Re: ISC DHCP client and unsolicited DHCP options

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/17/2013 01:21 PM, Florian Weimer wrote:
> Somewhat surprisingly, ISC DHCP does not check if a server
> response contains options which have not been requested.  As a
> result, removing items from dhclient.conf (say, DNS servers or
> route requests) does not provide any additional security.
>
> This is not a CVE assignment request.  I just want to share this
> to give distributions the opportunity to update their
> configuration scripts (the actual interface configuration is
> implemented in shell, in case you wonder).  Upstream version 4.2.5
> adds additional environment variables which allow the script to
> check what was requested in dhclient.conf:
>
> | - The client now passes information about the options it
> requested |   from the server to the script code via environment
> variables. |   These variables are of the form
> requested_<option_name>=1 with |   the option name being the same
> as used in the new_* and old_* |   variables. |   [ISC-Bugs
> #29068]
>
> (Using NetworkManager may still bypass dhclient.conf settings, see 
> Debian bug 717158.)

Do any DHCP clients process and use options passed to them that are
not explicitly wanted? Might be worth setting up a DHCP server that
hands out every possible options (there's a lot) and see what happens
on various clients.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJR53CoAAoJEBYNRVNeJnmTGw0P/ifiXZNt56f0JaBOaq4J3ZOM
xQICpvZiOJ5meCYyVwJHxB3Ket4GXxEjLlwFi4RTWc5So5tlH9diINQq4q1oeUHF
ajOs2vb0dXA7bxUOaug2BU+35GQYncQ9ns4XcP0U0aMP23z7JAolXcwkELM3TN3p
kQICLwdcPK/x9zT8avmX37LTE41N0zSltxVRxw60iTy1QyHwlFVP+VG8VHNKeu+i
20zUsVpMUajhwzOm1xnzvJIjSdlZrVBMcLNorFRlbDkqKZpwAd50IfSAvGmcbpfu
JlZUn+xJfGLSNhjx7TvbuLAaADUUH0ZVOYkHvkFGp4wPvYpwLnDMkWUiN+TdUyD2
rKQa5SEDIQ45YeZLhAIwAimabQdMUOYLnCQXMlWlryJK4Oog3X8eBaQMwKuxlMfm
6pbSrBrfdfhPwFjLaUXEQCwHb4IKNDp3pH32/WyDuo49D7q0iRAQrZg3gQ0N0cg7
Ua9YtUt5FJNqkDE7M26ANjrgPCONHgqOXvvH1qAWvTiNpxDtKwwOykwVAYQ4yAcP
A3wvmJ5WsUj6o10toTfuNrlZzj37eqY1ppiyd9e9J36fQ82Tl2FkQcWTJhDxu3Dc
ah6ymoXURH/d2JdTHdUvIgBFoRjHmZNWSMzPjt/50p5RdhfP/jgujlO5g6Me4KTa
lLAMAGNWCipXHmCCGamO
=LDL/
-----END PGP SIGNATURE-----