--- 1/draft-ietf-dhc-relay-port-01.txt 2017-02-28 19:13:09.044862822 -0800 +++ 2/draft-ietf-dhc-relay-port-02.txt 2017-02-28 19:13:09.064863299 -0800 @@ -1,305 +1,391 @@ Networking Working Group N. Shen Internet-Draft E. Chen Intended status: Standards Track Cisco Systems -Expires: July 9, 2017 January 5, 2017 +Expires: September 1, 2017 February 28, 2017 - Generalized Source UDP Port of DHCP Relay - draft-ietf-dhc-relay-port-01 + Generalized UDP Source Port for DHCP Relay + draft-ietf-dhc-relay-port-02 Abstract - This document extends the DHCP and DHCPv6 protocols for the UDP - transport from relay agent to server and allows the port to be any - valid number on the DHCP relay system. + This document proposes an extension to the DHCP and DHCPv6 protocols + that allows any valid number to be used as the relay agent UDP source + port for DHCP packets. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on July 9, 2017. + This Internet-Draft will expire on September 1, 2017. Copyright Notice Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 - 2. Changes to DHCP and DHCPv6 Specifications . . . . . . . . . . 3 - 2.1. Changes to DHCP in RFC 2131 . . . . . . . . . . . . . . . 3 - 2.2. Changes to DHCPv6 in RFC 3315 . . . . . . . . . . . . . . 3 - 3. Relay Agent Source Port Sub-option and Option . . . . . . . . 4 - 3.1. DHCP Relay Agent Source Port Sub-option . . . . . . . . . 4 - 3.2. DHCPv6 Relay Agent Source Port Option . . . . . . . . . . 4 - 4. Compatibility . . . . . . . . . . . . . . . . . . . . . . . . 6 - 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 - 6. Security Considerations . . . . . . . . . . . . . . . . . . . 6 - 7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 6 - 8. Document Change Log . . . . . . . . . . . . . . . . . . . . . 7 - 8.1. Changes to draft-ietf-dhc-relay-port-01 . . . . . . . . . 7 - 8.2. Changes to draft-ietf-dhc-relay-port-00 . . . . . . . . . 7 - 9. Normative References . . . . . . . . . . . . . . . . . . . . 7 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 7 + 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 + 3. Changes to DHCP and DHCPv6 Specifications . . . . . . . . . . 3 + 3.1. Changes to DHCP in RFC 2131 . . . . . . . . . . . . . . . 3 + 3.2. Changes to DHCPv6 in RFC 3315 . . . . . . . . . . . . . . 4 + 4. Relay Source Port Sub-option and Option . . . . . . . . . . . 4 + 4.1. Source Port Sub-option for DHCPv4 . . . . . . . . . . . . 4 + 4.2. Relay Source Port Option for DHCPv6 . . . . . . . . . . . 5 + 5. A DHCPv6 Cascaded Relay Example . . . . . . . . . . . . . . . 6 + 6. Compatibility . . . . . . . . . . . . . . . . . . . . . . . . 7 + 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 + 8. Security Considerations . . . . . . . . . . . . . . . . . . . 8 + 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 8 + 10. Document Change Log . . . . . . . . . . . . . . . . . . . . . 8 + 10.1. Changes to draft-ietf-dhc-relay-port-02 . . . . . . . . 8 + 10.2. Changes to draft-ietf-dhc-relay-port-01 . . . . . . . . 9 + 10.3. Changes to draft-ietf-dhc-relay-port-00 . . . . . . . . 9 + 11. Normative References . . . . . . . . . . . . . . . . . . . . 9 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 1. Introduction - RFC 2131 [RFC2131] and RFC 3315 [RFC3315] specify the DHCP transport - protocol as UDP. They also define both the server side and client - side port numbers. The DHCP server port is UDP number (67) and the - client port is UDP number (68); for DHCPv6 the server port is (546) - and the client port is (547). + RFC 2131 [RFC2131] and RFC 3315 [RFC3315] specify the use of UDP as + the transport protocol for DHCP and DHCPv6. They also define both + the server side and client side port numbers. The DHCP server port + is UDP number (67) and the client port is UDP number (68); for DHCPv6 + the server port is (546) and the client port is (547). - This fixed port number of DHCP protocol scheme creates problems in - certain DHCP relay operations and environments. For instance, in a - large scale DHCP relay implementation on a single switch node, the - DHCP relay functionality may be partitioned among multiple relay - processes running under different CPUs. All those DHCP relay - processes may share the same IP address of the switch node. If the - UDP source port has to be a fixed number, the transport socket - operation of DHCP packets needs to go through a central location or - process which defeats the purpose of distributed DHCP relay - functionality. + This fixed UDP port of DHCP protocol scheme creates challenges in + certain DHCP relay operations. For instance, in a large scale DHCP + relay implementation on a single switch node, the DHCP relay + functionality may be partitioned among multiple relay processes. All + these DHCP relay processes may share the same IP address of the + switch node. If the UDP source port has to be a fixed number as + currently specified, the transport socket operation of DHCP packets + would need to go through a central entity or process which would + defeat the purpose of distributing DHCP relay functionality. - In some of the scalable operational environment, the decision to - split functionality into multiple processes on a node may not be - purely based on DHCP relay load. But DHCP relay is one of the - functions in the multiple process implementation. + In some large-scale deployment, the decision to split the DHCP + functionality into multiple processes on a node may not be purely + based on DHCP relay computational load. But rather DHCP relay could + just be one of the functions in a multi-process implementation. - Although assigning the different source IP/IPv6 address for each DHCP - relay process can be a solution, it requires operational and network - management involvement. It needs to be sure, at least for DHCP, the - address space among the relay and server is in private IPv4 address - domain. + Although assigning a different IP/IPv6 source address for each DHCP + relay process can be a solution, it would introduce operational and + network management complexities, especially given the scarceness of + the IPv4 addresses. - This document proposes the option to relax the fixed source port - requirement for the DHCP relay agents. This extension requires the - DHCP server or relay agent, in the case of relay chaining [RFC3315], - to remember the inbound packet's UDP port number along with the IP/ - IPv6 address. The DHCP server when sending back replies MUST use the - UDP port number that the incoming relay agent uses instead of blindly - setting the DHCP fixed port number. + This document proposes an extension to relax the fixed UDP source + port requirement for the DHCP relay agents. This extension requires + a DHCP server or relay agent, in the case of cascaded relay agents + [RFC3315], to remember the inbound packet's UDP port number along + with the IP/IPv6 address. The DHCP server when sending back replies + MUST use the UDP port number that the incoming relay agent uses + instead of the fixed DHCP port number. 1.1. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. -2. Changes to DHCP and DHCPv6 Specifications +2. Terminology -2.1. Changes to DHCP in RFC 2131 + Downstream Device: In the DHCP relay context, it refers to the next + relay agent for forwarding Relay-reply Messages. - Section 4.1 of RFC 2131 [RFC2131] asserts that: DHCP uses UDP as its - transport protocol. DHCP messages from a client to a server are sent - to the 'DHCP server' port (67), and DHCP messages from a server to a - client are sent to the 'DHCP client' port (68). + Upstream Device: In the DHCP relay context, it refers to the next + relay agent or DHCP server for forwarding Relay-forward + Messages. - This specification adds to the above paragraph in the paragraph - below. + Relay Source Port: This is the UDP port that a relay agent uses to + receive Relay-forward Messages from an upstream device. + + Downstream Source Port: This is the UDP port that the downstream + device uses when forwarding Relay-forward Messages to this + relay agent device. This UDP port is to be used by this + relay agent device when forwarding the Relay-reply Messages + to that downstream device. + + Non-DHCP UDP Port: Any valid UDP port other than port 67 for DHCP + and port 547 for DHCPv6. + +3. Changes to DHCP and DHCPv6 Specifications + +3.1. Changes to DHCP in RFC 2131 + + Section 4.1 of RFC 2131 [RFC2131] specifies that: + + DHCP uses UDP as its transport protocol. DHCP messages from a + client to a server are sent to the 'DHCP server' port (67), and + DHCP messages from a server to a client are sent to the 'DHCP + client' port (68). + + This specification adds the following extension to the above + paragraph. DHCP messages from a relay agent to a server are sent to the 'DHCP - server' port (67), and the UDP source port it uses can be any valid - UDP port available on the relay system, including the DHCP port 67. - The default is port number 67 if there is no explicit configuration - for generalized source UDP port extension of DHCP relay. + server' port (67), and the UDP source port it uses can be any + valid UDP port available in the relay system, including the DHCP + port 67. The default port number is 67 if there is no explicit + configuration for the generalized source UDP port extension for + DHCP relay. -2.2. Changes to DHCPv6 in RFC 3315 +3.2. Changes to DHCPv6 in RFC 3315 - Section 5.2 of RFC 3315 [RFC3315] asserts that: Clients listen for - DHCP messages on UDP port 546. Servers and relay agents listen for - DHCP messages on UDP port 547. + Section 5.2 of RFC 3315 [RFC3315] specifies that: - This specification adds to the above paragraph in the paragraph - below. + Clients listen for DHCP messages on UDP port 546. Servers and + relay agents listen for DHCP messages on UDP port 547. - DHCP relay agents can listen for DHCP messages from server or another - upstream relay agent on any valid UDP port available on the relay - system including the DHCP UDP port 547. The default is port 547 if - there is no explicit configuration for generalized source UDP port - extension of DHCP relay. + This specification adds the following extension to the above + paragraph. -3. Relay Agent Source Port Sub-option and Option + A DHCP relay agent can listen for DHCP messages from a server or + another upstream relay agent device on any valid UDP port + available in the relay system including the DHCP UDP port 547. + The default is port 547 if there is no explicit configuration for + the generalized UDP source port extension for DHCP relay. - Although the DHCP or DHCPv6 server can implicitly detect a source UDP - port that is different from the standard DHCP port number when it - receives an inbound message from relay agents, this sub-option makes - the request explicit for the server to use a non-DHCP UDP port in the - reply message. +4. Relay Source Port Sub-option and Option -3.1. DHCP Relay Agent Source Port Sub-option + Although a DHCP or DHCPv6 server can implicitly determine a UDP + source port when it receives an inbound message from a relay agent, + this sub-option makes the request explicit for the server to use a + non-DHCP UDP port in the reply message. When DHCPv6 cascaded relay + agents are involved, the downstream non-DHCP UDP port needs to be + recorded using the option. - The Relay Agent Source Port sub-option is part of the relay-agent- - information option for DHCPv4 [RFC3046]. It SHOULD be used by the - relay agent that uses a non-DHCP UDP port communicating with the DHCP - server. +4.1. Source Port Sub-option for DHCPv4 - The format of the DHCPv4 Relay Agent Source Port Sub-option is shown - below: + The Relay Agent "Source Port Sub-option" is a new option, and it is + part of the relay-agent-information option for DHCPv4 [RFC3046]. It + SHOULD be used by a relay agent that uses a non-DHCP UDP port + communicating with the DHCP server. + + The format of the "Source Port Sub-option" is shown below: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | SubOpt Code | Len | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Where: - SubOpt Code: TBD. 8 bits value, to be assigned by IANA. + SubOpt Code: SUBOPT_RELAY_PORT. 8 bits value, to be assigned by + IANA. Len: 8 bits value to be set to 0. - When a DHCP server receives a message from relay agent with this - Relay Source Port sub-option, it MUST remember the inbound message - UDP source port from the relay agent and use the same port number for - the UDP destination port that sends the reply message to the same - relay agent. + When a DHCP server receives a message from a relay agent with the + "Source Port Sub-option", it MUST remember the UDP source port of the + message and use that port number as the UDP destination port when + sending the reply message to the same relay agent. -3.2. DHCPv6 Relay Agent Source Port Option +4.2. Relay Source Port Option for DHCPv6 - The Relay Agent Source Port Option is a new DHCPv6 option. It SHOULD - be used either by a DHCPv6 relay agent that uses a non-DHCP UDP port + The "Relay Source Port Option" is a new DHCPv6 option. It SHOULD be + used either by a DHCPv6 relay agent that uses a non-DHCP UDP port communicating with the DHCP server and the upstream relay agent, or by a DHCPv6 relay agent that detects the use of a non-DHCP UDP port by a downstream relay agent. - The format of the DHCPv6 Relay Agent Source Port Option is shown - below: + The format of the "Relay Source Port Option" is shown below: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - | Option-Code | Option-Len | + | OPTION_RELAY_RELAY_PORT | Option-Len | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - | Downstream UDP Source Port | + | Downstream Source Port | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Where: - Option-Code: TBD. 16 bits value, to be assigned by IANA. + Option-Code: OPTION_RELAY_RELAY_PORT. 16 bits value, to be + assigned by IANA. Option-Len: 16 bits value to be set to 2. - Downstream UDP Source Port: 16 bits value. To be set by the - DHCPv6 relay to the downstream relay agent's UDP source - port used for the UDP packet or to be set to zero. + Downstream Source Port: 16 bits value. To be set by the DHCPv6 + relay either to the downstream relay agent's UDP source + port used for the UDP packet, or to zero if only the + local relay agent uses the non-DHCP UDP port. - The DHCPv6 relay agent SHOULD include this Relay Source Port Option - when it uses a non-DHCP UDP port to communicate to the DHCPv6 server - or an upstream DHCPv6 relay agent. Also when a DHCPv6 relay agent - detects that the downstream relay agent uses a non-DHCP UDP port in - the packet, it MUST record the port number in the Downstream UDP - Source Port field of this option. If this option is included to - indicate only the local non-DHCP UDP port usage and there is no - downstream relay agent's non-DHCP UDP port usage, the field - Downstream UDP Source Port MUST be set to zero. + The DHCPv6 relay agent SHOULD include the "Relay Source Port Option" + when it uses a non-DHCP UDP port to communicate to a DHCPv6 server or + an upstream DHCPv6 relay agent. Also when a DHCPv6 relay agent + detects that a downstream relay agent uses a non-DHCP UDP port in the + packet, it MUST record the port number in the "Downstream Source + Port" field of this option. If this option is included to indicate + only the local non-DHCP UDP port usage and there is no downstream + relay agent's non-DHCP UDP port usage, the field Downstream Source + Port field MUST be set to zero. - When a DHCPv6 server receives the relayed DHCPv6 packet with this - Relay Source Port Option, it MUST copy and add the option when - constructing the Relay-Reply chain in response to the Relay-Forward - messages. This option MUST NOT appear in any message except a Relay- - Forward or Relay-Reply message. + The DHCPv6 relay agent SHOULD include this option in the following + three cases: - With this Relay Source Port Option in the message, when a DHCPv6 - server replies the Relay-Reply message towards a relay agent, it MUST - check and use the UDP source port from the UDP packet of the Relay- - Forward message by the relay agent. + 1) The local relay agent uses a non-DHCP UDP port. - When a relay agent receives this Relay-Reply message with this option - from the server or from an upstream relay agent, and if the - Downstream UDP Source Port value is non-zero, it MUST use this UDP - port to relay the Relay-Reply message to the downstream relay agent. + 2) the downstream relay agent uses a non-DHCP UDP port. -4. Compatibility + 3) the local relay agent and the downstream relay agent both use + non-DHCP UDP ports. - With this extension of DHCP and DHCPv6 source port generalization, - the server behavior is compatible with the relay agent that uses the - DHCP fixed UDP port. The DHCP server will reflect back the UDP well- - known port number (67/547) that the client uses when relaying back to - the relay agent. It is recommended to upgrade the server side first. + In the first case, the value of the field in "Downstream Source Port" + field is set to zero. In the other two cases, the value of the field + is set to the UDP port number that the downstream relay agent uses. - The implementation is advised to allow the relay agent configuration - for specifying a fixed DHCP relay port number. This is for the case - where the DHCP relay agent is upgraded with this extension before the - server side upgrade. + When a DHCPv6 server receives a Relay-forward message with the "Relay + Source Port Option", it MUST copy the option when constructing the + Relay-reply chain in response to the Relay-forward message. This + option MUST NOT appear in any message other than a Relay-forward or + Relay-reply message. Additionally, the DHCPv6 server MUST check and + use the UDP source port from the UDP packet of the Relay-forward + message in replying to the relay agent. -5. IANA Considerations + When a relay agent receives a Relay-reply message with the "Relay + Source Port Option" from a server or from an upstream relay agent, if + the "Downstream Source Port" field in the option is non-zero, it MUST + use this UDP port number to forward the Relay-reply message to the + downstream relay agent. - A new sub-option, DHCP Relay Agent Source Port, is defined in this - document within the DHCPv4 Relay Agent Information Option. It needs - to be assigned by IANA from the DHCP Relay Agent sub-options space +5. A DHCPv6 Cascaded Relay Example + + An example of DHCPv6 cascaded relay agents with the "Relay Source + Port Option" is shown below. + + (forward) (forward) (forward) + Relay1 ----------> Relay2 ----------> Relay3 ----------> Server + (1000) (547) (547) + (reply) (reply) (reply) + <---------- <---------- <---------- + + In the above diagram, all the DHCPv6 devices support this generalized + UDP source port extension except for Relay3. Relay1 is the only + relay agent device uses a non-DHCP UDP port. Relay2 is the upstream + device of Relay1. + + Both Relay1 and Relay2 include the "Relay Source Port Option" in + Relay-forward message. Relay1 sets the "Downstream Source Port" + field in the option to zero. Relay2 notices the "Relay Source Port + Option" is included in the message from Relay1, and it determines + that the UDP source port used by Relay1 is 1000. Relay2 will include + the "Relay Source Port Option" and it sets the "Downstream Source + Port" field in the option to 1000. The DHCPv6 server copies the + "Relay Source Port Option" when replying with the Relay-reply + message. + + When Relay2 receives the Relay-reply message with the "Relay Source + Port Option", it finds the "Downstream Source Port" field has the + value of 1000. Relay2 then uses this port number in the UDP packet + when sending the Relay-reply message to Relay1. + + When Relay1 receives the Relay-reply message with the "Relay Source + Port Option", it finds that the "Downstream Source Port" field has + the value of zero. Relay1 then uses the normal DHCP port 547 in the + packet sending the Relay-reply message to its downstream relay agent + or uses UDP port 546 to a DHCPv6 client. + +6. Compatibility + + With this source port generalization for DHCP and DHCPv6, the server + behavior is compatible with the relay agent that uses the normal DHCP + UDP port. The DHCP server will use the well-known UDP port (67 or + 547) when sending Relay-reply message back to the relay agent. It is + recommended to upgrade the server side first before using a non-DHCP + UDP port for a relay agent. + + The implementation is advised to allow configuration for relay agent + specifying a DHCP relay port number. It can be used to allow the + relay agent either using a normal DHCP UDP port or non-DHCP UDP port. + +7. IANA Considerations + + A new sub-option, DHCP Relay Source Port, is defined in this document + within the DHCPv4 Relay Agent Information Option. It needs to be + assigned by IANA from the DHCP Relay Agent sub-options space [RFC3046]. A new option, DHCPv6 Relay Source Port, is defined in this document for DHCPv6 and it needs to be assigned by IANA for the DHCPv6 option code. -6. Security Considerations +8. Security Considerations If the network uses firewall to block or allow DHCP packets with both static UDP source and destination port numbers, this may no longer match the packets from new DHCP relay agent and server software. The firewall rules need to be modified only to match the DHCP server side of the UDP port number, and if necessary, IP addresses and other attributes. -7. Acknowledgments +9. Acknowledgments The authors would like to thank Peter Arberg, Bhanu Gopalasetty, Andre Kostur, Ted Lemon, and Kishore Seshadri for their review and comments of this document. The authors would like to thank Bernie Volz for discussions that lead - to the definition of The Relay Agent Source Port sub-option and - DHCPv6 Relay Agent Source Port Option. + to the definition of The Relay Source Port sub-option and DHCPv6 + Relay Source Port Option. The RFC text was produced using Marshall Rose's xml2rfc tool. -8. Document Change Log +10. Document Change Log -8.1. Changes to draft-ietf-dhc-relay-port-01 +10.1. Changes to draft-ietf-dhc-relay-port-02 + + o Posted the draft in February 2017. + + o Added the Terminology section. + + o Defined the Sub-option and Option names for DHCPv4 and DHCPv6. + + o Added the DHCPv6 cascaded relay agents example. + +10.2. Changes to draft-ietf-dhc-relay-port-01 o Posted the draft in January 2017. - o Change the DHCPv6 Relay Agent Source Port Option, UDP Source Port - field to Downstream UDP Source Port. Add the option handling - mechanism for DHCPv6 server and relay agents. + o Change the DHCPv6 Relay Source Port Option, UDP Source Port field + to Downstream Source Port. Add the option handling mechanism for + DHCPv6 server and relay agents. -8.2. Changes to draft-ietf-dhc-relay-port-00 +10.3. Changes to draft-ietf-dhc-relay-port-00 o Posted first version of working group draft in October 2016. o This draft was renamed from draft-shen-dhc-client-port-03.txt. -9. Normative References +11. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, DOI 10.17487/RFC2131, March 1997, .