--- 1/draft-ietf-dhc-relay-port-06.txt 2017-10-27 12:13:49.124864684 -0700 +++ 2/draft-ietf-dhc-relay-port-07.txt 2017-10-27 12:13:49.144865170 -0700 @@ -1,42 +1,43 @@ Networking Working Group N. Shen Internet-Draft E. Chen Intended status: Standards Track Cisco Systems -Expires: March 1, 2018 August 28, 2017 +Expires: April 30, 2018 October 27, 2017 Generalized UDP Source Port for DHCP Relay - draft-ietf-dhc-relay-port-06 + draft-ietf-dhc-relay-port-07 Abstract This document proposes an extension to the DHCP protocols that allows - a relay agent to receive packets from a server or an upstream relay - agent on any UDP port, not just the default port 67 for IPv4 or - default port 547 for IPv6. + a relay agent to use any available source port for upstream + communications, and to include a DHCP option that can be used to + statelessly route responses back to the appropriate source port on + downstream communications. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on March 1, 2018. + This Internet-Draft will expire on April 30, 2018. Copyright Notice Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents @@ -54,65 +55,66 @@ 3. Changes to DHCP Specifications . . . . . . . . . . . . . . . 3 3.1. Changes to DHCPv4 in RFC 2131 . . . . . . . . . . . . . . 3 3.2. Changes to DHCPv6 in RFC 3315 . . . . . . . . . . . . . . 4 4. Relay Source Port Sub-option and Option . . . . . . . . . . . 4 4.1. Source Port Sub-option for DHCPv4 . . . . . . . . . . . . 4 4.2. Relay Source Port Option for DHCPv6 . . . . . . . . . . . 5 5. Relay Agent and Server Behavior . . . . . . . . . . . . . . . 6 5.1. DHCPv4 . . . . . . . . . . . . . . . . . . . . . . . . . 6 5.2. DHCPv6 . . . . . . . . . . . . . . . . . . . . . . . . . 6 5.3. Compatibility . . . . . . . . . . . . . . . . . . . . . . 7 + 5.4. Deployment Considerations . . . . . . . . . . . . . . . . 7 6. An IPv6 Cascaded Relay Example . . . . . . . . . . . . . . . 7 - 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 - 8. Security Considerations . . . . . . . . . . . . . . . . . . . 8 - 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 8 + 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 + 8. Security Considerations . . . . . . . . . . . . . . . . . . . 9 + 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 9 10. Normative References . . . . . . . . . . . . . . . . . . . . 9 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 10 1. Introduction RFC 2131 [RFC2131] and RFC 3315 [RFC3315] specify the use of UDP as the transport protocol for DHCP. They also define both the server side and client side port numbers. The IPv4 server port is UDP number (67) and the client port is UDP number (68); for IPv6 the server port is (546) and the client port is (547). - This fixed UDP port of DHCP protocol scheme creates challenges in - certain DHCP relay operations. For instance, in a large scale DHCP - relay implementation on a single switch node, the DHCP relay - functionality may be partitioned among multiple relay processes. All - these DHCP relay processes may share the same IP address of the - switch node. If the UDP source port has to be a fixed number as - currently specified, the transport socket operation of DHCP packets - would need to go through a central entity or process which would - defeat the purpose of distributing DHCP relay functionality. + The fixed UDP port combinations for the DHCP protocol scheme creates + challenges in certain DHCP relay operations. For instance, in a + large scale DHCP relay implementation on a single switch node, the + DHCP relay functionality may be partitioned among multiple relay + processes. All these DHCP relay processes may share the same IP + address of the switch node. If the UDP source port has to be a fixed + number as currently specified, the transport socket operation of DHCP + packets would need to go through a central entity or process which + would defeat the purpose of distributing DHCP relay functionality. In some large-scale deployment, the decision to split the DHCP functionality into multiple processes on a node may not be purely based on DHCP relay computational load. But rather DHCP relay could just be one of the functions in a multi-process implementation. - Although assigning a different IP/IPv6 source address for each DHCP + Although assigning a different IPv4/IPv6 source address for each DHCP relay process can be a solution, it would introduce operational and network management complexities, especially given the scarceness of the IPv4 addresses. This document proposes an extension to relax the fixed UDP source port requirement for the DHCP relay agents. This extension requires a DHCP server to remember the inbound packet's UDP port number along - with the IP/IPv6 address. The DHCP server when sending back replies - MUST use the UDP port number that the incoming relay agent uses - instead of the fixed DHCP port number. In the case of IPv6 cascaded - relay agents [RFC3315], the upstream relay agent needs to use the - "Relay Source Port Option" to record the downstream source port and - it MUST use this recorded port number instead of the fixed DHCP port - number when replaying the reply messages. + with the IPv4/IPv6 address. The DHCP server when sending back + replies MUST use the UDP port number that the incoming relay agent + uses instead of the fixed DHCP port number. In the case of IPv6 + cascaded relay agents [RFC3315], the upstream relay agent needs to + use the "Relay Source Port Option" to record the downstream source + port and it MUST use this recorded port number instead of the fixed + DHCP port number when replaying the reply messages. 1.1. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 2. Terminology Downstream Device: In the DHCP relay context, it refers to the next @@ -282,23 +284,41 @@ downstream relay agent. 5.3. Compatibility Sites that need for relay agents to specify a source port will need to install new DHCP server and DHCP relay agent software with this feature. If a site installs only DHCP relay agent software with this feature, there is no possibility that the DHCP server will be able to communicate to the relay agent. - The implementation is advised to allow configuration for relay agent - specifying a DHCP relay port number. It can be used to allow the - relay agent either using a normal DHCP UDP port or non-DHCP UDP port. +5.4. Deployment Considerations + + During deployment, it may be advisable the operator and/or user of + the new DHCP relay port implementation upgrade the DHCP server first + when possible, before the relay implementations are deployed. This + would ensure that the erroneous case noted in Section 5.3 is not + encountered. + + When the DHCP relay port implementation is deployed, it is + recommended that the configuration is setup to allow for the mode of + operation where a non-DHCP port can be used for the DHCP relay + agents. The recommended configuration then permits the relay agent + to utilize the default DHCP UDP port, or a non-DHCP UDP port as + desired. + + Although if the network uses firewall to block or allow DHCP packets + with both static UDP source and destination port numbers, this may no + longer match the packets from new DHCP relay agent and server + software with this extension. The firewall rules need to be modified + only to match the DHCP server side of the UDP port number, and if + necessary, IP addresses and other attributes. 6. An IPv6 Cascaded Relay Example An example of IPv6 cascaded relay agents with the "Relay Source Port Option" is shown below. (forward) (forward) (forward) Relay1 ----------> Relay2 ----------> Relay3 ----------> Server (1000) (547) (547) (reply) (reply) (reply) @@ -322,51 +342,59 @@ Port Option", it finds the "Downstream Source Port" field has the value of 1000. Relay2 then uses this port number in the UDP packet when sending the Relay-reply message to Relay1. When Relay1 receives the Relay-reply message with the "Relay Source Port Option", it finds that the "Downstream Source Port" field has the value of zero. Relay1 then uses the normal IPv6 port 547 in the packet sending the Relay-reply message to its downstream relay agent or uses UDP port 546 to an IPv6 client. + This DHCP extension works with any combination of IPv6 cascaded relay + agents, as long as the relay agent which uses a non-DHCP UDP port + (not 547) and its upstream relay device support this generalized UDP + source port extension. + + Similar to the above example, now assume that Relay2 uses the UDP + source port of 2000 instead of 547 as in the diagram. The Relay3 + device needs to support this DHCP extension and it will set 2000 in + its "Downstream Source Port" field of the option in the Relay-forward + message. When DHCP server sends the DHCP Relay-reply to Relay3, + Relay3 finds its own relay option has this "Downstream Source Port" + with the value of 2000. Relay3 will use this UDP port when sending + the Relay-reply message to Relay2. + 7. IANA Considerations A new sub-option, DHCPv4 Relay Source Port, is defined in this document within the IPv4 Relay Agent Information Option. It needs to be assigned by IANA in the "DHCP Relay Agent Sub-Option Codes" registry, http://www.iana.org/assignments/bootp-dhcp-parameters as specified in [RFC3046]. A new option, DHCPv6 Relay Source Port, is defined in this document for DHCPv6 and it needs to be assigned by IANA for the DHCPv6 option code, in the "Option Codes" registry for DHCPv6, http://www.iana.org/assignments/dhcpv6-parameters as specified in [RFC3315]. 8. Security Considerations [RFC3118] and [RFC3315] described many of the threats in using DHCP. This extension does not raise addition security issues. - Although if the network uses firewall to block or allow DHCP packets - with both static UDP source and destination port numbers, this may no - longer match the packets from new DHCP relay agent and server - software. The firewall rules need to be modified only to match the - DHCP server side of the UDP port number, and if necessary, IP - addresses and other attributes. - 9. Acknowledgments The authors would like to thank Peter Arberg, Luyuan Fang, Bhanu - Gopalasetty, Andre Kostur, Ted Lemon, Kishore Seshadri and Jackelyn - Shen for their review and comments of this document. + Gopalasetty, Scott Kelly, Andre Kostur, Victor Kuarsingh, Ted Lemon, + Kishore Seshadri and Jackelyn Shen for their review and comments of + this document. The authors would like to thank Bernie Volz for discussions that led to the definition of The Relay Source Port sub-option and DHCPv6 Relay Source Port Option. The RFC text was produced using Marshall Rose's xml2rfc tool. 10. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate