DHCP Relay Agent Information Option
updated by
- rfc-6607 — Virtual Subnet Selection Options for DHCPv4 and DHCPv6
Extracted elements (26)
Co-locating the DHCP relay agent with the circuit access equipment allows unicast forwarding of DHCP replies to only the correct circuit, avoids replicating broadcast replies to thousands of access circuits, and enables use of circuit-layer identity (e.g., ATM VC, cable modem ID) as a trusted DHCP client identifier.
The circuit access model deliberately avoids allocating an IP address to the modem or a dedicated Logical IP Subnet (LIS) per user-side LAN, since doing so would require a full IP router at the user site and is inappropriate for large public-access networks.
The Relay Agent Information option is organized as a single DHCP option with sub-options (rather than multiple independent options) specifically so that future DHCP authentication mechanisms can unambiguously omit the entire block from integrity calculations, and so the relay agent can cleanly strip it before forwarding to the client.
DHCP servers unaware of the Relay Agent Information option will ignore it on receipt and will not echo it back in responses, which is the specified RFC 2132 behavior for unknown options. Deployments must account for servers that silently drop the option.
A relay agent adding a Relay Agent Information field SHALL add it as the last option (before 'End Option' 255, if present) in the DHCP options field of any recognized BOOTP or DHCP packet forwarded from client to server.
DHCP servers claiming to support the Relay Agent Information option SHALL echo the entire contents of the option in all replies, SHOULD copy it as the last DHCP option in the response, and SHALL NOT place the echoed option in the overloaded sname or file fields.
If a server is unable to copy a full Relay Agent Information field into a response, it SHALL send the response without the Relay Agent Information field and SHOULD increment an error counter.
In the absence of a configurable maximum packet size, the relay agent SHALL NOT increase a forwarded DHCP packet size to exceed the MTU of the forwarding interface. If a size limit is configured and would be exceeded by adding the option, the packet SHALL be forwarded without the option and an error counter SHOULD be incremented.
Overall adding of the Relay Agent Information option SHOULD be configurable and SHOULD be disabled by default. Relay agents SHOULD have separate configurables for each sub-option.
Relay agents configured to add a Relay Agent option which receive a client DHCP packet with a nonzero giaddr SHALL discard the packet if the giaddr spoofs a giaddr address implemented by the local agent itself. Otherwise, the relay agent SHALL forward the packet WITHOUT adding relay agent options and SHALL NOT modify the giaddr value.
Relay agents MUST NOT modify DHCP packets that use the IPsec Authentication Header or IPsec Encapsulating Security Payload.
Relay agents receiving a DHCP packet from an untrusted circuit with giaddr set to zero but with a Relay Agent Information option already present SHALL discard the packet and increment an error count.
Servers SHOULD be prepared to handle relay agent options in unicast messages, but MUST NOT expect them to always be present, since relay agents are not required to monitor unicast DHCP messages sent directly between client and server.
The Agent Remote ID sub-option value MUST be globally unique. Servers and relay agents SHOULD treat it as opaque, with policies based on exact string match only.
The Relay Agent Information option echoed by a server MUST be removed by either the relay agent or the trusted downstream network element which added it when forwarding a server-to-client response back to the client.
The relay agent SHALL NOT add an 'Option Overload' option to the packet, nor use the 'file' or 'sname' fields for the Relay Agent Information option. It SHALL NOT parse or remove Relay Agent Information options that may appear in those fields in server-to-client packets.
The Relay Agent Information option is a container option inserted by the relay agent when forwarding client-to-server DHCP packets. The server echoes it verbatim in replies, and the relay agent strips it before forwarding the reply to the client.
IANA maintains a 'DHCP Relay Agent Sub-options' number space in the BOOTP-DHCP Parameters Registry. Initial assignments are sub-option 1 (Agent Circuit ID) and sub-option 2 (Agent Remote ID). Future sub-options require IETF Consensus per RFC 2434.
Any future mechanisms for authenticating DHCP client-to-server communications must omit the DHCP Relay Agent option from server authentication calculations to avoid the relay agent being unable to strip the option. This concern drove the single-option-with-sub-options design.
Automatic reforwarding of IP or ARP broadcast packets back downstream by the circuit access unit exposes serious IP security risks; for example, a rebroadcast DHCP-DISCOVER or DHCP-REQUEST could allow any public host to spoof the desired DHCP server.
The option relies on an implied trusted relationship between the relay agent and the DHCP server, with the DHCP client assumed untrusted. The trusted network must prevent unauthorized DHCP traffic from entering except through secured relay agents. Deployers must carefully evaluate security vulnerabilities before deployment.
The Remote ID is provided by the access network or modem, not by client premise equipment, making it a trusted identifier. Cryptographic or other authentication techniques for the Remote ID are encouraged but beyond the scope of this document.
Agent Circuit ID is sub-option code 1 with a variable-length value (c1..cN) encoding an agent-local identifier of the ingress circuit. The field is opaque; servers SHOULD treat it as an exact-match string qualified by the giaddr.
Agent Remote ID is sub-option code 2 with a variable-length value (r1..rN) encoding a globally unique identifier for the remote host end of the circuit, such as a modem ID, caller ID, or remote IP address.
Sub-options within the Relay Agent Information option are encoded as SubOpt/Len/Value tuples. No pad sub-option is defined, and the field SHALL NOT be terminated with sub-option 255. Sub-option length N counts only that sub-option's value octets; a zero-length sub-option value is permitted.
The Relay Agent Information option is DHCP option 82. It consists of a 1-octet code (82), a 1-octet length N giving total octets in the Agent Information Field, followed by N octets of sub-option tuples. The minimum length is 2, requiring at least one sub-option.