Internet Engineering Task Force (IETF) B. Joshi
Request for Comments: 6925 R. Desetti
Category: Standards Track Infosys Ltd.
ISSN: 2070-1721 M. Stapp
Cisco Systems, Inc.
April 2013
Internet Engineering Task Force (IETF) B. Joshi
Request for Comments: 6925 R. Desetti
Category: Standards Track Infosys Ltd.
ISSN: 2070-1721 M. Stapp
Cisco Systems, Inc.
April 2013
The DHCPv4 Relay Agent Identifier Sub-Option
DHCPv4中继代理标识符子选项
Abstract
摘要
This document defines a new Relay Agent Identifier sub-option for the Dynamic Host Configuration Protocol (DHCP) Relay Agent Information option. The sub-option carries a value that uniquely identifies the relay agent device within the administrative domain. The value is normally administratively configured in the relay agent. The sub-option allows a DHCP relay agent to include the identifier in the DHCP messages it sends.
本文档为动态主机配置协议（DHCP）中继代理信息选项定义了一个新的中继代理标识符子选项。sub选项带有一个值，该值唯一标识管理域中的中继代理设备。该值通常在中继代理中进行管理配置。子选项允许DHCP中继代理在其发送的DHCP消息中包含标识符。
Status of This Memo
关于下段备忘
This is an Internet Standards Track document.
这是一份互联网标准跟踪文件。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.
本文件是互联网工程任务组（IETF）的产品。它代表了IETF社区的共识。它已经接受了公众审查，并已被互联网工程指导小组（IESG）批准出版。有关互联网标准的更多信息，请参见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6925.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问http://www.rfc-editor.org/info/rfc6925.
Copyright Notice
版权公告
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2013 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本，并提供简化BSD许可证中所述的无担保。
Table of Contents
目录
1. Introduction ....................................................2
2. Terminology .....................................................2
3. Example Use Cases ...............................................3
3.1. Bulk Leasequery ............................................3
3.2. Industrial Ethernet ........................................3
4. Sub-Option Format ...............................................4
5. Identifier Stability ............................................4
5.1. Identifier Uniqueness ......................................5
6. Security Considerations .........................................6
6.1. Forged Relay ID Attacks ....................................6
6.2. Factory-Floor Scenario .....................................6
7. IANA Considerations .............................................7
8. Acknowledgments .................................................7
9. References ......................................................7
9.1. Normative References .......................................7
9.2. Informative References .....................................8
1. Introduction ....................................................2
2. Terminology .....................................................2
3. Example Use Cases ...............................................3
3.1. Bulk Leasequery ............................................3
3.2. Industrial Ethernet ........................................3
4. Sub-Option Format ...............................................4
5. Identifier Stability ............................................4
5.1. Identifier Uniqueness ......................................5
6. Security Considerations .........................................6
6.1. Forged Relay ID Attacks ....................................6
6.2. Factory-Floor Scenario .....................................6
7. IANA Considerations .............................................7
8. Acknowledgments .................................................7
9. References ......................................................7
9.1. Normative References .......................................7
9.2. Informative References .....................................8
The Dynamic Host Configuration Protocol for IPv4 (DHCPv4) [RFC2131] provides IP addresses and configuration information for IPv4 clients. It includes a relay agent capability, in which network elements receive broadcast messages from clients and forward them to DHCP servers as unicast messages. In many network environments, relay agents add information to the DHCP messages before forwarding them, using the Relay Agent Information option [RFC3046]. Servers that recognize the Relay Agent Information option echo it back in their replies.
IPv4的动态主机配置协议（DHCPv4）[RFC2131]为IPv4客户端提供IP地址和配置信息。它包括中继代理功能，其中网络元素从客户端接收广播消息，并将其作为单播消息转发到DHCP服务器。在许多网络环境中，中继代理在转发DHCP消息之前使用中继代理信息选项[RFC3046]向DHCP消息添加信息。识别中继代理信息选项的服务器在其回复中回显该选项。
This specification introduces a Relay Agent Identifier (Relay-ID) sub-option for the Relay Agent Information option. The Relay-ID sub-option carries a sequence of octets that is intended to uniquely identify the relay agent within the administrative domain. In this document, an administrative domain consists of all DHCP servers and relay agents that communicate with each other.
本规范为中继代理信息选项引入了中继代理标识符（中继ID）子选项。中继ID子选项包含一系列八位字节，用于唯一标识管理域中的中继代理。在本文档中，管理域由相互通信的所有DHCP服务器和中继代理组成。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照[RFC2119]中所述进行解释。
DHCPv4 terminology is defined in [RFC2131], and the DHCPv4 Relay Agent Information option is defined in [RFC3046].
DHCPv4术语在[RFC2131]中定义，DHCPv4中继代理信息选项在[RFC3046]中定义。
There has been quite a bit of recent interest in extending the DHCP Leasequery protocol [RFC4388] to accommodate some additional situations. [RFC6926] proposes a variety of enhancements to the existing Leasequery protocol. The document describes a use case where a relay agent queries DHCP servers using the relay identifier to retrieve all the leases allocated through the relay agent.
最近，人们对扩展DHCP租赁协议[RFC4388]以适应一些其他情况颇感兴趣。[RFC6926]提出了对现有租赁协议的多种增强。本文档描述了一个用例，其中中继代理使用中继标识符查询DHCP服务器，以检索通过中继代理分配的所有租约。
DHCP typically identifies clients based on information in their DHCP messages, such as the Client-Identifier option or the value of the chaddr field. In some networks, however, the location of a client -- its point of attachment to the network -- is a more useful identifier. In factory-floor networks (commonly called 'industrial' networks), for example, the role a device plays is often fixed and based on its location. Using manual address configuration is possible (and is common), but it would be beneficial if DHCP configuration could be applied to these networks.
DHCP通常根据其DHCP消息中的信息来标识客户端，例如客户端标识符选项或chaddr字段的值。然而，在某些网络中，客户机的位置——它与网络的连接点——是一个更有用的标识符。例如，在工厂层网络（通常称为“工业”网络）中，设备扮演的角色通常是固定的，并且基于其位置。使用手动地址配置是可能的（并且是常见的），但如果DHCP配置可以应用于这些网络，这将是有益的。
One way to provide connection-based identifiers for industrial networks is to have the network elements acting as DHCP relay agents supply information that a DHCP server could use as a client identifier. A straightforward way to form identifier information is to combine something that is unique within the scope of the network element, such as a port/slot value, with something that uniquely identifies that network element, such as a Relay Agent Identifier.
为工业网络提供基于连接的标识符的一种方法是让充当DHCP中继代理的网络元素提供DHCP服务器可用作客户端标识符的信息。形成标识符信息的一种简单方法是将在网元范围内唯一的东西（如端口/插槽值）与唯一标识该网元的东西（如中继代理标识符）组合起来。
Format of the Relay Agent Identifier sub-option:
中继代理标识符子选项的格式：
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|SUBOPT_RELAY_ID| length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. .
. identifier (variable) .
. .
+---------------------------------------------------------------+
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|SUBOPT_RELAY_ID| length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. .
. identifier (variable) .
. .
+---------------------------------------------------------------+
Where:
哪里：
SUBOPT_RELAY_ID 12
子端口继电器ID 12
length the number of octets in the sub-option (excluding the sub-option ID and length fields); the minimum length is one.
长度子选项中的八位字节数（不包括子选项ID和长度字段）；最小长度为1。
identifier the identifying data
识别数据的标识符
If the relay identifier is to be meaningful, it has to be stable. A relay agent SHOULD use a single identifier value consistently. The identifier used by a relay device SHOULD be committed to stable storage, unless the relay device can regenerate the value upon reboot.
如果中继器标识符要有意义，它必须是稳定的。中继代理应一致地使用单个标识符值。中继设备使用的标识符应提交到稳定存储，除非中继设备可以在重新启动时重新生成该值。
If the Relay-ID configured in a relay agent is not unique within its administrative domain, resource allocation problems may occur as the DHCP server attempts to allocate the same resource to devices behind two different relay agents. Therefore, a Relay-ID configured in a relay agent MUST be unique within its administrative domain. To aid in ensuring uniqueness of Relay-IDs, relay agents SHOULD make their relay identifiers visible to their administrators via their user interface, through a log entry, through a MIB field, or through some other mechanism.
如果中继代理中配置的中继ID在其管理域中不唯一，则当DHCP服务器尝试将相同的资源分配给两个不同中继代理后面的设备时，可能会出现资源分配问题。因此，中继代理中配置的中继ID在其管理域中必须是唯一的。为了帮助确保中继ID的唯一性，中继代理应通过其用户界面、日志条目、MIB字段或其他机制使其管理员可以看到其中继标识符。
Implementors of relay agents should note that the identifier needs to be present in all DHCP message types where its value is being used by the DHCP server. The relay agent may not be able to add the Relay Agent Information option to all messages, such as RENEW messages sent as IP unicasts. In some deployments, that might mean that the server has to be willing to continue to associate the relay identifier it
中继代理的实现者应该注意，标识符需要出现在DHCP服务器使用其值的所有DHCP消息类型中。中继代理可能无法将中继代理信息选项添加到所有消息，例如作为IP单播发送的续订消息。在某些部署中，这可能意味着服务器必须愿意继续将中继标识符与其关联
has last seen with a lease that is being RENEWed. Other deployments may prefer to use the Server Identifier Override sub-option [RFC5107] to permit the relay device to insert the Relay Agent Information option into all relayed messages.
最后一次看到的是正在续签的租约。其他部署可能更倾向于使用服务器标识符覆盖子选项[RFC5107]，以允许中继设备将中继代理信息选项插入所有中继消息。
Handling situations where a relay agent device is replaced is another aspect of stability. One of the use cases for the relay identifier is to permit a server to associate clients' lease bindings with the relay device connected to the clients. If the relay device is replaced because it has failed or been upgraded, it may be desirable for the new device to continue to provide the same relay identifier as the old device. Therefore, if a relay agent supports Relay-ID, the Relay-ID should be administratively configurable.
处理更换中继代理设备的情况是稳定性的另一个方面。中继标识符的一个用例是允许服务器将客户端的租约绑定与连接到客户端的中继设备相关联。如果中继设备因故障或升级而被更换，则新设备可能需要继续提供与旧设备相同的中继标识符。因此，如果中继代理支持中继ID，则中继ID应该是可管理配置的。
It is strongly recommended that administrators take special care to ensure that Relay-IDs configured in their relay agents are not duplicated. There are a number of strategies that may be used to achieve this.
强烈建议管理员特别注意确保在其中继代理中配置的中继ID不重复。有许多策略可用于实现这一目标。
Administrators may use a strategy to configure unique Relay-IDs. One such strategy is that a Relay-ID on a relay agent may reuse an existing identifier or set of identifiers that are already guaranteed to be unique (e.g., Universally Unique Identifier (UUID) [RFC4122]).
管理员可以使用一种策略来配置唯一的中继ID。一种这样的策略是中继代理上的中继ID可以重用已经被保证是唯一的现有标识符或标识符集（例如，通用唯一标识符（UUID）[RFC4122]）。
For administrators who are already using a provisioning system to manage their networking infrastructure, it may work to enumerate relay agents on the basis of roles and then, as a second step, assign those roles to specific relay agents or groups of relay agents. In such a scenario, when a replacement relay agent is first seen by the DHCP server, it could trigger a configuration event on the provisioning system, and the new relay agent could be assigned to the role of the relay agent it is replacing.
对于已经使用供应系统管理其网络基础设施的管理员，可以根据角色枚举中继代理，然后作为第二步，将这些角色分配给特定的中继代理或中继代理组。在这种情况下，当DHCP服务器第一次看到替换的中继代理时，它可能会触发配置系统上的配置事件，并且可以将新的中继代理分配给它要替换的中继代理的角色。
It may be that the DHCP server has configurable event notification and that a duplicate Relay-ID would trigger this notification. Administrators can take advantage of this feature to work out whether the duplication is real and unintended or whether the original relay agent is being replaced.
可能是DHCP服务器具有可配置的事件通知，并且重复的中继ID将触发此通知。管理员可以利用此功能确定复制是真实的还是无意的，或者是否正在替换原始中继代理。
A network management/provisioning system may also be able to collect a full list of all relay agents on the network. It may then notice that more than one device reports the same Relay-ID. In such a case, the provisioning system could notify the administrator of the fault, which could then be corrected.
网络管理/供应系统还可以收集网络上所有中继代理的完整列表。然后，它可能会注意到多个设备报告相同的中继ID。在这种情况下，供应系统可能会将故障通知管理员，然后可以进行纠正。
This is not an exhaustive list of strategies. We suggest an additional strategy in the Security Considerations section. If none of these strategies will work, administrators are also encouraged to consider the specifics of their own network configuration to see if there is some way to detect duplicate Relay-IDs other than the ones listed here.
这不是一份详尽的战略清单。我们建议在“安全注意事项”一节中增加一个策略。如果这些策略都不起作用，也鼓励管理员考虑他们自己的网络配置的细节，看看是否有某种方法来检测重复的中继ID，而不是这里列出的那些。
Security issues with the Relay Agent Information option and its use by servers in address assignment are discussed in [RFC3046] and [RFC4030]. The DHCP Relay Agent Information option depends on a trusted relationship between the DHCP relay agent and the DHCP server, as described in Section 5 of [RFC3046]. While the introduction of fraudulent DHCP Relay Agent Information options can be prevented by a perimeter defense that blocks these options unless the DHCP relay agent is trusted, a deeper defense using the authentication sub-option for the DHCP Relay Agent Information option [RFC4030] SHOULD be deployed as well. It also helps in avoiding duplication of relay identifiers by malicious entities. However, implementation of the authentication sub-option for the DHCP Relay Agent Information option [RFC4030] is not a must to support the Relay-ID sub-option.
[RFC3046]和[RFC4030]中讨论了中继代理信息选项的安全问题以及服务器在地址分配中的使用。DHCP中继代理信息选项取决于DHCP中继代理和DHCP服务器之间的信任关系，如[RFC3046]第5节所述。虽然引入欺诈性DHCP中继代理信息选项可以通过周界防御来防止，除非DHCP中继代理受信任，否则周界防御会阻止这些选项，但也应部署使用DHCP中继代理信息选项[RFC4030]的身份验证子选项的更深入防御。它还有助于避免恶意实体复制中继标识符。但是，DHCP中继代理信息选项[RFC4030]的身份验证子选项的实现不是支持中继ID子选项的必要条件。
One possible use case for the Relay-ID sub-option is the automated configuration of machines on a factory floor. In this situation, various sections of the factory floor might be on their own network links with a relay agent interposed between those links and the DHCP server. The Relay-ID of each relay agent might cause special configurations to be downloaded to those devices to control their behavior.
继电器ID子选项的一个可能用例是在工厂车间自动配置机器。在这种情况下，工厂车间的各个部分可能在它们自己的网络链路上，在这些链路和DHCP服务器之间插入一个中继代理。每个中继代理的中继ID可能会导致将特殊配置下载到这些设备以控制其行为。
If a relay agent was deployed on the factory floor in such a situation, with an incorrect Relay-ID, there is the potential that devices could be misconfigured in a way that could produce incorrect results, cause physical damage, or even create hazardous conditions for workers.
如果在这种情况下，继电器代理部署在工厂地板上，且继电器ID不正确，则有可能错误配置设备，从而产生错误结果，造成物理损坏，甚至为工人创造危险条件。
In deployment scenarios like this one, administrators must use some dependable technique to ensure that such misconfigurations do not occur. It is beyond the scope of this document to provide a complete list of such techniques.
在这样的部署场景中，管理员必须使用一些可靠的技术来确保不会发生此类错误配置。提供此类技术的完整列表超出了本文件的范围。
However, as an example, a relay agent device intended for use in such a scenario could require the use of a hardware token that contains a Relay-ID that is physically attached to the installation location of the relay agent device and can be connected to and disconnected from the relay agent device without the use of special tools. Such a relay agent device should not be operable when this hardware token is not connected to it: either it should fail because it presents an unknown identifier to the DHCP server, or it should simply refuse to relay DHCP packets until the token is connected to it.
然而，作为示例，打算在这种场景中使用的中继代理设备可能需要使用硬件令牌，该硬件令牌包含物理连接到中继代理设备的安装位置的中继ID，并且可以在不使用专用工具的情况下连接到中继代理设备并从中继代理设备断开。当此硬件令牌未连接到此类中继代理设备时，此类中继代理设备不应可操作：要么因为向DHCP服务器提供未知标识符而失败，要么干脆拒绝中继DHCP数据包，直到令牌连接到它为止。
A relay agent device that does not provide a clear mitigation strategy for a scenario where misconfiguration could have damaging or hazardous consequences should not be deployed in such a scenario.
对于错误配置可能产生破坏性或危险后果的场景，如果中继代理设备未提供明确的缓解策略，则不应在此类场景中部署。
IANA has assigned a new sub-option code from the "DHCP Relay Agent Sub-Option Codes" registry maintained at http://www.iana.org/assignments/bootp-dhcp-parameters.
IANA已从维护在的“DHCP中继代理子选项代码”注册表中分配了一个新的子选项代码http://www.iana.org/assignments/bootp-dhcp-parameters.
Relay Agent Identifier Sub-Option 12
中继代理标识符子选项12
Thanks to Bernie Volz, David W. Hankins, Pavan Kurapati, and Ted Lemon for providing valuable suggestions.
感谢Bernie Volz、David W.Hankins、Pavan Kurapati和Ted Lemon提供了宝贵的建议。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, March 1997.
[RFC2131]Droms，R.，“动态主机配置协议”，RFC21311997年3月。
[RFC3046] Patrick, M., "DHCP Relay Agent Information Option", RFC 3046, January 2001.
[RFC3046]Patrick，M.，“DHCP中继代理信息选项”，RFC3046，2001年1月。
[RFC4030] Stapp, M. and T. Lemon, "The Authentication Suboption for the Dynamic Host Configuration Protocol (DHCP) Relay Agent Option", RFC 4030, March 2005.
[RFC4030]Stapp，M.和T.Lemon，“动态主机配置协议（DHCP）中继代理选项的身份验证子选项”，RFC 4030，2005年3月。
[RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, July 2005.
[RFC4122]Leach，P.，Mealling，M.和R.Salz，“通用唯一标识符（UUID）URN名称空间”，RFC 4122，2005年7月。
[RFC4388] Woundy, R. and K. Kinnear, "Dynamic Host Configuration Protocol (DHCP) Leasequery", RFC 4388, February 2006.
[RFC4388]Woundy，R.和K.Kinnear，“动态主机配置协议（DHCP）租赁”，RFC 4388，2006年2月。
[RFC5107] Johnson, R., Kumarasamy, J., Kinnear, K., and M. Stapp, "DHCP Server Identifier Override Suboption", RFC 5107, February 2008.
[RFC5107]Johnson，R.，Kumarasamy，J.，Kinnear，K.，和M.Stapp，“DHCP服务器标识符覆盖子选项”，RFC 5107，2008年2月。
[RFC6926] Kinnear, K., Stapp, M., Desetti, R., Joshi, B., Russell, N., Kurapati, P., and B. Volz, "DHCPv4 Bulk Leasequery", RFC 6926, April 2013.
[RFC6926]K.Kinnear、M.Stapp、R.Desetti、B.Joshi、B.Russell、N.Kurapati、P.和B.Volz，“DHCPv4散装租赁”，RFC 69262013年4月。
Authors' Addresses
作者地址
Bharat Joshi Infosys Ltd. 44 Electronics City, Hosur Road Bangalore 560 100 India
印度班加罗尔霍苏尔路电子城44号Bharat Joshi Infosys Ltd.560 100
EMail: bharat_joshi@infosys.com
URI: http://www.infosys.com/
EMail: bharat_joshi@infosys.com
URI: http://www.infosys.com/
D.T.V Ramakrishna Rao Infosys Ltd. 44 Electronics City, Hosur Road Bangalore 560 100 India
印度班加罗尔霍苏尔路电子城44号D.T.V罗摩克里希纳·拉奥信息系统有限公司560 100
EMail: ramakrishnadtv@infosys.com
URI: http://www.infosys.com/
EMail: ramakrishnadtv@infosys.com
URI: http://www.infosys.com/
Mark Stapp Cisco Systems, Inc. 1414 Massachusetts Ave. Boxborough, MA 01719 USA
Mark Stapp Cisco Systems，Inc.美国马萨诸塞州Boxborough大道1414号，邮编01719
Phone: +1 978 936 0000
EMail: mjs@cisco.com
Phone: +1 978 936 0000
EMail: mjs@cisco.com