Re: [dhcwg] A question regarding section 6.2 of RFC 6221

["Bernie Volz (volz)" <[e-mail]>]

Section 6., Relaying a Relay-Reply Message from the Network, does state:


   The LDRA MUST copy the link-layer and IP source address from the

   Relay-Reply message into the IP/UDP packet that is forwarded to the

   client.

This is required because the LDRA does not have any addresses of its own.

And, 6.2 also says:

   The LDRA MUST intercept and process all IP traffic received on the
   network-facing interface that has:

   o  a link-local scoped source address;

   o  a link-local scoped destination address;

   o  protocol type UDP; and

   o  destination port 547

  An LDRA MUST inspect the DHCP message type and only forward Relay-
   Reply messages.  Other DHCP message types MUST be silently discarded.

Which would indeed cause the LDRA to not do anything with the packet if the source address is not a link-local. But as the destination address is link-local (for LDRA), the source address SHOULD also be.

And, the relay closest to the server (relayB) isn't an LDRA relay, so why it would use the server's unicast address is very odd?

For DHCPv6, excepting the special requirements for LDRA because they have no IPv6 addresses, standard networking functions should be used and no special requirement exists for the 'standard' relay to follow these rules. If a relay is not an LDRA relay, it not be using LDRA rules; it should use a source address appropriate for the interface on which it will send out the relayed packet (appropriate here implies of the same or lesser scope than the destination address). If the next hop is indeed the LDRA relay, the appropriate address would indeed be a link-local address as that will be the destination address of the packet.

So it seems to me that relayB is broken.


  *   Bernie

From: dhcwg <[e-mail]> On Behalf Of Benjamin Kappel
Sent: Thursday, September 24, 2020 11:32 PM
To: [e-mail] <[e-mail]>
Subject: [dhcwg] A question regarding section 6.2 of RFC 6221

Hi

I have a question regarding your work on RFC 6221 (Lightweight DHCPv6 Relay Agent) and hope this is an appropriate way to start a discussion.

In section 6.2 it that that the lrda should only intercept DHCPv6 messages with a link local source address. We run into the following issue:

Simplified, we have a topology like 7.2 where server and client communicate using a relay agent. The reply from the server is sourced by its unicast address and sent as unicast back to the relay agent. (packet A)

packet A:

src-ip:              server (global unicast address)

   dst-ip:              relayB (global unicast address of link A)

     msg-type:          RELAY-REPLY

     hop-count:         1

     link-address:      relayB address from link A (global unicast address)

     peer-address:      client link-local address

     Relay-Message Option, which contains:

       msg-type:        RELAY-REPLY

       hop-count:       0

       link-address:    Unspecified_Address

       peer-address:    client link-local address

       Interface-ID Option:

         interface-id:  LDRA-inserted interface-id

       Relay-Message Option, which contains:

         msg-type:      REPLY

         Reply Message Options: <from server>


The relay agent stripes away its relay message option and generating a new packet with the destination of the client. However, this implementation uses the source address (the unicast address) of the server as the source of the outgoing packet.  (packet B)

Packet B:
src-ip:              server (global unicast address)
dst-ip:              client link-local address

     msg-type:        RELAY-REPLY

       hop-count:       0

       link-address:    Unspecified_Address

       peer-address:    client link-local address

       Interface-ID Option:

         interface-id:  LDRA-inserted interface-id

       Relay-Message Option, which contains:

         msg-type:      REPLY

         Reply Message Options: <from server>

I've examined the DHCPv6 RFC (8415) to check if the relay agent behaviour is part of the document. The document says: "the relay agent relays the message from the server to the client on the link identified by the Interface-Id option". I'd argue "relays" not necessarily implies, that the agent needs to "source" it from its interface.

Anyway, currently, we have the problem that the LDRA doesn't intercept the packets, based on that above rule, and the client receives a RELAY-REPLY reply instead of a REPLY. Both manufactures pointing to the standards and argue that the comply, which they do, I think.

Can I ask about the motivation behind your rule? Why not allowing any address to be a legitimate source? Do you think the relay agent doesn't comply to standard?

Thank you in advance and have a nice day
Ben