The Classless Static Route Option for Dynamic Host Configuration Protocol (DHCP) version 4
updates
- rfc-2132 — DHCP Options and BOOTP Vendor Extensions
Extracted elements (20)
The destination descriptor uses a compact encoding (mask width + significant octets only, not always 4 octets) to minimize option space, which is important because DHCP option space is constrained and a full routing table could otherwise overflow the maximum DHCP message size.
This option obsoletes the Static Route option (option 33) defined in RFC 2132 because classful routing is no longer in common use. The Static Routes option omits per-route subnet masks, making it unsuitable for classless (CIDR) routing, which requires both a network number and an explicit subnet mask to identify a route.
DHCP clients MAY also request the Static Routes option (33) in their parameter request list for compatibility with older servers that do not support the Classless Static Routes option.
DHCP server administrators should configure their servers to send both a Router option and a Classless Static Routes option (specifying the default router in both), because many clients may not implement option 121. This ensures backward compatibility with non-supporting clients.
A DHCP client whose TCP/IP stack does not support a 0.0.0.0 router address for local subnet routes MUST ignore routes in the Classless Static Routes option whose router IP address is 0.0.0.0.
After deriving a subnet number and mask from each destination descriptor, the DHCP client MUST zero any bits in the subnet number where the corresponding bit in the mask is zero (i.e., install the logical AND of the descriptor's subnet number and subnet mask).
Clients implementing this option SHOULD send a Maximum DHCP Message Size option, set to at least the MTU of the interface being configured, because a full routing table may exceed the standard 576-octet DHCP message size.
DHCP clients requesting this option and DHCP servers sending this option MUST implement DHCP option concatenation per RFC 3396; the Classless Static Route Option is a concatenation-requiring option.
DHCP clients that do not support this option MUST ignore it if received from a DHCP server.
DHCP clients that support this option and send a DHCP Parameter Request List MUST request both this option (121) and the Router option in that list.
DHCP clients that support this option MUST install the routes specified in the option, except for local subnet routes with a 0.0.0.0 router that the underlying stack cannot handle.
If both a Static Routes option (code 33) and the Classless Static Routes option are provided, DHCP clients that support this option MUST NOT install the routes from the Static Routes option.
If the DHCP server returns both a Classless Static Routes option and a Router option, the DHCP client MUST ignore the Router option. Similarly, if the server returns both a Classless Static Routes option and a Static Routes option, the client MUST ignore the Static Routes option.
The Classless Static Routes option code (121) MUST appear in the parameter request list prior to both the Router option code and the Static Routes option code, if those are also present.
When a DHCP server is sending Classless Static Routes to a client that also requested the Router or Static Routes options, the server SHOULD NOT include the Router or Static Routes options in its reply.
Local subnet routes allow a DHCP server to specify a router address of 0.0.0.0 for subnets that are on the same link as the client but in a different IP subnet, indicating the destination is directly reachable without a router.
The Classless Static Route Option has option code 121 and a minimum length of 5 bytes. It carries one or more static routes, each consisting of a destination descriptor (subnet mask width + significant subnet octets) followed by a 4-octet router IP address.
IANA has allocated option code 121 in the DHCP option codes registry for the Classless Static Routes option defined by this document.
The Classless Static Routes option can be exploited to misdirect network traffic by supplying incorrect router IP addresses, enabling either a Denial of Service attack (invalid router address) or a man-in-the-middle attack (router address of a snooper). This vulnerability is shared with the existing Router and Static Routes options in RFC 2132. DHCP authentication (RFC 3118) mitigates this risk.
A destination descriptor encodes a subnet as one octet giving the subnet mask width (number of 1-bits), followed by only the significant octets of the subnet number (0 octets for /0, 1 for /1-/8, 2 for /9-/16, 3 for /17-/24, 4 for /25-/32). The router address is always 4 octets. Multiple routes are concatenated within a single option value.