DHC  Working Grop                                      Michael Patrick
       <draft-ietf-dhc-agent-options-00.txt>                  Motorola ISG
                                                              December 11, 1996
       
                             DHCP Agent-Supplied Options
       
       Status of this Memo
       
          This document is an Internet Draft.  Internet Drafts are working
          documents of the Internet Engineering Task Force (IETF), its Areas,
          and its Working Groups.  Note that other groups may also distribute
          working documents as Internet Drafts.
       
          Internet Drafts are draft documents valid for a maximum of six
          months.  Internet Drafts may be updated, replaced, or obsoleted by
          other documents at any time.  It is not appropriate to use Internet
          Drafts as reference material or to cite them other than as a "working
          draft" or "work in progress."
       
          Please check the "1id-abstracts.txt" listing contained in the
          Internet-Drafts Shadow Directories on ftp.is.co.za (Africa),
          nic.nordu.net (Europe), munnari.oz.au (Pacific Rim), ds.internic.net
          (US East Coast), or ftp.isi.edu (US West Coast).
       
       Abstract
       
          Newer high-speed public Internet access technologies call for a
          high-speed modem to have a LAN attachment to one or more user hosts.
          It is advantageous to use DHCP to assign user host IP addresses in
          this environment, but a number of security and scaling problems arise
          with such "public" DHCP use.  This draft calls for the definition of
          three options which are added by the DHCP relay agent when forwarding
          public DHCP requests:
       
                          -- Agent Circuit ID
                          -- Agent Remote ID
                          -- Agent Subnet Mask
       
          These options solve the identified problems.
       
       
       
       
       
       
       
       
       
       
       
       
       Expires June 1997                                               [Page 1]


       <draft-ietf-dhc-agent-options-00.txt>                  December 11, 1996
       
       
       Table of Contents
       
       
                  1   Introduction...........................................2
                  1.1 High-Speed Circuit Switched Data Networks..............2
                  1.2 Bridge vs. Router Models...............................3
                  1.3 DHCP Relay Agent in the Circuit Access Equipment.......4
                  2.0 Agent-Supplied Options.................................6
                  2.1 Agent Circuit ID.......................................6
                  2.2 Agent Remote ID........................................7
                  2.3 Agent Subnet Mask......................................7
                  3.0 Issues Resolved........................................8
                  4.0 References.............................................10
                  5.0 Author's Address.......................................10
       
       
       
       1   Introduction
       
       1.1 High-Speed Circuit Switched Data Networks
       
          Public Access to the Internet is usually via a circuit switched data
          network.  Today, this is primarily implemented with dial-up modems
          connecting to a Remote Access Server.  But higher speed circuit
          access networks also include ISDN, ATM, Frame Relay, and Cable Data
          Networks.  All of these networks can be characterized as a "star"
          topology where multiple users connect to a central access point.
       
          With dial-up modems, only a single host PC attempts to connect to the
          central point.  The PPP protocol is widely used to assign IP
          addresses to be used by the single host PC.
       
          The newer high-speed circuit technologies, however, frequently
          provide a LAN interface (especially Ethernet) to one or more host
          PCs.  It is desirable to support centralized assignment of the IP
          addresses of host computers connecting on such circuits via DHCP.
          The DHCP server can be, but usually is not, co-implemented with the
          centralized circuit concentration access device.  The DHCP server is
          often connected as a separate server on the "Central LAN" to which
          the central access device (or devices) attach.
       
          A common physical model for high-speed Internet circuit access is
          shown in Figure 1, below.
       
       
       
       
       
       
       
       
       Expires June 1997                                               [Page 2]


       <draft-ietf-dhc-agent-options-00.txt>                  December 11, 1996
       
       
       
       
       
                             +---------------+
               Central       |   DHCP        |-- ckt 1--- Modem1-- Host--- Host A
               LAN     |     |   Relay       |                     Lan  +- Host B
                       |     |   Agent       |                          +- Host C
                       |-----|     1         |--
                       |     |               |...
          +---------+  |     +---------------+
          |  DHCP   |--|
          | Server  |  |
          +---------+  |
                       |
                       |     +---------------+
          +---------+  |     |   DHCP        |-- ckt 1--- Modem2-- Host--- Host D
          | Other   |  |     |   Relay       |                     Lan
          | Servers |--|-----|   Agent       |
          |  (Web,  |  |     |     2         |-- ckt 2--- Modem3-- Host--- Host E
          |   DNS)  |  |     |               |...                  Lan
          |         |        +---------------+
          +---------+
                   Figure 1:  DHCP High Speed Circuit Access Model
       
       
          Note that in this model, the "modem" connects to a LAN at the user
          site, rather than to a single host. Multiple hosts are implemented at
          this site.  Although it is certainly possible to implement a full IP
          router at the user site, this requires a relatively expensive piece
          of equipment (compared to typical modem costs).  Furthermore, a
          router requires an IP address not only for every host, but for the
          router itself. Finally, a user-side router requires a dedicated
          Logical IP Subnet (LIS) for each user.  While this model is
          appropriate for relatively small corporate networking environments,
          it is not appropriate for large, public accessed networks. In this
          scenario, it is advantageous to implement an IP networking model that
          does not allocate an IP address for the modem (or other networking
          equipment device at the user site), and especially not an entire LIS
          for the user side LAN.
       
       1.2 Bridge vs. Router Models
       
          For relay agents implementing a "bridge" model, i.e. where the
          service offered is to bridge the Host LAN with the Central LAN, the
          DHCP broadcast from the host is forwarded at the data link layer to
          the DHCP server.  The central access device performs proxy ARP for
       
       
       
       
       
       Expires June 1997                                               [Page 3]


       <draft-ietf-dhc-agent-options-00.txt>                  December 11, 1996
       
       
          hosts, and DHCP proceeds as if the host and the DHCP server are on
          the same IP subnetwork.
       
          It is envisioned, however, that public access devices must support
          tens of thousands of hosts connecting into the service, e.g. through
          a cable data service.  In this environment, it is unreasonable to
          require all hosts and servers on the central LAN to maintain ARP
          tables with tens of thousands of entries.  A this scale, then, it is
          necessary to provides a "Routing" model of public Internet access,
          where one or more Logical IP Subnets (LISs) are implemented for
          connecting hosts.  The connecting hosts must be assigned, via DHCP,
          host addresses from a set of LISs.
       
          The Routing access model requires at some point between the Host and
          the Central LAN a Logical IP Subnet (LIS) interface be identified,
          and that the Host be assigned an IP address on that LIS.  The
          choices in use today by LAN-attached modems include:
       
            1.  Modem LIS:  A LIS is defined for all hosts connected to the
                Modem.  This describes "dial-up" routers, ISDN routers, IP
                routing Frame Relay Access Devices, and some cable data modems.
       
            2.  Router LIS:  The circuit attachment equipment provides only
                bridging between an intermediate LAN and the Host LAN.  A
                traditional router implements a LIS interface to the
                intermediate LAN, routing it to the central LAN. This
                characterizes traditional dial-up Remote Access Servers, and
                some cable data head-end equipment.
       
            3.  Virtual LIS: The circuit attachment equipment provides
                "virtual" LISs, and permits hosts connecting on its circuits to
                belong to any of them.  This characterizes switching hubs, and
                some cable data network routers.
       
       1.3 DHCP Relay Agent in the Circuit Access Equipment
       
          This document advocates the co-located implementation of a DHCP relay
          agent with the circuit access equipment. In the Modem LIS and Virtual
          LIS model, the circuit access equipment acts as both a router to the
          circuits and as the DHCP relay agent. It is appropriate for any of
          the circuit access routing models discussed above, although is most
          appropriate for the Modem LIS and Virtual LIS models.
       
          The advantages of co-locating the DHCP relay agent with the circuit
          access equipment are:
       
       
       
       
       
       
       Expires June 1997                                               [Page 4]


       <draft-ietf-dhc-agent-options-00.txt>                  December 11, 1996
       
       
            1.  DHCP broadcast replies can be routed to only the proper
                circuit, avoiding, say, the replication of the DCHP reply
                broadcast onto thousands of access circuits;
       
       
            2.  The same mechanism use to identify the remote connection of the
                circuit (e.g. a user ID requested by a Remote Access Server
                acting as teh circuit access equiment) may be used as a host
                indentifier by DHCP, and used for parameter assignment.  This
                includes centralized static assignment of IP addresses to
                hosts.  This provides a secure remote ID from a trusted source
                -- the relay agent.
       
          A number of issues arise when forwarding DHCP requests from hosts
          connecting publicly accessed high-speed circuits with LAN connections
          at the host. Many of these are security issues arising from DHCP
          client requests from untrusted sources.
       
             - How does the relay agent know to which circuit to forward
               replies?
       
             - How does the DHCP server know from which LIS to assign an IP
               address?
       
             - How does the system prevent  DHCP IP exhaustion attacks?  This
               is when an attacker requests all available IP addresses from a
               DHCP server by sending requests with fabricated client MAC
               addresses.
       
             - How can an IP address or LIS be permanently assigned to a
               particular user or modem?
       
             - How does one prevent "spoofing" of client identifer fields used
               to assign IP addresses?
       
             - How does one prevent denial of service by "spoofing" other
               client's MAC addresses?
       
          All of these issues may be addressed by having the circuit access
          equipment, which is a trusted component, add information to DHCP
          client requests that it forwards to the DHCP server.
       
       2.0 Agent-Supplied Options
       
          This document describes options which are added by the DHCP relay
          agent.  It also specifies handling of those options by the DHCP
       
       
       
       
       
       Expires June 1997                                               [Page 5]


       <draft-ietf-dhc-agent-options-00.txt>                  December 11, 1996
       
       
          server.  The option IDs shown have been assigned by IANA, and are in
          decimal format.
       
       2.1 Agent Circuit ID
       
          This option MAY be added by DHCP relay agents which terminate
          switched or permanent circuits.  It encodes a agent-local identifier
          of the circuit from which a DHCP discover/request packet was
          received.  It is intended for use by agents in relaying DHCP
          responses back to the proper circuit.  Possible uses of this field
          include
              - Router interface number
              - Switching Hub port number
              - Remote Access Server port number
              - Frame Relay DLCI
              - ATM virtual circuit number
              - Cable Data virtual circuit number
       
          The format of the Agent Circuit ID may be further standardized by
          IETF working groups responsible for IP communication on that type of
          circuit.  In the absence of such standardization, the format may
          proprietary to the relay agent vendor.
       
          DHCP relay agents SHALL NOT modify any existing Agent Circuit ID
          field which may be in a received DHCP Discover/Request; such an
          option may have been added by a circuit bridge.
       
          DHCP servers supporting this option MUST return the option value
          unchanged in all Offer and Ack responses.  Servers MAY use the
          information for IP and other parameter assignment policies, but care
          should be taken due to the potential proprietary format.  The DHCP
          server MAY report the Agent Circuit ID value of current leases in
          statistical reports (including its MIB) and in logs.
       
       
                   Code   Len     Circuit ID
                  +------+------+------+------+------+------+------+------+--
                  |  82  |   n  |  c1  |  c2  |  c3  |  c4  |  c5  |  c6  | ...
                  +------+------+------+------+------+------+------+------+--
       
       
       2.2 Agent Remote ID
       
          This option MAY be added by DHCP relay agents which terminate
          switched or permanent circuits and have mechanisms to identify the
          remote host end of the circuit.  The Remote ID field may be used to
       
       
       
       
       
       Expires June 1997                                               [Page 6]


       <draft-ietf-dhc-agent-options-00.txt>                  December 11, 1996
       
       
          encode, for instance:
              -- a "caller ID" telephone number for dial-up connection
              -- a "user name" prompted for by a Remote Access Server
              -- a remote caller ATM address
              -- a "modem ID" of a cable data modem
              -- the remote IP address of a point-to-point link
              -- a remote X.25 address for X.25 connections
       
          The format of the Agent Remote ID will depend on the type of circuit
          connected to the relay agent, and further specification of this field
          may be standardized by the IETF working groups responsible for IP
          communications on those circuit types.  The only requirement is that
          the remote ID be administered as globally unique.
       
          DHCP servers supporting this option MUST return the option value
          unchanged in all Offer and Ack responses.  DHCP servers MAY use this
          option to select parameters specific to particular users, hosts, or
          subscriber modems.  The relay agent MAY use this field in addition to
          or instead of the Agent Circuit ID field to select the circuit on
          which to forward the DHCP Offer/Ack reply.
       
          DHCP relay agents SHALL NOT modify any existing Agent Remote ID field
          in received broadcasted DHCP Discover/Ack packets; such a field may
          have been added by a circuit bridge.
       
       
                   Code   Len     Agent Remote ID
                  +------+------+------+------+------+------+------+------+--
                  | 83   |   n  |  r1  |  r2  |  r3  |  r4  |  r5  |  r6  | ...
                  +------+------+------+------+------+------+------+------+--
       
       
       2.3 Agent Subnet Mask
       
          This option MAY be added by DHCP relay agents which terminate
          multiple Logical IP Subnets. It provides the server with the subnet
          mask for the LIS on which the relay agent received the request. (The
          giaddr field provides the agent's IP host address on that LIS.)
       
          DHCP servers supporting this option MAY copy the Agent Subnet mask
          value into the Client Subnet Mask (option 1) parameter returned to
          the host, and SHOULD have a configurable option to do so.  DHCP
          Servers SHOULD NOT return the Agent Subnet Mask option in the
          response.
       
          This option is intended to avoid the duplicate configuration in both
       
       
       
       
       
       Expires June 1997                                               [Page 7]


       <draft-ietf-dhc-agent-options-00.txt>                  December 11, 1996
       
       
          the relay agent and the server of the agent's circuit subnet masks.
          A DHCP relay agent terminating a public data switched network may
          have thousands of such configured circuits and masks.
       
          DHCP relay agents SHALL remove any incoming Agent Subnet Mask options
          on received broadcasted DHCP Discover/Request packets from clients.
          This option is only appropriately added by the relay agent
          implementing a LIS interface.
       
       
       
                   Code   Len      Agent Subnet Mask
                  +------+------+------+------+------+------+
                  | 84   |   4  |  m1  |  m2  |  m3  |  m4  |
                  +------+------+------+------+------+------+
       
       
       
       3.0 Issues Resolved
       
          Broadcast Forwarding
       
             The circuit access equipment forwards the normally broadcasted
             DHCP response only on the circuit indicated in the Agent Circuit
             ID.
       
          DHCP LIS selection
       
             The DHCP server MAY use the "Gateway IP Address" to select the
             Logical IP subnet from which to assign IP addresses. It may select
             either the Subnet Mask provided by the forwarding relay agent, or
             use local configuration information to select the Subnet Mask
             based on giaddr (or other info in the DHCP request).
       
             Note that the DHCP server SHOULD use the "giaddr" field of the
             relayed DHCP request for the Router Option reported to the host.
       
          DHCP Address Exhaustion
       
             In general, the DHCP server may be extended to maintain a database
             with the "triplet" of
       
       
                         (client IP address,  client MAC address,  client remote ID)
       
       
       
       
       
       
       
       Expires June 1997                                               [Page 8]


       <draft-ietf-dhc-agent-options-00.txt>                  December 11, 1996
       
       
             The DHCP server SHOULD implement policies that restrict the number
             of IP addresses to be assigned to a single remote ID.
       
       
          Static Assignment
       
             The DHCP server may use the remote ID to select the IP address to
             be assigned.  It may permit static assignment of IP addresses to
             particular remote IDs, and disallow an address request from an
             unauthorized remote ID.
       
       
          IP Spoofing
       
             The circuit access device may associate the IP address assigned by
             a DHCP server in a forwarded DHCP Ack packet with the circuit to
             which it was forwarded. The circuit access device MAY prevent
             forwarding of IP packets with source IP addresses -other than-
             those it has associated with the receiving circuit.  This prevents
             simple IP spoofing attacks on the Central Lan, and IP spoofing of
             other hosts.
       
          Client Identifer Spoofing
       
             By using the agent-supplied Agent Remote ID option, the untrusted
             and as-yet unstandardized client identifer field need not be used
             by the DHCP server.
       
          MAC Address Spoofing
       
             By associating a MAC address with an Agent Remote ID, the DHCP
             server can prevent offering an IP address to an attacker on a
             different remote ID.
       
       4.0 References
       
               [1]     Droms, R. "Dynamic Host Configuration Protocol", RFC 1531
       
               [2]     Alexander,S. and Droms, R., "DHCP Options and BOOTP Vendor Extension"
                       RFC 1533.
       
       
       5.0 Author's Address
       
       
       
       
       
       
       
       
       Expires June 1997                                               [Page 9]


       <draft-ietf-dhc-agent-options-00.txt>                  December 11, 1996
       
       
       
                      Michael Patrick
                      Motorola Information Systems Group
                      20 Cabot Blvd., MS M4-30
                      Mansfield, MA 02048
       
                      Phone: (508) 261-5707
                      Email: mpatrick@dma.isg.mot.com
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       Expires June 1997                                              [Page 10]