DHCPv6 Options for Configuration of Softwire Address and Port-Mapped Clients
updated by
- rfc-8539 — Softwire Provisioning Using DHCPv4 over DHCPv6
Extracted elements (28)
Each Softwire46 mechanism has its own DHCPv6 container option, allowing a CE to request multiple mechanisms simultaneously via the ORO and enabling future transitions between mechanisms without re-architecting option space.
Softwire46 options use addresses rather than FQDNs. The rationale is deferred to Section 8 of RFC 7227 (Guidelines for Creating New DHCPv6 Options), which recommends avoiding FQDNs in DHCPv6 options that carry network-layer parameters.
The validity of a Softwire46 IPv4 address, prefix, shared IPv4 address, and port set is tied to the lifetime of the associated End-user IPv6 prefix, coupling IPv4 service lifecycle to DHCPv6 prefix delegation.
A client MUST support processing multiple received OPTION_S46_RULE options within a single OPTION_S46_CONT_MAPE or OPTION_S46_CONT_MAPT container option.
A client receiving an unsupported S46 option or an invalid parameter value SHOULD discard that S46 container option and log the event.
An S46 CE acting as a DHCPv6 client MUST request the S46 container option(s) it is configured for in its ORO in SOLICIT, REQUEST, RENEW, REBIND, and INFORMATION-REQUEST messages.
Clients MUST be able to process received S46 Rule option values that differ from any hint values the client sent earlier.
If a CE system is MAP-E capable and attached to multiple networks providing OPTION_S46_CONT_MAPE, then the CE MUST configure MAP-E for each interface separately.
Softwire46 DHCPv6 clients that receive container options violating the mandatory/optional/not-permitted encapsulation rules MUST silently ignore such container options.
Softwire46 DHCPv6 clients that receive provisioning options not encapsulated in the correct container options MUST silently ignore those options.
The reserved bits in the ipv4-prefix field after prefix4-len bits MUST be initialized to zero by the sender and ignored by the receiver.
When receiving OPTION_S46_PORTPARAMS with an explicit PSID, the client MUST use that PSID when configuring its softwire interface. The option with an explicit PSID MUST be discarded if the CE is not configured with a full IPv4 address.
OPTION_S46_BR (code 90) conveys the IPv6 address of the Border Relay as a fixed 16-octet field. Multiple instances MAY be included for redundancy via anycast.
OPTION_S46_CONT_LW (code 96) is the Lightweight 4over6 container option. It MUST contain at least one OPTION_S46_BR and at most one OPTION_S46_V4V6BIND option.
OPTION_S46_CONT_MAPE (code 94) is the MAP-E container option grouping all rules and port parameters for a MAP-E domain. It MUST contain at least one OPTION_S46_RULE and at least one OPTION_S46_BR option.
OPTION_S46_CONT_MAPT (code 95) is the MAP-T container option. It MUST contain at least one OPTION_S46_RULE and exactly one OPTION_S46_DMR option.
OPTION_S46_DMR (code 91) conveys the Default Mapping Rule for MAP-T, containing a variable-length IPv6 prefix (dmr-ipv6-prefix) and its length (dmr-prefix6-len, 0–128). The field is right-padded to the nearest octet boundary.
OPTION_S46_PORTPARAMS (code 93) specifies port set information via three fields: 1-octet offset (a-bits, 0–15), 1-octet PSID-len (k-bits), and 2-octet PSID (left-aligned, right-padded). The address-sharing ratio is 2^k.
OPTION_S46_RULE (code 89) conveys Basic Mapping Rule (BMR) and Forwarding Mapping Rule (FMR) parameters including flags, EA bit length, IPv4 prefix, and IPv6 prefix. It is the primary provisioning option for MAP-E and MAP-T CEs.
OPTION_S46_V4V6BIND (code 92) binds a CE's full or shared IPv4 address (4-octet ipv4-address) to an IPv6 prefix (variable-length bind-ipv6-prefix), used by Lightweight 4over6 to identify the tunnel source prefix.
Table 1 defines option encapsulation rules: OPTION_S46_RULE and OPTION_S46_BR are mandatory in MAP-E; OPTION_S46_RULE and OPTION_S46_DMR are mandatory in MAP-T; OPTION_S46_BR is mandatory and OPTION_S46_V4V6BIND is optional in Lightweight 4over6. Cross-container options are not permitted.
The S46 Rule Flags field is 8 bits; the F-flag (bit 7) indicates whether the rule is used for forwarding (FMR). If not set, the rule is BMR only and MUST NOT be used for forwarding.
IANA allocated eight DHCPv6 option codes in the RFC 3315 option code space: 89 (OPTION_S46_RULE), 90 (OPTION_S46_BR), 91 (OPTION_S46_DMR), 92 (OPTION_S46_V4V6BIND), 93 (OPTION_S46_PORTPARAMS), 94 (OPTION_S46_CONT_MAPE), 95 (OPTION_S46_CONT_MAPT), 96 (OPTION_S46_CONT_LW).
DHCPv6-derived configuration may be delivered by a man-in-the-middle attacker, so there is no basis for trusting access over MAP or Lightweight 4over6 softwires. Softwires MUST NOT bypass IP firewalls or other security mechanisms.
In IPv6-only networks lacking IPv4 firewalls, a device supporting MAP could be tricked via malicious DHCPv6 into enabling its IPv4 stack and directing traffic to an attacker, exposing it to previously infeasible IPv4 attack vectors.
S46 BR option wire format: 2-octet option-code (90), 2-octet option-length (fixed 16), 16-octet br-ipv6-address.
S46 Port Parameters option wire format: 2-octet option-code (93), 2-octet option-length (fixed 4), 1-octet offset, 1-octet PSID-len, 2-octet PSID. First k bits of PSID carry the PSID value; remaining (16-k) bits are zero padding.
S46 Rule option wire format: 2-octet option-code (89), 2-octet option-length, 1-octet flags, 1-octet ea-len (0–48), 1-octet prefix4-len (0–32), 4-octet ipv4-prefix, 1-octet prefix6-len (0–128), variable-length ipv6-prefix padded to octet boundary, followed by sub-options.