Bug? INFORM and REQUEST getting ACK'ed with different DNS server lists (3.0.4, 3.1.1, 3.1.2)

[David W. Hankins]

On Tue, Feb 03, 2009 at 06:35:58PM +0100, Axel Beckert wrote:
> As far as I understand DHCP there should be no difference in any of
> the server lists equal if the query was a DHCP REQUEST or a DHCP
> INFORM packet.

There is a strange MUST in RFC 2131 that says a DHCP server "MUST
NOT check for an existing lease" when processing a DHCPINFORM.  My
interpretation is that we can't source the client's dynamic lease, and
therefore can't pull any information from lease binding scopes or the
pool it belongs to.  We can't source fixed-address host records
("static leases" are still leases).

So, yes, DHCPREQUEST and DHCPINFORM results start looking different.

I would have to say that it is completely strange that the protocol
would make such a demand, and I am not suggesting you are wrong for
complaining.  It's just that we're looking at a bug in the protocol's
documentation, which the software is correctly implementing.

I've written a draft that, among other problems with DHCPINFORM,
seeks a standard statement that the intention is not to inspect
nor extend "lease times" (said another way, DHCPINFORM stands outside
of the client's state engine), not to limit the extent to which the
server can select and manufacture configuration appropriate to that
node.

It's been accepted as a WG item, and I need to get some time to
attend to its needs.

So, there is progress, if it has been a long time coming.

We'll have to see what happens as it progresses towards RFC.


Workarounds;

If you're looking at Windows boxes, the reason they are DHCPINFORMing
may be because 'Windows Industry Updater' wants to find a WPAD option.
It is kind of a security risk to let it try, so you are actually in
a better position if you give a WPAD 'poison pill' at DHCPREQUEST
time.

  http://www.mercenary.net/blog/index.php?/archives/42-HOWTO-WPAD.html

No DHCPINFORM, no fallbacks to DNS queries to find WPAD, no problems.

-- 
David W. Hankins	"If you don't do it right the first time,
Software Engineer		     you'll just have to do it again."
Internet Systems Consortium, Inc.		-- Jack T. Hankins
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/dhcp-users/attachments/20090203/0b87b1ba/attachment.bin>