Subject: [shara] DHCPv6 Port Range: Quick implementation report

From: <[email-masked]>
Date: Mon, 21 Dec 2009 10:12:01 +0100

Dear all,

Our R&D Lab have implemented the port range DHCPv6 options defined in http://tools.ietf.org/html/draft-boucadair-dhcpv6-shared-address-option-00, especially OPTION_PORT_EXTENDED_A and the option to convey the IPv6 prefix used to build IPv4 embedded IPv6 addresses.

We used the DHCPv6 implementation available at https://fedorahosted.org/dhcpv6 to incorporate new port range DHCPv6 options. Below some information about the required changes to support port range options.

- In addition to the basic dhcpv6 configuration lines, the following lines should be provided

interface eth1 {                       
      ...                               
      request prefix-delegation;         
      request port-range;                
 ...                                    
 };                                     

A "request port-range 64512 1024;" command may be used to indicated a requested port range mask (64512 is an example) and port range value (1024 is an example).

-  dhcpv6s.conf file encloses the configuration of the DHCPv6 server. These configuration lines should be filled:

* "prefix pref6;"           "pref6" is used to build IPv4 embedded IPv6 addresses. In our tested a /32 has been used (2fff:ffff::/32).
* "range IPv41 to IPv42;"   Indicates the IPv4 @ pool to be used. IPv42 may be equal to IPv41 (one IPv4 address is shared)
* "portmask 64512;"         Indicates the port range mask. In this example (64512), this config line indicates that the first 6 bits are used to build the port mask. An IPv4 address is then shared between 64 customers. The server generates automatically the port ranges according to this port mask.

The overall behaviour is as follows:
- configuration of the DHCPv6 server.
- configuration of the DHCPv6 client to enable port range requests.
- On the initialisation of the DHCPv6 client, it issues a request to retrieve its IPv6 prefix, delegated prefix (to build IPv4 embedded IPv6 prefix), shared IPv4 address and a port range. 
- Upon receipt of the request, the server generates automatically a port range and sends backs an offer to the client. The server keeps track on the assigned shared IPv4 address + port range. Port range assignment are not lost if the server reboots since the leases are stored in a file on the disk.
- Once the DHCPv6 offer is received by the client, (after parsing operations) the client builds its IPv4 Embedded IPv6 prefix and proceeds to a DAD verification. If succeeded, (1) it launches a script to build a tun64 interface (for encapsulation and decapsulation purposes of IPv4 in IPv6 together with port restriction features) and (2) configures automatically the following two routes:

* ip -6 route add ipv4_embedded_ipv6 dev tun64 (where ipv4_embedded_ipv6 is the automatically built IPv4 embedded IPv6 prefix and tun64 is the interface used particularly to receive IPv4-in-IPv6 traffic.)
* ip -6 route add default via linklocal dev eth1 

As a result: 
- a local machine is able to issue port restricted IPv4 traffic over IPv6. No manual configuration is required on the client side.
- Port ranges are automatically assigned by the DHCP server: no need to configure individual port ranges. Only the size of the port range is configured on the server.

Cheers,
Med

*********************************
This message and any attachments (the "message") are confidential and intended solely for the addressees. 
Any unauthorised use or dissemination is prohibited.
Messages are susceptible to alteration. 
France Telecom Group shall not be liable for the message if altered, changed or falsified.
If you are not the intended addressee of this message, please cancel it immediately and inform the sender.
********************************