RFC 6603

Prefix Exclude Option for DHCPv6-based Prefix Delegation

📅 published May 2012, from ietf

RFC 6603 💖 Prefix Exclude Option for DHCPv6-based Prefix Delegation

Okay bestie, this one is RFC 6603 🎀, and it's titled Prefix Exclude Option for DHCPv6-based Prefix Delegation. It's a Standards Track doc from May 2012 (ISSN 2070-1721). The authors are J. Korhonen (Ed.) from Nokia Siemens Networks, T. Savolainen from Nokia, S. Krishnan from Ericsson, and O. Troan from Cisco Systems, Inc. ✨ It updates RFC 3633, which is the big reason this one matters so much 👑

Part 1 of 2 🧚

Abstract 🌸

Okay so the big idea is this: the spec adds an optional way to carve exactly one specific prefix out of a delegated prefix set, but only when you're using DHCPv6-based prefix delegation. And this new mechanism updates RFC 3633 💅

Status of This Memo 📜

This one is an Internet Standards Track document 🌈

It's a product of the Internet Engineering Task Force (IETF) and it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 5741 ✨

Info about the current status of this doc, any errata, and how to send feedback is at http://www.rfc-editor.org/info/rfc6603 🦋

Copyright Notice 🔒

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can find at http://trustee.ietf.org/license-info as they stood on the publication date. Please actually read them, because they spell out your rights and restrictions for this doc 🙈 If you pull Code Components out of this doc, they have to include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License 💜

Table of Contents 🗺️

   1. Introduction ....................................................2
   2. Requirements and Terminology ....................................2
   3. Problem Background ..............................................3
   4. Solution ........................................................3
      4.1. Prefix Delegation with Excluded Prefixes ...................3
      4.2. Prefix Exclude Option ......................................4
   5. Delegating Router Solicitation ..................................6
      5.1. Requesting Router ..........................................6
      5.2. Delegating Router ..........................................6
   6. Requesting Router Initiated Prefix Delegation ...................7
      6.1. Requesting Router ..........................................7
      6.2. Delegating Router ..........................................8
   7. Security Considerations .........................................8
   8. IANA Considerations .............................................8
   9. Acknowledgements ................................................8
   10. References .....................................................9
      10.1. Normative References ......................................9
      10.2. Informative References ....................................9

1. Introduction 🌷

This spec defines an optional mechanism, plus the related DHCPv6 option, that lets you exclude one specific prefix from a delegated prefix set when you're doing DHCPv6-based prefix delegation 🦋

So here's the situation it's targeting. You've got deployments that use DHCPv6-based prefix delegation, but a single aggregated route or prefix needs to represent one customer. The alternative would be one prefix for the link between the delegating router and the requesting router, and a second prefix for the customer network. The new mechanism lets a delegating router take a prefix out of the delegated prefix set and use it on the link where it exchanges DHCPv6 messages with the requesting router. It's meant for networks where each requesting router sits on its own layer-2 domain ✨

2. Requirements and Terminology 📚

Here's the deal with the key words. "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in [RFC2119] 🤓

3. Problem Background 🧩

Okay this is the tea 🫖 DHCPv6 Prefix Delegation (DHCPv6-PD) [RFC3633] has an explicit limitation, described in Section 12.1 of [RFC3633]. A prefix delegated to a requesting router can't be used by the delegating router. That means the delegating router ends up with two routes towards a customer that can't be aggregated: one for the link between the requesting router and the delegating router, and one for the customer site behind the requesting router 💀

There are architectures and link models where a host (for example, a mobile router that also acts as a requesting router) always has a single /64 prefix configured on its uplink interface. The delegating router is also the requesting router's first-hop router. On top of that, the prefix on the uplink interface may need to be aggregatable with the delegated prefixes. That creates a problem: how do you use DHCPv6-PD together with stateless [RFC4862] or stateful [RFC3315] address autoconfiguration on a link where the advertised /64 is also part of the prefix delegated (say, a /56) to the requesting router? 😭

4. Solution 💡

4.1. Prefix Delegation with Excluded Prefixes 🎀

This spec defines a brand new DHCPv6 option called OPTION_PD_EXCLUDE (67). It's used to exclude exactly one prefix from a delegated prefix. The OPTION_PD_EXCLUDE goes inside the OPTION_IAPREFIX IAprefix-options field. There can be at most one OPTION_PD_EXCLUDE option in one OPTION_IAPREFIX option 🔥

This is what makes prefix delegation work here. A requesting router gets delegated a prefix (say, a /56). Then the delegating router uses one prefix (say, a /64) on the link where it exchanges DHCPv6 messages with that requesting router, and that /64 comes from the same delegated prefix set 🌈

A requesting router includes an OPTION_ORO option with the OPTION_PD_EXCLUDE option code in a Solicit, Request, Renew, or Rebind message. That tells the delegating router it supports the prefix delegation functionality in this spec ✨ A delegating router can also put the OPTION_PD_EXCLUDE option code in an OPTION_ORO option inside a Reconfigure message. That's how it signals that the requesting router should request OPTION_PD_EXCLUDE from the delegating router 🦋

The delegating router puts the excluded prefix (the one that's leaving the delegated prefix set) inside the OPTION_PD_EXCLUDE option. The requesting router MUST NOT assign that excluded prefix to any of its downstream interfaces 🚫

4.2. Prefix Exclude Option 🧁

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |       OPTION_PD_EXCLUDE       |         option-len            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  prefix-len   | IPv6 subnet ID (1 to 16 octets)               ~
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                           Prefix Exclude Option

Here are the fields of the Prefix Exclude Option, bestie 💜

option-code: OPTION_PD_EXCLUDE (67).
option-len: 1 + length of IPv6 subnet ID in octets. A valid option-len is between 2 and 17.
prefix-len: The length of the excluded prefix in bits. The prefix-len MUST be between 'OPTION_IAPREFIX prefix-length'+1 and 128.
IPv6 subnet ID: A variable-length IPv6 subnet ID up to 128 bits.

The IPv6 subnet ID holds prefix-len minus 'OPTION_IAPREFIX prefix-length' bits. Those bits get pulled out of the excluded prefix, starting at bit position 'OPTION_IAPREFIX prefix-length'. The extracted subnet ID MUST be left-shifted so it starts on a full octet boundary, meaning a left-shift of 'OPTION_IAPREFIX prefix-length' mod 8 bits. The subnet ID MUST also be zero-padded to the next full octet boundary 🌸

Here's how you'd encode the IPv6 subnet ID, written as C-like pseudocode:

     uint128_t p1;           // the delegated IPv6 prefix
     uint128_t p2;           // the excluded IPv6 prefix
     uint16_t a;             // the OPTION_IAPREFIX prefix-length
     uint8_t b;              // the excluded IPv6 prefix length
     uint8_t s;

     // sanity checks

     s = 128-a;              // size of non-prefix bits
     assert(b>a);            // b must be at least a+1
     assert(p1>>s == p2>>s); // p1 and p2 must share a common
                             // prefix of 'a' bits

     // calculate the option content

     uint16_t c = b-a-1;     // the IPv6_subnet_ID_length-1 in bits
     uint16_t d = (c/8)+1;   // the IPv6_subnet_ID_length in octets
     uint128_t p = p2<<a;    // p is the IPv6 subnet ID that has the
                             // common p1 prefix left-shifted out to
                             // a full octet boundary (trailing bits
                             // are zeroed)

     // populate the option

     uint8_t* id = &OPTION_PD_EXCLUDE.IPv6_subnet_ID;
     OPTION_PD_EXCLUDE.option_len = d+1;
     OPTION_PD_EXCLUDE.prefix_len = b;

     while (d-- > 0) {
       *id++ = p>>120;
       p <<= 8;
     }

The OPTION_PD_EXCLUDE option MUST only be included in the OPTION_IAPREFIX IAprefix-options [RFC3633] field. Any prefix excluded from the delegated prefix MUST be contained in OPTION_PD_EXCLUDE options within the corresponding OPTION_IAPREFIX. 🫶

The prefix in the OPTION_PD_EXCLUDE option shares the same preferred-lifetime and valid-lifetime as the delegated prefix in the encapsulating OPTION_IAPREFIX option ⭐

The prefix in the OPTION_PD_EXCLUDE option MUST be part of the delegated prefix in the OPTION_IAPREFIX. For example, say the requesting router was earlier assigned 2001:db8:dead:beef::/64 by the delegating router, and the delegated prefix in the OPTION_IAPREFIX is 2001:db8:dead:bee0::/59. In that case, 2001:db8:dead:beef::/64 is a valid prefix to use in the OPTION_PD_EXCLUDE option. Here's how that option would be encoded 🧚

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |       OPTION_PD_EXCLUDE       |               2               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |       64      |0|1|1|1|1|0|0|0|
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                   ^         ^
                   |         |
                   |         +- 3 zero-padded bits follow
                   |
                   +- using C syntax: 0xef << (59 % 8)
                      Note: 59 mod 8 = 3

5. Delegating Router Solicitation 🔍

The requesting router finds and picks a delegating router the same way Section 11 [RFC3633] describes. This spec only covers the extra steps you need when you use the OPTION_PD_EXCLUDE option 💖

5.1. Requesting Router

okay so if the requesting router is doing the thing from Section 4.1, then it SHOULD include the OPTION_PD_EXCLUDE option code in the OPTION_ORO option in Solicit messages 💅✨

Once it gets Advertise message(s), the requesting router uses the prefix(es) it received in OPTION_PD_EXCLUDE, on top of the advertised prefixes, to pick the delegating router 🎀 The requesting router MUST proceed to the Prefix Delegation procedure described in Section 6.1. If the Advertise message did not include the OPTION_PD_EXCLUDE option, then the requesting router MUST fall back to normal behavior, as described in Section 11.1 of [RFC3633] 🫶

5.2. Delegating Router

so if the OPTION_ORO option in the Solicit message includes the OPTION_PD_EXCLUDE option code, the delegating router knows the requesting router supports this solution 👑 If the Solicit message also has an IA_PD option, the delegating router can delegate a prefix that includes the prefix already assigned to the requesting router's uplink interface 🦋 The delegating router puts the prefix originally, or to be, assigned to the requesting router in the OPTION_PD_EXCLUDE option, inside the OPTION_IAPREFIX IAprefix-option in the Advertise message 💖

If the OPTION_ORO option in the Solicit message does not include the OPTION_PD_EXCLUDE option code, then the delegating router MUST fall back to normal behavior, as described in Section 11.2 of [RFC3633] 🌸

If the OPTION_ORO option in the Solicit message includes the OPTION_PD_EXCLUDE option code but the delegating router does not support the solution described in this specification, then the delegating router acts as specified in [RFC3633] 💅

6. Requesting Router-Initiated Prefix Delegation ✨

The procedures in the following sections line up with Section 12 of [RFC3633] 🧚 In this specification, we only describe the extra steps needed when you use the OPTION_PD_EXCLUDE option 🎀

6.1. Requesting Router

the requesting router's behavior for OPTION_PD_EXCLUDE is mostly identical to the steps in Section 5.1. The difference is that it uses a DHCPv6 Request instead of a Solicit message 🦋 The requesting router SHOULD include the OPTION_PD_EXCLUDE option code in the OPTION_ORO option for DHCPv6 messages, as described in Section 22.7 of [RFC3315]. The requesting router SHOULD include the OPTION_PD_EXCLUDE option code in the OPTION_ORO option for DHCPv6 messages, as described in Section 22.7 of [RFC3315] (yes, it's said twice, it's giving emphasis 😭).

The requesting router uses a Release message to give the delegated prefix(es) back to a delegating router 💖 The prefix(es) being released MUST be included in the IA_PDs, along with the excluded prefix included in the OPTION_PD_EXCLUDE option. The requesting router MUST NOT use the OPTION_PD_EXCLUDE option to add an extra excluded prefix in the Release message for a prefix it originally got a valid binding for 🙈

The requesting router must create sink routes for the delegated prefixes, minus the excluded prefixes. This may be done by creating sink routes for delegated prefixes and more specific routes for the excluded prefixes 🌈

6.2. Delegating Router

the delegating router's behavior for OPTION_PD_EXCLUDE is more or less identical to the step in Section 5.2 🍓 The only difference is which DHCPv6 messages carry the OPTION_PD_EXCLUDE option 🫶

The delegating router may mark any prefix(es) in the IA_PD Prefix options in a Release message from a requesting router as 'available', excluding the prefix included in the OPTION_PD_EXCLUDE options. If the Release message contains a 'new' excluded prefix in any OPTION_PD_EXCLUDE option, the delegating router MUST send a Reply message with the Status Code set to NoBinding for that IA_PD option 💀

7. Security Considerations 🔥

Security considerations for DHCPv6 are in Section 23 of [RFC3315]. For DHCPv6 Prefix Delegation, they're in Section 15 of [RFC3633]. In particular, RFC 3633 gives recommendations for protecting against prefix delegation attacks 😱 This specification doesn't add any new security considerations beyond the ones RFC 3633 already covers 🛡️

8. IANA Considerations 🌷

A new DHCPv6 Option Code has been reserved from the "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" registry for DHCP Option Codes 🎀

   OPTION_PD_EXCLUDE   (67)

9. Acknowledgements 🫶

The authors want to thank Ralph Droms, Frank Brockners, Ted Lemon, Julien Laganier, Fredrik Garneij, Sri Gundavelli, Mikael Abrahamsson, Behcet Sarikaya, Jyrki Soini, Deng Hui, Stephen Jacob, Hemant Singh, Gaurav Halwasia, Lorenzo Colitti, and Tomasz Mrugalski for their valuable comments and discussions 💜

10. References 📚

10.1. Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC3315]  Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins,
              C., and M. Carney, "Dynamic Host Configuration Protocol
              for IPv6 (DHCPv6)", RFC 3315, July 2003.

   [RFC3633]  Troan, O. and R. Droms, "IPv6 Prefix Options for Dynamic
              Host Configuration Protocol (DHCP) version 6", RFC 3633,
              December 2003.

10.2. Informative References

   [RFC4862]  Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless
              Address Autoconfiguration", RFC 4862, September 2007.

Authors' Addresses 🦋

   Jouni Korhonen (editor)
   Nokia Siemens Networks
   Linnoitustie 6
   FI-02600 Espoo
   Finland

   EMail: jouni.nospam@gmail.com


   Teemu Savolainen
   Nokia
   Hermiankatu 12 D
   FI-33720 Tampere
   Finland

   EMail: teemu.savolainen@nokia.com


   Suresh Krishnan
   Ericsson
   8400 Decarie Blvd.
   Town of Mount Royal, QC
   Canada

   EMail: suresh.krishnan@ericsson.com


   Ole Troan
   Cisco Systems, Inc
   Oslo
   Norway

   EMail: ot@cisco.com

📦 where this page comes from

ietf: rfc6603 2012-05
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms