Network Working Group A.K. Vijayabhaskar Internet-Draft Hewlett-Packard Expires: April 17, 2004 16 Oct 2003 The Name Service Search Option for DHCPv6 draft-ietf-dhc-dhcpv6-opt-nss-00.txt Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on April 17, 2004. Copyright Notice Copyright (C) The Internet Society (2003). All Rights Reserved. Abstract This document describes a new option called Name Service Search Option to specify the order in which name services should be consulted by the client when resolving host names and other information. 1. Introduction DHCPv6 specification [1] allows DHCPv6 server to convey various kinds of name services to the DHCPv6 clients through the options like DNS Servers Option [2], NIS Servers Option [3] and NIS+ Servers Option [3]. The clients can use multiple name services. Currently, there is no way by which the client can be notified with the search order for the name services. This document defines a new option by which the server can pass the search order for the name services to the clients. Vijayabhaskar A K Expires April 17, 2004 [Page 1] Internet-Draft The Name Service Search Option for DHCPv6 Oct 2003 2. Requirements The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this document, are to be interpreted as described in RFC 2119 [5] 3. Terminology This document uses terminology specific to IPv6 and DHCPv6 as defined in "Terminology" section of the DHCPv6 specification [1]. 4. Name Service Search Option The Name Service Search Option lists the one or more option codes of the name services in the order of preference. The first listed name service will be first used for resolution. The format of the Name Service Search Option is as shown below: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OPTION_NSS | option-len | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | NS Option code | NS Option code | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ option-code: OPTION_NSS (tbd) option-len: Length of the 'NS Option code' fields in octets; It must be a multiple of 2. NS Option code: 2 bytes option code of Name service represented in network byte order. The following list gives the various name services and their corresponding option codes. Name Service Option code Domain Name Servers Option OPT_DNS_SERVERS Network Information Servers Option OPT_NIS_SERVERS NetBIOS over TCP/IP Name Server Option OPT_NBNS_SERVERS Network Information Service+ Servers Option OPT_NISP_SERVERS The value of OPT_DNS_SERVERS is defined in [2] and the values of OPT_NIS_SERVERS and OPT_NISP_SERVERS are defined in [3]. Currently the values are `tbd`. IANA has been requested to assign a value for these options. Currently, there is no DHCPv6 option to deliver NetBIOS over TCP/IP Name Server (NBNS) [4] addresses to the clients. So, the value of OPT_NBNS_SERVERS is `tbd`. Vijayabhaskar A K Expires April 17, 2004 [Page 2] Internet-Draft The Name Service Search Option for DHCPv6 Oct 2003 The NS Option code of 0 is to indicate that the client should refer to local naming information (e.g., an /etc/hosts file on a UNIX machine). Example: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OPTION_NSS | 6 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OPT_DNS_SERVERS | OPT_NIS_SERVERS | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 0 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ This means, the client has to first use DNS, then NIS and then the local naming information like /etc/hosts for name service. 5. Client Behaviour The client should use this option to create search list for name service. i) If the DHCPv6 server doesn't provide the information about one or more name services listed in this option and these service are supported in the client and the client is configured to access these services, it can either use the information about these name services configured by some other mechanism external to DHCPv6 (or) it can try to obtain the information about these name services from the alternative DHCPv6 servers (or) it can ignore these name services and keep the remaining name services in the search list in the same relative order as before. For example, assume that the server provides the search list as (1) DNS (2) NIS+ and (3) NetBIOS and the server has not provided NIS+ server addresses to the client. The client supports NIS+ and it is configured to use NIS+. The client can either get the information about NIS+ servers through some other mechanisms like manual configuration database (or) it can contact alternative DHCPv6 servers to obtain NIS+ server addresses. If both mechanisms doesn't succeed, it can ignore NIS+ and keep (1) DNS and (2) NetBIOS in its search list with DNS and NetBIOS in same relative order as before. ii) The client may receive this option with some name services, which are not supported by client (or) it has not been configured to access. In this case, it can ignore these name services and create the search list removing these name services with relative order of the remaining name services not changed. This specification does mandate any strict rules to be followed for the cases i) and ii). However, it provides the guidelines which will be helpful for the implementors. For all these cases the client can interpret this option in a system-specific manner whose specification is outside the scope of this document. Vijayabhaskar A K Expires April 17, 2004 [Page 3] Internet-Draft The Name Service Search Option for DHCPv6 Oct 2003 6. Appearance of this option The Name Service Search option MUST NOT appear in other than the following messages: Solicit, Advertise, Request, Renew, Rebind, Information-Request and Reply. The option number for this option MAY appear in the Option Request Option [1] in the following messages: Solicit, Request, Renew, Rebind, Information-Request and Reconfigure. 7. Security Considerations The Name Service Search Option may be used by an intruder DHCPv6 server to provide a search list which contain only the name services which are not supported in the client. This will make the clients unable to resolve the names and other information. The Name Service Search Option may be used by an intruder DHCPv6 server to provide a search list with lower precedence given to the service which provide better results. For example, local naming information like /etc/hosts, which doesn't have adequate information for name and other resolutions, will be given higher precedence in the search list. This will degrade the performance of the applications running on the client as they have to perform lookup multiple times with different name services to resolve the names and other information. If these applications are very critical like banking services, which require higher throughput, this will result in Denial Of Service. To avoid attacks through this option, the DHCP client SHOULD use authenticated DHCP (see section "Authentication of DHCP messages" in the DHCPv6 specification [1]). 8. IANA Considerations IANA is requested to assign an option code to the following options from the option-code space defined in "DHCPv6 Options" section of the DHCPv6 specification [1]. Option Name Value Described in OPTION_NSS tbd Section 4 OPTION_NBNS_SERVERS tbd Section 4 9. Normative References [1] Bound, J., Carney, M., Perkins, C., Lemon, T., Volz, B. and R. Droms (ed.), "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003. Vijayabhaskar A K Expires April 17, 2004 [Page 4] Internet-Draft The Name Service Search Option for DHCPv6 Oct 2003 10. Informative References [2] R. (ed.) Droms. DNS Configuration options for DHCPv6. Internet Draft, Internet Engineering Task Force, August 2003. Work in progress. [3] A. K. Vijayabhaskar. NIS Configuration Options for DHCPv6. Internet Draft, Internet Engineering Task Force, Oct 2003. Work in progress. [4] NetBIOS Working Group, "Protocol Standard for a NetBIOS Service on a TCP/UDP transport: Detailed Specifications", STD 19, RFC 1002, March 1987. [5] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. Author's Address Vijayabhaskar A K Hewlett-Packard STSD-I 29, Cunningham Road Bangalore - 560052 India Phone: +91-80-2053085 E-Mail: vijayak@india.hp.com Vijayabhaskar A K Expires April 17, 2004 [Page 5] Internet-Draft The Name Service Search Option for DHCPv6 Oct 2003 Full Copyright Statement Copyright (C) The Internet Society (2003). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Acknowledgement Funding for the RFC Editor function is currently provided by the Internet Society. The idea of this specification is based on RFC 2937, September 2000. Vijayabhaskar A K Expires April 17, 2004 [Page 6]