Subject: [secdir] SecDir Review of draft-ietf-opsec-dhcpv6-shield

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 05 Dec 2014 11:47:16 +0100

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors. Document editors and WG chairs should treat these
comments just like any other last call comments.

This document specifies packet filtering criterion so that DHCPv6-server
messages are discarded by the layer-2 device unless they are received
on a specific (previously configured) ports of the layer-2 device.

The document is well-written and I don't see any problems with the
write-up. While specifying packet filtering firewall rules is an
implementation / configuration dependent task that does not require
standardization as such this work follows earlier patterns, namely
the RA-Guard mechanism for the protection against rogue router
advertisements.

The only question I have whether the document type (currently set to
'Best Current Practice') is appropriate.

Ciao
Hannes

PS: Minor editorial nit:

"
Finally, we note that the security of a site employing DHCPv6 Shield
   could be further improved by deploying [I-D.ietf-savi-dhcp], to
   mitigate IPv6 address. spoofing attacks.
                       ^^^
"

---

From: Fernando Gont <[email-masked]>
Date: Fri, 05 Dec 2014 09:25:44 -0300

Hi, Hannes,

Thanks so much for your feedback! Please find my comments in-line....

On 12/05/2014 07:47 AM, Hannes Tschofenig wrote:
> implementation / configuration dependent task that does not
> require standardization as such this work follows earlier patterns,
> namely the RA-Guard mechanism for the protection against rogue
> router advertisements.

Other than following earlier patterns, the goal is to avoid
implementation flaws (such as those described in RFC7113.

> The only question I have whether the document type (currently set
> to 'Best Current Practice') is appropriate.

The idea is that this document specifies the best current way of
implementing the filtering rules for such packets

> PS: Minor editorial nit:
> 
> " Finally, we note that the security of a site employing DHCPv6
> Shield could be further improved by deploying [I-D.ietf-savi-dhcp],
> to mitigate IPv6 address. spoofing attacks. ^^^ "

Will do.

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492