RFC 6422
Relay-Supplied DHCP Options
Internet Engineering Task Force (IETF) ✨ T. Lemon, Nominum 🎀 Q. Wu, Huawei 💖
Request for Comments: 6422 🌸 Updates: 3315 🦋 Category: Standards Track 👑 ISSN: 2070-1721 ⭐ December 2011 🍓
1. Relay-Supplied DHCP Options 💅
Abstract 🫶
okay so bestie, DHCPv6 relay agents literally can't talk to DHCPv6 clients directly 😭 but sometimes the relay agent knows stuff the client would love to have. This doc describes a way for the relay agent to pass that info to the DHCPv6 server, and then the server can pass it along to the DHCP client. It's giving teamwork 🧚
This document also updates RFC 3315 (DHCPv6) by making explicit an implicit requirement: relay agents must not modify the content of encapsulation payloads as they're relayed back toward clients. Iconic behaviour, no cap 🔥
Status of This Memo 🌈
This is an Internet Standards Track document. ✨
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. 💜
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6422. 🎀
Copyright Notice 🦋
Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved. 🌸
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. 💅
Table of Contents 🧚
1. Introduction ....................................................2
1.1. Requirements Language ......................................3
1.2. Terminology ................................................3
2. Protocol Summary ................................................3
3. Encoding ........................................................3
4. RSOO-Enabled Options ............................................4
5. DHCP Relay Agent Behavior .......................................4
6. DHCP Server Behavior ............................................5
7. Security Considerations .........................................6
8. IANA Considerations .............................................7
9. References ......................................................7
9.1. Normative References .......................................7
9.2. Informative References .....................................71. Introduction ✨
okay so the DHCPv6 spec [RFC3315] lets DHCP relay agents forward DHCPv6 messages between clients and servers that aren't on the same IPv6 link. Lowkey genius 🧠 Sometimes the relay agent has info the DHCP server doesn't have, and that info would be super useful for the client. For example, the client might need to learn the EAP Re-authentication Protocol (ERP) local domain name [RFC6440] for EAP re-authentication [RFC5296]. The relay knows it, the server doesn't. Main character energy for the relay 💖
The DHCPv6 protocol spec doesn't have a way for the relay agent to give options to the client. So this document adds a mechanism that lets DHCP relay agents propose options for the server to send to DHCP clients. 🦋
This doc is NOT meant to be a general way of storing client config info in the relay agent 🙅♀️ It's for specific use cases where only the relay agent has the info the client needs. This extension isn't for DHCP options in general. It's a tool for new specs that need this functionality. 🌸
1.1. Requirements Language 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 💜
1.2. Terminology 🍓
The following terms and acronyms are used in this document: 🧚
- DHCP: Dynamic Host Configuration Protocol Version 6 [RFC3315] 💅
- RSOO: Relay-Supplied Options option 🦋
2. Protocol Summary 🌈
DHCP clients don't support a way to receive options from relay agents. The relay agent is REQUIRED to deliver the payload from the DHCP server to the DHCP client without changing it. 😭 So, for the relay agent to give options to the client, it sends those options to the DHCP server, wrapped up in an RSOO. Then the DHCP server can choose to put those options in the response it sends to the client. Slay 👑
3. Encoding 🦋
To supply options for the DHCP server to send to the client, the relay agent sends an RSOO in the Relay-Forward message. This option wraps up whatever options the relay agent wants to give the DHCPv6 server. 🎀
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_RSOO | option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| options...
+-+-+-+-+-+-+-+-+-+-+-+OPTION_RSOO💖 is the Relay-Supplied Options code (66).option-length🌸 is the length of the RSOO.options🧚 is one or more DHCPv6 options.
4. RSOO-Enabled Options 💜
The RSOO MUST NOT contain any option that isn't specifically called out as an RSOO-enabled option. Specifications that describe RSOO-enabled options MUST reference this specification, and MUST state that the option they define is RSOO-enabled. No DHCP option specified before this specification was issued is RSOO-enabled. 🙅♀️
A current list of RSOO-enabled options can be found in the list titled "Options Permitted in the Relay-Supplied Options Option" maintained at http://www.iana.org/. 🍓
DHCP option specs that define RSOO-enabled options MUST add text similar to the following to their IANA Considerations section. "random relay option" should be swapped out with the name of the option being defined in the spec: 🦋
We request that IANA add the name "random relay option" to the
registry titled "Options Permitted in the Relay-Supplied Options
Option" maintained at http://www.iana.org/.5. DHCP Relay Agent Behavior 🌈
Relay agents MAY include an RSOO in the option payload of a Relay-Forward message being sent toward a DHCP server. When relaying the payload of Relay-Reply messages toward clients, relay agents MUST NOT modify the payload. 💅
Relay agents MUST NOT send non-RSOO-enabled options in the Relay-Supplied Options option. 🙅♀️
So network admins can control the flow of RSOO options onto the network, relay agents that implement the Relay-Supplied Options option need a configuration parameter. It decides whether or not they'll relay Relay-Forward messages containing RSOOs. 🎀
Relay agents with this configuration parameter that are set to disable forwarding of a Relay-Forward message containing an RSOO MUST silently discard any such message. 💀
Implementations that can be configured this way MUST examine all Relay-Forward encapsulations, not just the outer encapsulation. 👑
6. DHCP Server Behavior 👑
DHCP servers that implement this protocol spec MUST examine each option contained in an RSOO to see if it's an RSOO-enabled option. DHCP servers MUST silently discard any option in an RSOO that isn't RSOO-enabled. DHCP server implementations SHOULD have an administrator-configurable list of RSOO-enabled options, so new RSOO-enabled options don't require a software update. ✨
DHCP servers normally build a list of options that are candidates to send to the DHCP client, and then build the DHCP packet according to Section 17.2.2 of the DHCPv6 spec [RFC3315]. 🦋
If the server implementing this protocol spec receives an RSOO, it SHOULD add any options that appear in the RSOO for which it has no internal candidate to the list of candidate options to send to the DHCP client. The server SHOULD discard any options that appear in the RSOO for which it already has one or more candidates. 🫶
Aside from adding options from the RSOO, the DHCP server should then build a DHCP packet as it normally would, and transmit it to the DHCP client as described in [RFC3315]. 💖
DHCP servers may receive multiply-nested Relay-Forward messages containing conflicting values for options contained in RSOOs in these messages. 🌸
When a conflict like that exists, the DHCP server MUST choose no more than one of these options to forward to the client. The DHCP server MUST NOT forward more than one of these options to the client. This is non-negotiable, bestie 😭🔥
By default, the DHCP server MUST choose the innermost value (the value supplied by the relay agent closest to the DHCP client) to forward to the DHCP client. 🧚
DHCP server implementations MAY provide other heuristics for choosing which one of a set of such conflicting options to forward to the client, as long as the specified behaviour is the default behaviour. 🌈
7. Security Considerations ✨
okay bestie, this section is SERIOUS but also kind of iconic 💅 so let's gooo. 🔥
This document lets a relay agent slip options into the response the DHCP server sends back to the DHCP client. 🎀 In the use cases we know about right now, like the ERP Local Domain Option [RFC6440], RSOO-enabled options only ever start on a relay agent. 🧚 They literally don't make sense coming from a DHCP server, so it's giving "relay-only" energy. 💖
If some new RSOO-enabled option ever gets specified that can come from either the server OR the relay agent, the Security Considerations section of that document needs to deal with it. 🫶 That's the rule, no cap. 🌸
Now here's the drama. 😭 In some environments there's an interface where one side is the client (plus zero or more routers), and the other side is a network run by one monolithic, or basically monolithic, administrative entity. 🏰 The nodes and routers on the client side aren't controlled by that entity, so they're considered "untrusted". 🙈 The nodes and routers on the network side are considered trusted. 👑
A malicious node acting as a relay agent on the untrusted side could send an RSOO containing one or more RSOO-enabled options that override the same option(s) a relay agent on the trusted side provided. 💀 That's a whole main-character villain arc. 🦹
In environments where this is possible, network administrators are advised to use relay agents that can drop Relay-Forward messages containing the RSOO, and to configure those relay agents to drop such messages. 🛡️ Please, please do this. 😭
BUT. 🥺 Dropping those messages only works if the message from the DHCP server to the DHCP client is authenticated, as specified in Section 21 of [RFC3315], or with some similar mechanism. 🔐 Without that authentication, the malicious node on the untrusted side can just modify the DHCP server's response on its way back to the DHCP client, and the client has no way to notice it happened. 😱 Unreal. 💀
8. IANA Considerations 🦋
okay so IANA has assigned one new DHCPv6 option code from the registry of DHCP Option Codes maintained at http://www.iana.org/. 🌈 The option code 66 (OPTION_RSOO) is now assigned to the Relay-Supplied Options option. 🎀✨
IANA also made a brand-new registry on the same assignments page, titled "Options Permitted in the Relay-Supplied Options Option". 💜 This registry lists every code point from the DHCP Option Codes table that's allowed to show up in the RSOO. 🍓 Options can be added to it after IETF Review [RFC5226]. ✅ When you add an option, make sure its description in the registry matches the description in the DHCP Option Codes table for that code. 🫶 And if an option code hasn't been requested to be added through that process, don't mention it in the table at all, and don't list it as "reserved" or "unassigned". 🙅♀️ Not me being extra about it. 💅
IETF Review has to carefully think through the security implications of letting a relay agent supply a value for any option being considered for this registry. 🔍 And if there's an IETF working group chartered to review DHCP protocol extensions, some other working group can't just rubber-stamp the registry addition. 🙅♀️ That working group has to be the one reviewing it. 👑
9. References 📚
9.1. Normative References
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC3315] Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins, C., and M. Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003.
- [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.
9.2. Informative References
- [RFC5296] Narayanan, V. and L. Dondeti, "EAP Extensions for EAP Re-authentication Protocol (ERP)", RFC 5296, August 2008.
- [RFC6440] Zorn, G., Wu, Q., and Y. Wang, "The EAP Re-authentication Protocol (ERP) Local Domain Name DHCPv6 Option", RFC 6440, December 2011.
Authors' Addresses 💌
Ted Lemon Nominum 2000 Seaport Blvd. Redwood City, CA 94063 USA
Phone: +1 650 381 6000 EMail: mellon@nominum.com
Qin Wu Huawei Technologies Co., Ltd. 101 Software Avenue, Yuhua District Nanjing, Jiangsu 210012 China
Phone: +86-25-56623633 EMail: sunseawq@huawei.com
📦 where this page comes from
- ietf: rfc6422 2011-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms