Simple Network Time Protocol (SNTP) Configuration Option for DHCPv6
Extracted elements (11)
The option is defined only for IPv6 SNTP servers; configuration of IPv4 SNTP servers is handled by RFC 2132. Mechanisms for dual-stack IPv4/IPv6 configuration were under consideration but not specified in this document.
The server MAY list SNTP servers in decreasing order of preference, making the ordered-list requirement meaningful for clients that prefer the first available server.
Clients MUST treat the list of SNTP servers as an ordered list.
If the SNTP servers option appears in DHCPv6 messages other than those permitted, the receiver SHOULD ignore it.
The option number for OPTION_SNTP_SERVERS MAY appear in the Option Request Option in Solicit, Request, Renew, Rebind, Information-Request, and Reconfigure messages. If it appears in the Option Request Option in other messages, the receiver SHOULD ignore it.
The SNTP servers option MUST NOT appear in DHCPv6 messages other than Solicit, Advertise, Request, Renew, Rebind, Information-Request, and Reply.
To avoid rogue SNTP server attacks, the DHCPv6 client SHOULD use authenticated DHCPv6 as specified in the DHCPv6 specification.
The SNTP servers option (OPTION_SNTP_SERVERS, code 31) provides a list of one or more IPv6 addresses of SNTP servers available to the DHCPv6 client for time synchronization. The option-len field indicates the total length of the SNTP server address fields in octets and must be a multiple of 16.
IANA assigned option code 31 (OPTION_SNTP_SERVERS) from the DHCPv6 option-code space defined in the DHCPv6 specification (RFC 3315).
A rogue DHCPv6 server could use the SNTP servers option to direct clients to a malicious SNTP server, causing incorrect time synchronization. This can compromise time-critical security mechanisms such as certificate validity checking and replay attack prevention via timestamps.
The SNTP servers option encodes a 16-bit option-code field (OPTION_SNTP_SERVERS = 31), a 16-bit option-len field (must be a multiple of 16 octets), followed by one or more 128-bit (16-octet) IPv6 addresses of SNTP servers.