draft-ietf-geopriv-lis-discovery-09.txt   draft-ietf-geopriv-lis-discovery-10.txt 
GEOPRIV M. Thomson GEOPRIV M. Thomson
Internet-Draft J. Winterbottom Internet-Draft J. Winterbottom
Intended status: Standards Track Andrew Intended status: Standards Track Andrew
Expires: October 3, 2009 April 1, 2009 Expires: October 25, 2009 April 23, 2009
Discovering the Local Location Information Server (LIS) Discovering the Local Location Information Server (LIS)
draft-ietf-geopriv-lis-discovery-09 draft-ietf-geopriv-lis-discovery-10
Status of This Memo Status of This Memo
This Internet-Draft is submitted to IETF in full conformance with the This Internet-Draft is submitted to IETF in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet- other groups may also distribute working documents as Internet-
Drafts. Drafts.
skipping to change at page 1, line 32 skipping to change at page 1, line 32
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt. http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
This Internet-Draft will expire on October 3, 2009. This Internet-Draft will expire on October 25, 2009.
Copyright Notice Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the Copyright (c) 2009 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents in effect on the date of Provisions Relating to IETF Documents in effect on the date of
publication of this document (http://trustee.ietf.org/license-info). publication of this document (http://trustee.ietf.org/license-info).
Please review these documents carefully, as they describe your rights Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. and restrictions with respect to this document.
Abstract Abstract
Discovery of the correct Location Information Server (LIS) in the Discovery of the correct Location Information Server (LIS) in the
local access network is necessary for devices that wish to acquire local access network is necessary for devices that wish to acquire
location information from the network. A method is described for the location information from the network. A method is described for the
discovery of a LIS. Dynamic Host Configuration Protocol (DHCP) discovery of a LIS in the access network serving a device. Dynamic
options for IP versions 4 and 6 are defined that specify a URI for a Host Configuration Protocol (DHCP) options for IP versions 4 and 6
LIS in the local access network. An alternative method that uses are defined that specify a domain name. This domain name is then
URI-enabled NAPTR (U-NAPTR) is described for use where the DHCP used as input to a URI-enabled NAPTR (U-NAPTR) resolution process.
option is unsuccessful.
Table of Contents Table of Contents
1. Introduction and Overview . . . . . . . . . . . . . . . . . . 3 1. Introduction and Overview . . . . . . . . . . . . . . . . . . 3
1.1. DHCP Discovery . . . . . . . . . . . . . . . . . . . . . . 3 1.1. Discovery Procedure Overview . . . . . . . . . . . . . . . 3
1.2. U-NAPTR Discovery . . . . . . . . . . . . . . . . . . . . 3 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4
1.3. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4 2. LIS Discovery Procedure . . . . . . . . . . . . . . . . . . . 4
2. LIS Discovery Using DHCP . . . . . . . . . . . . . . . . . . . 4 2.1. Residential Gateways . . . . . . . . . . . . . . . . . . . 5
2.1. DHCPv4 LIS URI Option . . . . . . . . . . . . . . . . . . 4 2.2. Virtual Private Networks (VPNs) . . . . . . . . . . . . . 6
2.2. DHCPv6 LIS URI Option . . . . . . . . . . . . . . . . . . 5 3. Access Network Domain Name DHCP Option . . . . . . . . . . . . 6
3. U-NAPTR for LIS Discovery . . . . . . . . . . . . . . . . . . 6 3.1. Domain Name Encoding . . . . . . . . . . . . . . . . . . . 7
3.1. Determining a Domain Name . . . . . . . . . . . . . . . . 7 3.2. Access Network Domain Name DHCPv4 Option . . . . . . . . . 7
4. Overall Discovery Procedure . . . . . . . . . . . . . . . . . 7 3.3. Access Network Domain Name DHCPv6 Option . . . . . . . . . 8
4.1. Residential Gateways . . . . . . . . . . . . . . . . . . . 8 4. U-NAPTR Resolution of a LIS URI . . . . . . . . . . . . . . . 8
4.2. Virtual Private Networks (VPNs) . . . . . . . . . . . . . 9 4.1. Determining a Domain Name . . . . . . . . . . . . . . . . 9
5. Security Considerations . . . . . . . . . . . . . . . . . . . 9 5. Security Considerations . . . . . . . . . . . . . . . . . . . 10
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11
6.1. Registration of DHCPv4 and DHCPv6 LIS URI Option Codes . . 10 6.1. Registration of DHCPv4 and DHCPv6 Option Codes . . . . . . 11
6.2. Registration of a Location Server Application Service 6.2. Registration of a Location Server Application Service
Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
6.3. Registration of a Location Server Application Protocol 6.3. Registration of a Location Server Application Protocol
Tag for HELD . . . . . . . . . . . . . . . . . . . . . . . 11 Tag for HELD . . . . . . . . . . . . . . . . . . . . . . . 12
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 11 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 12
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 12
8.1. Normative References . . . . . . . . . . . . . . . . . . . 11 8.1. Normative References . . . . . . . . . . . . . . . . . . . 12
8.2. Informative References . . . . . . . . . . . . . . . . . . 13 8.2. Informative References . . . . . . . . . . . . . . . . . . 14
1. Introduction and Overview 1. Introduction and Overview
The location of a device is a useful and sometimes necessary part of The location of a device is a useful and sometimes necessary part of
many services. A Location Information Server (LIS) is responsible many services. A Location Information Server (LIS) is responsible
for providing that location information to devices with an access for providing that location information to devices with an access
network. The LIS uses knowledge of the access network and its network. The LIS uses knowledge of the access network and its
physical topology to generate and serve location information to physical topology to generate and serve location information to
devices. devices.
Each access network requires specific knowledge about topology. Each access network requires specific knowledge about topology.
Therefore, it is important to discover the LIS that has the specific Therefore, it is important to discover the LIS that has the specific
knowledge necessary to locate a device. That is, the LIS that serves knowledge necessary to locate a device. That is, the LIS that serves
the current access network. Automatic discovery is important where the current access network. Automatic discovery is important where
there is any chance of movement outside a single access network. there is any chance of movement outside a single access network.
Reliance on static configuration can lead to unexpected errors if a Reliance on static configuration can lead to unexpected errors if a
device moves between access networks. device moves between access networks.
This document describes DHCP options and DNS records that a device This document describes a process that a device can use to discover a
can use to discover a LIS. LIS. This process uses a DHCP option and the DNS. The product of
this discovery process is an http: or https: URI, which identifies a
The product of a discovery process, such as the one described in this LIS.
document, is the address of the service. In this document, the
result is an http: or https: URI, which identifies a LIS.
The URI result from the discovery process is suitable for location The URI result from the discovery process is suitable for location
configuration only; that is, the device MUST dereference the URI configuration only; that is, the device MUST dereference the URI
using the process described in HELD using the process described in HELD
[I-D.ietf-geopriv-http-location-delivery]. URIs discovered in this [I-D.ietf-geopriv-http-location-delivery]. URIs discovered in this
way are not "location URIs" [I-D.ietf-geopriv-lbyr-requirements]; way are not "location URIs" [I-D.ietf-geopriv-lbyr-requirements];
dereferencing one of them provides the location of the requester dereferencing one of them provides the location of the requester
only. Devices MUST NOT embed these URIs in fields in other protocols only. Devices MUST NOT embed these URIs in fields in other protocols
designed to carry the location of the device. designed to carry the location of the device.
1.1. DHCP Discovery 1.1. Discovery Procedure Overview
DHCP ([RFC2131], [RFC3315]) is a commonly used mechanism for DHCP ([RFC2131], [RFC3315]) is a commonly used mechanism for
providing bootstrap configuration information allowing a device to providing bootstrap configuration information allowing a device to
operate in a specific network environment. The bulk of DHCP operate in a specific network environment. The bulk of DHCP
information is largely static; consisting of configuration information is largely static; consisting of configuration
information that does not change over the period that the device is information that does not change over the period that the device is
attached to the network. Physical location information might change attached to the network. Physical location information might change
over this time, however the address of the LIS does not. Thus, DHCP over this time, however the address of the LIS does not. Thus, DHCP
is suitable for configuring a device with the address of a LIS. is suitable for configuring a device with the address of a LIS.
1.2. U-NAPTR Discovery This document defines a DHCP option that produces a domain name that
identifies the local access network in Section 3.
Where DHCP is not available, the DNS might be able to provide a URI. Section 4 describes a method that uses URI-enabled NAPTR (U-NAPTR)
This document describes a method that uses URI-enabled NAPTR [RFC4848], a Dynamic Delegation Discovery Service (DDDS) profile that
(U-NAPTR) [RFC4848], a Dynamic Delegation Discovery Service (DDDS) produces a URI for the LIS. The input to this process is provided by
profile that supports URI results. the DHCP option.
For the LIS discovery DDDS application, an Application Service tag For the LIS discovery DDDS application, an Application Service tag
"LIS" and an Application Protocol tag "HELD" are created and "LIS" and an Application Protocol tag "HELD" are created and
registered with the IANA. Taking a domain name, this U-NAPTR registered with the IANA. Based on the domain name, this U-NAPTR
application uses the two tags to determine the LIS URI. application uses the two tags to determine a URI for a LIS that
supports the HELD protocol.
1.3. Terminology 1.2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
This document also uses the term "device" to refer to an end host, or This document also uses the term "device" to refer to an end host, or
client consistent with its use in HELD. In HELD and RFC3693 client consistent with its use in HELD. In HELD and RFC3693
[RFC3693] parlance, the Device is also the Target. [RFC3693] parlance, the Device is also the Target.
The terms "access network" refers to the network that a device The terms "access network" refers to the network that a device
connects to for Internet access. The "access network provider" is connects to for Internet access. The "access network provider" is
the entity that operates the access network. This is consistent with the entity that operates the access network. This is consistent with
the definition in [I-D.ietf-geopriv-l7-lcp-ps] which combines the the definition in [I-D.ietf-geopriv-l7-lcp-ps] which combines the
Internet Access Provider (IAP) and Internet Service Provider (ISP). Internet Access Provider (IAP) and Internet Service Provider (ISP).
The access network provider is responsible for allocating the device The access network provider is responsible for allocating the device
a public IP address and for directly or indirectly providing a LIS a public IP address and for directly or indirectly providing a LIS
service. service.
2. LIS Discovery Using DHCP 2. LIS Discovery Procedure
DHCP allows the access network provider to specify the address of a A device that has multiple network interfaces could potentially be
LIS as part of network configuration. If the device is able to served by a different access network on each interface, each with a
acquire a LIS URI using DHCP then this URI is used directly; the different LIS. The device SHOULD attempt to discover the LIS
U-NAPTR process is not necessary if this option is provided. applicable to each network interface, stopping when a LIS is
successfully discovered on any interface.
This document registers a DHCP option for a LIS URI for both IPv4 and The LIS discovery procedure follows the following process:
IPv6. An "https:" LIS URI that is a product of U-NAPTR MUST be
authenticated using the domain name method described in Section 3.1
of RFC 2818 [RFC2818].
2.1. DHCPv4 LIS URI Option 1. Acquire the access network domain name DHCP option (Section 3).
This section defines a DHCP for IPv4 (DHCPv4) option for the address This process might be repeated for each of the network interfaces
of a LIS. on the device. Domain names acquired from other sources might
also be added.
0 1 2 3 2. Apply U-NAPTR resolution (Section 4) to discover a LIS URI.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| LIS_URI | Length | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
. LIS URI .
. ... .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1: DHCPv4 LIS URI Option The U-NAPTR process is applied using each of the domain names as
input.
LIS_URI: The IANA assigned option number (TBD). [[IANA/RFC-Editor 3. Verify that the LIS is able to provide location information.
Note: Please replace TBD with the assigned DHCPv4 option code.]]
Length: The length of the entire LIS URI option in octets. The first URI that results in a successful response from the LIS
is used.
LIS URI: The address of the LIS. The URI MUST NOT be terminated by A device MUST support discovery using the access network domain name
a zero octet. DHCP option (Section 3) as input to U-NAPTR resolution (Section 4).
Other domain names MAY be used, as described in Section 4.1.
The DHCPv4 version of this URI SHOULD NOT exceed 255 octets in A device that discovers a LIS URI MUST attempt to verify that the LIS
length, but MAY be extended by concatenating multiple option is able to provide location information. For the HELD protocol, the
values if necessary, as described in [RFC3396]. device verifies the URI by making a location request to the LIS. If
- at any time - the LIS responds to a request with the "notLocatable"
error code (see Section 4.3.2 of
[I-D.ietf-geopriv-http-location-delivery]), the device MUST continue
or restart the discovery process. A device SHOULD NOT make further
requests to a LIS that provides a "notLocatable" error until its
network attachment changes, or it discovers the LIS on an alternative
network interface.
2.2. DHCPv6 LIS URI Option Static configuration of a domain name or a LIS URI MAY be used if all
other discovery methods fail. Note that if a device has moved from
its customary location, static configuration might indicate a LIS
that is unable to provide accurate location information.
This section defines a DHCP for IPv6 (DHCPv6) option for the address The product of the LIS discovery process for HELD is an "https:" or
of a LIS. The DHCPv6 option for this parameter is similarly "http:" URI. Nothing distinguishes this URI from other URIs with the
formatted to the DHCPv4 option. same scheme, aside from the fact that it is the product of this
process. Only URIs produced by the discovery process can be used for
location configuration using HELD.
2.1. Residential Gateways
The process described in this document is known to not work in a very
common deployment scenario. A fixed wireline scenario is described
in more detail in Section 3.1 of [I-D.ietf-geopriv-l7-lcp-ps]. In
this fixed wireline environment an intervening residential gateway
exists between the device and the access network. If the residential
gateway does not provide this option to the devices it serves, those
devices are unable to discover a LIS.
Support of this specification by residential gateways ensures that
the devices they serve are able to acquire location information. In
many cases the residential gateway configures the devices it serves
using DHCP. When DHCP is used, the residential gateway MUST provide
the devices it serves with an access network domain name DHCP option
suitable for LIS discovery. In order to provide a useful value for
this option, the residential gateway MUST either:
o acquire an access network domain name from the access network
provider (possibly using DHCP) and pass the resulting value to
devices; or
o discover a LIS on its external interface, then provide devices
with the domain name that was used to successfully discover the
LIS; or
o explicitly include configuration that refers to a particular LIS.
In either case, the residential gateway provides an access network
domain name DHCP option to devices.
[I-D.ietf-dhc-container-opt] might be used by an access network
provider to convey configuration information to a residential gateway
for use by the devices it serves. Support and use of this option is
RECOMMENDED for both residential gateways and devices. Option values
found within the container MUST be used after values that are
directly in the DHCP response.
2.2. Virtual Private Networks (VPNs)
LIS discovery over a VPN network interface SHOULD NOT be performed.
A LIS discovered in this way is unlikely to have the information
necessary to determine an accurate location.
Not all interfaces connected to a VPN can be detected by devices or
the software running on them. A LIS MUST NOT provide location
information in response to requests that it can identify as
originating from a device on the remote end of a VPN tunnel, unless
it is able to accurately determine location. The "notLocatable" HELD
error code can be used to indicate to a device that discovery has
revealed an unsuitable LIS. This ensures that even if a device
discovers a LIS over the VPN, it does not rely on a LIS that is
unable to provide accurate location information.
3. Access Network Domain Name DHCP Option
DHCP provides a direct means for the access network provider to
configure a device. The access network domain name option identifies
a domain name that is suitable for service discovery within the
access network. This domain name is used as input to the U-NAPTR
resolution process for LIS discovery.
The domain name provided in this option is one owned by the access
network operator. This domain name is intended for use in
discovering services within the access network.
This document registers a DHCP option for the access network domain
name for both IPv4 and IPv6.
3.1. Domain Name Encoding
This section describes the encoding of the domain name used in the
DHCPv4 option defined in Section 3.2 and also used in the DHCPv6
option defined in Section 3.3.
The domain name is encoded according to Section 3.1 of [RFC1035].
Each label is represented as a one-octet length field followed by
that number of octets. Since every domain name ends with the null
label of the root, a domain name is terminated by a length byte of
zero. The high-order two bits of every length octet MUST be zero,
and the remaining six bits of the length field limit the label to 63
octets or less. To simplify implementations, the total length of a
domain name (i.e., label octets and label length octets) is
restricted to 255 octets or less.
3.2. Access Network Domain Name DHCPv4 Option
This section defines a DHCP for IPv4 (DHCPv4) option for the domain
name associated with the access network.
Code Len Access Network Domain Name
+-----+-----+-----+-----+-----+-----+-----+----
| TBD | n | s1 | s2 | s3 | s4 | s5 | ...
+-----+-----+-----+-----+-----+-----+-----+----
Figure 1: Access Network Domain Name DHCPv4 Option
The values s1, s2, s3, etc. represent the domain name labels in the
domain name encoding. Note that the length field in the DHCPv4
option represents the length of the entire domain name encoding,
whereas the length fields in the domain name encoding (see Section 3)
is the length of a single domain name label.
Code: OPTION_V4_ACCESS_DOMAIN (TBD). [[IANA/RFC-Editor Note: Please
replace TBD with the assigned DHCPv4 option code, both here and in
Figure 1.]]
Length: The length of the entire access network domain name option
in octets.
Access Network Domain Name: The domain name associated with the
access network, encoded as described in Section 3.1.
A DHCPv4 client MAY request a LoST server domain name in a Parameter
Request List option, as described in [RFC2131].
This option contains a single domain name and, as such, MUST contain
precisely one root label.
3.3. Access Network Domain Name DHCPv6 Option
This section defines a DHCP for IPv6 (DHCPv6) option for the domain
name associated with the access network. The DHCPv6 option for this
parameter is similarly formatted to the DHCPv4 option.
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_LIS_URI | Length | | OPTION_V6_ACCESS_DOMAIN | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. LIS URI . . Access Network Domain Name .
. ... . . ... .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: DHCPv6 LIS URI Option Figure 2: DHCPv6 Access Network Domain Name Option
OPTION_LIS_URI: The IANA assigned option number (TBD). [[IANA/ option-code: OPTION_V6_ACCESS_DOMAIN (TBD). [[IANA/RFC-Editor Note:
RFC-Editor Note: Please replace TBD with the assigned DHCPv6 Please replace TBD with the assigned DHCPv6 option code.]]
option code.]]
Length: The length of the LIS URI option in octets. option-length: The length of the entire access network domain name
option in octets.
The semantics and format of the remainder of the LIS URI option option-value: The access network domain name, encoded as described
are identical to the DHCPv4 option, except for the larger in Section 3.1.
allowance for URI length granted by the 16 bit length field.
DHCPv6 prohibits concatenation of option values.
3. U-NAPTR for LIS Discovery A DHCPv6 client MAY request a LoST server domain name in a Options
Request Option (ORO), as described in [RFC3315].
U-NAPTR resolution for a LIS takes a domain name as input and This option contains a single domain name and, as such, MUST contain
produces a URI that identifies the LIS. This process also requires precisely one root label.
an Application Service tag and an Application Protocol tag, which
differentiate LIS-related NAPTR records from other records for that 4. U-NAPTR Resolution of a LIS URI
domain.
U-NAPTR [RFC4848] resolution for a LIS takes a domain name as input
and produces a URI that identifies the LIS. This process also
requires an Application Service tag and an Application Protocol tag,
which differentiate LIS-related NAPTR records from other records for
that domain.
Section 6.2 defines an Application Service tag of "LIS", which is Section 6.2 defines an Application Service tag of "LIS", which is
used to identify the location service for a particular domain. The used to identify the location service for a given domain. The
Application Protocol tag "HELD", defined in Section 6.3, is used to Application Protocol tag "HELD", defined in Section 6.3, is used to
identify a LIS that understands the HELD protocol identify a LIS that understands the HELD protocol
[I-D.ietf-geopriv-http-location-delivery]. [I-D.ietf-geopriv-http-location-delivery].
The NAPTR records in the following example demonstrate the use of the The NAPTR records in the following example demonstrate the use of the
Application Service and Protocol tags. Iterative NAPTR resolution is Application Service and Protocol tags. Iterative NAPTR resolution is
used to delegate responsibility for the LIS service from used to delegate responsibility for the LIS service from
"zonea.example.net." and "zoneb.example.net." to "zonea.example.net." and "zoneb.example.net." to
"outsource.example.com.". "outsource.example.com.".
skipping to change at page 7, line 8 skipping to change at page 9, line 39
. ; replacement . ; replacement
) )
Figure 3: Sample LIS:HELD Service NAPTR Records Figure 3: Sample LIS:HELD Service NAPTR Records
Details for the "LIS" Application Service tag and the "HELD" Details for the "LIS" Application Service tag and the "HELD"
Application Protocol tag are included in Section 6. Application Protocol tag are included in Section 6.
An "https:" LIS URI that is a product of U-NAPTR MUST be An "https:" LIS URI that is a product of U-NAPTR MUST be
authenticated using the domain name method described in Section 3.1 authenticated using the domain name method described in Section 3.1
of RFC 2818 [RFC2818]. of RFC 2818 [RFC2818]. The domain name that is used in this
authentication is the one extracted from the URI, not the input to
3.1. Determining a Domain Name the U-NAPTR resolution process.
The U-NAPTR discovery method described requires a domain name as
input. This document does not specify how that domain name is
acquired by a device. If a device knows one or more domain names
that might be used for discovery, it is able to attempt to use each
domain name as input to the U-NAPTR discovery process. Static
configuration of a device is possible if a domain name is known to
work for this purpose.
A fully qualified domain name (FQDN) for the device might be provided
by a DHCP server ([RFC4702] for DHCPv4, [RFC4704] for DHCPv6).
DHCPv4 option 15 [RFC2131] could also be used as a source of a domain
name suffix for the device. If DHCP and any of these options are
available, these values could be used as input the U-NAPTR procedure;
however, implementers need to be aware that many DHCP servers do not
provide a sensible value for these options. Therefore, this method
of discovery SHOULD be given lesser precedence than methods that are
based on more explicit assurances.
4. Overall Discovery Procedure
The individual components of discovery are combined into a single
discovery procedure. Some networks maintain a topology analogous to
an onion and are comprised of layers, or segments, separating devices
from the Internet through intermediate networks. Applying the
individual discovery methods in an order that favours a physically
proximate LIS over a remote LIS is preferred.
A device MUST support DHCP discovery, where applicable. Devices
SHOULD support U-NAPTR discovery unless no input domain names can be
determined.
The following process ensures a greater likelihood of a LIS in close
physical proximity being discovered:
1. Request the DHCP LIS URI Option for each network interface.
2. Use U-NAPTR to discover a LIS URI using all known domain names.
3. Use a statically configured LIS URI.
A device that has multiple network interfaces could potentially be
served by a different access network on each interface, each with a
different LIS. The device SHOULD attempt to discover the LIS
applicable to each network interface, stopping when a LIS is
successfully discovered on any interface.
A device that discovers a LIS URI MUST attempt to verify that the LIS
is able to provide location information. For the HELD protocol, the
device MUST make a location request to the LIS. If - at any time -
the LIS responds to a request with the "notLocatable" error code (see
Section 4.3.2 of [I-D.ietf-geopriv-http-location-delivery]), the
device MUST continue or restart the discovery process. A device
SHOULD NOT make further requests to a LIS that provides a
"notLocatable" error until its network attachment changes, or it
discovers the LIS on an alternative network interface.
DHCP discovery MUST be attempted before any other discovery method.
This allows the network access provider a direct and explicit means
of configuring a LIS address. Alternative methods are only specified
as a means to discover a LIS where the DHCP infrastructure does not
support the LIS URI option.
This document does not mandate any particular source for the domain
name that is used as input to U-NAPTR.
Static configuration MAY be used if all other discovery methods fail.
Note however, that if a device has moved from its customary location,
static configuration might indicate a LIS that is unable to provide
accurate location information.
The product of the LIS discovery process is an "https:" or "http:"
URI. Nothing distinguishes this URI from other URIs with the same
scheme, aside from the fact that it is the product of this process.
Only URIs produced by the discovery process can be used for location
configuration using HELD. URIs that are not a product of LIS
discovery MUST NOT be used for location configuration.
4.1. Residential Gateways
The process described in this document is known to not work in a very
common deployment scenario. A fixed wireline scenario is described
in more detail in Section 3.1 of [I-D.ietf-geopriv-l7-lcp-ps]. In
this fixed wireline environment an intervening residential gateway
exists between the device and the access network. If the residential
gateway does not provide this option to the devices it serves, those
devices are unable to discover a LIS.
Support of this specification by residential gateways ensures that
the devices they serve are able to acquire location information. In
most cases the residential gateway configures the devices it serves
using DHCP. When DHCP is used, the residential gateway MUST provide
the devices it serves with a LIS URI option. In order to provide a
sensible value for this option, the residential gateway MUST either:
1. act as a LIS and provide location information to the devices that
it serves, or
2. discover a LIS on its external interface and relay this
information to devices.
In either case, the residential gateway provides a LIS URI option to 4.1. Determining a Domain Name
devices.
4.2. Virtual Private Networks (VPNs) The U-NAPTR resolution method described requires a domain name as
input. The access network domain name DHCP option (Section 3)
describes one source of this domain name.
LIS discovery over a VPN network interface SHOULD NOT be performed. If a device knows one or more alternative domain names that might be
A LIS discovered in this way is unlikely to have the information used for discovery, it MAY repeat the U-NAPTR process using those
necessary to determine an accurate location. domain names as input. For instance, static configuration of a
device might be used to provide a device with a domain name.
Not all interfaces connected to a VPN can be detected by devices or Alternative domain names MUST NOT be used unless the access network
the software running on them. A LIS MUST NOT provide location domain name option is unsuccessful or where external information
information in response to requests that it can identify as indicates that a particular domain name is to be used. For instance,
originating from a device on the remote end of a VPN tunnel, unless domain names for the device might be provided by a DHCP server
it is able to accurately determine location. The "notLocatable" HELD ([RFC4702] for DHCPv4, [RFC4704] for DHCPv6); DHCPv4 option 15
error code can be used to indicate to a device that discovery has [RFC2131] could also be used as a source of a domain name suffix for
revealed an unsuitable LIS. This ensures that even if a device the device. However, these domain names could be provided without
discovers a LIS over the VPN, it does not rely on a LIS that is considering their use for LIS discovery; therefore, many DHCP servers
unable to provide accurate location information. do not provide a sensible value for these options.
5. Security Considerations 5. Security Considerations
The address of a LIS is usually well-known within an access network;
therefore, interception of messages does not introduce any specific
concerns.
The primary attack against the methods described in this document is The primary attack against the methods described in this document is
one that would lead to impersonation of a LIS. The LIS is one that would lead to impersonation of a LIS. The LIS is
responsible for providing location information and this information responsible for providing location information and this information
is critical to a number of network services; furthermore, a device is critical to a number of network services; furthermore, a device
does not necessarily have a prior relationship with a LIS. Several does not necessarily have a prior relationship with a LIS. Several
methods are described here that can limit the probablity of, or methods are described here that can limit the probablity of, or
provide some protection against, such an attack. provide some protection against, such an attack. These methods MUST
be applied unless similar protections are in place, or in cases -
such as an emergency - where location information of dubious origin
is arguably better than none at all.
The address of a LIS is usually well-known within an access network; An attacker could attempt to compromise LIS discovery at any of three
therefore, interception of messages does not introduce any specific stages:
concerns.
An attacker that is able to modify or spoof messages from a DHCP 1. providing a falsified domain name to be used as input to U-NAPTR
server could provide a falsified LIS URI that a device would be able
to use to successfully authenticate the LIS. Preventing DHCP
messages from being modified or spoofed by attackers is necessary if
this information is to be relied upon. Physical or link layer
security are commonplace methods that can reduce the possibility of
such an attack within an access network; alternatively, DHCP
authentication [RFC3118] can provide a degree of protection against
modification or spoofing.
An attacker could attempt to compromise the U-NAPTR resolution. A 2. altering the DNS records used in U-NAPTR resolution
more thorough description of the security considerations for U-NAPTR
applications is included in [RFC4848]. In addition to considerations 3. impersonation of the LIS
related to U-NAPTR, it is important to recognize that the output of
U-NAPTR discovery is entirely dependent on its input. An attacker U-NAPTR is entirely dependent on its inputs. In falsifying a domain
who can control the domain name is therefore able to control the name, an attacker avoids any later protections, bypassing them
final URI. entirely. To ensure that the access network domain name DHCP option
can be relied upon, preventing DHCP messages from being modified or
spoofed by attackers is necessary. Physical or link layer security
are commonplace methods that can reduce the possibility of such an
attack within an access network; alternatively, DHCP authentication
[RFC3118] can provide a degree of protection against modification or
spoofing.
The domain name that is used to authenticated the LIS is the domain
name in the URI that is the result of the U-NAPTR resolution.
Therefore, if an attacker were able to modify or spoof any of the DNS
records used in the DDDS resolution, this URI could be replaced by an
invalid URI. The application of DNS security (DNSSEC) [RFC4033]
provides a means to limit attacks that rely on modification of the
DNS records used in U-NAPTR resolution. Security considerations
specific to U-NAPTR are described in more detail in [RFC4848].
An "https:" URI is authenticated using the method described in
Section 3.1 of [RFC2818]. The domain name used for this
authentication is the domain name in the URI resulting from U-NAPTR
resolution, not the input domain name as in [RFC3958]. Using the
domain name in the URI is more compatible with existing HTTP client
software, which authenticate servers based on the domain name in the
URI.
A LIS that is identified by an "http:" URI cannot be authenticated. A LIS that is identified by an "http:" URI cannot be authenticated.
Use of HTTP also does not meet requirements in HELD for Use of unsecured HTTP also does not meet requirements in HELD for
confidentiality and integrity. If an "http:" URI is the product of confidentiality and integrity. If an "http:" URI is the product of
DHCP or U-NAPTR discovery, this leaves devices vulnerable to several LIS discovery, this leaves devices vulnerable to several attacks.
attacks. Lower layer protections, such as layer 2 traffic separation Lower layer protections, such as layer 2 traffic separation might be
might provide some guarantees. used to provide some guarantees.
6. IANA Considerations 6. IANA Considerations
6.1. Registration of DHCPv4 and DHCPv6 LIS URI Option Codes 6.1. Registration of DHCPv4 and DHCPv6 Option Codes
The IANA has assigned an option code of (TBD) for the DHCPv4 option The IANA has assigned an option code of (TBD) for the DHCPv4 option
for a LIS URI, as described in Section 2.1 of this document. for an access network domain name option, as described in Section 3.2
of this document.
The IANA has assigned an option code of (TBD) for the DHCPv6 option The IANA has assigned an option code of (TBD) for the DHCPv6 option
for a LIS URI, as described in Section 2.2 of this document. for an access network domain name option, as described in Section 3.3
of this document.
6.2. Registration of a Location Server Application Service Tag 6.2. Registration of a Location Server Application Service Tag
This section registers a new S-NAPTR/U-NAPTR Application Service tag This section registers a new S-NAPTR/U-NAPTR Application Service tag
for a LIS, as mandated by [RFC3958]. for a LIS, as mandated by [RFC3958].
Application Service Tag: LIS Application Service Tag: LIS
Intended usage: Identifies a service that provides a device with its Intended usage: Identifies a service that provides a device with its
location information. location information.
skipping to change at page 11, line 36 skipping to change at page 12, line 41
Contact Information: The authors of this document Contact Information: The authors of this document
Author/Change Controller: The IESG Author/Change Controller: The IESG
7. Acknowledgements 7. Acknowledgements
The authors would like to thank Leslie Daigle for her work on The authors would like to thank Leslie Daigle for her work on
U-NAPTR; Peter Koch for feedback on how not to use DNS for discovery; U-NAPTR; Peter Koch for feedback on how not to use DNS for discovery;
Andy Newton for constructive suggestions with regards to document Andy Newton for constructive suggestions with regards to document
direction; Hannes Tschofenig and Richard Barnes for input and direction; Hannes Tschofenig, Richard Barnes, and Joe Salowey for
reviews; Dean Willis for constructive feedback. input and reviews; Dean Willis for constructive feedback.
8. References 8. References
8.1. Normative References 8.1. Normative References
[RFC1035] Mockapetris, P., "Domain
names - implementation and
specification", STD 13,
RFC 1035, November 1987.
[RFC2131] Droms, R., "Dynamic Host [RFC2131] Droms, R., "Dynamic Host
Configuration Protocol", Configuration Protocol",
RFC 2131, March 1997. RFC 2131, March 1997.
[RFC2818] Rescorla, E., "HTTP Over [RFC2818] Rescorla, E., "HTTP Over
TLS", RFC 2818, May 2000. TLS", RFC 2818, May 2000.
[RFC3315] Droms, R., Bound, J., [RFC3315] Droms, R., Bound, J.,
Volz, B., Lemon, T., Volz, B., Lemon, T.,
Perkins, C., and M. Perkins, C., and M.
Carney, "Dynamic Host Carney, "Dynamic Host
Configuration Protocol for Configuration Protocol for
IPv6 (DHCPv6)", RFC 3315, IPv6 (DHCPv6)", RFC 3315,
July 2003. July 2003.
[RFC3396] Lemon, T. and S. Cheshire, [RFC4033] Arends, R., Austein, R.,
"Encoding Long Options in Larson, M., Massey, D.,
the Dynamic Host and S. Rose, "DNS Security
Configuration Protocol Introduction and
(DHCPv4)", RFC 3396, Requirements", RFC 4033,
November 2002. March 2005.
[RFC4702] Stapp, M., Volz, B., and [RFC4702] Stapp, M., Volz, B., and
Y. Rekhter, "The Dynamic Y. Rekhter, "The Dynamic
Host Configuration Host Configuration
Protocol (DHCP) Client Protocol (DHCP) Client
Fully Qualified Domain Fully Qualified Domain
Name (FQDN) Option", Name (FQDN) Option",
RFC 4702, October 2006. RFC 4702, October 2006.
[RFC4704] Volz, B., "The Dynamic [RFC4704] Volz, B., "The Dynamic
skipping to change at page 12, line 49 skipping to change at page 14, line 10
[I-D.ietf-geopriv-http-location-delivery] Barnes, M., Winterbottom, [I-D.ietf-geopriv-http-location-delivery] Barnes, M., Winterbottom,
J., Thomson, M., and B. J., Thomson, M., and B.
Stark, "HTTP Enabled Stark, "HTTP Enabled
Location Delivery (HELD)", Location Delivery (HELD)",
draft-ietf-geopriv-http- draft-ietf-geopriv-http-
location-delivery-13 (work location-delivery-13 (work
in progress), in progress),
February 2009. February 2009.
[I-D.ietf-dhc-container-opt] Droms, R., "Container
Option for Server
Configuration", draft-
ietf-dhc-container-opt-05
(work in progress),
March 2009.
[RFC2119] Bradner, S., "Key words [RFC2119] Bradner, S., "Key words
for use in RFCs to for use in RFCs to
Indicate Requirement Indicate Requirement
Levels", BCP 14, RFC 2119, Levels", BCP 14, RFC 2119,
March 1997. March 1997.
8.2. Informative References 8.2. Informative References
[RFC3118] Droms, R. and W. Arbaugh, [RFC3118] Droms, R. and W. Arbaugh,
"Authentication for DHCP "Authentication for DHCP
 End of changes. 54 change blocks. 
247 lines changed or deleted 318 lines changed or added

This html diff was produced by rfcdiff 1.35. The latest version is available from http://tools.ietf.org/tools/rfcdiff/