Prefix Exclude Option for DHCPv6-based Prefix Delegation
updates
- rfc-3633 — IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6
Extracted elements (22)
A delegating router may include the OPTION_PD_EXCLUDE option code in an OPTION_ORO inside a Reconfigure message to signal to the requesting router that it should re-request the exclusion option. This allows a delegating router to retroactively indicate support for prefix exclusion after an initial exchange that predated the feature.
In architectures where a mobile router always has a single /64 configured on its uplink and that /64 must be aggregatable with the delegated prefix (e.g., /56), it was previously impossible to use DHCPv6-PD without advertising two separate, non-aggregatable prefixes. The OPTION_PD_EXCLUDE mechanism solves this by allowing the /64 uplink prefix to be carved out of the delegated /56.
RFC 3633 Section 12.1 explicitly prevents a delegating router from using any prefix it has delegated, resulting in two non-aggregatable routes per customer: one for the link between delegating and requesting router, and one for the customer site. This specification removes that constraint by allowing one prefix from the delegated set to be excluded and used on the uplink.
The IPv6 subnet ID in OPTION_PD_EXCLUDE is not the full excluded prefix; instead it carries only the bits that differ from the delegated prefix (i.e., bits starting at position 'OPTION_IAPREFIX prefix-length'), left-shifted to start on an octet boundary and zero-padded. This compact encoding avoids redundantly retransmitting the common prefix bits already present in OPTION_IAPREFIX.
If the requesting router requests OPTION_PD_EXCLUDE but the delegating router does not support this specification, the delegating router acts as specified in RFC 3633 (ignoring the unknown option code in OPTION_ORO). The requesting router must therefore be prepared to operate without prefix exclusion when the delegating router omits OPTION_PD_EXCLUDE from its Advertise.
A requesting router that supports this specification SHOULD include OPTION_PD_EXCLUDE option code in the OPTION_ORO option in Solicit, Request, Renew, and Rebind messages to advertise support for the prefix exclusion mechanism.
Any prefix excluded from a delegated prefix MUST be contained in an OPTION_PD_EXCLUDE option within the corresponding OPTION_IAPREFIX, and the excluded prefix MUST be a sub-prefix of the delegated prefix carried in that OPTION_IAPREFIX.
If a Release message from a requesting router contains a 'new' excluded prefix in any OPTION_PD_EXCLUDE option (one for which the delegating router has no existing binding), the delegating router MUST send a Reply message with Status Code set to NoBinding for that IA_PD option.
If the Advertise message received by the requesting router does not include OPTION_PD_EXCLUDE, the requesting router MUST fall back to normal DHCPv6-PD behavior as described in RFC 3633 Section 11.1.
If the Solicit message's OPTION_ORO does not include OPTION_PD_EXCLUDE, the delegating router MUST fall back to normal DHCPv6-PD behavior as described in RFC 3633 Section 11.2.
OPTION_PD_EXCLUDE MUST only be included in the OPTION_IAPREFIX IAprefix-options field; it is not valid at the top level or in any other option.
The extracted subnet ID MUST be left-shifted by 'OPTION_IAPREFIX prefix-length' mod 8 bits so that it starts from a full octet boundary, and MUST be zero-padded to the next full octet boundary.
The prefix-len field in OPTION_PD_EXCLUDE MUST be strictly greater than the OPTION_IAPREFIX prefix-length and at most 128; that is, OPTION_IAPREFIX prefix-length+1 ≤ prefix-len ≤ 128.
The requesting router must create sink routes covering the delegated prefixes minus the excluded prefixes, for example by installing a sink route for the full delegated prefix and a more-specific route for the excluded prefix.
The requesting router MUST NOT assign the excluded prefix (carried in OPTION_PD_EXCLUDE) to any of its downstream interfaces.
When releasing delegated prefixes, the requesting router MUST include the excluded prefix in the OPTION_PD_EXCLUDE option within the IA_PDs of the Release message, and MUST NOT use OPTION_PD_EXCLUDE to introduce any additional excluded prefix for which it did not originally receive a valid binding.
OPTION_PD_EXCLUDE (option code 67) is a new DHCPv6 option that identifies exactly one prefix excluded from a delegated prefix set. It is embedded in the IAprefix-options field of OPTION_IAPREFIX and there can be at most one OPTION_PD_EXCLUDE per OPTION_IAPREFIX.
The prefix in OPTION_PD_EXCLUDE shares the same preferred-lifetime and valid-lifetime as the encapsulating OPTION_IAPREFIX's delegated prefix; no separate lifetime fields are carried in the exclude option.
IANA has reserved DHCPv6 Option Code 67 (OPTION_PD_EXCLUDE) in the 'Dynamic Host Configuration Protocol for IPv6 (DHCPv6)' registry for DHCP Option Codes.
This specification introduces no new security considerations beyond those already documented in RFC 3315 Section 23 (DHCPv6 security) and RFC 3633 Section 15 (DHCPv6-PD security), which includes recommendations for protection against prefix delegation attacks.
Delegating Router Solicitation flow: Requesting Router sends Solicit with OPTION_ORO containing OPTION_PD_EXCLUDE → Delegating Router includes OPTION_PD_EXCLUDE in Advertise → Requesting Router proceeds to Request/Reply exchange (Section 6.1). If Advertise omits OPTION_PD_EXCLUDE, Requesting Router falls back to RFC 3633 standard flow.
OPTION_PD_EXCLUDE carries a 2-octet option-code (67), a 2-octet option-len (value 2–17), a 1-octet prefix-len (the excluded prefix length in bits), and a variable-length IPv6 subnet ID (1–16 octets) holding the bits of the excluded prefix that differ from the delegated prefix, left-shifted to a full octet boundary and zero-padded.