RFC 7037
RADIUS Option for the DHCPv6 Relay Agent
RFC 7037: RADIUS Option for the DHCPv6 Relay Agent 🎀
- Number: RFC 7037
- Series: Internet Engineering Task Force (IETF)
- Authors: L. Yeh (Freelancer Technologies) and M. Boucadair (France Telecom)
- Category: Standards Track
- ISSN: 2070-1721
- Date: October 2013
- Obsoletes/Updates: The title block doesn't list anything this RFC obsoletes or updates.
Abstract ✨
okay so the DHCPv6 RADIUS option is basically a way for the DHCPv6 relay agent and the DHCPv6 server to swap authorization and identification info 💖 The setup assumes the Network Access Server (NAS) is doing double duty as both a DHCPv6 relay agent and a RADIUS client. When it gets messages from DHCPv6 clients, the NAS checks in with the RADIUS server and tacks the RADIUS response onto the client's message as it forwards it to the DHCPv6 server. The server then uses that extra info to build the right response to the client's requests. slay 👑
Status of This Memo 🦋
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7037.
Copyright Notice 🌸
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, since they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
Table of Contents 🧚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology and Language . . . . . . . . . . . . . . . . . . 3
3. Network Scenarios . . . . . . . . . . . . . . . . . . . . . . 3
4. DHCPv6 RADIUS Option . . . . . . . . . . . . . . . . . . . . 6
4.1. RADIUS Attributes Permitted in DHCPv6 RADIUS Option . . . 7
5. DHCPv6 Relay Agent Behavior . . . . . . . . . . . . . . . . . 7
6. DHCPv6 Server Behavior . . . . . . . . . . . . . . . . . . . 7
7. DHCPv6 Client Behavior . . . . . . . . . . . . . . . . . . . 7
8. Security Considerations . . . . . . . . . . . . . . . . . . . 8
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 9
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 9
11.1. Normative References . . . . . . . . . . . . . . . . . . 9
11.2. Informative References . . . . . . . . . . . . . . . . . 101. Introduction ✨
DHCPv6 is the protocol that lets a server assign or delegate both stateful and stateless configuration parameters to clients 🦋 The stateful stuff includes IPv6 addresses [RFC3315] and IPv6 prefixes [RFC3633]. The stateless parameters [RFC3736] include things like DNS [RFC3646], or the Fully Qualified Domain Name (FQDN) of an Address Family Transition Router (AFTR) [RFC6334]. In the scenarios this document describes, the DHCPv6 server lives in the central part of an ISP network 🌸
RADIUS [RFC2865] is widely used as the centralized authentication, authorization, and user management mechanism for service provision in a Broadband access network 💜 [RFC3162], [RFC4818], [RFC6519], and [RFC6911] specify the attributes that support service provision for IPv6-only and IPv6-transition access. The RADIUS server authorizes the Network Access Server (NAS) to assign an IPv6 address or prefix from the indicated pool, or to assign an IPv6 address or prefix with an explicitly indicated value. It can also indicate other configuration parameters based on the RADIUS attributes for the subscribers.
When the NAS acts as the distributed DHCPv6 server and RADIUS client at the same time, it talks to the RADIUS server after receiving a request from the DHCPv6 client. Once it gets the Access-Accept message from the RADIUS server, the NAS responds to the DHCPv6 client's requests according to the authorization information in the RADIUS attributes of that Access-Accept message. When the NAS acts as the DHCPv6 relay agent and RADIUS client at the same time, and the centralized DHCPv6 server is co-located with the RADIUS server, they may share the same database of users. However, when the centralized DHCPv6 server is not in the same place as the RADIUS server, a new communication mechanism is needed. That mechanism lets the DHCPv6 relay agent pass the authorization information from the RADIUS attributes along to the DHCPv6 server ✨
2. Terminology and Language 💅
This document specifies a new DHCPv6 option. The DHCPv6 Relay Agent uses it to transfer the authorization information from the RADIUS attributes in the Access-Accept message (sent by the RADIUS server) over to the centralized DHCPv6 server. Terms and acronyms that aren't defined in this document are defined in [RFC2865] and [RFC3315].
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Those are the words that carry the rules, so keep an eye out for them 🍓
3. Network Scenarios 🦋
okay so, figures 1 and 2 show the typical network scenarios where this communication mechanism is actually needed 😭🫶 in these setups the centralized DHCPv6 server is NOT chilling with the RADIUS server, but they're both in the same administrative domain. the NAS is doing double duty as the DHCPv6 relay agent AND the RADIUS client at the same time, which is so iconic 💅 figure 1 shows the DHCPv6 and RADIUS messages for the IP over Ethernet (IPoE) access model when the access loop uses direct Ethernet encapsulation, and figure 2 shows the same vibe for the PPP over Ethernet (PPPoE) access model.
the mechanism in this document is generic, so it could also be used in other network scenarios where the DHCPv6 relay agent and the RADIUS client live in the same device ✨
+-------+ +-------+ +-------+
|DHCPv6 | Access Model: | NAS | |RADIUS |
|Client | IPoE | | |Server |
+-------+ +-------+ +-------+
RADIUS Client/DHCPv6 Relay Agent
| | |
|---Solicit---------------->| |
| |---Access-Request---------->|
| | |
| |<--Access-Accept------------|
| |(e.g. Delegated-IPv6-Prefix)|
| | |
DHCPv6 messages RADIUS messages
+-------+
|DHCPv6 |
|Server |
+-------+
| | |
| |---Relay-forward----------->|
| | (OPTION_RADIUS) |
| | |
| |<--Relay-reply -------------|
|<--Advertise---------------| |
| (e.g., IA_PD) | |
| | |
|---Request---------------->| |
| (e.g., IA_PD) |---Relay-forward----------->|
| | (OPTION_RADIUS) |
| | |
| |<--Relay-reply -------------|
|<--Reply-------------------| |
| (e.g., IA_PD) | |
| | |
DHCPv6 messages DHCPv6 messages
Figure 1: Network Scenario and Message Sequence When Employing DHCPv6
RADIUS Option in IPoE Access+-------+ +-------+ +-------+
|DHCPv6 | Access Model: | NAS | |RADIUS |
|Client | PPPoE | | |Server |
+-------+ +-------+ +-------+
RADIUS Client/DHCPv6 Relay Agent
| | |
|--PPP LCP Config-Request-->| |
| |---Access-Request---------->|
| | |
| |<--Access-Accept------------|
|<----PPP LCP Config-ACK----|(e.g. Delegated-IPv6-Prefix)|
| | |
PPP messages RADIUS messages
+-------+
|DHCPv6 |
|Server |
+-------+
| | |
|---Solicit---------------->| |
| |---Relay-forward----------->|
| | (OPTION_RADIUS) |
| | |
| |<--Relay-reply -------------|
|<--Advertise---------------| |
| (e.g., IA_PD) | |
| | |
|---Request---------------->| |
| (e.g., IA_PD) |---Relay-forward----------->|
| | (OPTION_RADIUS)
| | |
| |<--Relay-reply -------------|
|<--Reply-------------------| |
| (e.g., IA_PD) | |
| | |
DHCPv6 messages DHCPv6 messages
Figure 2: Network Scenario and Message Sequence When Employing DHCPv6
RADIUS Option in PPPoE Accessif RADIUS authentication or authorization fails, the message sequences just stop 🙅♀️ the NAS acting as the DHCPv6 relay agent will not forward the message it got from the client to the DHCPv6 server. but if RADIUS authentication or authorization passes, the NAS MUST store the information from the RADIUS attributes it received in the Access-Accept message from the RADIUS server for the whole session 🔐 how the NAS manages that info during the RADIUS session is out of scope for this document, so that's a vibe for another day.
once the DHCPv6 client sends a RENEW (5) message, the NAS SHOULD NOT start a new Access-Request/Access-Accept exchange with the RADIUS server 🌸 but when the DHCPv6 client sends a REBIND (6) message, the NAS MUST start a new Access-Request/Access-Accept exchange with the RADIUS server, unless RADIUS capability is disabled on the NAS. the difference between those two is giving main character energy 👑
4. DHCPv6 RADIUS Option 🎀
OPTION_RADIUS is a DHCPv6 option that the DHCPv6 relay agent uses to carry the authorization information from RADIUS attributes it got in the Access-Accept message from the RADIUS server 💜 its format is defined like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_RADIUS | option-len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| option-data (List of RADIUS Attributes)
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+option-code 81
option-len Length of the option-data in octets
option-data List of one or more RADIUS attributesso the option-data is a list of one or more RADIUS attributes that came in the Access-Accept message from the RADIUS server 🧚 the format of those attributes is defined in Section 5 of [RFC2865] and also in Sections 2.1 and 2.2 of [RFC6929]. if there are multiple attributes with the same type (this includes the Long Extended Type from Section 2.2 of [RFC6929]), the order of those same-type attributes MUST be the same as the order the RADIUS server sent them in ⏱️ and OPTION_RADIUS can ONLY contain the RADIUS attributes listed in the "RADIUS Attributes Permitted in DHCPv6 RADIUS Option" registry, so no sneaking in extras 🙅♀️
based on the network scenarios from Section 3, OPTION_RADIUS should appear in the RELAY-FORW (12) message that relays SOLICIT (1), REQUEST (3), and REBIND (6) from the DHCPv6 client, and it may appear in the RELAY-FORW (12) that relays any other message from the DHCPv6 client 💅
4.1. RADIUS Attributes Permitted in DHCPv6 RADIUS Option 🌈
the RADIUS attributes in the table below are the initial attributes registered in the "RADIUS Attributes Permitted in DHCPv6 RADIUS Option" registry 🍓 new RADIUS attributes can be added to this list after Expert Review [RFC5226].
Type Code Attribute Reference
26 Vendor-Specific [RFC2865]
123 Delegated-IPv6-Prefix [RFC4818]
144 DS-Lite-Tunnel-Name [RFC6519]
168 Framed-IPv6-Address [RFC6911]
169 DNS-Server-IPv6-Address [RFC6911]
171 Delegated-IPv6-Prefix-Pool [RFC6911]
172 Stateful-IPv6-Address-Pool [RFC6911]Note: the RADIUS attribute's 'Length' defined in Section 5 of [RFC2865] includes the length of the 'Type' and 'Length' fields. don't forget this one, bestie 🙈
5. DHCPv6 Relay Agent Behavior 💖
if the Relay Agent is configured to send OPTION_RADIUS, AND the Access-Accept message from the RADIUS server had RADIUS attributes that are permitted for use in OPTION_RADIUS, then the Relay Agent MUST include OPTION_RADIUS in the RELAY-FORW (12) message 🫶 the DHCPv6 relay agent adds the permitted RADIUS attributes into OPTION_RADIUS one by one. and if multiple attributes have the same type, their order MUST be the same as the order the RADIUS server sent them ✨
6. DHCPv6 Server Behavior 🦋
when a DHCPv6 server gets a RELAY-FORW (12) message with OPTION_RADIUS from a relay agent, the server that supports OPTION_RADIUS SHOULD extract and interpret the RADIUS attributes in OPTION_RADIUS, and then use that info to pick configuration parameters for the requesting client 👑 but if the DHCPv6 server does NOT support OPTION_RADIUS, it MUST silently discard this option 🤫
7. DHCPv6 Client Behavior 🌸
OPTION_RADIUS is only exchanged between the relay agents and the servers 💜 DHCPv6 clients are not aware of OPTION_RADIUS at all, so it's not their business 😌 DHCPv6 clients MUST NOT send OPTION_RADIUS, and they MUST ignore OPTION_RADIUS if they happen to receive it 🙅♀️💅
8. Security Considerations 🔐
Okay bestie, security time 🔐 DHCPv6 and RADIUS both have their own known vulnerabilities, and those can apply to their options too 😬. The DHCPv6 security stuff is in Section 23 of [RFC3315]. The RADIUS stuff is in Section 8 of [RFC2865], Section 5 of [RFC3162], and Section 11 of [RFC6929] 📚.
The mechanism in this document might open a brand new attack vector against the DHCPv6 server if the DHCPv6 relay agent gets compromised 💀. If an attacker forges the RADIUS attributes inside the OPTION_RADIUS of RELAY-FORW (12) messages, they can mess with the parameter assignment the DHCPv6 server gives to clients 🙈. BUT, as described in the Section 3, the NAS always belongs to the same administrative domain as the DHCPv6 server in a real deployment, so it's not as scary as it sounds 🫶.
Network admins, heads up: RADIUS messages are encrypted, but DHCPv6 messages are always unencrypted 🔓. Some RADIUS vendor-specific attributes might contain sensitive or confidential info, so admins are strongly advised to keep that stuff out of DHCPv6 messages 🚫.
If you really need vendor-specific attributes with confidential content, admins are advised to use IPsec with encryption to protect the confidentiality of the RADIUS attributes. Relay agents and servers implementing this specification MUST support the use of IPsec Encapsulating Security Payload (ESP) with encryption in transport mode, according to Section 3.1.1 of [RFC4303] and Section 21.1 of [RFC3315] ✨🔐
9. IANA Considerations 🌸
IANA has assigned OPTION_RADIUS (81) in the "DHCP Option Codes" registry, as defined in Section 4. IANA also created a brand new registry called "RADIUS Attributes Permitted in DHCPv6 RADIUS Option" in the "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" registry, as defined in Section 4.1 💅.
That new registry enumerates the RADIUS Attributes Types (http://www.iana.org/assignments/radius-types) that are permitted for inclusion in the DHCPv6 RADIUS option. Its allocation policy is Expert Review per [RFC5226]. Designated experts should carefully consider the security implications of allowing the relay agent to include new RADIUS attributes in this registry 🧐
10. Acknowledgements 🫶
Huge thanks to Tomek Mrugalski, Bernie Volz, Gaurav Halwasia, and Roberta Maglione for their thorough review comments on the DHC working group mailing list 💜. Thanks also to Ted Lemon for his continuous encouragement and technical guidance 🌈
11. References 📚
11.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)", RFC
2865, June 2000.
[RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C.,
and M. Carney, "Dynamic Host Configuration Protocol for
IPv6 (DHCPv6)", RFC 3315, July 2003.
[RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC
4303, December 2005.
[RFC4818] Salowey, J. and R. Droms, "RADIUS Delegated-IPv6-Prefix
Attribute", RFC 4818, April 2007.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226,
May 2008.
[RFC6519] Maglione, R. and A. Durand, "RADIUS Extensions for Dual-
Stack Lite", RFC 6519, February 2012.
[RFC6911] Dec, W., Sarikaya, B., Zorn, G., Miles, D., and B.
Lourdelet, "RADIUS Attributes for IPv6 Access Networks",
RFC 6911, April 2013.
[RFC6929] DeKok, A. and A. Lior, "Remote Authentication Dial In User
Service (RADIUS) Protocol Extensions", RFC 6929, April
2013.11.2. Informative References
[RFC3162] Aboba, B., Zorn, G., and D. Mitton, "RADIUS and IPv6", RFC
3162, August 2001.
[RFC3633] Troan, O. and R. Droms, "IPv6 Prefix Options for Dynamic
Host Configuration Protocol (DHCP) version 6", RFC 3633,
December 2003.
[RFC3646] Droms, R., "DNS Configuration options for Dynamic Host
Configuration Protocol for IPv6 (DHCPv6)", RFC 3646,
December 2003.
[RFC3736] Droms, R., "Stateless Dynamic Host Configuration Protocol
(DHCP) Service for IPv6", RFC 3736, April 2004.
[RFC6334] Hankins, D. and T. Mrugalski, "Dynamic Host Configuration
Protocol for IPv6 (DHCPv6) Option for Dual-Stack Lite",
RFC 6334, August 2011.Authors' Addresses 🦋
Leaf Y. Yeh
Freelancer Technologies
P. R. China
EMail: leaf.yeh.sdo@gmail.com
Mohamed Boucadair
France Telecom
France
EMail: mohamed.boucadair@orange.com📦 where this page comes from
- ietf: rfc7037 2013-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms