RADIUS Extensions for DHCP-Configured Services
updates
- rfc-4014 — Remote Authentication Dial-In User Service (RADIUS) Attributes Suboption for the Dynamic Host Configuration Protocol (DHCP) Relay Agent Information Option
Extracted elements (28)
Both attributes use the 'Long Extended Type' format (RFC 6929 Section 2.2) specifically to permit transport of attributes encapsulating more than 253 octets of data, which is necessary for carrying DHCP options that may be larger than the standard RADIUS attribute value limit.
RFC 4014's frozen static table of permitted RADIUS attributes was replaced with a registry-based approach because the static list is suboptimal when new services (e.g., encrypted DNS) require passing new RADIUS attributes through the DHCP relay-server path.
The mechanism is intentionally generic rather than specific to encrypted DNS (DNR), enabling use for any future DHCP-configured service without requiring new RADIUS attributes, with extensibility managed through the permitted-options IANA registries.
Two separate attributes (DHCPv6-Options and DHCPv4-Options) were specified rather than a single unified attribute to accommodate both IPv4 and IPv6 deployment contexts while respecting the constraints in RFC 6158 Section 3.4 on RADIUS design.
In deployments where the NAS acts as DHCPv6 relay agent, RADIUS CoA-Requests carrying updated DHCPv6-Options (e.g., changed encrypted DNS resolver information) trigger DHCPv6 Reconfigure messages to clients via the procedure in RFC 6977.
The DHCPv6-Options Attribute MAY appear in a RADIUS Access-Request packet as a hint to the RADIUS server to indicate a preference, but the server is not required to honor such a preference.
This document updates RFC 4014 by replacing its frozen static table of permitted RADIUS attributes in the DHCP suboption with a reference to the new 'RADIUS Attributes Permitted in RADIUS Attributes DHCP Suboption' IANA registry, allowing future extensibility without further RFC updates.
Absent any explicit configuration on the DHCP server, RADIUS-supplied data via DHCP*-Options Attributes take precedence over any local configuration on the DHCP server.
Absent explicit configuration, RADIUS implementations and DHCP server implementations SHOULD ignore non-permitted DHCP options received in a RADIUS DHCP*-Options Attribute.
For DHCPv4 options that require concatenation and exceed the 255-octet maximum DHCPv4 option size, the mechanism specified in RFC 3396 MUST be used for splitting and concatenating instances.
Per the RFC 4014 update, if the relay agent relays RADIUS attributes not in the 'RADIUS Attributes Permitted in RADIUS Attributes DHCP Suboption' registry and explicit configuration is absent, the DHCP server SHOULD ignore them.
Per the RFC 4014 update, the DHCP relay agent SHOULD only include attributes listed in the 'RADIUS Attributes Permitted in RADIUS Attributes DHCP Suboption' registry in an instance of the RADIUS Attributes DHCP suboption.
RADIUS implementations are RECOMMENDED to support a packet size up to 65535 bytes to accommodate deployments with large DHCP options, relaxing the standard 4096-byte RADIUS packet limit.
The DHCPv4-Options Attribute MUST NOT appear in any RADIUS packet other than Access-Request, Access-Accept, CoA-Request, and Accounting-Request packets.
The DHCPv6-Options Attribute MUST NOT appear in any RADIUS packet other than Access-Request, Access-Accept, CoA-Request, and Accounting-Request packets.
When multiple instances of the same DHCPv6 option appear in the DHCPv6-Options Attribute, each instance is considered separate; the data areas of the options MUST NOT be concatenated or otherwise combined.
The DHCPv4-Options Attribute (identifier 245.4) uses the Long Extended Type format with Type=245 and Extended-Type=4. Its Value field contains a list of DHCPv4 options. Multiple instances of the same option MAY be included especially for concatenation-requiring options that exceed the 255-octet maximum DHCPv4 option size.
The DHCPv6-Options Attribute (identifier 245.3) uses the Long Extended Type format with Type=245 and Extended-Type=3. Its Value field contains a list of DHCPv6 options as defined in Section 21 of RFC 8415. Multiple instances of the same DHCPv6 option MAY be included.
New subregistry 'DHCP Options Permitted in the RADIUS DHCPv4-Options Attribute' created in the BOOTP/DHCP Parameters registry with Expert Review policy. Initial content: Tag 162 (OPTION_V4_DNR).
New subregistry 'DHCPv6 Options Permitted in the RADIUS DHCPv6-Options Attribute' created in the DHCPv6 registry with Expert Review policy. Initial content: Value 144 (OPTION_V6_DNR).
New subregistry 'RADIUS Attributes Permitted in RADIUS Attributes DHCP Suboption' created in the BOOTP/DHCP Parameters registry with Expert Review policy. Initial contents include attributes from RFC 2865/2869/3162 (User-Name, Service-Type, Vendor-Specific, Session-Timeout, Framed-Pool, Framed-IPv6-Pool) plus the new 245.4 DHCPv4-Options attribute.
The existing 'RADIUS Attributes Permitted in DHCPv6 RADIUS Option' subregistry is updated to add entry 245.3 (DHCPv6-Options), enabling DHCP relay agents to pass this attribute to DHCPv6 servers.
Two new RADIUS attribute types registered in the 'RADIUS Attribute Types' registry: 245.3 (DHCPv6-Options, string type) and 245.4 (DHCPv4-Options, string type), both defined in RFC 9445.
It is RECOMMENDED that RADIUS servers implementing this specification be updated to understand the format and encoding of DHCP options rather than treating them as opaque strings, to ensure correct encoding, improve security, and increase usability for administrators.
Security considerations from RFC 4014 Section 7 and RFC 7037 Section 8 apply to deployments where DHCP relay agents pass DHCP*-Options Attributes to DHCP servers. Additional considerations for Reconfigure messages are in RFC 6977 Section 9.
The Value fields of the DHCP*-Options Attributes are encoded in the clear and not encrypted (unlike, for example, the Tunnel-Password Attribute). Sensitive DHCP option data transmitted in these attributes is not protected at the RADIUS attribute level.
DHCPv4-Options Attribute wire format: Type (1 octet, value 245), Length (total octets including Type/Length/Extended-Type/Value), Extended-Type (1 octet, value 4), Value (list of DHCPv4 options). Uses Long Extended Type format consistent with RFC 6929 Section 2.2.
DHCPv6-Options Attribute wire format: Type (1 octet, value 245), Length (total octets including Type/Length/Extended-Type/Value), Extended-Type (1 octet, value 3), Value (list of DHCPv6 options). Uses Long Extended Type format to permit more than 253 octets of data.