Network Working Group R. Droms Internet-Draft Cisco Systems Expires: July 13, 2004 January 13, 2004 Stateless DHCP Service for IPv6 draft-ietf-dhc-dhcpv6-stateless-04.txt Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http:// www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on July 13, 2004. Copyright Notice Copyright (C) The Internet Society (2004). All Rights Reserved. Abstract Stateless DHCP service for IPv6 (DHCPv6) is used by nodes to obtain configuration information such as the addresses of DNS recursive name servers that does not require the maintenance of any dynamic state for individual clients. A node that uses stateless DHCP must have obtained its IPv6 addresses through some other mechanism, typically stateless address autoconfiguration. This document explains which parts of RFC3315 must be implemented in each of the different kinds of DHCP agents so that that agent can support stateless DHCP. 1. Introduction Nodes that have obtained IPv6 addresses through some other mechanism such as stateless address autoconfiguration [6] or manual Droms Expires July 13, 2004 [Page 1] Internet-Draft Stateless DHCPv6 Implementation Guide January 2004 configuration can use stateless DHCP to obtain other configuration information such as a list of DNS recursive name servers or SIP servers. A stateless DHCP server provides only configuration information to nodes and does not perform any address assignment. Such a server is called "stateless" because it need not maintain any dynamic state for individual clients. While the DHCP specification [1] defines more than 10 protocol messages and 20 options, only a subset of those messages and options are required for stateless DHCP service. This document explains which messages and options defined in RFC 3315 are required for stateless DHCP service. The intended use of the document is to guide the interoperable implementation of clients and servers that use stateless DHCP service. The operation of relay agents is the same for stateless and stateful DHCP service. The operation of relay agents is described in the DHCP specification. Section 4 of this document lists the sections of the DHCP document that an implementor should read for an overview of the DHCP specification and the basic requirements of a DHCP service. Section 5 lists the specific messages and options that are specifically required for stateless DHCP service. Section 6 describes how stateless and stateful DHCP servers interact to provide service to clients that require address assignment and clients that require only stateless service. 2. Terminology Throughout this document, "DHCP" refers to DHCP for IPv6. This document uses the terminology defined in RFC2460 [2], the DHCP specification [1] and the DHCP DNS configuration options specification [3]. "Stateless DHCP" refers to the use of DHCP to provide configuration information to clients that does not require the server to maintain dynamic state about the DHCP clients. 3. Overview This document assumes that a node using stateless DHCP configuration is not using DHCP for address assignment, and that a node has determined at least a link-local address as described in section 5.3 of RFC2461 [4]. To obtain configuration parameters through stateless DHCP, a node Droms Expires July 13, 2004 [Page 2] Internet-Draft Stateless DHCPv6 Implementation Guide January 2004 uses the DHCP Information-request message. DHCP servers respond to the node's message with a Reply message that carries configuration parameters for the node. The Reply message from the server can carry configuration information such as a list of DNS recursive name servers [3] and SIP servers [5]. This document does not apply to the function of DHCP relay agents as described in RFC 3315. A network element can provide both DHCP server and DHCP relay service. For example, a network element can provide stateless DHCP service to hosts requesting stateless DHCP service, while relaying messages from hosts requesting address assignment through DHCP to another DHCP server. 4. Basic Requirements for Implementation of DHCP Several sections of the DHCP specification provide background information or define parts of the specification that are common to all implementations: 1-4: give an introduction to DHCP and an overview of DHCP message flows 5: defines constants used throughout the protocol specification 6, 7: illustrates the format of DHCP messages 8: describes the representation of Domain Names 9: defines the "DHCP unique identifier" (DUID) 13-16: describe DHCP message transmission, retransmission and validation 21: describes authentication for DHCP 5. Implementation of Stateless DHCP The client indicates that it is requesting configuration information by sending an Information-request message that includes an Option Request option specifying the options that it wishes to receive from the DHCP server. For example, if the client is attempting to obtain a list of DNS recursive name servers, it identifies the DNS Recursive Name Server option in the Information-request message. The server determines the appropriate configuration parameters for the client based on its configuration policies and responds with a Reply message containing the requested parameters. In this example, the server would respond with DNS configuration parameters. Droms Expires July 13, 2004 [Page 3] Internet-Draft Stateless DHCPv6 Implementation Guide January 2004 As described in section 18.1.5 of RFC 3315, a node may include a Client Identifier option in the Information-request message to identify itself to a server, because the server administrator may want to customize the server's response to each node, based on the node's identity. RFC 3315 does not define any mechanisms through which the time at which a host uses an Information-request message to obtain updated configuration parameters can be controlled. The dhc WG has undertaken the development of such a mechanism or mechanisms which will be published as Standards-track RFC(s). RFC 3315 also does not provide any guidance about when a host might use an Information-request message to obtain updated configuration parameters when the host has moved to a new link. The dhc WG is reviewing a related document, "Detection of Network Attachment (DNA) in IPv4" [8], which describes how a host using IPv4 can determine when to use DHCPv4. Either the dhc WG or a WG formed from the dna BOF will undertake development of a similar document for IPv6. 5.1 Messages Required for Stateless DHCP Service Clients and servers implement the following messages for stateless DHCP service; the section numbers in this list refer to the DHCP specification: Information-request: sent by a DHCP client to a server to request configuration parameters (sections 18.1.5 and 18.2.5) Reply: sent by a DHCP server to a client containing configuration parameters (sections 18.2.6 and 18.2.8) In addition, servers and relay agents implement the following messages for stateless DHCP service; the section numbers in this list refer to the DHCP specification: Relay-forward: Sent by a DHCP relay agent to carry the client message to a server (section 15.13) Relay-reply: Sent by a DHCP server to carry a response message to the relay agent (section 15.14) 5.2 Options Required for Stateless DHCP Service Clients and servers implement the following options for stateless DHCP service; the section numbers in this list refer to the DHCP specification: Droms Expires July 13, 2004 [Page 4] Internet-Draft Stateless DHCPv6 Implementation Guide January 2004 Option Request: specifies the configuration information that the client is requesting from the server (section 22.7) Status Code: used to indicate completion status or other status information (section 22.13) Server Identifier: used to identify the server responding to a client request (section 22.3) Servers and relay agents implement the following options for stateless DHCP service; the section numbers in this list refer to the DHCP specification: Client message: Sent by a DHCP relay agent in a Relay-forward message to carry the client message to a server (section 20) Server message: Sent by a DHCP server in a Relay-reply message to carry a response message to the relay agent (section 20) Interface-ID: Sent by the DHCP relay agent and returned by the server to identify the interface to use to forward a message to the client (section 22.18) 5.3 Options Used for Configuration Information Clients and servers use the following options to pass configuration information to clients; note that other options for configuration information may be specified in future Internet Standards: DNS Recursive Name Servers: specifies the DNS recursive name servers [7] the client uses for name resolution; see "DNS Configuration options for DHCPv6" [3] DNS search list: specifies the domain names to be searched during name resolution; see "DNS Configuration options for DHCPv6" [3] SIP Servers: specifies the SIP servers the client uses to obtain a list of domain names of IPv6 addresses that can be mapped to one or more SIP outbound proxy servers [5] 5.4 Other Options Used in Stateless DHCP Clients and servers may implement the following options for stateless DHCP service; the section numbers in this list refer to the DHCP specification: Droms Expires July 13, 2004 [Page 5] Internet-Draft Stateless DHCPv6 Implementation Guide January 2004 Preference: Sent by a DHCP server to indicate the preference level for the server (section 22.8) Elapsed time: Sent by a DHCP client to indicate the time since the client began the DHCP configuration process (section 22.9) User Class: Sent by a DHCP client to give additional information to the server for selecting configuration parameters for the client (section 22.15) Vendor Class: Sent by a DHCP client to give additional information about the client vendor and hardware to the server for selecting configuration parameters for the client (section 22.16) Vendor-specific Information: Used to pass information to clients in options defined by vendors (section 22.17) Client Identifier: Sent by a DHCP client to identify itself (section 22.2). Clients are not required to send this option; servers send the option back if included in a message from a client Authentication: Used to provide authentication of DHCP messages (section 21) 6. Interaction with DHCP for Address Assignment In some networks, there may be both clients that are using stateless address autoconfiguration and DHCP for DNS configuration and clients that are using DHCP for stateful address configuration. Depending on the deployment and configuration of relay agents, DHCP servers that are intended only for stateless configuration may receive messages from clients that are performing stateful address configuration. A DHCP server that is only able to provide stateless configuration information through an Information-request/Reply message exchange discards any other DHCP messages it receives. Specifically, the server discards any messages other than Information-Request or Relay-forward it receives, and the server does not participate in any stateful address configuration messages exchanges. If there are other DHCP servers that are configured to provide stateful address assignment, one of those servers will provide the address assignment. 7. Security Considerations Stateless DHCP service is a proper subset of the DHCP service described in the DHCP specification, RFC 3315. Therefore, stateless DHCP service introduces no additional security considerations beyond Droms Expires July 13, 2004 [Page 6] Internet-Draft Stateless DHCPv6 Implementation Guide January 2004 those discussed in sections 21, 22.11 and 23 of the DHCP specification. Configuration information provided to a node through stateless DHCP service may be used to mount spoofing, man-in-the-middle, denial-of-service and other attacks. These attacks are described in more detail in the specifications for each of the options that carry configuration information. Authenticated DHCP, as described in sections 21 and 22.11 of the DHCP specification, can be used to avoid attacks mounted through the stateless DHCP service. 8. Acknowledgments Jim Bound, Ted Lemon and Bernie Volz reviewed this document and contributed editorial suggestions. Thanks to Peter Barany, Tim Chown, Christian Huitema, Tatuya Jinmei, Pekka Savola and Juha Wiljakka for their review and comments. Normative References [1] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C. and M. Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003. [2] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998. Informative References [3] Droms, R., "DNS Configuration options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3646, December 2003. [4] Narten, T., Nordmark, E. and W. Simpson, "Neighbor Discovery for IP Version 6 (IPv6)", RFC 2461, December 1998. [5] Schulzrinne, H. and B. Volz, "Dynamic Host Configuration Protocol (DHCPv6) Options for Session Initiation Protocol (SIP) Servers", RFC 3319, July 2003. [6] Thomson, S. and T. Narten, "IPv6 Stateless Address Autoconfiguration", RFC 2462, December 1998. [7] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, November 1987. [8] Aboba, B., "Detection of Network Attachment (DNA) in IPv4", draft-ietf-dhc-dna-ipv4-04 (work in progress), October 2003. Droms Expires July 13, 2004 [Page 7] Internet-Draft Stateless DHCPv6 Implementation Guide January 2004 Author's Address Ralph Droms Cisco Systems 1414 Massachusetts Avenue Boxborough, MA 01719 USA Phone: +1 978 497 4733 EMail: rdroms@cisco.com Droms Expires July 13, 2004 [Page 8] Internet-Draft Stateless DHCPv6 Implementation Guide January 2004 Intellectual Property Statement The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director. Full Copyright Statement Copyright (C) The Internet Society (2004). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assignees. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION Droms Expires July 13, 2004 [Page 9] Internet-Draft Stateless DHCPv6 Implementation Guide January 2004 HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Acknowledgment Funding for the RFC Editor function is currently provided by the Internet Society. Droms Expires July 13, 2004 [Page 10]