draft-ietf-geopriv-lis-discovery-13.txt   draft-ietf-geopriv-lis-discovery-14.txt 
GEOPRIV M. Thomson GEOPRIV M. Thomson
Internet-Draft J. Winterbottom Internet-Draft J. Winterbottom
Intended status: Standards Track Andrew Intended status: Standards Track Andrew Corporation
Expires: June 11, 2010 December 8, 2009 Expires: August 29, 2010 February 25, 2010
Discovering the Local Location Information Server (LIS) Discovering the Local Location Information Server (LIS)
draft-ietf-geopriv-lis-discovery-13 draft-ietf-geopriv-lis-discovery-14
Abstract Abstract
Discovery of the correct Location Information Server (LIS) in the Discovery of the correct Location Information Server (LIS) in the
local access network is necessary for devices that wish to acquire local access network is necessary for devices that wish to acquire
location information from the network. A method is described for the location information from the network. A method is described for the
discovery of a LIS in the access network serving a device. Dynamic discovery of a LIS in the access network serving a device. Dynamic
Host Configuration Protocol (DHCP) options for IP versions 4 and 6 Host Configuration Protocol (DHCP) options for IP versions 4 and 6
are defined that specify a domain name. This domain name is then are defined that specify a domain name. This domain name is then
used as input to a URI-enabled NAPTR (U-NAPTR) resolution process. used as input to a URI-enabled NAPTR (U-NAPTR) resolution process.
skipping to change at page 1, line 42 skipping to change at page 1, line 42
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt. http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
This Internet-Draft will expire on June 11, 2010. This Internet-Draft will expire on August 29, 2010.
Copyright Notice Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the Copyright (c) 2010 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
skipping to change at page 2, line 23 skipping to change at page 2, line 23
Table of Contents Table of Contents
1. Introduction and Overview . . . . . . . . . . . . . . . . . . 3 1. Introduction and Overview . . . . . . . . . . . . . . . . . . 3
1.1. Discovery Procedure Overview . . . . . . . . . . . . . . . 3 1.1. Discovery Procedure Overview . . . . . . . . . . . . . . . 3
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4
2. LIS Discovery Procedure . . . . . . . . . . . . . . . . . . . 4 2. LIS Discovery Procedure . . . . . . . . . . . . . . . . . . . 4
2.1. Residential Gateways . . . . . . . . . . . . . . . . . . . 6 2.1. Residential Gateways . . . . . . . . . . . . . . . . . . . 6
2.2. Virtual Private Networks (VPNs) . . . . . . . . . . . . . 7 2.2. Virtual Private Networks (VPNs) . . . . . . . . . . . . . 7
3. Determining a Domain Name . . . . . . . . . . . . . . . . . . 8 3. Determining a Domain Name . . . . . . . . . . . . . . . . . . 8
3.1. Domain Name Encoding . . . . . . . . . . . . . . . . . . . 8 3.1. Domain Name Encoding . . . . . . . . . . . . . . . . . . . 8
3.2. Access Network Domain Name DHCPv4 Option . . . . . . . . . 8 3.2. Access Network Domain Name DHCPv4 Option . . . . . . . . . 9
3.3. Access Network Domain Name DHCPv6 Option . . . . . . . . . 9 3.3. Access Network Domain Name DHCPv6 Option . . . . . . . . . 9
3.4. Alternative Domain Names . . . . . . . . . . . . . . . . . 10 3.4. Alternative Domain Names . . . . . . . . . . . . . . . . . 10
4. U-NAPTR Resolution of a LIS URI . . . . . . . . . . . . . . . 10 4. U-NAPTR Resolution of a LIS URI . . . . . . . . . . . . . . . 10
5. Security Considerations . . . . . . . . . . . . . . . . . . . 11 5. Security Considerations . . . . . . . . . . . . . . . . . . . 12
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13
6.1. Registration of DHCPv4 and DHCPv6 Option Codes . . . . . . 13 6.1. Registration of DHCPv4 and DHCPv6 Option Codes . . . . . . 13
6.2. Registration of a Location Server Application Service 6.2. Registration of a Location Server Application Service
Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
6.3. Registration of a Location Server Application Protocol 6.3. Registration of a Location Server Application Protocol
Tag for HELD . . . . . . . . . . . . . . . . . . . . . . . 13 Tag for HELD . . . . . . . . . . . . . . . . . . . . . . . 14
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 14 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 14
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 14 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 14
8.1. Normative References . . . . . . . . . . . . . . . . . . . 14 8.1. Normative References . . . . . . . . . . . . . . . . . . . 14
8.2. Informative References . . . . . . . . . . . . . . . . . . 16 8.2. Informative References . . . . . . . . . . . . . . . . . . 16
1. Introduction and Overview 1. Introduction and Overview
The location of a device is a useful and sometimes necessary part of The location of a device is a useful and sometimes necessary part of
many services. A Location Information Server (LIS) is responsible many services. A Location Information Server (LIS) is responsible
for providing that location information to devices with an access for providing that location information to devices with attached
network. The LIS uses knowledge of the access network and its access networks used to provide Internet access. The LIS uses
physical topology to generate and serve location information to knowledge of the access network and its physical topology to generate
devices. and serve location information to devices.
Each access network requires specific knowledge about topology. Each access network requires specific knowledge about topology.
Therefore, it is important to discover the LIS that has the specific Therefore, it is important to discover the LIS that has the specific
knowledge necessary to locate a device. That is, the LIS that serves knowledge necessary to locate a device. That is, the LIS that serves
the current access network. Automatic discovery is important where the current access network. Automatic discovery is important where
there is any chance of movement outside a single access network. there is any chance of movement outside a single access network.
Reliance on static configuration can lead to unexpected errors if a Reliance on static configuration can lead to unexpected errors if a
device moves between access networks. device moves between access networks.
This document describes a process that a device can use to discover a This document describes a process that a device can use to discover a
LIS. This process uses a DHCP option and the DNS. The product of LIS. This process uses a DHCP option and the DNS. The product of
this discovery process is an http: or https: URI, which identifies a this discovery process is an http: [RFC2616] or https: [RFC2818] URI
LIS. that identifies a LIS.
The URI result from the discovery process is suitable for location The URI result from the discovery process is suitable for location
configuration only; that is, the device MUST dereference the URI configuration only; that is, the device MUST dereference the URI
using the process described in HELD using the process described in HELD
[I-D.ietf-geopriv-http-location-delivery]. URIs discovered in this [I-D.ietf-geopriv-http-location-delivery]. URIs discovered in this
way are not "location URIs" [I-D.ietf-geopriv-lbyr-requirements]; way are not "location URIs" [I-D.ietf-geopriv-lbyr-requirements];
dereferencing one of them provides the location of the requester dereferencing one of them provides the location of the requester
only. Devices MUST NOT embed these URIs in fields in other protocols only. Devices MUST NOT embed these URIs in fields in other protocols
designed to carry the location of the device. designed to carry the location of the device.
1.1. Discovery Procedure Overview 1.1. Discovery Procedure Overview
DHCP ([RFC2131], [RFC3315]) is a commonly used mechanism for DHCP ([RFC2131], [RFC3315]) is a commonly used mechanism for
providing bootstrap configuration information allowing a device to providing bootstrap configuration information allowing a device to
operate in a specific network environment. The bulk of DHCP operate in a specific network environment. The DHCP information is
information is largely static; consisting of configuration largely static; consisting of configuration information that does not
information that does not change over the period that the device is change over the period that the device is attached to the network.
attached to the network. Physical location information might change Physical location information might change over this time, however
over this time, however the address of the LIS does not. Thus, DHCP the address of the LIS does not. Thus, DHCP is suitable for
is suitable for configuring a device with the address of a LIS. configuring a device with the address of a LIS.
This document defines a DHCP option that produces a domain name that This document defines a DHCP option that produces a domain name that
identifies the local access network in Section 3. identifies the local access network in Section 3.
Section 4 describes a method that uses URI-enabled NAPTR (U-NAPTR) Section 4 describes a method that uses URI-enabled NAPTR (U-NAPTR)
[RFC4848], a Dynamic Delegation Discovery Service (DDDS) profile that [RFC4848], a Dynamic Delegation Discovery Service (DDDS) profile that
produces a URI for the LIS. The input to this process is provided by produces a URI for the LIS. The input to this process is provided by
the DHCP option. the DHCP option.
For the LIS discovery DDDS application, an Application Service tag For the LIS discovery DDDS application, an Application Service tag
skipping to change at page 5, line 17 skipping to change at page 5, line 17
The first URI that results in a successful response from the LIS The first URI that results in a successful response from the LIS
is used. is used.
A device MUST support discovery using the access network domain name A device MUST support discovery using the access network domain name
DHCP option (Section 3) as input to U-NAPTR resolution (Section 4). DHCP option (Section 3) as input to U-NAPTR resolution (Section 4).
If this option is not available, DHCPv4 option 15 [RFC2132] is used. If this option is not available, DHCPv4 option 15 [RFC2132] is used.
Other domain names MAY be used, as described in Section 3.4. Other domain names MAY be used, as described in Section 3.4.
A device that discovers a LIS URI MUST attempt to verify that the LIS A device that discovers a LIS URI MUST attempt to verify that the LIS
is able to provide location information. For the HELD protocol, the is able to provide location information. For the HELD protocol, the
device verifies the URI by making a location request to the LIS. If device verifies the URI by making a location request to the LIS. Any
- at any time - the LIS responds to a request with the "notLocatable" HTTP 200 response containing a HELD response signifies success. This
error code (see Section 4.3.2 of includes HELD error responses, with the exception of the
"notLocatable" error.
If - at any time - the LIS responds to a request with the
"notLocatable" error code (see Section 4.3.2 of
[I-D.ietf-geopriv-http-location-delivery]), the device MUST continue [I-D.ietf-geopriv-http-location-delivery]), the device MUST continue
or restart the discovery process. A device SHOULD NOT make further or restart the discovery process. A device SHOULD NOT make further
requests to a LIS that provides a "notLocatable" error until its requests to a LIS that provides a "notLocatable" error until its
network attachment changes, or it discovers the LIS on an alternative network attachment changes, or it discovers the LIS on an alternative
network interface. network interface.
Static configuration of a domain name or a LIS URI MAY be used. Note Static configuration of a domain name or a LIS URI MAY be used. Note
that if a device has moved from its customary location, static that if a device has moved from its customary location, static
configuration might indicate a LIS that is unable to provide accurate configuration might indicate a LIS that is unable to provide accurate
location information. location information.
skipping to change at page 6, line 20 skipping to change at page 6, line 20
V | V |
------^------- ------^------ | ------^------- ------^------ |
/ \ / 1. \ | / \ / 1. \ |
< Next interface >------->< Get domain >-----+ < Next interface >------->< Get domain >-----+
\ / Y ^ \ / N \ / Y ^ \ / N
------v------- | ------v------ ------v------- | ------v------
| N | | Y | N | | Y
| | V | | V
| | ------^------ | | ------^------
| | / 2. \ | | / 2. \
| +----< Get URI > | +----< Get URI ><----+
| | N \ / | N \ / |
| | ------v------ | ------v------ |
| | | Y | | Y |
| | V | V |
| | ------^------ | ------^------ |
| | / 3. \ | / 3. \ |
| +----< Check URI > | < Check URI >-----+
| N \ / | \ / N
| ------v------ | ------v------
| | Y | | Y
V V V V
----------- ----------- ----------- -----------
( Failure ) ( Success ) ( Failure ) ( Success )
----------- ----------- ----------- -----------
Figure 1: LIS Discovery Flowchart Figure 1: LIS Discovery Flowchart
2.1. Residential Gateways 2.1. Residential Gateways
The process described in this document is likely to fail in many The options available in residential gateways will affect the success
residential network scenarios. A fixed wireline scenario is of this algorithm in residential network scenarios. A fixed wireline
described in more detail in Section 3.1 of scenario is described in more detail in [I-D.ietf-geopriv-l7-lcp-ps],
[I-D.ietf-geopriv-l7-lcp-ps]. In this fixed wireline environment an Section 3.1. In this fixed wireline environment an intervening
intervening residential gateway exists between the device and the residential gateway exists between the device and the access network.
access network. If the residential gateway does not provide this If the residential gateway does not provide the appropriate
option to the devices it serves, those devices are unable to discover information to the devices it serves, those devices are unable to
a LIS. discover a LIS.
Support of this specification by residential gateways ensures that Support of this specification by residential gateways ensures that
the devices they serve are able to acquire location information. In the devices they serve are able to acquire location information. In
many cases the residential gateway configures the devices it serves many cases the residential gateway configures the devices it serves
using DHCP. A residential gateway is able to use DHCP to assist using DHCP. A residential gateway is able to use DHCP to assist
devices in gaining access to their location information. This can be devices in gaining access to their location information. This can be
accomplished by providing an access network domain name DHCP option accomplished by providing an access network domain name DHCP option
suitable for LIS discovery, or by acting as a LIS directly. To suitable for LIS discovery, or by acting as a LIS directly. To
actively assist devices, a residential gateway can either: actively assist devices, a residential gateway can either:
skipping to change at page 7, line 43 skipping to change at page 7, line 43
[I-D.ietf-dhc-container-opt] might be used by an access network [I-D.ietf-dhc-container-opt] might be used by an access network
provider to convey configuration information to a residential gateway provider to convey configuration information to a residential gateway
for use by the devices it serves. Support and use of this option is for use by the devices it serves. Support and use of this option is
RECOMMENDED for both residential gateways and devices. Option values RECOMMENDED for both residential gateways and devices. Option values
found within the container MUST be used after values that are found within the container MUST be used after values that are
directly in the DHCP response. directly in the DHCP response.
2.2. Virtual Private Networks (VPNs) 2.2. Virtual Private Networks (VPNs)
A Device MUST avoid performing LIS discovery over a VPN network A device MUST NOT attempt LIS discovery over a VPN network interface
interface unless discovery on other interfaces is unsuccessful. A until it has attempted and failed to perform discovery on all other
LIS discovered in this way is unlikely to have the information non-VPN interfaces. A device MAY perform discovery over a VPN
necessary to determine an accurate location. network interface if it has first attempted discovery on non-VPN
interfaces, but a LIS discovered in this way is unlikely to have the
information necessary to determine an accurate location.
Not all interfaces connected to a VPN can be detected by devices or Not all interfaces connected to a VPN can be detected by devices or
the software running on them. In these cases, it might be that a LIS the software running on them. In these cases, it might be that a LIS
on the remote side of a VPN is inadvertently discovered. A LIS MUST on the remote side of a VPN is inadvertently discovered. A LIS
NOT provide location information in response to requests that it can provides a "notLocatable" error code in response to a request that is
identify as originating from a device on the remote end of a VPN unable to fulfill (see [I-D.ietf-geopriv-http-location-delivery],
tunnel, unless it is able to accurately determine location. The Section 6.3). This ensures that even if a device discovers a LIS
"notLocatable" HELD error code can be used to indicate to a device over the VPN, it does not rely on a LIS that is unable to provide
that discovery has revealed an unsuitable LIS. This ensures that accurate location information.
even if a device discovers a LIS over the VPN, it does not rely on a
LIS that is unable to provide accurate location information.
3. Determining a Domain Name 3. Determining a Domain Name
DHCP provides a direct means for the access network provider to DHCP provides a direct means for the access network provider to
configure a device. The access network domain name option identifies configure a device. The access network domain name option identifies
a domain name that is suitable for service discovery within the a domain name that is suitable for service discovery within the
access network. This domain name is used as input to the U-NAPTR access network. This domain name is used as input to the U-NAPTR
resolution process for LIS discovery. resolution process for LIS discovery.
The domain name provided in this option is one owned by the access The domain name provided in this option is one owned by the access
skipping to change at page 8, line 42 skipping to change at page 8, line 42
The domain name is encoded according to Section 3.1 of [RFC1035]. The domain name is encoded according to Section 3.1 of [RFC1035].
Each label is represented as a one-octet length field followed by Each label is represented as a one-octet length field followed by
that number of octets. Since every domain name ends with the null that number of octets. Since every domain name ends with the null
label of the root, a domain name is terminated by a length byte of label of the root, a domain name is terminated by a length byte of
zero. The high-order two bits of every length octet MUST be zero, zero. The high-order two bits of every length octet MUST be zero,
and the remaining six bits of the length field limit the label to 63 and the remaining six bits of the length field limit the label to 63
octets or less. To simplify implementations, the total length of a octets or less. To simplify implementations, the total length of a
domain name (i.e., label octets and label length octets) is domain name (i.e., label octets and label length octets) is
restricted to 255 octets or less. restricted to 255 octets or less.
For example, the domain "example.com." is encoded in 13 octets as:
+---+---+---+---+---+---+---+---+---+---+---+---+---+
| 7 | e | x | a | m | p | l | e | 3 | c | o | m | 0 |
+---+---+---+---+---+---+---+---+---+---+---+---+---+
Note that the length field in the either option represents the length
of the entire domain name encoding, whereas the length fields in the
domain name encoding is the length of a single domain name label.
3.2. Access Network Domain Name DHCPv4 Option 3.2. Access Network Domain Name DHCPv4 Option
This section defines a DHCP for IPv4 (DHCPv4) option for the domain This section defines a DHCP for IPv4 (DHCPv4) option for the domain
name associated with the access network. name associated with the access network.
Code Len Access Network Domain Name 0 1 2 3
+-----+-----+-----+-----+-----+-----+-----+---- 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
| TBD | n | s1 | s2 | s3 | s4 | s5 | ... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-----+-----+-----+-----+-----+-----+-----+---- | Code | Length | Access Network Domain Name .
Figure 2: Access Network Domain Name DHCPv4 Option +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. Access Network Domain Name (cont.) .
. ... .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The values s1, s2, s3, etc. represent the domain name labels in the Figure 2: Access Network Domain Name DHCPv4 Option
domain name encoding. Note that the length field in the DHCPv4
option represents the length of the entire domain name encoding,
whereas the length fields in the domain name encoding (see Section 3)
is the length of a single domain name label.
Code: OPTION_V4_ACCESS_DOMAIN (TBD). [[IANA/RFC-Editor Note: Please option-code: OPTION_V4_ACCESS_DOMAIN (TBD). [[IANA/RFC-Editor Note:
replace TBD with the assigned DHCPv4 option code, both here and in Please replace TBD with the assigned DHCPv4 option code, both here
Figure 2.]] and in Figure 2.]]
Length: The length of the entire access network domain name option option-length: The length of the entire access network domain name
in octets. option in octets.
Access Network Domain Name: The domain name associated with the option-value: The domain name associated with the access network,
access network, encoded as described in Section 3.1. encoded as described in Section 3.1.
A DHCPv4 client MAY request a access network domain name option in a A DHCPv4 client MAY request a access network domain name option in a
Parameter Request List option, as described in [RFC2131]. Parameter Request List option, as described in [RFC2131].
This option contains a single domain name and, as such, MUST contain This option contains a single domain name and, as such, MUST contain
precisely one root label. precisely one root label.
3.3. Access Network Domain Name DHCPv6 Option 3.3. Access Network Domain Name DHCPv6 Option
This section defines a DHCP for IPv6 (DHCPv6) option for the domain This section defines a DHCP for IPv6 (DHCPv6) option for the domain
skipping to change at page 10, line 5 skipping to change at page 10, line 11
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3: DHCPv6 Access Network Domain Name Option Figure 3: DHCPv6 Access Network Domain Name Option
option-code: OPTION_V6_ACCESS_DOMAIN (TBD). [[IANA/RFC-Editor Note: option-code: OPTION_V6_ACCESS_DOMAIN (TBD). [[IANA/RFC-Editor Note:
Please replace TBD with the assigned DHCPv6 option code.]] Please replace TBD with the assigned DHCPv6 option code.]]
option-length: The length of the entire access network domain name option-length: The length of the entire access network domain name
option in octets. option in octets.
option-value: The access network domain name, encoded as described option-value: The domain name associated with the access network,
in Section 3.1. encoded as described in Section 3.1.
A DHCPv6 client MAY request a access network domain name option in a A DHCPv6 client MAY request a access network domain name option in a
Options Request Option (ORO), as described in [RFC3315]. Options Request Option (ORO), as described in [RFC3315].
This option contains a single domain name and, as such, MUST contain This option contains a single domain name and, as such, MUST contain
precisely one root label. precisely one root label.
3.4. Alternative Domain Names 3.4. Alternative Domain Names
The U-NAPTR resolution method described requires a domain name as The U-NAPTR resolution method described requires a domain name as
skipping to change at page 11, line 26 skipping to change at page 11, line 32
) )
zoneb.example.net. zoneb.example.net.
;; order pref flags ;; order pref flags
IN NAPTR 100 10 "" "LIS:HELD" ( ; service IN NAPTR 100 10 "" "LIS:HELD" ( ; service
"" ; regex "" ; regex
outsource.example.com. ; replacement outsource.example.com. ; replacement
) )
outsource.example.com. outsource.example.com.
;; order pref flags ;; order pref flags
IN NAPTR 100 10 "u" "LIS:HELD" ( ; service IN NAPTR 100 10 "u" "LIS:HELD" ( ; service
"!*.!https://lis.example.org:4802/?c=ex!" ; regex "!.*!https://lis.example.org:4802/?c=ex!" ; regex
. ; replacement . ; replacement
) )
Figure 4: Sample LIS:HELD Service NAPTR Records Figure 4: Sample LIS:HELD Service NAPTR Records
Details for the "LIS" Application Service tag and the "HELD" Details for the "LIS" Application Service tag and the "HELD"
Application Protocol tag are included in Section 6. Application Protocol tag are included in Section 6.
U-NAPTR resolution might produce multiple results from each iteration
of the algorithm. Order and preference values in the NAPTR record
determine which value is chosen. A device MAY attempt to use
alternative choices if the first choice is not successful. However,
if a request to the resulting URI produces a HELD "notLocatable"
response, or equivalent, the device SHOULD NOT attempt to use any
alternative choices from the same domain name.
An "https:" LIS URI that is a product of U-NAPTR MUST be An "https:" LIS URI that is a product of U-NAPTR MUST be
authenticated using the domain name method described in Section 3.1 authenticated using the domain name method described in Section 3.1
of RFC 2818 [RFC2818]. The domain name that is used in this of RFC 2818 [RFC2818]. The domain name that is used in this
authentication is the one extracted from the URI, not the input to authentication is the one extracted from the URI, not the input to
the U-NAPTR resolution process. the U-NAPTR resolution process.
5. Security Considerations 5. Security Considerations
The address of a LIS is usually well-known within an access network; The address of a LIS is usually well-known within an access network;
therefore, interception of messages does not introduce any specific therefore, interception of messages does not introduce any specific
concerns. concerns.
The primary attack against the methods described in this document is The primary attack against the methods described in this document is
one that would lead to impersonation of a LIS. The LIS is one that would lead to impersonation of a LIS. The LIS is
responsible for providing location information and this information responsible for providing location information and this information
is critical to a number of network services; furthermore, a device is critical to a number of network services; furthermore, a device
does not necessarily have a prior relationship with a LIS. Several does not necessarily have a prior relationship with a LIS. Several
methods are described here that can limit the probablity of, or methods are described here that can limit the probability of, or
provide some protection against, such an attack. These methods MUST provide some protection against, such an attack. These methods MUST
be applied unless similar protections are in place, or in cases - be applied unless similar protections are in place, or in cases -
such as an emergency - where location information of dubious origin such as an emergency - where location information of dubious origin
is arguably better than none at all. is arguably better than none at all.
An attacker could attempt to compromise LIS discovery at any of three An attacker could attempt to compromise LIS discovery at any of three
stages: stages:
1. providing a falsified domain name to be used as input to U-NAPTR 1. providing a falsified domain name to be used as input to U-NAPTR
skipping to change at page 14, line 40 skipping to change at page 15, line 7
[RFC2131] Droms, R., "Dynamic Host [RFC2131] Droms, R., "Dynamic Host
Configuration Protocol", Configuration Protocol",
RFC 2131, March 1997. RFC 2131, March 1997.
[RFC2132] Alexander, S. and R. [RFC2132] Alexander, S. and R.
Droms, "DHCP Options and Droms, "DHCP Options and
BOOTP Vendor Extensions", BOOTP Vendor Extensions",
RFC 2132, March 1997. RFC 2132, March 1997.
[RFC2616] Fielding, R., Gettys, J.,
Mogul, J., Frystyk, H.,
Masinter, L., Leach, P.,
and T. Berners-Lee,
"Hypertext Transfer
Protocol -- HTTP/1.1",
RFC 2616, June 1999.
[RFC2818] Rescorla, E., "HTTP Over [RFC2818] Rescorla, E., "HTTP Over
TLS", RFC 2818, May 2000. TLS", RFC 2818, May 2000.
[RFC3315] Droms, R., Bound, J., [RFC3315] Droms, R., Bound, J.,
Volz, B., Lemon, T., Volz, B., Lemon, T.,
Perkins, C., and M. Perkins, C., and M.
Carney, "Dynamic Host Carney, "Dynamic Host
Configuration Protocol for Configuration Protocol for
IPv6 (DHCPv6)", RFC 3315, IPv6 (DHCPv6)", RFC 3315,
July 2003. July 2003.
skipping to change at page 17, line 16 skipping to change at page 17, line 39
"Requirements for a "Requirements for a
Location-by-Reference Location-by-Reference
Mechanism", draft-ietf- Mechanism", draft-ietf-
geopriv-lbyr-requirements- geopriv-lbyr-requirements-
09 (work in progress), 09 (work in progress),
November 2009. November 2009.
Authors' Addresses Authors' Addresses
Martin Thomson Martin Thomson
Andrew Andrew Corporation
PO Box U40 Andrew Building (39)
Wollongong University Campus, NSW 2500 Wollongong University Campus
Northfields Avenue
Wollongong, NSW 2522
AU AU
Phone: +61 2 4221 2915
EMail: martin.thomson@andrew.com EMail: martin.thomson@andrew.com
URI: http://www.andrew.com/
James Winterbottom James Winterbottom
Andrew Andrew Corporation
PO Box U40 Andrew Building (39)
Wollongong University Campus, NSW 2500 Wollongong University Campus
Northfields Avenue
Wollongong, NSW 2522
AU AU
Phone: +61 2 4221 2938
EMail: james.winterbottom@andrew.com EMail: james.winterbottom@andrew.com
URI: http://www.andrew.com/
 End of changes. 32 change blocks. 
83 lines changed or deleted 112 lines changed or added

This html diff was produced by rfcdiff 1.38. The latest version is available from http://tools.ietf.org/tools/rfcdiff/