RFC 8357

Generalized UDP Source Port for DHCP Relay

📅 published March 2018, from ietf

Generalized UDP Source Port for DHCP Relay ✨

Okay bestie, this is RFC 8357 🎀 It's from the Internet Engineering Task Force (IETF) and was written by N. Shen and E. Chen at Cisco Systems. It's on the Standards Track, which means it's a real, official spec and not just vibes 💅 The ISSN is 2070-1721 and it's dated March 2018. The header doesn't list anything it obsoletes or updates, so this one is standing on its own 🌸

Abstract

Okay so this doc adds an extension to the DHCP protocols that lets a relay agent use any available source port for upstream traffic 🦋 It also lets you include a DHCP option, so responses can be statelessly routed back to the right source port on the way down. Main character energy 👑

Status of This Memo

This is an Internet Standards Track document 💜

It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 7841 🧚

Info about the current status of this document, any errata, and how to give feedback is at https://www.rfc-editor.org/info/rfc8357 ✨

Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved 🔒

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Please actually read these, bestie, because they explain your rights and restrictions for this document 🙈 Any Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
     2.1.  Requirements Language . . . . . . . . . . . . . . . . . .   3
     2.2.  Definitions . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  Changes to DHCP Specifications  . . . . . . . . . . . . . . .   4
     3.1.  Additions to DHCPv4 in RFC 2131 . . . . . . . . . . . . .   4
     3.2.  Additions to DHCPv6 in RFC 3315 . . . . . . . . . . . . .   4
   4.  Relay Source Port Sub-option and Option . . . . . . . . . . .   4
     4.1.  Source Port Sub-option for DHCPv4 . . . . . . . . . . . .   5
     4.2.  Relay Source Port Option for DHCPv6 . . . . . . . . . . .   5
   5.  Relay Agent and Server Behavior . . . . . . . . . . . . . . .   6
     5.1.  DHCPv4  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     5.2.  DHCPv6  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     5.3.  Compatibility . . . . . . . . . . . . . . . . . . . . . .   7
     5.4.  Deployment Considerations . . . . . . . . . . . . . . . .   7
   6.  Example of an IPv6-Cascaded Relay . . . . . . . . . . . . . .   7
   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   9
   8.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
   9.  Normative References  . . . . . . . . . . . . . . . . . . . .   9
   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  10
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  10

1. Introduction ✨

Okay so RFC 2131 [RFC2131] and RFC 3315 [RFC3315] say DHCP uses UDP as its transport 🚀 They also pin down the server and client port numbers. For IPv4, the server port is UDP 67 and the client port is UDP 68. For IPv6, the server port is 547 and the client port is 546.

Those fixed port combos cause real problems for some DHCP relay setups 😭 Picture a big DHCP relay implementation running on a single switch node. The relay work might get split across several relay processes, and they could all share the switch's IP address. If the UDP source port has to be a fixed number, then DHCP packets would have to go through one central entity or process. That totally defeats the point of spreading the relay work out 💀

Sometimes the split into multiple processes isn't even about DHCP relay load. DHCP relay might just be one of several functions in a multi-process implementation 🧚

Giving each DHCP relay process its own IPv4 or IPv6 source address could work, but it creates operational and network management headaches, especially since IPv4 addresses are scarce 🥲

So this document adds an extension that loosens the fixed UDP source port requirement for DHCP relay agents 🦋 The DHCP server has to remember the UDP port number of the inbound packet, along with its IPv4 or IPv6 address. When it sends replies back, the DHCP server MUST use the UDP port number that the incoming relay agent uses, not the fixed DHCP port number. For IPv6-cascaded relay agents [RFC3315], the upstream relay agent needs to use the "Relay Source Port Option" to record the downstream source port. It MUST use that recorded port number instead of the fixed DHCP port number when it replays the reply messages 💖

2. Terminology 🎀

2.1. Requirements Language

Okay so the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are interpreted as described in BCP 14 [RFC2119] [RFC8174], but only when they appear in all capitals, exactly like that 🙈

2.2. Definitions

Here's the vocab, bestie 📚

  • Downstream Device: In the DHCP relay context, this is the next relay agent that forwards Relay-reply messages.
  • Upstream Device: In the DHCP relay context, this is the next relay agent or DHCP server that forwards Relay-forward messages.
  • Relay Source Port: This is the UDP port a relay agent uses to receive Relay-forward messages from an upstream device.
  • Downstream Source Port: This is the UDP port the downstream device uses when it forwards Relay-forward messages to this relay agent device. This same UDP port is what this relay agent device uses when it forwards the Relay-reply messages back to that downstream device 🫶
  • Non-DHCP UDP Port: Any valid, non-zero UDP port other than port 67 for DHCPv4 and port 547 for DHCPv6.

3. Changes to DHCP Specifications 💅

3.1. Additions to DHCPv4 in RFC 2131

Section 4.1 of RFC 2131 [RFC2131] says this about DHCP transport:

DHCP uses UDP as its transport protocol. DHCP messages from a client to a server are sent to the 'DHCP server' port (67), and DHCP messages from a server to a client are sent to the 'DHCP client' port (68).

Relay agents that implement this spec can instead be configured to 1) use a source port number other than 67 when relaying messages toward servers, and 2) receive responses toward clients on that same port 🌈 This only works if the DHCP server, or the relay agent it's forwarding to, has been upgraded to support this extension 🥹

3.2. Additions to DHCPv6 in RFC 3315

Section 5.2 of RFC 3315 [RFC3315] says:

Clients listen for DHCP messages on UDP port 546. Servers and relay agents listen for DHCP messages on UDP port 547.

Relay agents that implement this spec can instead be configured to 1) use a source port number other than 547 when relaying messages toward servers, and 2) receive responses toward clients on that same port 🧚 Same catch as before: it only works when the DHCP server, or the relay agent it's forwarding to, is upgraded to support this extension ✨

4. Relay Source Port Sub-option and Option 🦋

Relay agents don't maintain state 💭 So to send a message back to its source, the relay agent must include all the required information in the Relay-forward message. When a relay in a chain of cascaded relays doesn't use the standard source port, that source port must be included along with the source address. This option is what lets the relay agent do that 🫶

4.1. Source Port Sub-option for DHCPv4

The relay agent "Source Port Sub-option" is a brand-new option, and it's part of the "Relay Agent Information" option for DHCPv4 [RFC3046] 🎀

The format of the "Source Port Sub-option" looks like this:

            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
            | SubOpt Code   |      Len      |
            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Where:

  • SubOpt Code: SUBOPT_RELAY_PORT. An 8-bit value, 19.
  • Len: An 8-bit value that is set to 0.

4.2. Relay Source Port Option for DHCPv6

The "Relay Source Port Option" is a new DHCPv6 option 🌸 It MUST be used by either 1) a DHCPv6 relay agent that uses a non-DHCP UDP port (not 547) to talk to the IPv6 server and the upstream relay agent, or 2) an IPv6 relay agent that detects a downstream relay agent using a non-DHCP UDP port (not 547) 👑

The format of the "Relay Source Port Option" looks like this:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    OPTION_RELAY_PORT    |         Option-Len                  |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Downstream Source Port     |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Where:

  • Option-Code: OPTION_RELAY_PORT. A 16-bit value, 135.
  • Option-Len: A 16-bit value that is set to 2.
  • Downstream Source Port: A 16-bit value. The IPv6 relay sets it either to the downstream relay agent's UDP source port used for the UDP packet, or to zero if only the local relay agent uses the non-DHCP UDP port (not 547) 💅

5. Relay Agent and Server Behavior 🌈

5.1. DHCPv4

When a relay agent uses a non-DHCP UDP port (not 67) to talk to the DHCP server, it MUST include the "Source Port Sub-option" in Relay-forward messages to say so 📮

When an IPv4 server gets a message from a relay agent that has the "Source Port Sub-option", it MUST remember the UDP source port of that message. Then it uses that port number as the UDP destination port when it sends the reply back to that same relay agent 🦋

5.2. DHCPv6 💅

okay so the IPv6 relay agent has its own version of this, and it's giving the same energy 🦋 The IPv6 relay agent MUST include the "Relay Source Port Option" when it uses a non-DHCP UDP port (not 547) to talk to a DHCPv6 server or an upstream IPv6 relay agent. And if an IPv6 relay agent spots that a downstream relay agent is using a non-DHCP UDP port in the packet, it MUST record that port number in the "Downstream Source Port" field of this option. If the option is only saying "hey, I'm using a non-DHCP port locally" and no downstream relay is using one, the Downstream Source Port field MUST be set to zero. 🌸

The IPv6 relay agent MUST include this option in these three cases:

  1. The local relay agent uses a non-DHCP UDP port (not 547).
  2. The downstream relay agent uses a non-DHCP UDP port (not 547).
  3. The local relay agent and the downstream relay agent both use non-DHCP UDP ports (not 547).

In the first case, the "Downstream Source Port" field is set to zero. In the other two cases, the field gets set to the UDP port number that the downstream relay agent uses. 🎀

When an IPv6 server receives a Relay-forward message with the "Relay Source Port Option", it MUST copy the option when it builds the Relay-reply chain for that Relay-forward message. This option MUST NOT appear in any message other than a Relay-forward or Relay-reply message. 🚫 Also, the IPv6 server MUST check and use the UDP source port from the UDP packet of the Relay-forward message when it replies to the relay agent. The server is literally checking the receipts here 💅

When a relay agent gets a Relay-reply message with the "Relay Source Port Option" from a server or from an upstream relay agent, and the "Downstream Source Port" field in the option is non-zero, it MUST use that UDP port number to forward the Relay-reply message to the downstream relay agent. ✨

5.3. Compatibility 🧚

Sites that need relay agents to specify a source port have to install new DHCP server and DHCP relay agent software that has this feature. ngl, if a site only installs the relay agent software with this feature, there's zero chance the DHCP server will be able to talk to that relay agent 💀 It's a whole mismatch situation.

5.4. Deployment Considerations 🍓

During deployment, the operator and/or user of the new DHCP play port implementation should upgrade the DHCP server before the relay implementations get deployed. That way, the erroneous case from Section 5.3 never shows up 🙈 If the upstream relay agent or server doesn't support this extension, this DHCP relay port feature needs to be disabled.

When the DHCP relay port implementation is deployed, the default relay agent behavior should use the DHCP UDP port. It is recommended that the configuration be set up so that a non-DHCP port can be used for the DHCP relay agents, which is the mode of operation that gives you flexibility 🌈

If the network uses a firewall to block or allow DHCP packets with both static UDP source and destination port numbers, that rule may stop matching packets from the new DHCP relay agent and server software with this extension 😭 The firewall rules need to be modified to match only the DHCP server side of the UDP port number and, if necessary, IP addresses and other attributes. Firewall rules, please get it together 🔥

6. Example of an IPv6-Cascaded Relay 🦋

Let's look at an example of IPv6-cascaded relay agents using the "Relay Source Port Option". It's a whole chain, so pay attention 👑

              (forward)          (forward)          (forward)
      Relay1 ----------> Relay2 ----------> Relay3 ----------> Server
          (1000)              (547)              (547)
               (reply)            (reply)            (reply)
             <----------        <----------        <----------

In the diagram above, every IPv6 device supports this generalized UDP source port extension except Relay3. Relay1 is the only relay agent device that uses a non-DHCP UDP port (not 547). Relay2 is the upstream device of Relay1. 🧚

Both Relay1 and Relay2 include the "Relay Source Port Option" in the Relay-forward message. Relay1 sets the "Downstream Source Port" field in the option to zero. Relay2 notices that the option is in the message from Relay1, and it figures out that Relay1 is using UDP source port 1000. So Relay2 includes the "Relay Source Port Option" and sets the "Downstream Source Port" field to 1000. The IPv6 server copies the "Relay Source Port Option" when it replies with the Relay-reply message. 💖

When Relay2 gets the Relay-reply message with the "Relay Source Port Option", it sees that the "Downstream Source Port" field is 1000. So Relay2 uses that port number as the UDP packet's port when it sends the Relay-reply message to Relay1. 🌸

When Relay1 gets the Relay-reply message with the "Relay Source Port Option", it sees that the "Downstream Source Port" field is zero. So Relay1 uses the normal IPv6 port 547 in the packet it sends the Relay-reply message to its downstream relay agent, or it uses UDP port 546 when it's sending to an IPv6 client. ✨

This DHCP extension works with any combination of IPv6-cascaded relay agents, as long as the relay agent that uses a non-DHCP UDP port (not 547) and its upstream relay device both support this generalized UDP source port extension. 🫶

Now here's a twist. It's similar to the example above, but this time Relay2 uses UDP source port 2000 instead of 547 like in the diagram. Relay3 needs to support this DHCP extension, and it sets 2000 in its "Downstream Source Port" field of the option in the Relay-forward message. When the DHCP server sends the DHCP Relay-reply to Relay3, Relay3 finds that its own relay option has this "Downstream Source Port" with the value 2000, so it uses that UDP port when it sends the Relay-reply message to Relay2. Relay2 finds that its own relay option also has a "Downstream Source Port" with the value 1000, so it uses that UDP port when it sends the Relay-reply message to Relay1. Chain reaction, but make it iconic 👑

7. IANA Considerations 🌈

IANA has registered "DHCPv4 Relay Source Port Sub-option" (19) for the IPv4 "Relay Agent Information" option within the "DHCP Relay Agent Sub-Option Codes" registry <https://www.iana.org/assignments/ bootp-dhcp-parameters> [RFC3046]. 🎀

IANA has also registered "OPTION_RELAY_PORT" (135) for the DHCPv6 "Relay Source Port Option" within the DHCPv6 "Option Codes" registry <http://www.iana.org/assignments/dhcpv6-parameters"> [RFC3315]. 💅

8. Security Considerations 💀

[RFC3118] and [RFC3315] described many of the threats in using DHCP. This is serious business, bestie, so read those first 🙈 The good news is that this extension does not raise additional security issues. ✨

9. Normative References 📚

Acknowledgments 🫶

The authors would like to thank Peter Arberg, Luyuan Fang, Bhanu Gopalasetty, Scott Kelly, Andre Kostur, Victor Kuarsingh, Ted Lemon, Adam Roach, Kishore Seshadri, and Jackelyn Shen for their review and comments on this document. 💖

The authors would also like to thank Bernie Volz for discussions that led to the definition of the "Relay Source Port Sub-option" and DHCPv6 "Relay Source Port Option". 👑

Authors' Addresses 🦋

Naiming Shen
Cisco Systems
560 McCarthy Blvd.
Milpitas, CA  95035
United States of America

Email: naiming@cisco.com


Enke Chen
Cisco Systems
560 McCarthy Blvd.
Milpitas, CA  95035
United States of America

Email: enkechen@cisco.com
📦 where this page comes from