Shared IPv4 via DHCPv4: Dynamic Allocation of Shared IPv4 Addresses
How a DHCP server can hand the same IPv4 address to many clients at once, each with its own range of ports.
Cui, Y., Sun, Q., Farrer, I., Lee, Y., Sun, Q., and M. Boucadair, "Dynamic Allocation of Shared IPv4 Addresses", RFC 7618, DOI 10.17487/RFC7618, August 2015, <https://www.rfc-editor.org/info/rfc7618>.
@misc{rfc7618,
series = {Request for Comments},
number = 7618,
howpublished = {RFC 7618},
publisher = {RFC Editor},
doi = {10.17487/RFC7618},
url = {https://www.rfc-editor.org/info/rfc7618},
author = {Y. Cui and Q. Sun and I. Farrer and Y. Lee and Q. Sun and M. Boucadair},
title = {{Dynamic Allocation of Shared IPv4 Addresses}},
pagetotal = 15,
year = 2015,
month = aug,
} RFC text
Contents
Internet Engineering Task Force (IETF) Y. Cui
Request for Comments: 7618 Q. Sun
Category: Standards Track Tsinghua University
ISSN: 2070-1721 I. Farrer
Deutsche Telekom AG
Y. Lee
Comcast
Q. Sun
China Telecom
M. Boucadair
France Telecom
August 2015
Dynamic Allocation of Shared IPv4 Addresses
Abstract
This memo describes the dynamic allocation of shared IPv4 addresses
to clients using DHCPv4. Address sharing allows a single IPv4
address to be allocated to multiple active clients simultaneously,
with each client being differentiated by a unique set of transport-
layer source port numbers. The necessary changes to existing DHCPv4
client and server behavior are described, and a new DHCPv4 option for
provisioning clients with shared IPv4 addresses is included.
Due to the nature of IP address sharing, some limitations to its
applicability are necessary. This memo describes these limitations
and recommends suitable architectures and technologies where address
sharing may be utilized.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7618.
Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction ....................................................3
2. Applicability Statement .........................................3
3. Requirements Language ...........................................4
4. Terminology .....................................................4
5. Functional Overview .............................................4
6. Client-Server Interaction .......................................5
7. Client Behavior .................................................6
7.1. Restrictions to Client Usage of a Shared IPv4 Address ......7
8. Server Behavior .................................................7
8.1. Leasing Shared and Non-Shared IPv4 Addresses from a
Single DHCP 4o6 Server .....................................9
9. DHCPv4 Port Parameters Option ...................................9
10. Security Considerations .......................................10
10.1. Port Randomization .......................................11
11. IANA Considerations ...........................................11
12. References ....................................................11
12.1. Normative References .....................................11
12.2. Informative References ...................................12
Acknowledgements ..................................................14
Authors' Addresses ................................................14
1. Introduction
The shortage of available public IPv4 addresses means that it is not
always possible for operators to allocate a full IPv4 address to
every connected device. This problem is particularly acute while an
operator is migrating from their existing, native IPv4 network to a
native IPv6 network with IPv4 provided as an overlay service. During
this phase, public IPv4 addresses are needed to provide for both
existing and transition networks.
Two main types of solutions have emerged to address the problem (see
Appendix A of [RFC6269]):
1. Deploying Carrier-Grade Network Address Translation devices
(CGNs) [RFC6888].
2. Distributing the same public IPv4 address to multiple clients
differentiated by non-overlapping Layer 4 port sets.
This memo focuses on the second category of solutions.
[RFC7341] introduces a "DHCP 4o6 server", which offers dynamic
leasing for IPv4 addresses to clients as described in DHCPv4
[RFC2131], but transported within a DHCPv6 message flow. This memo
specifies a new DHCPv4 option -- OPTION_V4_PORTPARAMS -- and
describes how it can be used for the dynamic leasing of shared IPv4
addresses.
Although DHCPv4 over DHCPv6 is used as the underlying DHCPv4
transport mechanism throughout this document, OPTION_V4_PORTPARAMS as
a DHCPv4 option may also be used in other solutions, if required.
2. Applicability Statement
The solution allows multiple hosts to be simultaneously allocated the
same IP address. As the IP address is no longer a unique identifier
for a host, this solution is only suitable for specific architectures
based on the Address plus Port model (A+P) [RFC6346]. Specifically,
this document presents a solution that applies to [RFC7596] and
certain configurations of [RFC7597] (e.g., Embedded Address bit
(EA-bit) length set to 0).
The solution should only be used on point-to-point links, tunnels,
and/or in environments where authentication at the link layer is
performed before IP address assignment. It is not suitable for
network access over shared media (e.g., Ethernet, WLAN, cable).
3. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
4. Terminology
This document uses the following terms:
Shared IPv4 address: An IPv4 address with a restricted Layer 4
port set.
Port Set ID (PSID): Identifier for a range of ports assigned to a
DHCP client.
5. Functional Overview
Functionally, the dynamic allocation of shared IPv4 addresses by the
DHCP 4o6 server is similar to the dynamic allocation process for
"full" IPv4 addresses as described in [RFC2131]. The essential
difference is that the DHCP 4o6 server can allocate the same IPv4
address to more than one DHCP 4o6 client simultaneously, providing
that each shared-address allocation also includes a range of Layer 4
source ports unique to that address (i.e., the combined tuple of IPv4
address and Port Set ID is to be unique for each active lease).
The DHCP 4o6 client implements OPTION_V4_PORTPARAMS (described
below), which is a DHCPv4 option containing PSID information. The
client includes this option within the Parameter Request List option
[RFC2132] in its DHCPv4 DHCPDISCOVER and DHCPREQUEST messages,
indicating its support for shared, dynamic address leasing to the
DHCP 4o6 server.
OPTION_V4_PORTPARAMS is also implemented by the server to identify
clients that support shared, dynamic address leasing. With this
option, the server can dynamically allocate PSIDs to clients and
maintain shared IPv4 address leases. The server then manages unique
client leases based on the IPv4 address and PSID tuple, instead of
using only the IPv4 address.
In the event that a client capable of dynamic, shared addressing
receives more than one DHCP 4o6 offer, where a received offer does
not contain OPTION_V4_PORTPARAMS (i.e., it is an offer for a full
IPv4 address), then the client SHOULD prefer the full IPv4 offer over
the shared IPv4 address offer(s), unless specifically configured
otherwise.
6. Client-Server Interaction
The following DHCPv4 message flow is transported within the
DHCPv4-query and DHCPv4-response messages as described in DHCPv4 over
DHCPv6 [RFC7341].
1. When the client constructs the DHCPv4 DHCPDISCOVER message to be
transported within the DHCPv4-query message, the DHCPDISCOVER
message MUST include the client identifier option (constructed as
per [RFC4361]) and the Parameter Request List option with the
code OPTION_V4_PORTPARAMS. The client MAY insert an
OPTION_V4_PORTPARAMS with preferred values in related fields as a
suggestion to the DHCP 4o6 server.
2. DHCP 4o6 servers that receive the DHCPDISCOVER message and
support shared IPv4 addresses respond with a DHCPOFFER message
with the shared IPv4 address in the yiaddr field, and they MUST
add an OPTION_V4_PORTPARAMS option containing an available
restricted port set. If the DHCPDISCOVER included an
OPTION_V4_PORTPARAMS option containing a non-zero PSID-len field,
the DHCP 4o6 server MAY allocate a port set of the requested size
to the client (depending on policy). The DHCPOFFER message is
then encapsulated in the DHCPv4-response message and sent to the
client.
3. The client evaluates all received DHCPOFFER messages and selects
one (e.g., based on the configuration parameters received, such
as the size of the offered port set). The client then sends a
DHCPREQUEST encapsulated in the DHCPv4-query message containing
the corresponding OPTION_V4_PORTPARAMS received in the DHCPOFFER
message.
4. The server identified in the DHCPREQUEST message creates a
binding for the client. The binding includes the client
identifier, the IPv4 address, and the PSID. These parameters are
used by both the server and the client to identify a lease in any
DHCP message. The server MUST respond with a DHCPACK message
containing OPTION_V4_PORTPARAMS for the requesting client.
5. On receipt of the DHCPACK message with the configuration
parameters, the client MUST NOT perform an in-use probe on the
address, such as ARPing for a duplicate allocated address.
6. If the client chooses to relinquish its lease by sending a
DHCPRELEASE message, the client MUST include the leased network
address and OPTION_V4_PORTPARAMS (with the allocated PSID) to
identify the lease to be released.
In the case where the client has stored the previously allocated
address and restricted port set, the logic described in Section 3.2
of [RFC2131] MUST be followed on the condition that the client's
source IPv6 address for DHCP 4o6 does not change. Note that this
corresponds to the INIT-REBOOT state defined in [RFC2131]. The
client MUST include the OPTION_V4_PORTPARAMS with the requested
port-set information in the message flow, which starts with a
DHCPREQUEST message. If the client's DHCP 4o6 IPv6 source address
is changed for any reason, the client MUST re-initiate the DHCP 4o6
shared-address provisioning process by sending a
DHCPDISCOVER message.
7. Client Behavior
A DHCP 4o6 client sending a DHCPDISCOVER message for a shared IPv4
address MUST include the OPTION_V4_PORTPARAMS Option Code in the
Parameter Request List option. If a client has previously been
successfully allocated an IPv4 address and PSID, the client's
DHCPDISCOVER message MAY include the Requested IP Address option
along with an OPTION_V4_PORTPARAMS to request that a specific IPv4
address and PSID be reassigned. Alternatively, the client MAY omit
the Requested IP Address option but include an OPTION_V4_PORTPARAMS
with a non-zero value in only the PSID-len field, as a hint to the
server for the preferred size of the port set.
A client that requests OPTION_V4_PORTPARAMS but receives DHCPOFFER
and DHCPACK messages without OPTION_V4_PORTPARAMS SHOULD proceed as
described in Section 9 of [RFC7341] and configure a full IPv4 address
with no address sharing (see Section 8.1).
When receiving a DHCPACK message containing OPTION_V4_PORTPARAMS, the
client MUST use the received explicit PSID for configuring the
interface for which the DHCP 4o6 request was made.
The client MUST NOT probe a newly received IPv4 address (e.g., using
ARP) to see if it is in use by another host.
When the client renews or releases its DHCP lease, it MUST include
the offset, PSID length, and PSID values in OPTION_V4_PORTPARAMS, and
send it to the server within corresponding DHCPv4 messages.
In the event that the client's DHCP 4o6 IPv6 source address is
changed for any reason, the client MUST re-initiate the DHCP 4o6
shared-address provisioning process by sending a DHCPDISCOVER
message.
7.1. Restrictions to Client Usage of a Shared IPv4 Address
As a single IPv4 address is being shared between a number of
different clients, the allocated shared address is only suitable for
certain uses. The client MUST implement a function to ensure that
only the allocated Layer 4 ports of the shared IPv4 address are used
for sourcing new connections or accepting inbound connections.
The client MUST apply the following rules for all traffic destined
to, or originating from, the shared IPv4 address:
o The client MUST use only port-aware protocols (e.g., TCP, UDP, the
Datagram Congestion Control Protocol (DCCP)) and be ICMP compliant
with [RFC5508].
o All connections originating from the shared IPv4 address MUST use
a source port taken from the allocated restricted port set.
o The client MUST NOT accept inbound connections on ports outside of
the allocated restricted port set.
In order to prevent addressing conflicts that could arise from the
allocation of the same IPv4 address, the client MUST NOT use the
received restricted IPv4 address to perform ARP operations.
The mechanism by which a client implements the above rules is out of
scope for this document.
In the event that the DHCPv4-over-DHCPv6 configuration mechanism
fails for any reason, the client MUST NOT configure an IPv4
link-local address [RFC3927] (taken from the 169.254.0.0/16 range).
8. Server Behavior
The DHCP 4o6 server MUST NOT reply with OPTION_V4_PORTPARAMS unless
the client has explicitly listed the Option Code in the Parameter
Request List (Option 55) [RFC2132].
The DHCP 4o6 server SHOULD reply with OPTION_V4_PORTPARAMS if the
client includes OPTION_V4_PORTPARAMS in its Parameter Request List.
In order to achieve dynamic management of shared IPv4 addresses, the
server is required to implement an address and port-set pool that
provides the same function as the address pool in a regular DHCP
server. Also, the server uses the combination of address and PSID as
the key for maintaining the state of a lease and for searching for an
available lease for assignment. The leasing database is required to
include the IPv4 address, PSID, and client identifier of the
requesting client.
When a server receives a DHCPDISCOVER message with
OPTION_V4_PORTPARAMS in the Parameter Request List option, the server
determines an IPv4 address with a PSID for the requesting client. If
an IPv4 address with a PSID is available, the server SHOULD follow
the logic below to select which specific address and PSID to
provision to the client. The logic is similar to that described in
Section 4.3.1 of [RFC2131].
o The client's current address with the PSID, as recorded in the
client's current lease binding, ELSE
o The client's previous address with the PSID, as recorded in the
client's (expired or released) binding, if that address with PSID
is in the server's pool of available addresses and PSIDs, and not
already allocated, ELSE
o The address requested in the Requested IP Address option along
with the PSID parameters requested in the OPTION_V4_PORTPARAMS, if
that pair of address and PSID is valid and not already allocated,
ELSE
o A new address with a PSID allocated from the server's pool of
available addresses and PSIDs.
Upon receipt of a DHCPRELEASE message with OPTION_V4_PORTPARAMS, the
server searches for the lease using the address in the ciaddr field
and the PSID information in the OPTION_V4_PORTPARAMS, and marks the
lease as unallocated if a record (matching that PSID) is maintained
by the server for that client.
The port-set assignment MUST be coupled with the address assignment
process. Therefore, the server MUST assign the address and port set
in the same DHCP message.
When defining the pools of IPv4 addresses and PSIDs that are
available to lease to clients, the server MUST implement a mechanism
to reserve some port ranges (e.g., 0-1023) from allocation to
clients. The reservation policy SHOULD be configurable.
8.1. Leasing Shared and Non-Shared IPv4 Addresses from a Single
DHCP 4o6 Server
A single DHCP 4o6 server may serve clients that do not support
OPTION_V4_PORTPARAMS, as well as those that do. As the rules for the
allocation of shared addresses differ from the rules for full IPv4
address assignment, the DHCP 4o6 server MUST implement a mechanism to
ensure that clients not supporting OPTION_V4_PORTPARAMS do not
receive shared addresses. For example, two separate IPv4 addressing
pools could be used, one of which allocates IPv4 addresses and PSIDs
only to clients that have requested them.
If the server is only configured with address pools for shared-
address allocation, it MUST discard requests that do not contain
OPTION_V4_PORTPARAMS in the Parameter Request List option.
A server configured with non-shared address pools can be instructed
to honor received requests that contain OPTION_V4_PORTPARAMS in the
Parameter Request List option (that is, ignore OPTION_V4_PORTPARAMS
and serve the requesting clients with non-shared IPv4 addresses).
9. DHCPv4 Port Parameters Option
The meanings of the offset, PSID-len, and PSID fields of the DHCPv4
Port Parameters option are identical to those of the offset,
PSID-len, and PSID fields of the S46 Port Parameters option
(Section 4.5 of [RFC7598]). The use of the same encoding in both
options is meant to ensure compatibility with existing port-set
implementations.
The format of OPTION_V4_PORTPARAMS is shown in Figure 1.
0 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| option-code | option-len |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| offset | PSID-len |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| PSID |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
Figure 1: DHCPv4 Port Parameters Option
o option-code: OPTION_V4_PORTPARAMS (159)
o option-len: 4
o offset: PSID offset. 8-bit field that specifies the numeric value
for the excluded port range/offset bits ('a' bits), as per
Section 5.1 of [RFC7597]. Allowed values are between 0 and 15,
with the default value being 6 for MAP-based implementations.
This parameter is unused by a Lightweight 4over6 client and should
be set to 0.
o PSID-len: Bit length value of the number of significant bits in
the PSID field (also known as 'k'). When set to 0, the PSID field
is to be ignored. After the first 'a' bits, there are k bits in
the port number representing the value of PSID. Subsequently, the
address-sharing ratio would be 2^k.
o PSID: Explicit 16-bit (unsigned word) PSID value. The PSID value
algorithmically identifies a set of ports assigned to a client.
The first k bits on the left of this 2-octet field indicate the
PSID value. The remaining (16 - k) bits on the right are padding
zeros.
Section 5.1 of [RFC7597] provides a full description of how the PSID
is interpreted by the client.
In order to exclude the system ports ([RFC6335]) or ports reserved by
ISPs, the former port sets that contain well-known ports MUST NOT be
assigned unless the operator has explicitly configured otherwise
(e.g., by allocating a full IPv4 address).
10. Security Considerations
The security considerations described in [RFC2131] and [RFC7341] are
also potentially applicable to this solution. Unauthorized DHCP 4o6
servers in the network could be used to stage an amplification attack
or to supply an invalid configuration, leading to service disruption.
The risks of these types of attacks can be reduced by using unicast
DHCP 4o6 message flows (enabled by supplying DHCP 4o6 server unicast
addresses within the OPTION_DHCP4_O_DHCP6_SERVER option [RFC7341]).
A malicious user could attempt a DoS attack by requesting a large
number of IPv4 address (or fractional address) and port-set
allocations, exhausting the available addresses and port sets for
other clients. This can be mitigated by implementing, on each
applicable customer site, a DHCP 4o6 address allocation policy that
limits the number of simultaneously active IPv4 leases for clients
whose requests originate from that customer site.
The purpose of the client identifier option is to ensure that the
same client retains the same parameters over time. However, this
interferes with the client's privacy, as it allows the server to
track the client. Clients can manage their level of exposure by
controlling the value of the client identifier, thereby trading off
stability of parameter allocation for privacy. We expect that
guidance on this trade-off will be discussed in a future version of
[DHCP-Anonymity].
Additional security considerations are discussed in Section 10 of
[RFC7597] and Section 9 of [RFC7596].
10.1. Port Randomization
Preserving port randomization [RFC6056] may be more difficult because
the host can only randomize the ports inside a fixed port range (see
Section 13.4 of [RFC6269]).
More discussion regarding improving the robustness of TCP against
blind in-window attacks can be found in [RFC5961]. To provide
protection against attacks, means other than (IPv4) source port
randomization should be used (e.g., use [RFC5961] to improve the
robustness of TCP against blind in-window attacks, or use IPv6).
11. IANA Considerations
IANA has assigned the following new DHCPv4 Option Code in the
registry maintained at
<http://www.iana.org/assignments/bootp-dhcp-parameters/>:
Option Name Tag Data Meaning
Length
-------------------- --- ------ -----------------------------------
OPTION_V4_PORTPARAMS 159 4 This option is used to configure a
set of ports bound to a shared IPv4
address.
12. References
12.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol",
RFC 2131, DOI 10.17487/RFC2131, March 1997,
<http://www.rfc-editor.org/info/rfc2131>.
[RFC2132] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor
Extensions", RFC 2132, DOI 10.17487/RFC2132, March 1997,
<http://www.rfc-editor.org/info/rfc2132>.
[RFC4361] Lemon, T. and B. Sommerfeld, "Node-specific Client
Identifiers for Dynamic Host Configuration Protocol
Version Four (DHCPv4)", RFC 4361, DOI 10.17487/RFC4361,
February 2006, <http://www.rfc-editor.org/info/rfc4361>.
[RFC5961] Ramaiah, A., Stewart, R., and M. Dalal, "Improving TCP's
Robustness to Blind In-Window Attacks", RFC 5961,
DOI 10.17487/RFC5961, August 2010,
<http://www.rfc-editor.org/info/rfc5961>.
[RFC6056] Larsen, M. and F. Gont, "Recommendations for Transport-
Protocol Port Randomization", BCP 156, RFC 6056,
DOI 10.17487/RFC6056, January 2011,
<http://www.rfc-editor.org/info/rfc6056>.
[RFC7341] Sun, Q., Cui, Y., Siodelski, M., Krishnan, S., and I.
Farrer, "DHCPv4-over-DHCPv6 (DHCP 4o6) Transport",
RFC 7341, DOI 10.17487/RFC7341, August 2014,
<http://www.rfc-editor.org/info/rfc7341>.
[RFC7596] Cui, Y., Sun, Q., Boucadair, M., Tsou, T., Lee, Y., and
I. Farrer, "Lightweight 4over6: An Extension to the
Dual-Stack Lite Architecture", RFC 7596,
DOI 10.17487/RFC7596, July 2015,
<http://www.rfc-editor.org/info/rfc7596>.
[RFC7597] Troan, O., Ed., Dec, W., Li, X., Bao, C., Matsushima, S.,
Murakami, T., and T. Taylor, Ed., "Mapping of Address and
Port with Encapsulation (MAP-E)", RFC 7597,
DOI 10.17487/RFC7597, July 2015,
<http://www.rfc-editor.org/info/rfc7597>.
12.2. Informative References
[DHCP-Anonymity]
Huitema, C., Mrugalski, T., and S. Krishnan, "Anonymity
profile for DHCP clients", Work in Progress,
draft-ietf-dhc-anonymity-profile-01, June 2015.
[DHCP-Port-Set-Opt]
Sun, Q., Lee, Y., Sun, Q., Bajko, G., and M. Boucadair,
"Dynamic Host Configuration Protocol (DHCP) Option for
Port Set Assignment", Work in Progress,
draft-sun-dhc-port-set-option-02, October 2013.
[DHCPv4_v6-Shared-Addr]
Farrer, I., "Dynamic Allocation of Shared IPv4 Addresses
using DHCPv4 over DHCPv6", Work in Progress,
draft-farrer-dhc-shared-address-lease-00, June 2013.
[RFC3927] Cheshire, S., Aboba, B., and E. Guttman, "Dynamic
Configuration of IPv4 Link-Local Addresses", RFC 3927,
DOI 10.17487/RFC3927, May 2005,
<http://www.rfc-editor.org/info/rfc3927>.
[RFC5508] Srisuresh, P., Ford, B., Sivakumar, S., and S. Guha, "NAT
Behavioral Requirements for ICMP", BCP 148, RFC 5508,
DOI 10.17487/RFC5508, April 2009,
<http://www.rfc-editor.org/info/rfc5508>.
[RFC6269] Ford, M., Ed., Boucadair, M., Durand, A., Levis, P., and
P. Roberts, "Issues with IP Address Sharing", RFC 6269,
DOI 10.17487/RFC6269, June 2011,
<http://www.rfc-editor.org/info/rfc6269>.
[RFC6335] Cotton, M., Eggert, L., Touch, J., Westerlund, M., and S.
Cheshire, "Internet Assigned Numbers Authority (IANA)
Procedures for the Management of the Service Name and
Transport Protocol Port Number Registry", BCP 165,
RFC 6335, DOI 10.17487/RFC6335, August 2011,
<http://www.rfc-editor.org/info/rfc6335>.
[RFC6346] Bush, R., Ed., "The Address plus Port (A+P) Approach to
the IPv4 Address Shortage", RFC 6346, DOI 10.17487/
RFC6346, August 2011,
<http://www.rfc-editor.org/info/rfc6346>.
[RFC6888] Perreault, S., Ed., Yamagata, I., Miyakawa, S., Nakagawa,
A., and H. Ashida, "Common Requirements for Carrier-Grade
NATs (CGNs)", BCP 127, RFC 6888, DOI 10.17487/RFC6888,
April 2013, <http://www.rfc-editor.org/info/rfc6888>.
[RFC7598] Mrugalski, T., Troan, O., Farrer, I., Perreault, S., Dec,
W., Bao, C., Yeh, L., and X. Deng, "DHCPv6 Options for
Configuration of Softwire Address and Port-Mapped
Clients", RFC 7598, DOI 10.17487/RFC7598, July 2015,
<http://www.rfc-editor.org/info/rfc7598>.
Acknowledgements
This document is the result of merging [DHCP-Port-Set-Opt] and
[DHCPv4_v6-Shared-Addr].
The authors would like to thank Peng Wu, Gabor Bajko, Teemu
Savolainen, Ted Lemon, Tina Tsou, Pierre Levis, Cong Liu, Marcin
Siodelski, and Christian Huitema for their contributions.
Many thanks to Brian Haberman for the review.
Authors' Addresses
Yong Cui
Tsinghua University
Beijing 100084
China
Phone: +86-10-62603059
Email: yong@csnet1.cs.tsinghua.edu.cn
Qi Sun
Tsinghua University
Beijing 100084
China
Phone: +86-10-62785822
Email: sunqi.ietf@gmail.com
Ian Farrer
Deutsche Telekom AG
CTO-ATI, Landgrabenweg 151
Bonn, NRW 53227
Germany
Email: ian.farrer@telekom.de
Yiu L. Lee
Comcast
One Comcast Center
Philadelphia, PA 19103
United States
Email: yiu_lee@cable.comcast.com
Qiong Sun
China Telecom
Room 708, No.118, Xizhimennei Street
Beijing 100035
China
Phone: +86-10-58552936
Email: sunqiong@ctbri.com.cn
Mohamed Boucadair
France Telecom
Rennes 35000
France
Email: mohamed.boucadair@orange.com
AI ELI5
On this page
§1Why Share an IPv4 Address
There are not enough public IPv4 addresses to give a full one to every connected device. The RFC calls the problem particularly acute while an operator moves from a native IPv4 network to a native IPv6 network, with IPv4 offered as an overlay service. Public IPv4 addresses are then needed for both the existing and the transition networks.
Two kinds of solution have emerged: Carrier-Grade NAT devices (CGNs), or giving the same public IPv4 address to several clients that are told apart by non-overlapping Layer 4 port sets. This memo covers the second kind. It builds on the DHCP 4o6 server of RFC 7341, which leases IPv4 addresses as in DHCPv4 but carries the exchange inside DHCPv6 messages, and adds a new DHCPv4 option for shared leases.
There are too few street addresses to go around. So instead of each house getting its own, several houses share one address and each gets its own set of door numbers.
§2Where This Can Be Used
Because many hosts hold the same IP address, the address no longer identifies one host. The solution is therefore only suitable for architectures based on the Address plus Port model (A+P), namely RFC 7596 and certain configurations of RFC 7597 (for example, an Embedded Address bit length of 0).
It should only be used on point-to-point links, tunnels, or where link-layer authentication happens before an IP address is assigned. It is not suitable for network access over shared media such as Ethernet, WLAN or cable.
Sharing one address only works when the mail carrier knows exactly which house is which, such as on a private road with a guard at the gate. It does not work in a crowded open square.
§3Shared Addresses and Port Sets
A shared IPv4 address is an IPv4 address with a restricted Layer 4 port set. A Port Set ID (PSID) identifies the range of ports assigned to one DHCP client.
Allocation works like ordinary DHCPv4 leasing (RFC 2131), with one key difference: the server can give the same IPv4 address to more than one client at once, as long as each lease carries a unique port range. The combined tuple of IPv4 address and PSID must be unique for each active lease, so the server tracks leases by that pair rather than by address alone.
A client that supports the feature lists OPTION_V4_PORTPARAMS in the Parameter Request List of its DHCPDISCOVER and DHCPREQUEST messages. If it receives several offers and one is for a full IPv4 address (no OPTION_V4_PORTPARAMS), it SHOULD prefer that full address unless configured otherwise.
The address is the building, and the port set is your apartment range. The building manager writes down both so two tenants never get the same apartment.
§4The Client-Server Exchange
The DHCPv4 messages travel inside the DHCPv4-query and DHCPv4-response messages of RFC 7341. The steps are:
- The client sends a DHCPDISCOVER with its client identifier and OPTION_V4_PORTPARAMS in the Parameter Request List. It MAY include the option with preferred values as a suggestion.
- A server that supports shared addresses answers with a DHCPOFFER holding the shared address in
yiaddrand, as a MUST, an OPTION_V4_PORTPARAMS with an available port set. If the client asked for a non-zero PSID length, the server MAY offer a port set of that size, depending on policy. - The client picks an offer and sends a DHCPREQUEST containing the OPTION_V4_PORTPARAMS it was offered.
- The server creates a binding of client identifier, IPv4 address and PSID, and MUST reply with a DHCPACK containing the option.
- The client MUST NOT run an in-use probe, such as ARPing, on the address.
- To give up a lease, the client sends a DHCPRELEASE with the leased address and the option holding its PSID.
A client that stored its earlier address and port set follows the INIT-REBOOT logic of RFC 2131 as long as its DHCP 4o6 source IPv6 address has not changed. If that IPv6 address changes for any reason, it MUST start over with a DHCPDISCOVER.
You ask for a room, the manager offers you one with a range of door numbers, you say yes, and she writes it down. Later you hand the key back and say which door numbers you had.
- DHCPDISCOVERParameter Request List includes OPTION_V4_PORTPARAMS.
- DHCPOFFERShared address in yiaddr plus an available port set.
- DHCPREQUESTCarries the offered OPTION_V4_PORTPARAMS.
- DHCPACKBinding of client identifier, address and PSID is created.
§5Client and Server Rules
On the client, the option in the DHCPACK gives the explicit PSID to use for the interface. The client MUST apply the allocated ports to all traffic of the shared address: it MUST use only port-aware protocols (such as TCP, UDP and DCCP) and be ICMP compliant with RFC 5508; connections it starts MUST use a source port from its set; and it MUST NOT accept inbound connections on ports outside the set. It MUST NOT use the shared address for ARP, and if the DHCPv4-over-DHCPv6 mechanism fails it MUST NOT configure an IPv4 link-local address from 169.254.0.0/16. How the client enforces these rules is out of scope. If the reply has no OPTION_V4_PORTPARAMS, the client SHOULD configure a full IPv4 address with no sharing.
On the server, the option MUST NOT be sent unless the client listed it in the Parameter Request List. The server needs an address-and-port-set pool, and its lease database MUST include the IPv4 address, the PSID and the client identifier. To choose what to offer, it SHOULD try in order: the client's current binding, the client's previous binding if still free, the requested address and PSID if valid and free, and finally a new address with a PSID from the pool. The address and port set MUST be assigned in the same DHCP message. The server MUST be able to reserve some port ranges (for example 0-1023) from allocation, with a configurable policy.
A server serving both kinds of client MUST make sure clients without the option never get shared addresses, for example by using two separate pools. A server with only shared pools MUST discard requests lacking the option.
Each tenant must stay in their own door numbers and may not borrow someone else's. The manager keeps one list of who has what, and keeps the lowest door numbers for the building itself.
§6The Port Parameters Option
OPTION_V4_PORTPARAMS has option code 159 and option-len 4. Its offset, PSID-len and PSID fields mean the same as in the S46 Port Parameters option of RFC 7598, so existing port-set implementations stay compatible.
offset(8 bits): the number of excluded port range or offset bits ('a' bits). Allowed values are 0 to 15, with a default of 6 for MAP-based implementations. A Lightweight 4over6 client does not use it and it should be 0.PSID-len(8 bits): the number of significant bits in the PSID, also called 'k'. When 0, the PSID field is ignored. The address-sharing ratio is 2^k.PSID(16 bits): the explicit PSID. The first k bits on the left are the value and the remaining (16 - k) bits are padding zeros.
To keep system ports and operator-reserved ports out of clients' hands, port sets containing well-known ports MUST NOT be assigned unless the operator has explicitly configured otherwise, for example by allocating a full IPv4 address.
The option is a small slip of paper with a few numbers on it. It tells you which door numbers are yours and how many tenants share the building.
| Field | Name | Size | Value | Description |
|---|---|---|---|---|
OPTION-CODE | option-code | 1 byte | 159 | OPTION_V4_PORTPARAMS. |
OPTION-LEN | option-len | 1 byte | 4 | Length of the option data. |
OFFSET | offset | 1 byte | Excluded port range or offset bits ('a'); 0 to 15, default 6 for MAP. | |
PSID-LEN | PSID-len | 1 byte | Number of significant bits in the PSID ('k'); 0 means ignore the PSID. | |
PSID | PSID | 2 bytes | Port Set ID in the first k bits, padded with zeros. |
§7Security Considerations
The considerations of RFC 2131 and RFC 7341 also apply. Unauthorized DHCP 4o6 servers could stage an amplification attack or supply an invalid configuration that disrupts service. Using unicast DHCP 4o6 message flows reduces this risk.
A malicious user could request many addresses or port sets to exhaust the pool. The suggested mitigation is an allocation policy on each customer site that limits the number of simultaneously active IPv4 leases.
The client identifier keeps parameters stable but lets the server track the client, so clients can trade stability for privacy by controlling its value. Port randomization (RFC 6056) is harder because a host can only randomize within its fixed port range. The RFC advises other protections, such as the measures in RFC 5961 against blind in-window TCP attacks, or using IPv6.
A fake manager could hand out wrong room numbers, and a greedy person could grab lots of rooms. Limiting how many rooms one household can have helps.
§8IANA Considerations
IANA assigned one new DHCPv4 option code in its BOOTP and DHCP parameters registry: OPTION_V4_PORTPARAMS, tag 159, data length 4. Its meaning is to configure a set of ports bound to a shared IPv4 address.
The official list of option numbers got one new entry, number 159, for the port-set slip.