Open Source Project DHCPv6 and CGA Interaction

1
Open Source Project DHCPv6 and CGA Interaction
Xiangyang GONG Xirong QUE Yang XIAO
Yuhong LI (Speaker)

• Beijing University of Posts Telecommunications
• HUAWEI

12/11/2009
CSI WG/IETF76
1
2
Contents

• Project Overview
• DHCPv6 and CGA Interaction
• CGA Generation Delegation Using DHCPv6
• Secure DHCPv6
• Implementations
• New Options is defined
• based on the Dibbler open source DHCPv6 platform
• Validations
• Future work

3
Project Overview

• Project began from Nov. 2008
• GPL-style License
• Code
• Plan to put at Google Code (http//code.google.co
  m)
• Platforms
• Linux Kernel 2.6.24.6, Ubuntu 8.04
• DHCPv6 server, Dibbler-0.7.3
• Extensions based on
• draft-jiang-dhc-secure-dhcpv6-02
• draft-jiang-csi-cga-config-dhcpv6-01
• draft-ietf-csi-dhcpv6-cga-ps-00

12/11/2009
CSI WG/IETF76
3
4
CGA Generation Delegation Using DHCPv6
Reference draft-jiang-csi-cga-config-dhcpv6 draft
-jiang-csi-dhcpv6-cga-ps
Function -Client provides parameters (eg Sec,
public key) to server. -Server generates CGA
address for client, and presents both address and
parameters in the IA option.
Solicit without rapid-commit option
Solicit with rapid-commit option
12/11/2009
CSI WG/IETF76
4
5
Secure DHCPv6
Function -Client provides parameters (e.g., Sec,
public key) to server. -Server generates CGA
address for client, and presents both address and
parameters in the IA option.
Reference draft-jiang-dhc-secure-dhcpv6 draft-jia
ng-csi-dhcpv6-cga-ps

• Interaction with relays

• Interaction directly

- CGA address can be verified by a receiver.
- a new type (type4) of field DUID is used to
carry the servers CGA address. - server/relay
can be verified.
6
DHCPv6 and CGA Interaction

• Three new options are defined in DHCPv6
• CGA_PARAMETER
• CGA_SIGNATURE
• Reference draft-jiang-dhc-secure-dhcpv6-02
• CGA_GENERATION_REQUEST
• Reference draft-jiang-csi-cga-config-dhcpv6-01

12/11/2009
CSI WG/IETF76
6
7
Implementations

• Based on open source DHCPv6 Server software
  Dibbler
• Seven modules of Dibbler
• are extended

8
Tests

• Two environments
• 36 testing cases
• Server ltgt Client
• Server ltgtRelay
• Relay ltgt Relay
• Client ltgt Relay

12/11/2009
CSI WG/IETF76
8
9
Test results

• CGA delegation
• Client sends Solicit/Request to server to require
  CGA
• Server responds Reply to client with CGA
• Secure DHCPv6 (Verification function)
• In all types of nodes (Client/Server/Relay),
  DHCPv6 message is considered secure only when CGA
  option Signature option can be verified.

10
Thanks!Questions/Comments?

• Contact us
• Xiangyang Gong xygong_at_bupt.edu.cn
• Xirong Que rongqx_at_bupt.edu.cn
• Yang Xiao xiaoyang007_at_gmail.com