go on vacation the following Monday, so if it
>comes out on Dec. 12 I may not actually benefit from the review until January
>5.

---

From: Sheng Jiang <[email-masked]>
Date: Mon, 8 Dec 2014 02:12:16 +0000

Hi,

I have reviewed draft-ietf-opsec-dhcpv6-shield as an assigned reviewer by the Internet Area directorate. Below is my review comments:

Overall, this document proposes an useful mechanism to protecting hosts connected to a switched network against rogue DHCPv6 servers. The proposed mechanism and text are mature. However, I have one major and several minor technical comments:

Major technical comments:

In section 5, rule 3, the document propose: "When parsing the IPv6 header chain, if ... the packet contains an unrecognized Next Header value, DHCPv6-Shield MUST drop the packet". This default behavior is against RFC7045, which has "Intermediate forwarding nodes SHOULD NOT discard packets containing unrecognised extension headers." Although RFC7045 does allow "default configuration MAY drop such packets", I do not see a necessary reason why we drop such packet here. This seem not relevant to rogue DHCPv6 message at all.

Minor comments:

a) DHCP snooping has been understood widely. Why not continue use the similar name, DHCPv6 snooping? A new name "DHCPv6 shield" may imply the mechanism is different.

b) In section 5, rule 1, rationale part. Does an implementation that inspect IPv6 headers often enforce a limit on the number of bytes? I personally doubt any implementors would do so. Why one will even do this? So, although I agree the technical point here, I fail to understand the necessity for it.

c) Rule 2 section 5. Again, this rule is technically right, but not really relevant to rogue DHCPv6 messages. Therefore, I think the "MUST" is too strong here.

d) The third last paragraph of section 5, this section seems all relevant to rule 2. The better place is within the relation of rule 2 or a discussion part of rule 2.

e) The second last paragraph of section 5, "if the DHCPv6-Shield device fails to identify the upper-layer protocol as a result of the use of fragmentation". This may be down to implementation, but it is still unclear here: how a DHCPv6 device decides fragmented packets (not the first fragmented packet) is identify the upper-layer protocol as a result of the use of fragmentation and how it may be failed.

f) The first paragraph of section 7. This paragraph describe the scope of this document. It should belong to introduction section rather than security consideration.

g) This document does not mention Secure DHCPv6 at all. It is relevant, I believe.

Best regards,

Sheng

>From: Int-dir [mailto:[email-masked]] On Behalf Of Sheng Jiang
>Sent: Friday, December 05, 2014 8:56 AM
>To: Ted Lemon; Bernie Volz
>Cc: <[email-masked]>
>My original plan was to review it next Wednesday (Dec. 10th). But one of my
>colleagues who supposes to have a half-day meeting with me today has just
>notified me that he cannot make it due to an urgent family issue. So, I can
>review it today. Even I cannot finish it today, my review can be expected
>before Dec. 8th, US Western time.
>
>Regards,
>
>Sheng
>