Subject: [dhcwg] Comments on draft-ietf-dhc-opt-extrboot-00.txt

From: Ted Lemon <[email-masked]>
Date: Tue, 2 Mar 2004 08:42:35 +0900

I was just reading over this draft, and had a couple of minor comments.

First, in client behavior, I don't think it's safe for the client to 
assume that the server supports the bootfile-name and extended remote 
boot option.   The client SHOULD request both the extended and reguler 
boot options, and leave it to the server to sort it out.   The client 
also needs to implement the hierarchy described in section 6 - if it 
gets both a bootfile-name and an extended remote boot option, it should 
prefer the latter.   You could address this either by combining 
sections 6 and 8 or by referring to section 6 in section 8.

In the security considerations section, the problems are actually worse 
than stated - it is possible to supply a valid boot image which will 
take over a client machine, instead of just doing a denial-of-service 
attack.

One other problem with this option is that it assumes that suboptions 
will not be combined - that is, that they are not subject to the 
combination technique described in rfc3396.   I'm not sure how to 
address this, but it's an issue - it complicates server handling of 
this option.

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg