WDIFF

draft-ietf-dhc-agent-options-00.txt --> draft-ietf-dhc-agent-options-01.txt

DHC Working Grop Michael Patrick
<draft-ietf-dhc-agent-options-00.txt>
<draft-ietf-dhc-agent-options-01.txt> Motorola ISG
December 11, 1996
June 6, 1997

DHCP Agent-Supplied Options Relay Agent Information Option

Status of this Memo

This document is an Internet Draft. Internet Drafts are working
documents of the Internet Engineering Task Force (IETF), its Areas,
and its Working Groups. Note that other groups may also distribute
working documents as Internet Drafts.

Internet Drafts are draft documents valid for a maximum of six
months. Internet Drafts may be updated, replaced, or obsoleted by
other documents at any time. It is not appropriate to use Internet
Drafts as reference material or to cite them other than as a "working
draft" or "work in progress."

Please check the "1id-abstracts.txt" listing contained in the
Internet-Drafts Shadow Directories on ftp.is.co.za (Africa),
nic.nordu.net (Europe), munnari.oz.au (Pacific Rim), ds.internic.net
(US East Coast), or ftp.isi.edu (US West Coast).

Abstract

Newer high-speed public Internet access technologies call for a
high-speed modem to have a LAN attachment to one or more user hosts.
It is advantageous to use DHCP to assign user host IP addresses in
this environment, but a number of security and scaling problems arise
with such "public" DHCP use. This draft calls for the definition of
three options which are added
a "DHCP Relay Agent Information" option that is appended to a DHCP
packet forwarded from a client to a server by a relay agent. The
Server may or may not use the information in the the Relay Agent
Information option; in either case, it echoes back the option
verbatim in server-to-client replies.

The "Relay Agent Information" option contains sub-options that convey
information known by the DHCP relay agent. The initial sub-options are
defined for a relay agent when forwarding that is co-located in a public DHCP requests:

-- Agent Circuit ID
-- Agent Remote ID
-- Agent Subnet Mask circuit
access unit. These options solve include a "circuit ID" for the incoming circuit
and a "remote ID" which provides a trusted identifier for the identified problems. remote
high-speed modem.

Expires June December 1997 [Page 1]

<draft-ietf-dhc-agent-options-00.txt> December

<draft-ietf-dhc-agent-options-01.txt> February 11, 1996 1997

Table of Contents

1 Introduction...........................................2 Introduction........................................... 2
1.1 High-Speed Circuit Switched Data Networks..............2 Networks.............. 2
1.2 Bridge vs. Router Models...............................3
1.3 DHCP Relay Agent in the Circuit Access Equipment.......4 Equipment....... 4
2.0 Agent-Supplied Options.................................6 Relay Agent Information Option......................... 6
2.1 Agent Circuit ID.......................................6 Operation........................................ 7
2.2 Server Operation....................................... 8
3.0 Relay Agent Remote ID........................................7
2.3 Information Suboptions..................... 9
3.1 Agent Subnet Mask......................................7
3.0 Issues Resolved........................................8 Circuit ID....................................... 9
3.2 Agent Remote ID........................................ 10
4.0 References.............................................10 Issues Resolved........................................ 10
5.0 References............................................. 12
6.0 Glossary............................................... 12
7.0 Author's Address.......................................10 Address....................................... 12

Revision History

Rev Date Description
--- -------- -----------
-01 06/06/97 Updated per March 97 IETF review:
Organize as one DHCP option with sub-options.
Clarify operation when option already present.
Move Agent Subnet Mask option to separate
document.
-00 12/11/96 Original

1 Introduction

1.1 High-Speed Circuit Switched Data Networks

Public Access to the Internet is usually via a circuit switched data
network. Today, this is primarily implemented with dial-up modems
connecting to a Remote Access Server. But higher speed circuit
access networks also include ISDN, ATM, Frame Relay, and Cable Data
Networks. All of these networks can be characterized as a "star"
topology where multiple users connect to a central "circuit access point. unit" via
switched or permanent circuits.

With dial-up modems, only a single host PC attempts to connect to the
central point. The PPP protocol is widely used to assign IP
addresses to be used by the single host PC.

Expires December 1997 [Page 2]

<draft-ietf-dhc-agent-options-01.txt> February 11, 1997

The newer high-speed circuit technologies, however, frequently
provide a LAN interface (especially Ethernet) to one or more host
PCs. It is desirable to support centralized assignment of the IP
addresses of host computers connecting on such circuits via DHCP.
The DHCP server can be, but usually is not, co-implemented with the
centralized circuit concentration access device. The DHCP server is
often connected as a separate server on the "Central LAN" to which
the central access device (or devices) attach.

A common physical model for high-speed Internet circuit access is
shown in Figure 1, below.

Expires June 1997 [Page 2]

<draft-ietf-dhc-agent-options-00.txt> December 11, 1996

+---------------+ |
Central | DHCP Circuit |-- ckt 1--- Modem1-- Host--- Host-|- Host A
LAN | | Relay Access | Lan +- |- Host B
| | Agent Unit 1 | +- |- Host C
|-----| 1 |-- |
| |(relay agent) |...
+---------+ | +---------------+
| DHCP |--|
| Server | |
+---------+ |
|
| +---------------+
+---------+ | | DHCP Circuit |-- ckt 1--- Modem2-- Host--- Host D
| Other | | | Relay Access | Lan
| Servers |--|-----| Agent Unit 2 |
| (Web, | | | 2 |-- ckt 2--- Modem3-- Host--- Host E
| DNS) | | | |(relay agent) |... Lan
| | +---------------+
+---------+
Figure 1: DHCP High Speed Circuit Access Model

Note that in this model, the "modem" connects to a LAN at the user
site, rather than to a single host. Multiple hosts are implemented at
this site. Although it is certainly possible to implement a full IP
router at the user site, this requires a relatively expensive piece
of equipment (compared to typical modem costs). Furthermore, a
router requires an IP address not only for every host, but for the
router itself. Finally, a user-side router requires a dedicated
Logical IP Subnet (LIS) for each user. While this model is
appropriate for relatively small corporate networking environments,
it is not appropriate for large, public accessed networks. In this
scenario, it is advantageous to implement an IP networking model that

Expires December 1997 [Page 3]

<draft-ietf-dhc-agent-options-01.txt> February 11, 1997

does not allocate an IP address for the modem (or other networking
equipment device at the user site), and especially not an entire LIS
for the user side LAN.

1.2 Bridge vs. Router Models

For relay agents implementing a "bridge" model, i.e. where DHCP Relay Agent in the
service offered Circuit Access Unit

It is desirable to bridge the Host LAN with the Central LAN, the use DHCP broadcast from the host is forwarded at the data link layer to assign the IP addresses for public
high-speed circuit access. A number of circuit access units (e.g.
RAS's, cable modem termination systems, ADSL access units, etc)
connect to a LAN (or local internet) to which is attached a DHCP
server. The central access device performs proxy ARP for

Expires June 1997 [Page 3]

<draft-ietf-dhc-agent-options-00.txt> December 11, 1996

hosts, and DHCP proceeds as if the host and the DHCP server are on
the same IP subnetwork.

It is envisioned, however, that public access devices must support
tens of thousands of hosts connecting into the service, e.g. through
a cable data service. In this environment, it is unreasonable to
require all hosts

For scaling and servers on the central LAN to maintain ARP
tables with tens of thousands of entries. A this scale, then, security reasons, it is
necessary advantageous to provides a "Routing" model of public Internet access,
where one or more Logical IP Subnets (LISs) are implemented for
connecting hosts. The connecting hosts must be assigned, via DHCP,
host addresses from implement a set of LISs.

The Routing access model requires
"router hop" at some point between the Host and
the Central LAN a Logical IP Subnet (LIS) interface be identified,
and that the Host be assigned an IP address on that LIS. The
choices in use today by LAN-attached modems include:

1. Modem LIS: A LIS is defined for all hosts connected to the
Modem. This describes "dial-up" routers, ISDN routers, IP
routing Frame Relay Access Devices, and some cable data modems.

2. Router LIS: The circuit attachment equipment provides only
bridging between an intermediate LAN and the Host LAN. A
traditional router implements a LIS interface to the
intermediate LAN, routing it to the central LAN. This
characterizes traditional dial-up Remote Access Servers, and
some cable data head-end equipment.

3. Virtual LIS: The circuit attachment equipment provides
"virtual" LISs, and permits hosts connecting on its circuits to
belong to any of them. This characterizes switching hubs, and
some cable data network routers.

1.3 DHCP Relay Agent in the Circuit Access Equipment

This document advocates the co-located implementation of a DHCP relay
agent with the circuit access equipment. In the Modem LIS and Virtual
LIS model, the unit, much like high-capacity
RAS's do today. The circuit access equipment acts as both a router
to the circuits and as the DHCP relay agent. It is appropriate for any of
the circuit access routing models discussed above, although is most
appropriate for the Modem LIS and Virtual LIS models.

The advantages of co-locating the DHCP relay agent with the circuit
access equipment are:

Expires June 1997 [Page 4]

<draft-ietf-dhc-agent-options-00.txt> December 11, 1996

DHCP broadcast replies can be routed to only the proper circuit,
avoiding, say, the replication of the DCHP reply broadcast onto
thousands of access circuits;

The same mechanism use used to identify the remote connection of the
circuit (e.g. a user ID requested by a Remote Access Server acting as teh
the circuit access equiment) equipment) may be used as a host
indentifier identifier by
DHCP, and used for parameter assignment. This includes centralized static
assignment of IP addresses to hosts. This provides a secure remote
ID from a trusted source -- the relay agent.

A number of issues arise when forwarding DHCP requests from hosts
connecting publicly accessed high-speed circuits with LAN connections
at the host. Many of these are security issues arising from DHCP
client requests from untrusted sources.

- How does the relay agent
know to which circuit to forward replies?

- How does the DHCP server know from which LIS to assign an IP
address?

- How does the system
prevent DHCP IP exhaustion attacks? This is when an attacker
requests all available IP addresses from a DHCP server by sending
requests with fabricated client MAC addresses.

- How can an IP address
or LIS be permanently assigned to a particular user or modem?

- How
does one prevent "spoofing" of client identifer fields used to assign
IP addresses?

- How does one prevent denial of service by "spoofing"
other client's MAC addresses?

All of these issues may be addressed by having the circuit access
equipment, which is a trusted component, add information to DHCP
client requests that it forwards to the DHCP server.

2.0 Agent-Supplied Options

This document describes options which are added by the DHCP relay
agent. It also specifies handling of those options by the DHCP

Expires June December 1997 [Page 5]

<draft-ietf-dhc-agent-options-00.txt> December 4]

<draft-ietf-dhc-agent-options-01.txt> February 11, 1996

server. The option IDs shown have been assigned by IANA, and are in
decimal format.

2.1 1997

2.0 Relay Agent Circuit ID Information Option

This option MAY be added by DHCP relay agents which terminate
switched or permanent circuits. It encodes a agent-local identifier
of the circuit from which document defines a new DHCP discover/request packet was
received. Option called the Relay Agent
Information Option. It is intended a "container" option for use by agents in relaying DHCP
responses back to the proper circuit. Possible uses of this field
include
- Router interface number
- Switching Hub port number
- Remote Access Server port number
- Frame Relay DLCI
- ATM virtual circuit number
- Cable Data virtual circuit number specific agent-
supplied sub-options. The format of the Relay Agent Circuit ID may be further standardized by
IETF working groups responsible for IP communication on that type Information
option is:

Code Len Agent Information Field
+------+------+------+------+------+------+--...-+------+
| 82 | N | i1 | i2 | i3 | i4 | | iN |
+------+------+------+------+------+------+--...-+------+

The length N gives the total number of
circuit. In octets in the absence Agent
Information Field. The Agent Information field consists of such standardization, a sequence
of SubOpt/Length/Value tuples for each sub-option, encoded in the format may
proprietary to
following manner:

SubOpt Len Sub-option Value
+------+------+------+------+------+------+--...-+------+
| 1 | N | s1 | s2 | s3 | s4 | | sN |
+------+------+------+------+------+------+--...-+------+
SubOpt Len Sub-option Value
+------+------+------+------+------+------+--...-+------+
| 2 | N | i1 | i2 | i3 | i4 | | iN |
+------+------+------+------+------+------+--...-+------+

No "pad" sub-option is defined, and the relay agent vendor.

DHCP relay agents SHALL NOT modify any existing Agent Circuit ID Information field which may shall NOT
be in terminated with a received 255 sub-option. The length N of the DHCP Discover/Request; such an
option Agent
Information Option shall include all bytes of the sub-option
code/length/value tuples. Since at least one sub-option must be
defined, the minimum Relay Agent Information length is two (2). The
length N of the sub-options shall be the number of octets in only
that sub-option's value field. A sub-option length may be zero. The
sub-options need not appear in sub-option code order.

Sub-option codes shall be assigned by IANA. The initial assignment
shall be as follows:

DHCP Agent Sub-Option Descrption
Sub-option Code
--------------- ----------------------
1 Agent Circuit ID Sub-option
2 Agent Remote ID Sub-option

Expires December 1997 [Page 5]

<draft-ietf-dhc-agent-options-01.txt> February 11, 1997

Future drafts may define additional Relay Agent Information sub-
options.

2.1 Agent Operation

A DHCP relay agent adding a Relay Agent Information field SHALL add
it as the last DHCP agent option in the DHCP options field of any
recognized DHCP packet forwarded from a client to a server. Such
additions shall be made for only those packets recognized as DHCP;
BOOTP-only packets shall not be affected.

Relay agents receiving a DHCP packet with giaddr set to zero
(indicating that they are the first-hop router) but with a Relay
Agent Information option already present in the packet SHALL discard
the packet and increment an error count.

Relay agents supporting the Relay Agent Information option SHOULD
have been separate configurables for each sub-option to control whether it
is added to client-to-server packets.

Relay agents SHOULD have a configurable for the maximum size of the
DHCP packet to be created after appending the Agent Information
option. Packets which, after appending the Relay Agent Information
option, would exceed this configured maximum size shall be forwarded
WITHOUT adding the Agent Information option. An error counter SHOULD
be incremented in this case. In the absence of this configurable,
the agent SHALL NOT exceed a size of 576 bytes for the IP MTU
containing the modified DHCP packet. The default value of the
configurable shall be 576 bytes.

The Relay Agent Information option echoed by a circuit bridge. server SHOULD be
removed by the agent when forwarding a server-to-client response back
to the client. The agent MAY choose to not remove the option when,
for example, the Relay Agent Information field is not the last option
in the server-to-client response.

The agent SHALL NOT add an "Option Overload" option to the packet or
use the "file" or "sname" fields for adding Relay Agent Information
option. It SHALL NOT parse or remove Relay Agent Information options
that may appear in the sname or file fields of a server-to-client
packet forwarded through the agent.

The operation of relay agents for specific sub-options is specified
with that sub-option.

Expires December 1997 [Page 6]

<draft-ietf-dhc-agent-options-01.txt> February 11, 1997

2.2 Server Operation

DHCP servers supporting this unaware of the Relay Agent Information option SHOULD
ignore the option upon receive and SHOULD not echo it back on
responses. This is the specified server behaviour for unknown
options.

DHCP servers claiming to support the Relay Agent Information option MUST return
SHALL echo the entire contents of the Relay Agent Information option value
unchanged
in all Offer replies. Servers SHOULD copy the Relay Agent Information
option as the last DHCP option in the response. Servers SHALL NOT
place the echoed Relay Agent Information option in the overloaded
sname or file fields. If a server is unable to copy a full Relay
Agent Information field into a response, it SHALL send the response
without the Relay Information Field, and Ack responses. SHOULD increment an error
counter for the situation.

Servers using the DHCP Authentication option SHALL exclude the
entirety of the Relay Agent Information option (including Code,
Length, and Information fields) from the MAC authentication code
calculation.

The operation of DHCP servers for specific sub-options is specified
with that sub-option.

Expires December 1997 [Page 7]

<draft-ietf-dhc-agent-options-01.txt> February 11, 1997

3.0 Relay Agent Information Sub-options

3.1 Agent Circuit ID Sub-option

This sub-option MAY be added by DHCP relay agents which terminate
switched or permanent circuits. It encodes an agent-local identifier
of the circuit from which a DHCP client-to-server packet was
received. It is intended for use by agents in relaying DHCP
responses back to the proper circuit. Possible uses of this field
include
- Router interface number
- Switching Hub port number
- Remote Access Server port number
- Frame Relay DLCI
- ATM virtual circuit number
- Cable Data virtual circuit number

The format of the Agent Circuit ID may be further standardized by
IETF working groups responsible for IP communication on that type of
circuit. In the absence of such standardization, the format may
proprietary to the relay agent vendor.

Servers MAY use the information for IP and other parameter assignment
policies, but care should be taken due to the potential proprietary
format. The DHCP server MAY SHOULD report the Agent Circuit ID value of
current leases in statistical reports (including its MIB) and in
logs.

Code Since the Circuit ID is local only to a particular relay
agent, a circuit ID should be qualified with the giaddr value that
identifies the relay agent.

SubOpt Len Circuit ID
+------+------+------+------+------+------+------+------+--
| 82 1 | n | c1 | c2 | c3 | c4 | c5 | c6 | ...
+------+------+------+------+------+------+------+------+--

2.2

Expires December 1997 [Page 8]

<draft-ietf-dhc-agent-options-01.txt> February 11, 1997

3.2 Agent Remote ID Sub-option

This option sub-option MAY be added by DHCP relay agents which terminate
switched or permanent circuits and have mechanisms to identify the
remote host end of the circuit. The Remote ID field may be used to

Expires June 1997 [Page 6]

<draft-ietf-dhc-agent-options-00.txt> December 11, 1996
encode, for instance:
-- a "caller ID" telephone number for dial-up connection
-- a "user name" prompted for by a Remote Access Server
-- a remote caller ATM address
-- a "modem ID" of a cable data modem
-- the remote IP address of a point-to-point link
-- a remote X.25 address for X.25 connections

The format of the Agent Remote ID will depend on the type of circuit
connected to the relay agent, and further specification of this field
may be standardized by the IETF working groups responsible for IP
communications on those circuit types. The only requirement is that
the remote ID be administered as globally unique.

DHCP servers supporting this option MUST return the option value
unchanged in all Offer and Ack responses. DHCP servers MAY use this
option to select parameters specific to particular users, hosts, or
subscriber modems. The relay agent MAY use this field in addition to
or instead of the Agent Circuit ID field to select the circuit on
which to forward the DHCP Offer/Ack reply.

DHCP relay agents SHALL NOT modify any existing Agent Remote ID field
in received broadcasted DHCP Discover/Ack packets; such a field may
have been added by a circuit bridge.

Code Len Agent Remote ID
+------+------+------+------+------+------+------+------+--
| 83 | n | r1 | r2 | r3 | r4 | r5 | r6 | ...
+------+------+------+------+------+------+------+------+--

2.3 Agent Subnet Mask

This option MAY be added by DHCP relay agents which terminate
multiple Logical IP Subnets. It provides the server with the subnet
mask for the LIS on which the relay agent received the request. (The
giaddr field provides the agent's IP host address on that LIS.)

DHCP servers supporting this option MAY copy the Agent Subnet mask
value into the Client Subnet Mask (option 1) parameter returned to
the host, and SHOULD have a configurable option to do so. DHCP
Servers SHOULD NOT return the Agent Subnet Mask option in the
response.

This option is intended to avoid the duplicate configuration in both

Expires June 1997 [Page 7]

<draft-ietf-dhc-agent-options-00.txt> December 11, 1996 circuit
connected to the relay agent agent, and the server further specification of this field
may be standardized by the agent's IETF working groups responsible for IP
communications on those circuit subnet masks.
A types. The only requirement is that
the remote ID be administered as globally unique.

DHCP servers MAY use this option to select parameters specific to
particular users, hosts, or subscriber modems. The relay agent terminating a public data switched network may
have thousands MAY
use this field in addition to or instead of such configured circuits and masks.

DHCP relay agents SHALL remove any incoming the Agent Subnet Mask options Circuit ID
field to select the circuit on received broadcasted DHCP Discover/Request packets from clients.
This option is only appropriately added by which to forward the relay agent
implementing DHCP reply (e.g.
Offer, Ack, or Nak). DHCP servers SHOULD report this value in any
reports or MIBs associated with a LIS interface.

Code particular client.

SubOpt Len Agent Subnet Mask
+------+------+------+------+------+------+ Remote ID
+------+------+------+------+------+------+------+------+--
| 84 2 | 4 n | m1 r1 | r2 | m2 r3 | m3 r4 | m4 r5 |
+------+------+------+------+------+------+

3.0 r6 | ...
+------+------+------+------+------+------+------+------+--

4.0 Issues Resolved

Broadcast Forwarding

The circuit access equipment forwards the normally broadcasted
DHCP response only on the circuit indicated in the Agent Circuit
ID.

DHCP LIS selection

The DHCP server MAY use the "Gateway IP Address" to select the
Logical IP subnet from which to assign IP addresses. It may select
either the Subnet Mask provided by the forwarding relay agent, or
use local configuration information to select the Subnet Mask
based on giaddr (or other info in the DHCP request).

Note that the DHCP server SHOULD use the "giaddr" field of the
relayed DHCP request for the Router Option reported to the host.

DHCP Address Exhaustion

In general, the DHCP server may be extended to maintain a database
with the "triplet" of

Expires December 1997 [Page 9]

<draft-ietf-dhc-agent-options-01.txt> February 11, 1997

(client IP address, client MAC address, client remote ID)

Expires June 1997 [Page 8]

<draft-ietf-dhc-agent-options-00.txt> December 11, 1996

The DHCP server SHOULD implement policies that restrict the number
of IP addresses to be assigned to a single remote ID.

Static Assignment

The DHCP server may use the remote ID to select the IP address to
be assigned. It may permit static assignment of IP addresses to
particular remote IDs, and disallow an address request from an
unauthorized remote ID.

IP Spoofing

The circuit access device may associate the IP address assigned by
a DHCP server in a forwarded DHCP Ack packet with the circuit to
which it was forwarded. The circuit access device MAY prevent
forwarding of IP packets with source IP addresses -other than-
those it has associated with the receiving circuit. This prevents
simple IP spoofing attacks on the Central Lan, and IP spoofing of
other hosts.

Client Identifer Spoofing

By using the agent-supplied Agent Remote ID option, the untrusted
and as-yet unstandardized client identifer field need not be used
by the DHCP server.

MAC Address Spoofing

By associating a MAC address with an Agent Remote ID, the DHCP
server can prevent offering an IP address to an attacker on a
different remote ID.

4.0

5.0 References

[1] Droms, R. "Dynamic Host Configuration Protocol", RFC 1531

[2] Alexander,S. and Droms, R., "DHCP Options and BOOTP Vendor Extension"
RFC 1533.

5.0 Author's Address

Expires June December 1997 [Page 9]

<draft-ietf-dhc-agent-options-00.txt> December 10]

<draft-ietf-dhc-agent-options-01.txt> February 11, 1996 1997

6.0 Glossary

IANA Internet Assigned Numbers Authority
LIS Logical IP Subnet
MAC Message Authentication Code
RAS Remote Access Server

7.0 Author's Address

Michael Patrick
Motorola Information Systems Group
20 Cabot Blvd., MS M4-30
Mansfield, MA 02048

Phone: (508) 261-5707
Email: mpatrick@dma.isg.mot.com

Expires June December 1997 [Page 10] 11]

----