Generalized UDP Source Port for DHCP Relay
Extracted elements (19)
Fixed UDP source ports for DHCP relay (67 for DHCPv4, 547 for DHCPv6) prevent distributing relay functionality across multiple processes sharing a single IP address on a switch node, because all relay processes would contend for the same transport socket. Assigning distinct IP addresses per process is an alternative but is operationally complex and wasteful of scarce IPv4 addresses.
Relay agents are stateless; to enable stateless routing of replies back to the correct downstream port, the upstream relay must encode the downstream source port in the Relay-forward message rather than maintaining per-session state. The 'Relay Source Port Option' carries this information so no state table is required.
Firewalls that match DHCP packets using both static UDP source and destination port numbers will no longer match packets from upgraded relay agents and servers using non-standard ports. Firewall rules must be modified to match only the server-side DHCP UDP port and other attributes as needed.
In cascaded IPv6 relay scenarios, this extension works for any combination of relay agents as long as the relay using a non-DHCP UDP port and its immediate upstream relay device both support the extension; downstream relay agents that do not support it (e.g., Relay3 in the example) do not need to participate unless they also use a non-standard port.
This extension requires both the DHCP server and relay agents to be upgraded; deploying only upgraded relay agents without an upgraded DHCP server means the server cannot communicate back to the relay on the non-standard port. The recommended deployment order is to upgrade the server first.
An IPv6 relay agent MUST include the 'Relay Source Port Option' when it uses a non-DHCP UDP port (not 547) to communicate to a DHCPv6 server or upstream relay, and also when it detects that a downstream relay agent uses a non-DHCP UDP port.
If the 'Relay Source Port Option' indicates only local non-DHCP UDP port usage and no downstream relay uses a non-DHCP port, the Downstream Source Port field MUST be set to zero.
The 'Relay Source Port Option' MUST NOT appear in any message other than a Relay-forward or Relay-reply message.
When a relay agent receives a Relay-reply message with the 'Relay Source Port Option' and the 'Downstream Source Port' field is non-zero, it MUST use that UDP port number to forward the Relay-reply message to the downstream relay agent.
When an IPv4 DHCP server receives a message from a relay agent with the 'Source Port Sub-option', it MUST remember the UDP source port and use that port as the UDP destination port when sending the reply to the same relay agent.
When an IPv4 relay agent uses a non-DHCP UDP port (not 67) to communicate with the DHCP server, it MUST include the 'Source Port Sub-option' in Relay-forward messages.
When an IPv6 server receives a Relay-forward message with the 'Relay Source Port Option', it MUST copy the option when constructing the Relay-reply chain, and MUST use the UDP source port from the Relay-forward packet when replying to the relay agent.
The 'Relay Source Port Option' (OPTION_RELAY_PORT, code 135) is a new DHCPv6 option used by relay agents to record the downstream relay's non-standard UDP source port. It contains a 16-bit 'Downstream Source Port' field set to the downstream relay's port, or zero if only the local relay uses a non-standard port.
The 'Source Port Sub-option' (SUBOPT_RELAY_PORT, code 19) is a new sub-option within the DHCPv4 Relay Agent Information option (RFC 3046). It signals that the relay agent is using a non-standard UDP source port; it carries no data beyond its presence (Len = 0).
IANA registered 'DHCPv4 Relay Source Port Sub-option' with code 19 in the 'DHCP Relay Agent Sub-Option Codes' registry under the bootp-dhcp-parameters registry, referencing RFC 3046.
IANA registered 'OPTION_RELAY_PORT' with code 135 in the DHCPv6 'Option Codes' registry under dhcpv6-parameters, referencing RFC 3315.
RFC 8357 introduces no additional security issues beyond those already described for DHCP in RFC 3118 (DHCPv4 authentication) and RFC 3315 (DHCPv6). Existing DHCP threat models and mitigations apply unchanged.
The DHCPv4 Source Port Sub-option encodes as two 8-bit fields: SubOpt Code = 19 (1 octet) and Len = 0 (1 octet), with no value payload. Its presence in the Relay Agent Information option signals use of a non-standard relay source port.
The DHCPv6 Relay Source Port Option encodes as: Option-Code = 135 (16-bit), Option-Len = 2 (16-bit), Downstream Source Port (16-bit). Total wire size is 6 octets. The Downstream Source Port carries the UDP port used by the downstream relay, or zero if inapplicable.