idnits 2.17.1 draft-ietf-dhc-relay-port-10.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (December 14, 2017) is 2325 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 3315 (Obsoleted by RFC 8415) Summary: 1 error (**), 0 flaws (~~), 1 warning (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Networking Working Group N. Shen 3 Internet-Draft E. Chen 4 Intended status: Standards Track Cisco Systems 5 Expires: June 17, 2018 December 14, 2017 7 Generalized UDP Source Port for DHCP Relay 8 draft-ietf-dhc-relay-port-10 10 Abstract 12 This document proposes an extension to the DHCP protocols that allows 13 a relay agent to use any available source port for upstream 14 communications, and to include a DHCP option that can be used to 15 statelessly route responses back to the appropriate source port on 16 downstream communications. 18 Status of This Memo 20 This Internet-Draft is submitted in full conformance with the 21 provisions of BCP 78 and BCP 79. 23 Internet-Drafts are working documents of the Internet Engineering 24 Task Force (IETF). Note that other groups may also distribute 25 working documents as Internet-Drafts. The list of current Internet- 26 Drafts is at http://datatracker.ietf.org/drafts/current/. 28 Internet-Drafts are draft documents valid for a maximum of six months 29 and may be updated, replaced, or obsoleted by other documents at any 30 time. It is inappropriate to use Internet-Drafts as reference 31 material or to cite them other than as "work in progress." 33 This Internet-Draft will expire on June 17, 2018. 35 Copyright Notice 37 Copyright (c) 2017 IETF Trust and the persons identified as the 38 document authors. All rights reserved. 40 This document is subject to BCP 78 and the IETF Trust's Legal 41 Provisions Relating to IETF Documents 42 (http://trustee.ietf.org/license-info) in effect on the date of 43 publication of this document. Please review these documents 44 carefully, as they describe your rights and restrictions with respect 45 to this document. Code Components extracted from this document must 46 include Simplified BSD License text as described in Section 4.e of 47 the Trust Legal Provisions and are provided without warranty as 48 described in the Simplified BSD License. 50 Table of Contents 52 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 53 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 54 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 55 3. Changes to DHCP Specifications . . . . . . . . . . . . . . . 3 56 3.1. Additions to DHCPv4 in RFC 2131 . . . . . . . . . . . . . 3 57 3.2. Additions to DHCPv6 in RFC 3315 . . . . . . . . . . . . . 4 58 4. Relay Source Port Sub-option and Option . . . . . . . . . . . 4 59 4.1. Source Port Sub-option for DHCPv4 . . . . . . . . . . . . 4 60 4.2. Relay Source Port Option for DHCPv6 . . . . . . . . . . . 5 61 5. Relay Agent and Server Behavior . . . . . . . . . . . . . . . 5 62 5.1. DHCPv4 . . . . . . . . . . . . . . . . . . . . . . . . . 5 63 5.2. DHCPv6 . . . . . . . . . . . . . . . . . . . . . . . . . 6 64 5.3. Compatibility . . . . . . . . . . . . . . . . . . . . . . 6 65 5.4. Deployment Considerations . . . . . . . . . . . . . . . . 7 66 6. An IPv6 Cascaded Relay Example . . . . . . . . . . . . . . . 7 67 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 68 8. Security Considerations . . . . . . . . . . . . . . . . . . . 9 69 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 9 70 10. Normative References . . . . . . . . . . . . . . . . . . . . 9 71 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 73 1. Introduction 75 RFC 2131 [RFC2131] and RFC 3315 [RFC3315] specify the use of UDP as 76 the transport protocol for DHCP. They also define both the server 77 side and client side port numbers. The IPv4 server port is UDP 78 number (67) and the client port is UDP number (68); for IPv6 the 79 server port is (547) and the client port is (546). 81 The fixed UDP port combinations for the DHCP protocol scheme creates 82 challenges in certain DHCP relay operations. For instance, in a 83 large scale DHCP relay implementation on a single switch node, the 84 DHCP relay functionality may be partitioned among multiple relay 85 processes. All these DHCP relay processes may share the same IP 86 address of the switch node. If the UDP source port has to be a fixed 87 number as currently specified, the transport socket operation of DHCP 88 packets would need to go through a central entity or process which 89 would defeat the purpose of distributing DHCP relay functionality. 91 In some large-scale deployment, the decision to split the DHCP 92 functionality into multiple processes on a node may not be purely 93 based on DHCP relay computational load. But rather DHCP relay could 94 just be one of the functions in a multi-process implementation. 96 Although assigning a different IPv4/IPv6 source address for each DHCP 97 relay process can be a solution, it would introduce operational and 98 network management complexities, especially given the scarceness of 99 the IPv4 addresses. 101 This document proposes an extension to relax the fixed UDP source 102 port requirement for the DHCP relay agents. This extension requires 103 a DHCP server to remember the inbound packet's UDP port number along 104 with the IPv4/IPv6 address. The DHCP server when sending back 105 replies MUST use the UDP port number that the incoming relay agent 106 uses instead of the fixed DHCP port number. In the case of IPv6 107 cascaded relay agents [RFC3315], the upstream relay agent needs to 108 use the "Relay Source Port Option" to record the downstream source 109 port and it MUST use this recorded port number instead of the fixed 110 DHCP port number when replaying the reply messages. 112 1.1. Requirements Language 114 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 115 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 116 document are to be interpreted as described in RFC 2119 [RFC2119]. 118 2. Terminology 120 Downstream Device: In the DHCP relay context, it refers to the next 121 relay agent for forwarding Relay-reply Messages. 123 Upstream Device: In the DHCP relay context, it refers to the next 124 relay agent or DHCP server for forwarding Relay-forward 125 Messages. 127 Relay Source Port: This is the UDP port that a relay agent uses to 128 receive Relay-forward Messages from an upstream device. 130 Downstream Source Port: This is the UDP port that the downstream 131 device uses when forwarding Relay-forward Messages to this 132 relay agent device. This UDP port is to be used by this 133 relay agent device when forwarding the Relay-reply Messages 134 to that downstream device. 136 Non-DHCP UDP Port: Any valid and non-zero UDP port other than port 137 67 for DHCPv4 and port 547 for DHCPv6. 139 3. Changes to DHCP Specifications 141 3.1. Additions to DHCPv4 in RFC 2131 143 Section 4.1 of RFC 2131 [RFC2131] specifies that: 145 DHCP uses UDP as its transport protocol. DHCP messages from a 146 client to a server are sent to the 'DHCP server' port (67), and 147 DHCP messages from a server to a client are sent to the 'DHCP 148 client' port (68). 150 Relay agents implementing this specification may be configured 151 instead to use a source port number other than 67 when relaying 152 messages toward servers, and to receive responses toward clients on 153 that same port. This will only work when the DHCP server or relay 154 agent to which such a relay agent is forwarding messages is upgraded 155 to support this extension. 157 3.2. Additions to DHCPv6 in RFC 3315 159 Section 5.2 of RFC 3315 [RFC3315] specifies that: 161 Clients listen for DHCP messages on UDP port 546. Servers and 162 relay agents listen for DHCP messages on UDP port 547. 164 Relay agents implementing this specification may be configured 165 instead to use a source port number other than 547 when relaying 166 messages toward servers, and to receive responses toward clients on 167 that same port. This will only work when the DHCP server or relay 168 agent to which such a relay agent is forwarding messages is upgraded 169 to support this extension. 171 4. Relay Source Port Sub-option and Option 173 Relay agents do not maintain state. To return a message to its 174 source, the relay agent must include all the required information in 175 the Relay-Forward message. When a relay in a sequence of cascaded 176 relays does not use the standard source port, that source port must 177 be included along with the source address. This option allows the 178 relay agent to do so. 180 4.1. Source Port Sub-option for DHCPv4 182 The Relay Agent "Source Port Sub-option" is a new option, and it is 183 part of the relay-agent-information option for DHCPv4 [RFC3046]. 185 The format of the "Source Port Sub-option" is shown below: 187 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 188 | SubOpt Code | Len | 189 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 191 Where: 193 SubOpt Code: SUBOPT_RELAY_PORT. 8 bit value, to be assigned by 194 IANA. 196 Len: 8 bit value to be set to 0. 198 4.2. Relay Source Port Option for DHCPv6 200 The "Relay Source Port Option" is a new DHCPv6 option. It MUST be 201 used either by a DHCPv6 relay agent that uses a non-DHCP UDP port 202 (not 547) communicating with the IPv6 server and the upstream relay 203 agent, or by a IPv6 relay agent that detects the use of a non-DHCP 204 UDP port (not 547) by a downstream relay agent. 206 The format of the "Relay Source Port Option" is shown below: 208 0 1 2 3 209 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 210 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 211 | OPTION_RELAY_RELAY_PORT | Option-Len | 212 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 213 | Downstream Source Port | 214 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 216 Where: 218 Option-Code: OPTION_RELAY_RELAY_PORT. 16 bit value, to be 219 assigned by IANA. 221 Option-Len: 16 bit value to be set to 2. 223 Downstream Source Port: 16 bit value. To be set by the IPv6 224 relay either to the downstream relay agent's UDP source 225 port used for the UDP packet, or to zero if only the 226 local relay agent uses the non-DHCP UDP port (not 547). 228 5. Relay Agent and Server Behavior 230 5.1. DHCPv4 232 When a relay agent uses a non-DHCP UDP port (not 67) communicating 233 with the DHCP server, it MUST include the "Source Port Sub-option" in 234 Relay-forward messages to indicate that. 236 When an IPv4 server receives a message from a relay agent with the 237 "Source Port Sub-option", it MUST remember the UDP source port of the 238 message and use that port number as the UDP destination port when 239 sending the reply message to the same relay agent. 241 5.2. DHCPv6 243 The IPv6 relay agent MUST include the "Relay Source Port Option" when 244 it uses a non-DHCP UDP port (not 547) to communicate to a DHCPv6 245 server or an upstream IPv6 relay agent. Also when an IPv6 relay 246 agent detects that a downstream relay agent uses a non-DHCP UDP port 247 in the packet, it MUST record the port number in the "Downstream 248 Source Port" field of this option. If this option is included to 249 indicate only the local non-DHCP UDP port usage and there is no 250 downstream relay agent's non-DHCP UDP port usage, the field 251 Downstream Source Port field MUST be set to zero. 253 The IPv6 relay agent MUST include this option in the following three 254 cases: 256 1) The local relay agent uses a non-DHCP UDP port (not 547). 258 2) the downstream relay agent uses a non-DHCP UDP port (not 547). 260 3) the local relay agent and the downstream relay agent both use 261 non-DHCP UDP ports (not 547). 263 In the first case, the value of the "Downstream Source Port" field is 264 set to zero. In the other two cases, the value of the field is set 265 to the UDP port number that the downstream relay agent uses. 267 When an IPv6 server receives a Relay-forward message with the "Relay 268 Source Port Option", it MUST copy the option when constructing the 269 Relay-reply chain in response to the Relay-forward message. This 270 option MUST NOT appear in any message other than a Relay-forward or 271 Relay-reply message. Additionally, the IPv6 server MUST check and 272 use the UDP source port from the UDP packet of the Relay-forward 273 message in replying to the relay agent. 275 When a relay agent receives a Relay-reply message with the "Relay 276 Source Port Option" from a server or from an upstream relay agent, if 277 the "Downstream Source Port" field in the option is non-zero, it MUST 278 use this UDP port number to forward the Relay-reply message to the 279 downstream relay agent. 281 5.3. Compatibility 283 Sites that need for relay agents to specify a source port will need 284 to install new DHCP server and DHCP relay agent software with this 285 feature. If a site installs only DHCP relay agent software with this 286 feature, there is no possibility that the DHCP server will be able to 287 communicate to the relay agent. 289 5.4. Deployment Considerations 291 During deployment, it is advisable the operator and/or user of the 292 new DHCP relay port implementation upgrade the DHCP server first when 293 possible, before the relay implementations are deployed. This would 294 ensure that the erroneous case noted in Section 5.3 is not 295 encountered. If the upstream relay agent or server does not support 296 this extension, this DHCP relay port feature needs to be disabled. 298 When the DHCP relay port implementation is deployed, the default 299 relay agent behavior should use the DHCP UDP port, it is recommended 300 that the configuration is setup to allow for the mode of operation 301 where a non-DHCP port can be used for the DHCP relay agents. 303 Although if the network uses firewall to block or allow DHCP packets 304 with both static UDP source and destination port numbers, this may no 305 longer match the packets from new DHCP relay agent and server 306 software with this extension. The firewall rules need to be modified 307 only to match the DHCP server side of the UDP port number, and if 308 necessary, IP addresses and other attributes. 310 6. An IPv6 Cascaded Relay Example 312 An example of IPv6 cascaded relay agents with the "Relay Source Port 313 Option" is shown below. 315 (forward) (forward) (forward) 316 Relay1 ----------> Relay2 ----------> Relay3 ----------> Server 317 (1000) (547) (547) 318 (reply) (reply) (reply) 319 <---------- <---------- <---------- 321 In the above diagram, all the IPv6 devices support this generalized 322 UDP source port extension except for Relay3. Relay1 is the only 323 relay agent device uses a non-DHCP UDP port (not 547). Relay2 is the 324 upstream device of Relay1. 326 Both Relay1 and Relay2 include the "Relay Source Port Option" in 327 Relay-forward message. Relay1 sets the "Downstream Source Port" 328 field in the option to zero. Relay2 notices the "Relay Source Port 329 Option" is included in the message from Relay1, and it determines 330 that the UDP source port used by Relay1 is 1000. Relay2 will include 331 the "Relay Source Port Option" and it sets the "Downstream Source 332 Port" field in the option to 1000. The IPv6 server copies the "Relay 333 Source Port Option" when replying with the Relay-reply message. 335 When Relay2 receives the Relay-reply message with the "Relay Source 336 Port Option", it finds the "Downstream Source Port" field has the 337 value of 1000. Relay2 then uses this port number in the UDP packet 338 when sending the Relay-reply message to Relay1. 340 When Relay1 receives the Relay-reply message with the "Relay Source 341 Port Option", it finds that the "Downstream Source Port" field has 342 the value of zero. Relay1 then uses the normal IPv6 port 547 in the 343 packet sending the Relay-reply message to its downstream relay agent 344 or uses UDP port 546 to an IPv6 client. 346 This DHCP extension works with any combination of IPv6 cascaded relay 347 agents, as long as the relay agent which uses a non-DHCP UDP port 348 (not 547) and its upstream relay device support this generalized UDP 349 source port extension. 351 Similar to the above example, now assume that Relay2 uses the UDP 352 source port of 2000 instead of 547 as in the diagram. The Relay3 353 device needs to support this DHCP extension and it will set 2000 in 354 its "Downstream Source Port" field of the option in the Relay-forward 355 message. When DHCP server sends the DHCP Relay-reply to Relay3, 356 Relay3 finds its own relay option has this "Downstream Source Port" 357 with the value of 2000. Relay3 will use this UDP port when sending 358 the Relay-reply message to Relay2. Relay2 finds its own relay option 359 also has this "Downstream Source Port" with the value of 1000. 360 Relay2 will use this UDP port when sending the Relay-reply message to 361 Relay1. 363 7. IANA Considerations 365 A new sub-option, DHCPv4 Relay Source Port Sub-Option, is defined in 366 this document within the IPv4 Relay Agent Information Option. It 367 needs to be assigned by IANA in the "DHCP Relay Agent Sub-Option 368 Codes" registry, http://www.iana.org/assignments/bootp-dhcp- 369 parameters as specified in [RFC3046]. 371 A new option, DHCPv6 Relay Source Port, is defined in this document 372 for DHCPv6 and it needs to be assigned by IANA for the DHCPv6 option 373 code, in the "Option Codes" registry for DHCPv6, 374 http://www.iana.org/assignments/dhcpv6-parameters as specified in 375 [RFC3315]. 377 8. Security Considerations 379 [RFC3118] and [RFC3315] described many of the threats in using DHCP. 380 This extension does not raise addition security issues. 382 9. Acknowledgments 384 The authors would like to thank Peter Arberg, Luyuan Fang, Bhanu 385 Gopalasetty, Scott Kelly, Andre Kostur, Victor Kuarsingh, Ted Lemon, 386 Adam Roach, Kishore Seshadri and Jackelyn Shen for their review and 387 comments of this document. 389 The authors would like to thank Bernie Volz for discussions that led 390 to the definition of The Relay Source Port sub-option and DHCPv6 391 Relay Source Port Option. 393 The RFC text was produced using Marshall Rose's xml2rfc tool. 395 10. Normative References 397 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 398 Requirement Levels", BCP 14, RFC 2119, 399 DOI 10.17487/RFC2119, March 1997, . 402 [RFC2131] Droms, R., "Dynamic Host Configuration Protocol", 403 RFC 2131, DOI 10.17487/RFC2131, March 1997, 404 . 406 [RFC3046] Patrick, M., "DHCP Relay Agent Information Option", 407 RFC 3046, DOI 10.17487/RFC3046, January 2001, 408 . 410 [RFC3118] Droms, R., Ed. and W. Arbaugh, Ed., "Authentication for 411 DHCP Messages", RFC 3118, DOI 10.17487/RFC3118, June 2001, 412 . 414 [RFC3315] Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins, 415 C., and M. Carney, "Dynamic Host Configuration Protocol 416 for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July 417 2003, . 419 Authors' Addresses 420 Naiming Shen 421 Cisco Systems 422 560 McCarthy Blvd. 423 Milpitas, CA 95035 424 US 426 Email: naiming@cisco.com 428 Enke Chen 429 Cisco Systems 430 560 McCarthy Blvd. 431 Milpitas, CA 95035 432 US 434 Email: enkechen@cisco.com