The IPv4 Subnet Selection Option for DHCP
Extracted elements (17)
The option was motivated by RAS devices that allocate addresses on behalf of clients connected to external networks, while the device itself communicates with the DHCP server over an internal network that has no IP connectivity to the external networks. Without this option, the server would allocate addresses on the internal subnet rather than the required external subnets.
The subnet address value is defined as any IPv4 address on the subnet ANDed with the subnet mask, so that network and subnet bits are preserved and host bits are zeroed. This canonical form allows unambiguous subnet identification.
Servers that do not understand the subnet selection option will allocate an address using normal algorithms and will not return the option in DHCPOFFER or DHCPACK; in this case the client will discard those packets, resulting in a failed allocation.
A server implementing the subnet selection option SHOULD provide the ability to selectively enable the feature under restricted conditions, such as by client-id, source subnet, or restricting which subnets may be requested.
Clients using the subnet selection option MUST discard DHCPOFFER or DHCPACK packets that do not contain this option.
In all DHCP packets that contain the subnet selection option, the giaddr field in the BOOTP header MUST be set to an IPv4 address on which the DHCP client will accept DHCP packets (e.g., the address on the internal network subnet).
Servers administratively configured to ignore the subnet selection option MUST ignore it, use their normal allocation algorithms, and MUST NOT return this option in the DHCPOFFER or DHCPACK.
Servers configured to support this option MUST return an identical copy of the option to any client that sends it, regardless of whether the client requests it in a parameter request list.
Servers that implement the subnet selection option MUST by default disable use of the feature; it must be specifically enabled through configuration.
The IPv4 address to which a DHCP server sends a reply MUST be the same as it would choose when the subnet selection option is not present, preserving normal reply-routing behavior.
When the server is configured to respond to the subnet selection option, is allocating an address, and the option is present, the server MUST allocate the address on either the specified subnet or a subnet on the same network segment as the specified subnet.
When the subnet selection option is present and the server supports it, the server MUST NOT offer an address that is not on the requested subnet or network segment.
The subnet selection option (code 118) contains a single IPv4 address representing a subnet, computed by ANDing any address on that subnet with the subnet mask. It allows a DHCP client to override the server's normal subnet selection logic.
IANA has assigned DHCP option code 118 for the subnet selection option defined in this document.
DHCP provides no authentication or security mechanisms. The subnet selection option amplifies the existing address-pool exhaustion attack vector by allowing a client to target address pools on any subnet, not just its local subnet.
To mitigate misuse, the subnet selection feature must be disabled by default and should only be enabled with administrative controls such as restricting it to specific client-ids, source subnets, or permitted target subnets.
The subnet selection option is encoded as: Code=118 (1 octet), Len=4 (1 octet), followed by a 4-octet IPv4 subnet address (A1–A4). Total option length is 6 octets.