< draft-ietf-dhc-dhcpv6-opt-dnsconfig-03.txt		draft-ietf-dhc-dhcpv6-opt-dnsconfig-04.txt >
	Network Working Group R. Droms (ed.)		Dynamic Host Configuration Group R. Droms (ed.)
	Internet-Draft Cisco Systems		Internet-Draft Cisco Systems
	Expires: August 29, 2003 February 28, 2003		Expires: February 22, 2004 August 24, 2003
	DNS Configuration options for DHCPv6		DNS Configuration options for DHCPv6
	draft-ietf-dhc-dhcpv6-opt-dnsconfig-03.txt		draft-ietf-dhc-dhcpv6-opt-dnsconfig-04.txt
	Status of this Memo		Status of this Memo
	This document is an Internet-Draft and is in full conformance with		This document is an Internet-Draft and is in full conformance with
	all provisions of Section 10 of RFC2026.		all provisions of Section 10 of RFC2026.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF), its areas, and its working groups. Note that		Task Force (IETF), its areas, and its working groups. Note that other
	other groups may also distribute working documents as Internet-		groups may also distribute working documents as Internet-Drafts.
	Drafts.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	The list of current Internet-Drafts can be accessed at		The list of current Internet-Drafts can be accessed at http://
	http://www.ietf.org/ietf/1id-abstracts.txt.		www.ietf.org/ietf/1id-abstracts.txt.
	The list of Internet-Draft Shadow Directories can be accessed at		The list of Internet-Draft Shadow Directories can be accessed at
	http://www.ietf.org/shadow.html.		http://www.ietf.org/shadow.html.
	This Internet-Draft will expire on August 29, 2003.		This Internet-Draft will expire on February 22, 2004.
	Copyright Notice		Copyright Notice
	Copyright (C) The Internet Society (2003). All Rights Reserved.		Copyright (C) The Internet Society (2003). All Rights Reserved.
	Abstract		Abstract
	This document describes DHCPv6 options for passing a list of		This document describes DHCPv6 options for passing a list of
	available DNS resolvers and a domain search list to a client.		available DNS recursive name servers and a domain search list to a
			client.
	1. Introduction		1. Introduction
	This document describes two options for passing configuration		This document describes two options for passing configuration
	information related to Domain Name Service (DNS) [1, 6] in DHCPv6		information related to Domain Name Service (DNS) (RFC 1034 [6] and
	[2].		RFC 1035 [1]) in DHCPv6 (RFC 3315 [2]).
	2. Terminology		2. Terminology
	The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,		The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
	SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL in this document are to be		SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL in this document are to be
	interpreted as described in RFC2119 [3].		interpreted as described in RFC2119 [3].
	This document uses terminology specific to IPv6 and DHCPv6 as defined		Throughout this document, unless otherwise specified, the acronym
	in section "Terminology" of the DHCP specification [2].		DHCP refers to DHCP as specified in RFC 3315.
	3. DNS Resolver option		This document uses terminology specific to IPv6 and DHCP as defined
			in section "Terminology" of RFC 3315.
	The DNS Resolver option provides a list of one or more IPv6 addresses		3. DNS Recursive Name Server option
	of DNS recursive resolvers to which a client's DNS resolver MAY send
	DNS queries [1]. The DNS servers are listed in the order of
	preference for use by the client resolver.
	The format of the DNS Resolver option is:		The DNS Recursive Name Server option provides a list of one or more
			IPv6 addresses of DNS recursive recursive name servers to which a
			client's DNS resolver MAY send DNS queries [1]. The DNS servers are
			listed in the order of preference for use by the client resolver.
			The format of the DNS Recursive Name Server option is:
	0 1 2 3		0 1 2 3
	0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1		0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	| OPTION_DNS_RESOLVERS | option-len |		| OPTION_DNS_SERVERS | option-len |
	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	| |		| |
	| DNS-resolver (IPv6 address) |		| DNS-recursive-name-server (IPv6 address) |
	| |		| |
	| |		| |
	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	| |		| |
	| DNS-resolver (IPv6 address) |		| DNS-recursive-name-server (IPv6 address) |
	| |		| |
	| |		| |
	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	| ... |		| ... |
	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	option-code: OPTION_DNS_RESOLVERS (tbd)		option-code: OPTION_DNS_SERVERS (tbd)
	option-len: Length of the list of DNS resolvers in octets; must be a		option-len: Length of the list of DNS recursive name
	multiple of 16		servers in octets; must be a multiple of 16
	DNS-server: IPv6 address of DNS resolver		DNS-recursive-name-server: IPv6 address of DNS recursive name server
	4. Domain Search List option		4. Domain Search List option
	The Domain Search List option specifies the domain search list the		The Domain Search List option specifies the domain search list the
	client is to use when resolving hostnames with DNS. This option does		client is to use when resolving hostnames with DNS. This option does
	not apply to other name resolution mechanisms.		not apply to other name resolution mechanisms.
	The format of the Domain Search List option is:		The format of the Domain Search List option is:
	0 1 2 3		0 1 2 3
	0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1		0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	| OPTION_DOMAIN_LIST | option-len |		| OPTION_DOMAIN_LIST | option-len |
	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	| searchstring |		| searchlist |
	| ... |		| ... |
	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	option-code: OPTION_DOMAIN_LIST (tbd)		option-code: OPTION_DOMAIN_LIST (tbd)
	option-len: Length of the 'searchstring' field in octets		option-len: Length of the 'searchlist' field in octets
	searchstring: The specification of the list of domain names in the		searchlist: The specification of the list of domain names in the
	Domain Search List		Domain Search List
	The list of domain names in the 'searchstring' MUST be encoded as		The list of domain names in the 'searchlist' MUST be encoded as
	specified in section "Representation and use of domain names" of the		specified in section "Representation and use of domain names" of RFC
	DHCPv6 specification [2].		3315.
	5. Appearance of these options		5. Appearance of these options
	The Domain Name Server option MUST NOT appear in other than the		The DNS Recursive Name Server option MUST NOT appear in other than
	following messages: Solicit, Advertise, Request, Renew, Rebind,		the following messages: Solicit, Advertise, Request, Renew, Rebind,
	Information-Request, Reply.		Information-Request, Reply.
	The Domain Search List option MUST NOT appear in other than the		The Domain Search List option MUST NOT appear in other than the
	following messages: Solicit, Advertise, Request, Renew, Rebind,		following messages: Solicit, Advertise, Request, Renew, Rebind,
	Information-Request, Reply.		Information-Request, Reply.
	6. Security Considerations		6. Security Considerations
	The DNS Resolver option may be used by an intruder DHCP server to		The DNS Recursive Name Server option may be used by an intruder DHCP
	cause DHCP clients to send DNS queries to an intruder DNS resolver.		server to cause DHCP clients to send DNS queries to an intruder DNS
	The results of these misdirected DNS queries may be used to spoof DNS		recursive name server. The results of these misdirected DNS queries
	names.		may be used to spoof DNS names.
	To avoid attacks through the DNS Resolver option, the DHCP client		To avoid attacks through the DNS Recursive Name Server option, the
	SHOULD require DHCP authentication (see section "Authentication of		DHCP client SHOULD require DHCP authentication (see section
	DHCP messages" in the DHCPv6 specification) before installing a list		"Authentication of DHCP messages" in RFC 3315) before installing a
	of DNS resolvers obtained through authenticated DHCP .		list of DNS recursive name servers obtained through authenticated
			DHCP .
	The Domain Search List option may be used by an intruder DHCP server		The Domain Search List option may be used by an intruder DHCP server
	to cause DHCP clients to search through invalid domains for		to cause DHCP clients to search through invalid domains for
	incompletely specified domain names. The results of these		incompletely specified domain names. The results of these misdirected
	misdirected searches may be used to spoof DNS names. Note that		searches may be used to spoof DNS names. Note that support for
	support for DNSSEC [4] will not avert this attack, because the		DNSSEC [4] will not avert this attack, because the resource records
	resource records in the invalid domains may be legitimately signed.		in the invalid domains may be legitimately signed.
	The degree to which a host is vulnerable to attack via an invalid		The degree to which a host is vulnerable to attack via an invalid
	domain search option is determined in part by DNS resolver behavior.		domain search option is determined in part by DNS resolver behavior.
	RFC1535 [7] contains a discussion of security weaknesses related to		RFC1535 [7] contains a discussion of security weaknesses related to
	implicit as well as explicit domain searchlists, and provides		implicit as well as explicit domain searchlists, and provides
	recommendations relating to resolver searchlist processing. Section		recommendations relating to resolver searchlist processing. Section 6
	6 of RFC1536 [5] also addresses this vulnerability, and recommends		of RFC1536 [5] also addresses this vulnerability, and recommends that
	that resolvers:		resolvers:
	1. Use searchlists only when explicitly specified; no implicit		1. Use searchlists only when explicitly specified; no implicit
	searchlists should be used.		searchlists should be used.
	2. Resolve a name that contains any dots by first trying it as an		2. Resolve a name that contains any dots by first trying it as an
	FQDN and if that fails, with the names in the searchlist		FQDN and if that fails, with the names in the searchlist
	appended.		appended.
	3. Resolve a name containing no dots by appending with the		3. Resolve a name containing no dots by appending with the
	searchlist right away, but once again, no implicit searchlists		searchlist right away, but once again, no implicit searchlists
	skipping to change at page 4, line 39 ¶		skipping to change at page 4, line 46 ¶
	that:		that:
	1. Hosts implementing the domain search option SHOULD also implement		1. Hosts implementing the domain search option SHOULD also implement
	the searchlist recommendations of RFC1536, section 6.		the searchlist recommendations of RFC1536, section 6.
	2. Where DNS parameters such as the domain searchlist or DNS servers		2. Where DNS parameters such as the domain searchlist or DNS servers
	have been manually configured, these parameters SHOULD NOT be		have been manually configured, these parameters SHOULD NOT be
	overridden by DHCP.		overridden by DHCP.
	3. A host SHOULD require the use of DHCP authentication (see section		3. A host SHOULD require the use of DHCP authentication (see section
	"Authentication of DHCP messages" in the DHCPv6 specification)		"Authentication of DHCP messages" in RFC 3315) prior to accepting
	prior to accepting a domain search option.		a domain search option.
	7. IANA Considerations		7. IANA Considerations
	IANA is requested to assign an option code to these options from the		IANA is requested to assign an option code to the DNS Recursive Name
	option-code space defined in section "DHCPv6 Options" of the DHCPv6		Server option and to the Domain Search List option from the DHCP
	specification [2].		option code space defined in section "IANA Considerations" of RFC
			3315.
	8. Acknowledgments		8. Acknowledgments
	This option was originally part of the DHCPv6 specification, written		This option was originally part of the DHCPv6 specification, written
	by Jim Bound, Mike Carney, Charlie Perkins, Ted Lemon, Bernie Volz		by Jim Bound, Mike Carney, Charlie Perkins, Ted Lemon, Bernie Volz
	and Ralph Droms.		and Ralph Droms.
	The analysis of the potential attack through the domain search list		The analysis of the potential attack through the domain search list
	is taken from the specification of the DHCPv4 Domain Search option,		is taken from the specification of the DHCPv4 Domain Search option,
	RFC3397 [8].		RFC3397 [8].
	Thanks to Rob Austein, Alain Durand, Peter Koch, Tony Lindstrom and		Thanks to Rob Austein, Alain Durand, Peter Koch, Tony Lindstrom and
	Pekka Savola for their contributions to this document.		Pekka Savola for their contributions to this document.
	9. Changes from draft-ietf-dhc-dhcpv6-opt-dnsconfig-02.txt
	This document includes the following changes in response to comments
	made during the dhc/dnsext WG last call:
	o Combined RFC2119 reference and reference to DHCPv6 specification
	into one "Terminology" section; added explicit normative reference
	to DHCPv6 specification.
	o Changed name of "Domain Name Server" option to "DNS Resolver"
	option.
	o Clarified and corrected filed names and descriptions of fields in
	the option format diagrams.
	o Reworded "Appearance of these options" for clarity; removed
	Confirm from list of messages in which the options can appear.
	o Clarified the type of attack that can be mounted through the
	Domain Search List option by copying text from RFC3997
	Normative References		Normative References
	[1] Mockapetris, P., "Domain names - implementation and		[1] Mockapetris, P., "Domain names - implementation and
	specification", STD 13, RFC 1035, November 1987.		specification", STD 13, RFC 1035, November 1987.
	[2] Bound, J., Carney, M., Perkins, C., Lemon, T., Volz, B. and R.		[2] Bound, J., Carney, M., Perkins, C., Lemon, T., Volz, B. and R.
	Droms (ed.), "Dynamic Host Configuration Protocol for IPv6		Droms (ed.), "Dynamic Host Configuration Protocol for IPv6
	(DHCPv6)", RFC XXXX, TBD 2003.		(DHCPv6)", RFC 3315, May 2003.
	[3] Bradner, S., "Key words for use in RFCs to Indicate Requirement		[3] Bradner, S., "Key words for use in RFCs to Indicate Requirement
	Levels", BCP 14, RFC 2119, March 1997.		Levels", BCP 14, RFC 2119, March 1997.
	[4] Eastlake, D., "Domain Name System Security Extensions", RFC		[4] Eastlake, D., "Domain Name System Security Extensions", RFC
	2535, March 1999.		2535, March 1999.
	[5] Kumar, A., Postel, J., Neuman, C., Danzig, P. and S. Miller,		[5] Kumar, A., Postel, J., Neuman, C., Danzig, P. and S. Miller,
	"Common DNS Implementation Errors and Suggested Fixes", RFC		"Common DNS Implementation Errors and Suggested Fixes", RFC
	1536, October 1993.		1536, October 1993.
	Normative References		Informative References
	[6] Mockapetris, P., "Domain names - concepts and facilities", STD		[6] Mockapetris, P., "Domain names - concepts and facilities", STD
	13, RFC 1034, November 1987.		13, RFC 1034, November 1987.
	[7] Gavron, E., "A Security Problem and Proposed Correction With		[7] Gavron, E., "A Security Problem and Proposed Correction With
	Widely Deployed DNS Software", RFC 1535, October 1993.		Widely Deployed DNS Software", RFC 1535, October 1993.
	[8] Aboba, B. and S. Cheshire, "Dynamic Host Configuration Protocol		[8] Aboba, B. and S. Cheshire, "Dynamic Host Configuration Protocol
	(DHCP) Domain Search Option", RFC 3397, November 2002.		(DHCP) Domain Search Option", RFC 3397, November 2002.
	Author's Address		Author's Address
	Ralph Droms (ed.)		Ralph Droms (ed.)
	Cisco Systems		Cisco Systems
	250 Apollo Drive		1414 Massachusetts Ave.
	Chelmsford, MA 01824		Boxboro, MA 01719
	USA		USA
	Phone: +1 978 497 4733		Phone: +1 978 936 1674
	EMail: rdroms@cisco.com		EMail: rdroms@cisco.com
			Intellectual Property Statement
			The IETF takes no position regarding the validity or scope of any
			intellectual property or other rights that might be claimed to
			pertain to the implementation or use of the technology described in
			this document or the extent to which any license under such rights
			might or might not be available; neither does it represent that it
			has made any effort to identify any such rights. Information on the
			IETF's procedures with respect to rights in standards-track and
			standards-related documentation can be found in BCP-11. Copies of
			claims of rights made available for publication and any assurances of
			licenses to be made available, or the result of an attempt made to
			obtain a general license or permission for the use of such
			proprietary rights by implementors or users of this specification can
			be obtained from the IETF Secretariat.
			The IETF invites any interested party to bring to its attention any
			copyrights, patents or patent applications, or other proprietary
			rights which may cover technology that may be required to practice
			this standard. Please address the information to the IETF Executive
			Director.
	Full Copyright Statement		Full Copyright Statement
	Copyright (C) The Internet Society (2003). All Rights Reserved.		Copyright (C) The Internet Society (2003). All Rights Reserved.
	This document and translations of it may be copied and furnished to		This document and translations of it may be copied and furnished to
	others, and derivative works that comment on or otherwise explain it		others, and derivative works that comment on or otherwise explain it
	or assist in its implementation may be prepared, copied, published		or assist in its implementation may be prepared, copied, published
	and distributed, in whole or in part, without restriction of any		and distributed, in whole or in part, without restriction of any
	kind, provided that the above copyright notice and this paragraph are		kind, provided that the above copyright notice and this paragraph are
	included on all such copies and derivative works. However, this		included on all such copies and derivative works. However, this
	document itself may not be modified in any way, such as by removing		document itself may not be modified in any way, such as by removing
	the copyright notice or references to the Internet Society or other		the copyright notice or references to the Internet Society or other
	Internet organizations, except as needed for the purpose of		Internet organizations, except as needed for the purpose of
	developing Internet standards in which case the procedures for		developing Internet standards in which case the procedures for
	copyrights defined in the Internet Standards process must be		copyrights defined in the Internet Standards process must be
	followed, or as required to translate it into languages other than		followed, or as required to translate it into languages other than
	English.		English.
	The limited permissions granted above are perpetual and will not be		The limited permissions granted above are perpetual and will not be
	revoked by the Internet Society or its successors or assigns.		revoked by the Internet Society or its successors or assignees.
	This document and the information contained herein is provided on an		This document and the information contained herein is provided on an
	"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING		"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
	TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING		TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
	BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION		BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
	HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF		HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
	MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.		MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
	Acknowledgement		Acknowledgment
	Funding for the RFC Editor function is currently provided by the		Funding for the RFC Editor function is currently provided by the
	Internet Society.		Internet Society.
End of changes. 43 change blocks.
	89 lines changed or deleted		95 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/