RFC 7839
Access-Network-Identifier Option in DHCP
1. Introduction ✨
Okay bestie, so this is RFC 7839 🎀, Access-Network-Identifier Option in DHCP, and it's a Standards Track doc from the IETF (Internet Engineering Task Force) 🌸. It was published in June 2016 with ISSN 2070-1721. The authors are S. Bhandari, S. Gundavelli, M. Grayson, and B. Volz from Cisco Systems, plus J. Korhonen from Broadcom Limited 💜. The header doesn't list anything it obsoletes or updates, so it's not replacing or changing any other RFC 🙈.
Abstract 🫧
This doc spells out the format and mechanism for encoding Access-Network Identifiers in DHCPv4 and DHCPv6 messages. It does that by defining new Access-Network-Identifier options and sub-options 🧚.
Status of This Memo 📜
This is an Internet Standards Track document 💅.
It's a product of the IETF and represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 7841 🫶.
For the current status, any errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc7839 ✨.
Copyright Notice ©️
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved 🌈.
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were in effect on the date of publication. Please read these carefully, because they lay out your rights and restrictions for this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 🙏.
Table of Contents 📚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Motivation . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
4. DHCPv4 Access-Network-Identifier Option . . . . . . . . . . . 5
4.1. DHCPv4 Access-Network-Identifier Sub-options . . . . . . 5
4.2. DHCPv4 Access-Technology-Type Sub-option . . . . . . . . 6
4.3. DHCPv4 Network-Identifier Sub-options . . . . . . . . . . 7
4.3.1. DHCPv4 Network-Name Sub-option . . . . . . . . . . . 7
4.3.2. DHCPv4 Access-Point-Name Sub-option . . . . . . . . . 8
4.3.3. DHCPv4 Access-Point-BSSID Sub-option . . . . . . . . 9
4.4. DHCPv4 Operator-Identifier Sub-options . . . . . . . . . 9
4.4.1. DHCPv4 Operator-Identifier Sub-option . . . . . . . . 9
4.4.2. DHCPv4 Operator-Realm Sub-option . . . . . . . . . . 10
5. DHCPv6 Access-Network-Identifier Options . . . . . . . . . . 10
5.1. DHCPv6 Access-Technology-Type Option . . . . . . . . . . 11
5.2. DHCPv6 Network-Identifier Options . . . . . . . . . . . . 11
5.2.1. DHCPv6 Network-Name Option . . . . . . . . . . . . . 12
5.2.2. DHCPv6 Access-Point-Name Option . . . . . . . . . . . 12
5.2.3. DHCPv6 Access-Point-BSSID Option . . . . . . . . . . 13
5.3. DHCPv6 Operator-Identifier Options . . . . . . . . . . . 13
5.3.1. DHCPv6 Operator-Identifier Option . . . . . . . . . . 13
5.3.2. DHCPv6 Operator-Realm Option . . . . . . . . . . . . 14
6. Relay Agent Behavior . . . . . . . . . . . . . . . . . . . . 14
7. Server Behavior . . . . . . . . . . . . . . . . . . . . . . . 15
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16
9. Security Considerations . . . . . . . . . . . . . . . . . . . 17
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 18
10.1. Normative References . . . . . . . . . . . . . . . . . . 18
10.2. Informative References . . . . . . . . . . . . . . . . . 18
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 19
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 201. Introduction 🌷
Knowing which access network a device is on is useful for all kinds of things. For example, the Local Mobility Anchor (LMA) in a Proxy Mobile IPv6 (PMIPv6) domain can give the mobile node's traffic special service treatment based on the access network it's attached to 👑.
This doc specifies the options for the Dynamic Host Configuration Protocol for IPv4 (DHCPv4) [RFC2131] and the Dynamic Host Configuration Protocol for IPv6 (DHCPv6) [RFC3315] that handle access-network identification. The relay agent adds these options to the DHCPv4 or DHCPv6 messages it sends toward the server 🦋. The scope here is between a DHCP relay agent and a mobile access gateway, where the same operator typically runs both of these functions.
A DHCP relay agent that knows about the access network and access operator adds this info to the DHCP messages 💅. It can be used to provide differentiated services and to police traffic based on which access network a client is attached to. You can find examples of how this info is used in mobile networks in [RFC6757] 🧚.
2. Motivation 💖
PMIPv6 [RFC5213] can support network-based mobility management in lots of different network deployments 🌸. Some of these architectures, like service provider Wi-Fi access aggregation or a WLAN integrated mobile packet core, use PMIPv6 as one part of the bigger picture. Some of them need the LMA [RFC5213] to give differentiated services and police traffic to mobile nodes based on the access network they're on, which is very much a main character moment 🔥.
Policy systems in mobility architectures let you set policy rules with conditions based on access-network info. Two examples in the 3GPP system are Policy and Charging Control (PCC) [TS23203] and the Access Network Discovery and Selection Function (ANDSF) [TS23402] 🫶. For example, a mobile node might get different service treatment when it's on an access network owned by its home operator than when it's on one owned by a roaming partner. With IEEE 802.11 access networks, the service treatment can also depend on the configured Service Set Identifiers (SSIDs). Operators can also charge tariffs based on location, which is giving "pay for where you are" 💀.
The PMIPv6 extension in [RFC6757] defines PMIPv6 options that carry Access-Network Identifiers in PMIPv6 signaling from the Mobile Access Gateway (MAG) to the LMA 🎀. The MAG can learn this info from the DHCP options that the DHCP relay agent in the access network inserts. If the MAG relays DHCP messages to the LMA as specified in [RFC5844], the MAG can insert this info toward the LMA in the forwarded DHCP messages ✨.
Figure 1 shows an example PMIPv6 deployment 🍓. In this example, the access network is based on IEEE 802.11, the DHCP relay agent function lives on the Access Point (AP), and the DHCP server function lives on the MAG. The MAG sends the access-network info elements to the LMA over PMIPv6 signaling messages, and it gets those info elements from the DHCP relay agent as this specification describes. The info elements include the SSID of the IEEE 802.11 network, the geo-location of the access network the mobile node is attached to, and the identity of the operator running the IEEE 802.11 access-network infrastructure 🌈.
SSID: IETF-1
Operator-Identifier: provider1.example
+--+
|AP|-----------. {Access-Specific Policies)
+--+ | (DHCP Server) _-----_ |
(DHCP Relay) +-----+ _( )_ +-----+
| MAG |-=========( PMIPv6 )======-| LMA |-
+-----+ (_ Tunnel_) +-----+
+--+ | '-----'
|AP|-----------'
+--+
(DHCP Relay)
SSID: IETF-2
Operator-Identifier: provider2.example
Access Networks Attached to MAG3. Terminology 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🔥.
All the DHCP-related terms used in this doc should be read the way DHCPv4 [RFC2131] and DHCPv6 [RFC3315] define them 🧚. "DHCP message" means both DHCPv4 and DHCPv6 messages all the way through this doc.
All the mobility-related terms used here get read the way the PMIPv6 specs [RFC5213] and [RFC5844] define them. This doc also uses these abbreviations 🌸:
Service Set Identifier (SSID)
The Service Set Identifier (SSID) is the name of the IEEE 802.11 network. It's how one network is told apart from another 💖.
Operator-Identifier
The Operator-Identifier is the Structure of Management Information (SMI) Network Management Private Enterprise Code from the IANA-maintained "Private Enterprise Numbers" registry [SMI]. It identifies the operator running the access network where the client is attached 👑.
4. DHCPv4 Access-Network-Identifier Option 🦋
The Access-Network Identifier (ANI) carries info about the identity of the access network the client is attached to. That includes the access-technology type, the network identifier, and the access network operator identifiers 🫧.
Relay agents that include ANI info put in one or more sub-options (see Section 4.1) inside the Relay Agent Information option [RFC3046] 🎀.
4.1. DHCPv4 Access-Network-Identifier Sub-options 🎀
okay so the Access-Network-Identifier info is split up into a bunch of sub-options, and each one gets its own code from the "DHCP Relay Agent Sub-Option Codes" registry 🧚
The ANI sub-options are basically a list of Sub-Option Code, Length, and Value tuples, one tuple per sub-option, and they're laid out like this 💅
Subopt Len Sub-option Data
+------+------+------+------+------+------+--...-+------+
| code | N | s1 | s2 | s3 | s4 | | sN |
+------+------+------+------+------+------+--...-+------+Subopt code 💖 is the 1-octet code for the sub-options defined in the following sections.
Len 💖 is an unsigned 8-bit integer that gives the length of the Sub-option Data field in this sub-option, in octets.
Sub-option Data (s1 to sN) 💖 is the data area for the sub-option.
The initial assignment of the DHCP Access-Network-Identifier sub-options looks like this, and it's giving very organised ✨
+=================+=======================================+
| SUB-OPTION CODE | SUB-OPTION DESCRIPTION |
+=================+=======================================+
| 13 | Access-Technology-Type Sub-option |
+=========================================================+
| 14 | Access-Network-Name Sub-option |
+=========================================================+
| 15 | Access-Point-Name Sub-option |
+=========================================================+
| 16 | Access-Point-BSSID Sub-option |
+=========================================================+
| 17 | Operator-Identifier Sub-option |
+=========================================================+
| 18 | Operator-Realm Sub-option |
+=========================================================+4.2. DHCPv4 Access-Technology-Type Sub-option 📡
this one is for swapping the type of access technology of the network the client is hooked up to. Here's the format 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Subopt Code | Length | Reserved | ATT |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Subopt Code: 13 🌸
Length: 2 🌸
Reserved: this is an 8-bit field that's unused for now. The value MUST be initialized to 0 by the sender and MUST be ignored by the receiver. Be careful with this one, bestie 🙈
Access-Technology-Type (ATT): this is an 8-bit field that specifies the access technology through which the client is connected to the access link. The values come from the IANA name space "Access Technology Type Option type values" registry defined in [RFC5213] 🔥
4.3. DHCPv4 Network-Identifier Sub-options 🌈
These sub-options carry the name of the access network (like an SSID for an IEEE 802.11 access network, or a Public Land-based Mobile Network (PLMN) Identifier [TS23003] for a 3GPP access network) and the Access-Point Name the client is attached to. The format of each one is in the sections below. The Network-Identifier sub-options are only for the currently known access-technology types 🫶
4.3.1. DHCPv4 Network-Name Sub-option 🍓
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Subopt Code | Length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. .
. Network-Name (e.g., SSID or PLMNID) .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Subopt Code: 14 🌸
Length: The length of the Network-Name field. 🌸
Network-Name: The name of the access network the mobile node is attached to. The encoding MUST be UTF-8 as described in [RFC3629]. 💜
The type of the Network-Name depends on the access technology the mobile node is attached to. For networks based on IEEE 802.11, the Network-Name is the SSID of the network. For 3GPP access-based networks, it's the PLMN Identifier of the access network, and for 3GPP2 access, the Network-Name is the ANI [ANI]. 🧚
When you encode the PLMN Identifier, both the Mobile Network Code (MNC) [TS23003] and Mobile Country Code (MCC) [TS23003] MUST be three digits. If the MNC in use only has two digits, then it MUST be preceded with a '0'. This part is super important ✨
4.3.2. DHCPv4 Access-Point-Name Sub-option 💅
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Subopt Code | Length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. .
. Access-Point-Name .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Subopt Code: 15 🌸
Length: The length of the Access-Point-Name field. 🌸
Access-Point-Name: The name of the access point (the physical device name) the mobile node is attached to. This is the identifier that uniquely identifies the access point. The Network-Name (e.g., SSID) identifies the operator's access network, while the Access-Point-Name identifies one specific network device in the network the mobile node is attached to. In some deployments, the Access-Point-Name can be set to the string representation of the Media Access Control (MAC) address of the device as specified in [RFC6991] (see mac-address typedef), or to some unique identifier that policy systems in the operator network can use to unambiguously identify the device. The encoding MUST be UTF-8 as described in [RFC3629]. 🦋
4.3.3. DHCPv4 Access-Point-BSSID Sub-option 🌸
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Subopt Code | Length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| Access-Point-BSSID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Subopt Code: 16 🌸
Length: 6 🌸
Access-Point-BSSID: The 48-bit Basic SSSID (BSSID) of the access point the mobile node is attached to. 🍓
4.4. DHCPv4 Operator-Identifier Sub-options 👑
The Operator-Identifier sub-options can carry the Operator-Identifiers of the access network the client is attached to. The format of these sub-options is defined below 💖
4.4.1. DHCPv4 Operator-Identifier Sub-option ✨
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Subopt Code | Length | .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. Operator-Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Subopt Code: 17 🌸
Length: 4 🌸
Operator-Identifier: The Operator-Identifier is a variable-length Private Enterprise Number (PEN) [SMI] encoded in network byte order. For more details, check out Section 3.1.3 of [RFC6757] 🧠
4.4.2. DHCPv4 Operator-Realm Sub-option 🎀
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Subopt Code | Length | |
|-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. .
. Operator-Realm .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Subopt Code: 18 🌸
Length: The length of the Operator-Realm field. 🌸
Operator-Realm: The realm of the operator (e.g., EXAMPLE.COM). For more details, check out Section 3.1.3 of [RFC6757] 💜
5. DHCPv6 Access-Network-Identifier Options 🦋
The Access-Network-Identifier options defined here may be added by the DHCPv6 relay agent in Relay-forward messages 🌈
+=================+=======================================+
| OPTION CODE | OPTION DESCRIPTION |
+=================+=======================================+
| 105 | OPTION_ANI_ATT |
+=========================================================+
| 106 | OPTION_ANI_NETWORK_NAME |
+=========================================================+
| 107 | OPTION_ANI_AP_NAME |
+=========================================================+
| 108 | OPTION_ANI_AP_BSSID |
+=========================================================+
| 109 | OPTION_ANI_OPERATOR_ID |
+=========================================================+
| 110 | OPTION_ANI_OPERATOR_REALM |
+=========================================================+5.1. DHCPv6 Access-Technology-Type Option 📡
This option is for exchanging the type of access technology the client uses to attach to the network. Here's the format 🫶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_ANI_ATT | Option-Len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | ATT |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Option-Code: OPTION_ANI_ATT (105) 🌸
Option-Len: 2 🌸
Reserved: This is an 8-bit field that's unused for now. The value MUST be initialized to 0 by the sender and MUST be ignored by the receiver. 🙈
Access-Technology-Type (ATT): The contents of this field are the same as the ATT field described in Section 4.2. 💖
5.2. DHCPv6 Network-Identifier Options 🧚
These options can carry the name of the access network (like an SSID for an IEEE 802.11 access network, or a PLMN Identifier [TS23003] for a 3GPP access network) and an Access-Point Name the client is attached to. The format of these options is defined below ✨
5.2.1. DHCPv6 Network-Name Option 🎀
okay so this is the DHCPv6 version of the Network-Name, and it's giving total twin energy with the DHCPv4 one 🦋 Here's the layout:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_ANI_NETWORK_NAME | Option-Len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. Network-Name (e.g., SSID or PLMNID) .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Option-Code 🌸 It's OPTION_ANI_NETWORK_NAME (106).
Option-Len 💖 This is just the length of the Network-Name field.
Network-Name ✨ The contents here are the same as the Network-Name field from Section 4.3.1, so no new rules, just the same vibe.
5.2.2. DHCPv6 Access-Point-Name Option 🦋
same energy as the last one, just with the AP name instead 🫶 Check the shape:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_ANI_AP_NAME | Option-Len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. Access-Point-Name .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Option-Code 💅 It's OPTION_ANI_AP_NAME (107).
Option-Len 🌈 The length of the Access-Point-Name field.
Access-Point-Name 💜 Same contents as the Access-Point-Name field in Section 4.3.2. Easy.
5.2.3. DHCPv6 Access-Point-BSSID Option 🍓
this one is a fixed-size fit, bestie 🙈 The BSSID is always 6 bytes, so the Option-Len is always 6. Look at it:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_ANI_AP_BSSID | Option-Len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Access-Point-BSSID |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Option-Code 🧚 It's OPTION_ANI_AP_BSSID (108).
Option-Len 🎀 It's 6.
Access-Point-BSSID 🦋 Same contents as the Access-Point-BSSID field in Section 4.3.3.
5.3. DHCPv6 Operator-Identifier Options 🌸
the Operator-Identifier options are for carrying the Operator-Identifier of the access network the client is attached to. Here's how the format goes 💖
5.3.1. DHCPv6 Operator-Identifier Option ✨
the main character of this section, honestly 👑
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_ANI_OPERATOR_ID | Option-Len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Operator-Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Option-Code 🌈 It's OPTION_ANI_OPERATOR_ID (109).
Option-Len 💅 It's 4.
Operator-Identifier 🫶 Same contents as the DHCPv4 Operator-Identifier Sub-option field in Section 4.4.1.
5.3.2. DHCPv6 Operator-Realm Option 💜
last option in this batch, and it's a cute one 🍓 The layout:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_ANI_OPERATOR_REALM | Option-Len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. Operator-Realm .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Option-Code 🎀 It's OPTION_ANI_OPERATOR_REALM (110).
Option-Len 🧚 The length of the Operator-Realm field.
Operator-Realm 🦋 Same contents as the Operator-Realm field in Section 4.4.2.
6. Relay Agent Behavior 💅
okay, the relay agents are the messengers, and this section tells them what they can and can't skip 📬
DHCPv4 relay agents MAY include sub-options as defined in Section 4.2 through 4.4 of [RFC3046] in the Relay Agent Information option, to share info about the access network the client's DHCP messages came in on. Totally optional, bestie 🫶
The DHCPv4 relay agent MUST include the DHCPv4 Access-Technology-Type Sub-option (Section 4.2) whenever it includes any of these: the DHCPv4 Network-Name Sub-option (Section 4.3.1), the DHCPv4 Access-Point-Name Sub-option (Section 4.3.2), or the DHCPv4 Access-Point-BSSID Sub-option (Section 4.3.3). No skipping the Access-Technology-Type when the others show up 🙅♀️
DHCPv6 Relay Agents MAY include options (defined in Section 5) in the Relay-forward message when forwarding any DHCPv6 message type from clients to the servers, so the server knows about the access network the client's DHCPv6 messages arrived on 🌈
The DHCPv6 relay agent MUST include the DHCPv6 Access-Technology-Type Option (Section 5.1) when including any of these options in the DHCP message: the DHCPv6 Network-Name Option (Section 5.2.1), the DHCPv6 Access-Point-Name Option (Section 5.2.2), and the DHCPv6 Access-Point-BSSID Option (Section 5.2.3). Same rule as the v4 side, just in v6 clothes 💖
7. Server Behavior 🧚
this is where the server gets to decide what to do with all that juicy info, and there are some strict boundaries 👑
The DHCPv4 base specification [RFC2131] requires that the DHCPv4 server ignore the DHCPv4 Access-Network-Identifier Option if it does not understand the option. Fair enough 💅
If the DHCPv4 server does not understand the received sub-option defined in Sections 4.1 through 4.4 of [RFC3046], the DHCPv4 Relay-Agent-Information Option, it MUST ignore those sub-options only 🙈 Only the ones it doesn't get, though. The rest of the option is still on the table.
If the DHCPv4 server is able to process the DHCPv4 Access-Network-Identifier sub-options defined in Sections 4.1 through 4.4 of [RFC3046], the DHCPv4 Relay-Agent-Information Option, it MAY use this information obtained from the sub-option for address pool selection or for policy decisions as per its configured policy. So it's allowed to use the info to pick a pool or make policy calls, based on how it's configured ✨
This information obtained from the sub-option SHOULD NOT be stored unless it is absolutely needed. However, if it is stored, the information MUST be deleted as quickly as possible to eliminate any possibility of the information getting exposed to an intruder. 🔥 Don't keep it around longer than you need to, bestie. Intruders are not invited to the slumber party 🌙
The DHCPv4 server MUST ignore the received DHCPv4 Access-Network-Identifier Option and process the rest of the message as per the base DHCPv4 specifications if the received DHCPv4 message does not include the DHCPv4 Access-Technology-Type Sub-option (Section 4.2) but does include any one of these other options: the DHCPv4 Network Name Sub-option (Section 4.3.1), the DHCPv4 Access-Point-Name Sub-option (Section 4.3.2), or the DHCPv4 Access-Point-BSSID Sub-option (Section 4.3.3). So no Access-Technology-Type, no ANI stuff. Just the normal base rules 💀
DHCPv6 base specification [RFC3315] requires that the DHCPv6 server ignore the DHCPv6 Access-Network-Identifier Option if it does not understand the option. Same vibe as v4 🌸
If the DHCPv6 server receives the options defined in Section 5 and is configured to use the options defined in Section 5, it SHOULD look for the DHCPv6 Access-Network-Identifier options in the Relay-forward message of the DHCPv6 relay agent(s) based on its configured policy. It's recommended to check there, depending on the server's policy 🦋
The server MAY use received ANI options for its address pool selection policy decisions as per its configured policy. This information obtained from the options SHOULD NOT be stored unless it is absolutely needed. However, if it is stored, the information MUST be deleted as quickly as possible to eliminate any possibility of the information getting exposed to an intruder. Same storage rule as v4, no exceptions, periodt 💜
The DHCPv6 server MUST ignore the received DHCPv6 Access-Network-Identifier Option and process the rest of the message as per the base DHCPv6 specifications if the received DHCPv6 message does not include the DHCPv6 Access-Technology-Type Option (Section 5.1) but it does include any one of these other options: the DHCPv6 Network-Name Option (Section 5.2.1), the DHCPv6 Access-Point-Name Option (Section 5.2.2), or the DHCPv6 Access-Point-BSSID Option (Section 5.2.3). Same as the v4 side: no Access-Technology-Type means ANI gets ignored, and the message just gets handled the normal way 🎀
8. IANA Considerations 👑
the registry section, where the numbers get officially locked in 🔒
IANA has assigned sub-option codes for the following DHCPv4 sub-options from the "DHCP Relay Agent Sub-Option Codes" registry, <http://www.iana.org/assignments/bootp-dhcp-parameters>:
+=================+=======================================+
| SUB-OPTION CODE | SUB-OPTION DESCRIPTION |
+=================+=======================================+
| 13 | Access-Technology-Type Sub-option |
+=========================================================+
| 14 | Access-Network-Name Sub-option |
+=========================================================+
| 15 | Access-Point-Name Sub-option |
+=========================================================+
| 16 | Access-Point-BSSID Sub-option |
+=========================================================+
| 17 | Operator-Identifier Sub-option |
+=========================================================+
| 18 | Operator-Realm Sub-option |
+=========================================================+IANA has assigned option codes for the following DHCPv6 options from the "Option Codes" registry for DHCPv6, <http://www.iana.org/assignments/dhcpv6-parameters>, as specified in [RFC3315]:
+=================+=======================================+
| OPTION CODE | OPTION DESCRIPTION |
+=================+=======================================+
| 105 | OPTION_ANI_ATT |
+=========================================================+
| 106 | OPTION_ANI_NETWORK_NAME |
+=========================================================+
| 107 | OPTION_ANI_AP_NAME |
+=========================================================+
| 108 | OPTION_ANI_AP_BSSID |
+=========================================================+
| 109 | OPTION_ANI_OPERATOR_ID |
+=========================================================+
| 110 | OPTION_ANI_OPERATOR_REALM |
+=========================================================+9. Security Considerations 🔐
okay bestie, security time 😭 DHCP messages have zero privacy protection, so if someone can eavesdrop on the link between the DHCP server and the relay agent, they can totally discover the access-network information. 💀
[RFC3118] and [RFC3315] describe a lot of the threats that come with using DHCP ✨. Each one offers a solution: the Authentication Option for DHCPv4 and DHCPv6 (respectively). BUT, neither of these options is actually in active use, so they aren't a viable mitigation 🙈. DHCP is inherently insecure, so link-layer confidentiality and integrity protection SHOULD be employed to lower the risk of disclosure and tampering 🫶.
A rogue DHCP relay agent can insert or overwrite Access-Network-Identifier options with incorrect information for malicious purposes 👀. A DHCP client can also pretend to be a rogue relay agent by sending incorrect Access-Network-Identifier options. A perimeter defense that blocks these options unless the DHCP relay agent is trusted can stop fraudulent DHCP relay agent information options from getting in, but a deeper defense is needed too 💅. That deeper defense is the authentication sub-option for the DHCPv4 Relay-Agent-Information Option [RFC4030], which SHOULD be deployed as well. Administrators SHOULD configure DHCP servers that use this option to communicate with their relay agents using IPsec, as described in Section 21.1 of [RFC3315] 🔒.
The info this document exposes is the client's access-network information, and that's a lot of personal-ish data 😭. It covers the access network the client is attached to, like the Access-Technology Type (e.g., WLAN, Ethernet, etc.), the Access-Point Identity (Name, BSSID), and the Operator-Identifier and Operator-Realm. If this information can't be secured using IPsec [RFC4301] or other security protocols in a deployment, administrators SHOULD disable the capability specified in this document on the DHCP entities 🚨.
10. References 📚
10.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol",
RFC 2131, DOI 10.17487/RFC2131, March 1997,
<http://www.rfc-editor.org/info/rfc2131>.
[RFC3046] Patrick, M., "DHCP Relay Agent Information Option",
RFC 3046, DOI 10.17487/RFC3046, January 2001,
<http://www.rfc-editor.org/info/rfc3046>.
[RFC3315] Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins,
C., and M. Carney, "Dynamic Host Configuration Protocol
for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July
2003, <http://www.rfc-editor.org/info/rfc3315>.10.2. Informative References
[ANI] "Interoperability Specification (IOS) for High Rate Packet
Data (HRPD) Radio Access Network Interfaces with Session
Control in the Access Network", 3GPP2 A.S0008-C v4.0,
April 2011.
[RFC3118] Droms, R., Ed. and W. Arbaugh, Ed., "Authentication for
DHCP Messages", RFC 3118, DOI 10.17487/RFC3118, June 2001,
<http://www.rfc-editor.org/info/rfc3118>.
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO
10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November
2003, <http://www.rfc-editor.org/info/rfc3629>.
[RFC4030] Stapp, M. and T. Lemon, "The Authentication Suboption for
the Dynamic Host Configuration Protocol (DHCP) Relay Agent
Option", RFC 4030, DOI 10.17487/RFC4030, March 2005,
<http://www.rfc-editor.org/info/rfc4030>.
[RFC4301] Kent, S. and K. Seo, "Security Architecture for the
Internet Protocol", RFC 4301, DOI 10.17487/RFC4301,
December 2005, <http://www.rfc-editor.org/info/rfc4301>.
[RFC5213] Gundavelli, S., Ed., Leung, K., Devarapalli, V.,
Chowdhury, K., and B. Patil, "Proxy Mobile IPv6",
RFC 5213, DOI 10.17487/RFC5213, August 2008,
<http://www.rfc-editor.org/info/rfc5213>.
[RFC5844] Wakikawa, R. and S. Gundavelli, "IPv4 Support for Proxy
Mobile IPv6", RFC 5844, DOI 10.17487/RFC5844, May 2010,
<http://www.rfc-editor.org/info/rfc5844>.
[RFC6757] Gundavelli, S., Ed., Korhonen, J., Ed., Grayson, M.,
Leung, K., and R. Pazhyannur, "Access Network Identifier
(ANI) Option for Proxy Mobile IPv6", RFC 6757,
DOI 10.17487/RFC6757, October 2012,
<http://www.rfc-editor.org/info/rfc6757>.
[RFC6991] Schoenwaelder, J., Ed., "Common YANG Data Types",
RFC 6991, DOI 10.17487/RFC6991, July 2013,
<http://www.rfc-editor.org/info/rfc6991>.
[SMI] IANA, "PRIVATE ENTERPRISE NUMBERS, SMI Network Management
Private Enterprise Codes", March 2016,
<https://www.iana.org/assignments/enterprise-numbers>.
[TS23003] 3GPP, "Numbering, addressing and identification", 3GPP
TS 23.003 13.4.0, December 2015.
[TS23203] 3GPP, "Policy and charging control architecture", 3GPP
TS 23.203 13.6.0, December 2015.
[TS23402] 3GPP, "Architecture enhancements for non-3GPP accesses",
3GPP TS 23.402 13.4.0, December 2015.Acknowledgements 🫶
the authors want to give a huge thank-you to Kim Kinnear, Ted Lemon, Gaurav Halwasia, Hidetoshi Yokota, Sheng Jiang, and Francis Dupont for their super valuable input ✨. Also, a big shoutout to Tomek Mrugalski for doing a thorough review of the document 👑.
Authors' Addresses 🌸
Shwetha Bhandari
Cisco Systems
Cessna Business Park, Sarjapura Marathalli Outer Ring Road
Bangalore, KARNATAKA 560 087
India
Phone: +91 80 4426 0474
Email: shwethab@cisco.com
Sri Gundavelli
Cisco Systems
170 West Tasman Drive
San Jose, CA 95134
United States
Email: sgundave@cisco.com
Mark Grayson
Cisco Systems
11 New Square Park
Bedfont Lakes, FELTHAM TW14 8HA
England
Email: mgrayson@cisco.com
Bernie Volz
Cisco Systems
1414 Massachusetts Ave
Boxborough, MA 01719
United States
Email: volz@cisco.com
Jouni Korhonen
Broadcom Limited
3151 Zanker Rd
San Jose, CA 95134
United States
Email: jouni.nospam@gmail.com📦 where this page comes from
- ietf: rfc7839 2016-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms