1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
|
<pre>Internet Engineering Task Force (IETF) M. Thomson
Request for Comments: 5986 J. Winterbottom
Category: Standards Track Andrew Corporation
ISSN: 2070-1721 September 2010
<span class="h1">Discovering the Local Location Information Server (LIS)</span>
Abstract
Discovery of the correct Location Information Server (LIS) in the
local access network is necessary for Devices that wish to acquire
location information from the network. A method is described for the
discovery of a LIS in the access network serving a Device. Dynamic
Host Configuration Protocol (DHCP) options for IP versions 4 and 6
are defined that specify a domain name. This domain name is then
used as input to a URI-enabled NAPTR (U-NAPTR) resolution process.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in <a href="./rfc5741#section-2">Section 2 of RFC 5741</a>.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
<a href="http://www.rfc-editor.org/info/rfc5986">http://www.rfc-editor.org/info/rfc5986</a>.
Copyright Notice
Copyright (c) 2010 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
Provisions Relating to IETF Documents
(<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
<span class="grey">Thomson & Winterbottom Standards Track [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
Table of Contents
<a href="#section-1">1</a>. Introduction and Overview . . . . . . . . . . . . . . . . . . <a href="#page-2">2</a>
<a href="#section-1.1">1.1</a>. Discovery Procedure Overview . . . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-1.2">1.2</a>. Terminology . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-2">2</a>. LIS Discovery Procedure . . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2.1">2.1</a>. Residential Gateways . . . . . . . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-2.2">2.2</a>. Virtual Private Networks (VPNs) . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-3">3</a>. Determining a Domain Name . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-3.1">3.1</a>. Domain Name Encoding . . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-3.2">3.2</a>. Access Network Domain Name DHCPv4 Option . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-3.3">3.3</a>. Access Network Domain Name DHCPv6 Option . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-3.4">3.4</a>. Alternative Domain Names . . . . . . . . . . . . . . . . . <a href="#page-9">9</a>
<a href="#section-4">4</a>. U-NAPTR Resolution of a LIS URI . . . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#section-5">5</a>. Security Considerations . . . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
<a href="#section-6">6</a>. IANA Considerations . . . . . . . . . . . . . . . . . . . . . <a href="#page-13">13</a>
<a href="#section-6.1">6.1</a>. Registration of DHCPv4 and DHCPv6 Option Codes . . . . . . <a href="#page-13">13</a>
6.2. Registration of a Location Server Application Service
Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-13">13</a>
6.3. Registration of a Location Server Application Protocol
Tag for HELD . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-13">13</a>
<a href="#section-7">7</a>. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-14">14</a>
<a href="#section-8">8</a>. References . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-14">14</a>
<a href="#section-8.1">8.1</a>. Normative References . . . . . . . . . . . . . . . . . . . <a href="#page-14">14</a>
<a href="#section-8.2">8.2</a>. Informative References . . . . . . . . . . . . . . . . . . <a href="#page-15">15</a>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction and Overview</span>
The location of a Device is a useful and sometimes necessary part of
many services. A Location Information Server (LIS) is responsible
for providing that location information to Devices with attached
access networks used to provide Internet access. The LIS uses
knowledge of the access network and its physical topology to generate
and serve location information to Devices.
Each access network requires specific knowledge about topology.
Therefore, it is important to discover the LIS that has the specific
knowledge necessary to locate a Device, that is, the LIS that serves
the current access network. Automatic discovery is important where
there is any chance of movement outside a single access network.
Reliance on static configuration can lead to unexpected errors if a
Device moves between access networks.
This document describes a process that a Device can use to discover a
LIS. This process uses a DHCP option and the DNS. The product of
this discovery process is an HTTP [<a href="./rfc2616" title=""Hypertext Transfer Protocol -- HTTP/1.1"">RFC2616</a>] or HTTPS [<a href="./rfc2818" title=""HTTP Over TLS"">RFC2818</a>] URI
that identifies a LIS.
<span class="grey">Thomson & Winterbottom Standards Track [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
The URI result from the discovery process is suitable for location
configuration only; that is, the Device MUST dereference the URI
using the process described in HTTP-Enabled Location Delivery (HELD)
[<a href="./rfc5985" title=""HTTP-Enabled Location Delivery (HELD)"">RFC5985</a>]. URIs discovered in this way are not "location URIs"
[<a href="./rfc5808" title=""Requirements for a Location-by-Reference Mechanism"">RFC5808</a>]; dereferencing one of them provides the location of the
requestor only. Devices MUST NOT embed these URIs in fields in other
protocols designed to carry the location of the Device.
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>. Discovery Procedure Overview</span>
DHCP ([<a href="./rfc2131" title=""Dynamic Host Configuration Protocol"">RFC2131</a>], [<a href="./rfc3315" title=""Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"">RFC3315</a>]) is a commonly used mechanism for
providing bootstrap configuration information that allows a Device to
operate in a specific network environment. The DHCP information is
largely static, consisting of configuration information that does not
change over the period that the Device is attached to the network.
Physical location information might change over this time; however,
the address of the LIS does not. Thus, DHCP is suitable for
configuring a Device with the address of a LIS.
This document defines a DHCP option that produces a domain name that
identifies the local access network in <a href="#section-3">Section 3</a>.
<a href="#section-4">Section 4</a> describes a method that uses URI-enabled NAPTR (U-NAPTR)
[<a href="./rfc4848" title=""Domain-Based Application Service Location Using URIs and the Dynamic Delegation Discovery Service (DDDS)"">RFC4848</a>], a Dynamic Delegation Discovery Service (DDDS) profile that
produces a URI for the LIS. The input to this process is provided by
the DHCP option.
For the LIS discovery DDDS application, an Application Service tag
"LIS" and an Application Protocol tag "HELD" have been created and
registered with the IANA. Based on the domain name, this U-NAPTR
application uses the two tags to determine a URI for a LIS that
supports the HELD protocol.
<span class="h3"><a class="selflink" id="section-1.2" href="#section-1.2">1.2</a>. Terminology</span>
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
This document also uses the term "Device" to refer to an end host or
client consistent with its use in HELD. In HELD and <a href="./rfc3693">RFC 3693</a>
[<a href="./rfc3693" title=""Geopriv Requirements"">RFC3693</a>] parlance, the Device is also the Target.
The term "access network" refers to the network to which a Device
connects for Internet access. The "access network provider" is the
entity that operates the access network. This is consistent with the
definition in [<a href="./rfc5687" title=""GEOPRIV Layer 7 Location Configuration Protocol: Problem Statement and Requirements"">RFC5687</a>], which combines the Internet Access Provider
<span class="grey">Thomson & Winterbottom Standards Track [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
(IAP) and Internet Service Provider (ISP). The access network
provider is responsible for allocating the Device a public IP address
and for directly or indirectly providing a LIS service.
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. LIS Discovery Procedure</span>
A Device that has multiple network interfaces could potentially be
served by a different access network on each interface, each with a
different LIS. The Device SHOULD attempt to discover the LIS
applicable to each network interface, stopping when a LIS is
successfully discovered on any interface.
The LIS discovery procedure follows this process:
1. Acquire the access network domain name (<a href="#section-3">Section 3</a>).
This process might be repeated for each of the network interfaces
on the Device. Domain names acquired from other sources might
also be added.
2. Apply U-NAPTR resolution (<a href="#section-4">Section 4</a>) to discover a LIS URI.
The U-NAPTR process is applied using each of the domain names as
input.
3. Verify that the LIS is able to provide location information.
The first URI that results in a successful response from the LIS
is used.
A Device MUST support discovery using the access network domain name
DHCP option (<a href="#section-3">Section 3</a>) as input to U-NAPTR resolution (<a href="#section-4">Section 4</a>).
If this option is not available, DHCPv4 option 15 [<a href="./rfc2132" title=""DHCP Options and BOOTP Vendor Extensions"">RFC2132</a>] is used.
Other domain names MAY be used, as described in <a href="#section-3.4">Section 3.4</a>.
A Device that discovers a LIS URI MUST attempt to verify that the LIS
is able to provide location information. For the HELD protocol, the
Device verifies the URI by making a location request to the LIS. Any
HTTP 200 response containing a HELD response signifies success. This
includes HELD error responses, with the exception of the
"notLocatable" error.
If -- at any time -- the LIS responds to a request with the
"notLocatable" error code (see <a href="./rfc5985#section-4.3.2">Section 4.3.2 of [RFC5985]</a>), the
Device MUST continue or restart the discovery process. A Device
SHOULD NOT make further requests to a LIS that provides a
"notLocatable" error until its network attachment changes, or it
discovers the LIS on an alternative network interface.
<span class="grey">Thomson & Winterbottom Standards Track [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
Static configuration of a domain name or a LIS URI MAY be used. Note
that if a Device has moved from its customary location, static
configuration might indicate a LIS that is unable to provide accurate
location information.
The product of the LIS discovery process for HELD is an HTTPS or HTTP
URI. Nothing distinguishes this URI from other URIs with the same
scheme, aside from the fact that it is the product of this process.
Only URIs produced by the discovery process can be used for location
configuration using HELD.
The overall discovery process is summarized in Figure 1.
-----------
( Start )
-----+-----
|<--------------------------------------+
| |
V |
------^------- ------^------ |
/ \ / 1. \ |
< Next interface >------->< Get domain >-----+
\ / Y ^ \ / N
------v------- | ------v------
| N | | Y
| | V
| | ------^------
| | / 2. \
| +----< Get URI ><----+
| N \ / |
| ------v------ |
| | Y |
| V |
| ------^------ |
| / 3. \ |
| < Check URI >-----+
| \ / N
| ------v------
| | Y
V V
----------- -----------
( Failure ) ( Success )
----------- -----------
Figure 1: LIS Discovery Flowchart
<span class="grey">Thomson & Winterbottom Standards Track [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a>. Residential Gateways</span>
The options available in residential gateways will affect the success
of this algorithm in residential network scenarios. A fixed wireline
scenario is described in more detail in <a href="./rfc5687#section-3.1">[RFC5687], Section 3.1</a>. In
this fixed wireline environment, an intervening residential gateway
exists between the Device and the access network. If the residential
gateway does not provide the appropriate information to the Devices
it serves, those Devices are unable to discover a LIS.
Support of this specification by residential gateways ensures that
the Devices they serve are able to acquire location information. In
many cases, the residential gateway configures the Devices it serves
using DHCP. A residential gateway is able to use DHCP to assist
Devices in gaining access to their location information. This can be
accomplished by providing an access network domain name DHCP option
suitable for LIS discovery, or by acting as a LIS directly. To
actively assist Devices, a residential gateway can either:
o acquire an access network domain name from the access network
provider (possibly using DHCP) and pass the resulting value to
Devices; or
o discover a LIS on its external interface, then provide Devices
with the domain name that was used to successfully discover the
LIS; or
o explicitly include configuration that refers to a particular LIS;
or
o act as a LIS and directly provide location information to the
Devices it serves, including providing a means to discover this
service.
As with Devices, configuration of a specific domain name or location
information is only accurate as long as the residential gateway does
not move. If a residential gateway that relies on configuration
rather than automatic discovery is moved, the Devices it serves could
be provided with inaccurate information. Devices could be led to
discover a LIS that is unable to provide accurate location
information, or -- if location is configured on the residential
gateway -- the residential gateway could provide incorrect location
information.
<span class="grey">Thomson & Winterbottom Standards Track [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
<span class="h3"><a class="selflink" id="section-2.2" href="#section-2.2">2.2</a>. Virtual Private Networks (VPNs)</span>
A Device MUST NOT attempt LIS discovery over a VPN network interface
until it has attempted and failed to perform discovery on all other
non-VPN interfaces. A Device MAY perform discovery over a VPN
network interface if it has first attempted discovery on non-VPN
interfaces, but a LIS discovered in this way is unlikely to have the
information necessary to determine an accurate location.
Not all interfaces connected to a VPN can be detected by Devices or
the software running on them. In these cases, it might be that a LIS
on the remote side of a VPN is inadvertently discovered. A LIS
provides a "notLocatable" error code in response to a request that it
is unable to fulfill (see <a href="./rfc5985#section-6.3">[RFC5985], Section 6.3</a>). This ensures that
even if a Device discovers a LIS over the VPN, it does not rely on a
LIS that is unable to provide accurate location information.
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Determining a Domain Name</span>
DHCP provides a direct means for the access network provider to
configure a Device. The access network domain name option identifies
a domain name that is suitable for service discovery within the
access network. This domain name is used as input to the U-NAPTR
resolution process for LIS discovery.
The domain name provided in this option is one owned by the access
network operator. This domain name is intended for use in
discovering services within the access network.
This document registers a DHCP option for the access network domain
name for both IPv4 and IPv6.
<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a>. Domain Name Encoding</span>
This section describes the encoding of the domain name used in the
DHCPv4 option defined in <a href="#section-3.2">Section 3.2</a> and also used in the DHCPv6
option defined in <a href="#section-3.3">Section 3.3</a>.
The domain name is encoded according to <a href="./rfc1035#section-3.1">Section 3.1 of [RFC1035]</a>.
Each label is represented as a one-octet length field followed by
that number of octets. Since every domain name ends with the null
label of the root, a domain name is terminated by a length byte of
zero. The high-order two bits of every length octet MUST be zero,
and the remaining six bits of the length field limit the label to 63
octets or less. To simplify implementations, the total length of a
domain name (i.e., label octets and label length octets) is
restricted to 255 octets or less.
<span class="grey">Thomson & Winterbottom Standards Track [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
For example, the domain "example.com." is encoded in 13 octets as:
+---+---+---+---+---+---+---+---+---+---+---+---+---+
| 7 | e | x | a | m | p | l | e | 3 | c | o | m | 0 |
+---+---+---+---+---+---+---+---+---+---+---+---+---+
Note that the length field in either option represents the length of
the entire domain name encoding, whereas the length fields in the
domain name encoding is the length of a single domain name label.
<span class="h3"><a class="selflink" id="section-3.2" href="#section-3.2">3.2</a>. Access Network Domain Name DHCPv4 Option</span>
This section defines a DHCP for IPv4 (DHCPv4) option for the domain
name associated with the access network.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code | Length | Access Network Domain Name .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. Access Network Domain Name (cont.) .
. ... .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: Access Network Domain Name DHCPv4 Option
option-code: OPTION_V4_ACCESS_DOMAIN (213).
option-length: The length of the entire access network domain name
option in octets.
option-value: The domain name associated with the access network,
encoded as described in <a href="#section-3.1">Section 3.1</a>.
A DHCPv4 client MAY request an access network domain name option in a
Parameter Request List option, as described in [<a href="./rfc2131" title=""Dynamic Host Configuration Protocol"">RFC2131</a>].
This option contains a single domain name and, as such, MUST contain
precisely one root label.
<span class="h3"><a class="selflink" id="section-3.3" href="#section-3.3">3.3</a>. Access Network Domain Name DHCPv6 Option</span>
This section defines a DHCP for IPv6 (DHCPv6) option for the domain
name associated with the access network. The DHCPv6 option for this
parameter is similarly formatted to the DHCPv4 option.
<span class="grey">Thomson & Winterbottom Standards Track [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_V6_ACCESS_DOMAIN | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. Access Network Domain Name .
. ... .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3: DHCPv6 Access Network Domain Name Option
option-code: OPTION_V6_ACCESS_DOMAIN (57).
option-length: The length of the entire access network domain name
option in octets.
option-value: The domain name associated with the access network,
encoded as described in <a href="#section-3.1">Section 3.1</a>.
A DHCPv6 client MAY request an access network domain name option in
an Options Request Option (ORO), as described in [<a href="./rfc3315" title=""Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"">RFC3315</a>].
This option contains a single domain name and, as such, MUST contain
precisely one root label.
<span class="h3"><a class="selflink" id="section-3.4" href="#section-3.4">3.4</a>. Alternative Domain Names</span>
The U-NAPTR resolution method described requires a domain name as
input. The access network domain name DHCP options (Sections <a href="#section-3.2">3.2</a> and
3.3) are one source of this domain name.
If a Device knows one or more alternative domain names that might be
used for discovery, it MAY repeat the U-NAPTR process using those
domain names as input. For instance, static configuration of a
Device might be used to provide a Device with a domain name.
DHCPv4 option 15 [<a href="./rfc2132" title=""DHCP Options and BOOTP Vendor Extensions"">RFC2132</a>] provides an indication of the domain name
that a host uses when resolving hostnames in DNS. This option is
used when the DHCPv4 access domain name is not available.
DHCPv4 option 15 might not be suitable for some network deployments.
For instance, a global enterprise could operate multiple sites, with
Devices at all sites using the same value for option 15. In this
type of deployment, it might be desirable to discover a LIS local to
a site. The access domain name option can be given a different value
at each site to enable discovery of a LIS at that site.
<span class="grey">Thomson & Winterbottom Standards Track [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
Alternative domain names MUST NOT be used unless the access network
domain name option is unsuccessful or where external information
indicates that a particular domain name is to be used.
Other domain names might be provided by a DHCP server (for example,
[<a href="./rfc4702" title=""The Dynamic Host Configuration Protocol (DHCP) Client Fully Qualified Domain Name (FQDN) Option"">RFC4702</a>] for DHCPv4, [<a href="./rfc4704" title=""The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) Client Fully Qualified Domain Name (FQDN) Option"">RFC4704</a>] for DHCPv6). However, these domain
names could be provided without considering their use for LIS
discovery; therefore, it is not likely that these other domain names
contain useful values.
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. U-NAPTR Resolution of a LIS URI</span>
U-NAPTR [<a href="./rfc4848" title=""Domain-Based Application Service Location Using URIs and the Dynamic Delegation Discovery Service (DDDS)"">RFC4848</a>] resolution for a LIS takes a domain name as input
and produces a URI that identifies the LIS. This process also
requires an Application Service tag and an Application Protocol tag,
which differentiate LIS-related NAPTR records from other records for
that domain.
<a href="#section-6.2">Section 6.2</a> defines an Application Service tag of "LIS", which is
used to identify the location service for a given domain. The
Application Protocol tag "HELD", defined in <a href="#section-6.3">Section 6.3</a>, is used to
identify a LIS that understands the HELD protocol [<a href="./rfc5985" title=""HTTP-Enabled Location Delivery (HELD)"">RFC5985</a>].
The NAPTR records in the following example demonstrate the use of the
Application Service and Protocol tags. Iterative NAPTR resolution is
used to delegate responsibility for the LIS service from
"zonea.example.net." and "zoneb.example.net." to
"outsource.example.com.".
<span class="grey">Thomson & Winterbottom Standards Track [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
zonea.example.net.
;; order pref flags
IN NAPTR 100 10 "" "LIS:HELD" ( ; service
"" ; regex
outsource.example.com. ; replacement
)
zoneb.example.net.
;; order pref flags
IN NAPTR 100 10 "" "LIS:HELD" ( ; service
"" ; regex
outsource.example.com. ; replacement
)
outsource.example.com.
;; order pref flags
IN NAPTR 100 10 "u" "LIS:HELD" ( ; service
"!.*!https://lis.example.org:4802/?c=ex!" ; regex
. ; replacement
)
Figure 4: Sample LIS:HELD Service NAPTR Records
Details for the "LIS" Application Service tag and the "HELD"
Application Protocol tag are included in <a href="#section-6">Section 6</a>.
U-NAPTR resolution might produce multiple results from each iteration
of the algorithm. Order and preference values in the NAPTR record
determine which value is chosen. A Device MAY attempt to use
alternative choices if the first choice is not successful. However,
if a request to the resulting URI produces a HELD "notLocatable"
response, or equivalent, the Device SHOULD NOT attempt to use any
alternative choices from the same domain name.
An HTTPS LIS URI that is a product of U-NAPTR MUST be authenticated
using the domain name method described in <a href="./rfc2818#section-3.1">Section 3.1 of RFC 2818</a>
[<a href="./rfc2818" title=""HTTP Over TLS"">RFC2818</a>]. The domain name that is used in this authentication is
the one extracted from the URI, not the one that was input to the
U-NAPTR resolution process.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Security Considerations</span>
The address of a LIS is usually well-known within an access network;
therefore, interception of messages does not introduce any specific
concerns.
The primary attack against the methods described in this document is
one that would lead to impersonation of a LIS. The LIS is
responsible for providing location information, and this information
is critical to a number of network services; furthermore, a Device
<span class="grey">Thomson & Winterbottom Standards Track [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
does not necessarily have a prior relationship with a LIS. Several
methods are described here that can limit the probability of, or
provide some protection against, such an attack. These methods MUST
be applied unless similar protections are in place, or in cases --
such as an emergency -- where location information of dubious origin
is arguably better than none at all.
An attacker could attempt to compromise LIS discovery at any of three
stages:
1. providing a falsified domain name to be used as input to U-NAPTR
2. altering the DNS records used in U-NAPTR resolution
3. impersonating the LIS
The domain name that used to authenticate the LIS is the domain name
input to the U-NAPTR process, not the output of that process
[<a href="./rfc3958" title=""Domain-Based Application Service Location Using SRV RRs and the Dynamic Delegation Discovery Service (DDDS)"">RFC3958</a>], [<a href="./rfc4848" title=""Domain-Based Application Service Location Using URIs and the Dynamic Delegation Discovery Service (DDDS)"">RFC4848</a>]. As a result, the results of DNS queries do not
need integrity protection.
An HTTPS URI is authenticated using the method described in <a href="./rfc2818#section-3.1">Section</a>
<a href="./rfc2818#section-3.1">3.1 of [RFC2818]</a>. HTTP client implementations frequently do not
provide a means to authenticate based on a domain name other than the
one indicated in the request URI, namely the U-NAPTR output. To
avoid having to authenticate the LIS with a domain name that is
different from the one used to identify it, a client MAY choose to
reject URIs that contain a domain name that is different to the
U-NAPTR input. To support endpoints that enforce the above
restriction on URIs, network administrators SHOULD ensure that the
domain name in the DHCP option is the same as the one contained in
the resulting URI.
Authentication of a LIS relies on the integrity of the domain name
acquired from DHCP. An attacker that is able to falsify a domain
name circumvents the protections provided. To ensure that the access
network domain name DHCP option can be relied upon, preventing DHCP
messages from being modified or spoofed by attackers is necessary.
Physical- or link-layer security are commonly used to reduce the
possibility of such an attack within an access network. DHCP
authentication [<a href="./rfc3118" title=""Authentication for DHCP Messages"">RFC3118</a>] might also provide a degree of protection
against modification or spoofing.
A LIS that is identified by an HTTP URI cannot be authenticated. Use
of unsecured HTTP also does not meet requirements in HELD for
confidentiality and integrity. If an HTTP URI is the product of LIS
<span class="grey">Thomson & Winterbottom Standards Track [Page 12]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-13" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
discovery, this leaves Devices vulnerable to several attacks. Lower-
layer protections, such as Layer 2 traffic separation might be used
to provide some guarantees.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. IANA Considerations</span>
<span class="h3"><a class="selflink" id="section-6.1" href="#section-6.1">6.1</a>. Registration of DHCPv4 and DHCPv6 Option Codes</span>
The IANA has assigned an option code of 213 for the DHCPv4 option for
an access network domain name option, as described in <a href="#section-3.2">Section 3.2</a> of
this document.
The IANA has assigned an option code of 57 for the DHCPv6 option for
an access network domain name option, as described in <a href="#section-3.3">Section 3.3</a> of
this document.
<span class="h3"><a class="selflink" id="section-6.2" href="#section-6.2">6.2</a>. Registration of a Location Server Application Service Tag</span>
This section registers a new S-NAPTR/U-NAPTR Application Service tag
for LIS, as mandated by [<a href="./rfc3958" title=""Domain-Based Application Service Location Using SRV RRs and the Dynamic Delegation Discovery Service (DDDS)"">RFC3958</a>].
Application Service Tag: LIS
Intended usage: Identifies a service that provides a Device with its
location information.
Defining publication: <a href="./rfc5986">RFC 5986</a>
Related publications: HELD [<a href="./rfc5985" title=""HTTP-Enabled Location Delivery (HELD)"">RFC5985</a>]
Contact information: The authors of this document
Author/Change controller: The IESG
<span class="h3"><a class="selflink" id="section-6.3" href="#section-6.3">6.3</a>. Registration of a Location Server Application Protocol Tag for</span>
<span class="h3"> HELD</span>
This section registers a new S-NAPTR/U-NAPTR Application Protocol tag
for the HELD protocol [<a href="./rfc5985" title=""HTTP-Enabled Location Delivery (HELD)"">RFC5985</a>], as mandated by [<a href="./rfc3958" title=""Domain-Based Application Service Location Using SRV RRs and the Dynamic Delegation Discovery Service (DDDS)"">RFC3958</a>].
Application Protocol Tag: HELD
Intended Usage: Identifies the HELD protocol.
Applicable Service Tag(s): LIS
Terminal NAPTR Record Type(s): U
<span class="grey">Thomson & Winterbottom Standards Track [Page 13]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-14" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
Defining Publication: <a href="./rfc5986">RFC 5986</a>
Related Publications: HELD [<a href="./rfc5985" title=""HTTP-Enabled Location Delivery (HELD)"">RFC5985</a>]
Contact Information: The authors of this document
Author/Change Controller: The IESG
<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>. Acknowledgements</span>
This document uses a mechanism that is largely identical to that in
[<a href="./rfc5222" title=""LoST: A Location-to-Service Translation Protocol"">RFC5222</a>] and [<a href="./rfc5223" title=""Discovering Location-to-Service Translation (LoST) Servers Using the Dynamic Host Configuration Protocol (DHCP)"">RFC5223</a>]. The authors would like to thank Leslie
Daigle for her work on U-NAPTR; Peter Koch for feedback on how not to
use DNS for discovery; Andy Newton for constructive suggestions with
regards to document direction; Richard Barnes, Joe Salowey, Barbara
Stark, and Hannes Tschofenig for input and reviews; and Dean Willis
for constructive feedback.
<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>. References</span>
<span class="h3"><a class="selflink" id="section-8.1" href="#section-8.1">8.1</a>. Normative References</span>
[<a id="ref-RFC1035">RFC1035</a>] Mockapetris, P., "Domain names - implementation and
specification", STD 13, <a href="./rfc1035">RFC 1035</a>, November 1987.
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.
[<a id="ref-RFC2131">RFC2131</a>] Droms, R., "Dynamic Host Configuration Protocol",
<a href="./rfc2131">RFC 2131</a>, March 1997.
[<a id="ref-RFC2132">RFC2132</a>] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor
Extensions", <a href="./rfc2132">RFC 2132</a>, March 1997.
[<a id="ref-RFC2616">RFC2616</a>] Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext
Transfer Protocol -- HTTP/1.1", <a href="./rfc2616">RFC 2616</a>, June 1999.
[<a id="ref-RFC2818">RFC2818</a>] Rescorla, E., "HTTP Over TLS", <a href="./rfc2818">RFC 2818</a>, May 2000.
[<a id="ref-RFC3315">RFC3315</a>] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C.,
and M. Carney, "Dynamic Host Configuration Protocol for
IPv6 (DHCPv6)", <a href="./rfc3315">RFC 3315</a>, July 2003.
[<a id="ref-RFC4033">RFC4033</a>] Arends, R., Austein, R., Larson, M., Massey, D., and S.
Rose, "DNS Security Introduction and Requirements",
<a href="./rfc4033">RFC 4033</a>, March 2005.
<span class="grey">Thomson & Winterbottom Standards Track [Page 14]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-15" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
[<a id="ref-RFC4702">RFC4702</a>] Stapp, M., Volz, B., and Y. Rekhter, "The Dynamic Host
Configuration Protocol (DHCP) Client Fully Qualified
Domain Name (FQDN) Option", <a href="./rfc4702">RFC 4702</a>, October 2006.
[<a id="ref-RFC4704">RFC4704</a>] Volz, B., "The Dynamic Host Configuration Protocol for
IPv6 (DHCPv6) Client Fully Qualified Domain Name (FQDN)
Option", <a href="./rfc4704">RFC 4704</a>, October 2006.
[<a id="ref-RFC4848">RFC4848</a>] Daigle, L., "Domain-Based Application Service Location
Using URIs and the Dynamic Delegation Discovery Service
(DDDS)", <a href="./rfc4848">RFC 4848</a>, April 2007.
[<a id="ref-RFC5985">RFC5985</a>] Barnes, M., Ed., "HTTP-Enabled Location Delivery (HELD)",
<a href="./rfc5985">RFC 5985</a>, September 2010.
<span class="h3"><a class="selflink" id="section-8.2" href="#section-8.2">8.2</a>. Informative References</span>
[<a id="ref-RFC3118">RFC3118</a>] Droms, R. and W. Arbaugh, "Authentication for DHCP
Messages", <a href="./rfc3118">RFC 3118</a>, June 2001.
[<a id="ref-RFC3693">RFC3693</a>] Cuellar, J., Morris, J., Mulligan, D., Peterson, J., and
J. Polk, "Geopriv Requirements", <a href="./rfc3693">RFC 3693</a>, February 2004.
[<a id="ref-RFC3958">RFC3958</a>] Daigle, L. and A. Newton, "Domain-Based Application
Service Location Using SRV RRs and the Dynamic Delegation
Discovery Service (DDDS)", <a href="./rfc3958">RFC 3958</a>, January 2005.
[<a id="ref-RFC5222">RFC5222</a>] Hardie, T., Newton, A., Schulzrinne, H., and H.
Tschofenig, "LoST: A Location-to-Service Translation
Protocol", <a href="./rfc5222">RFC 5222</a>, August 2008.
[<a id="ref-RFC5223">RFC5223</a>] Schulzrinne, H., Polk, J., and H. Tschofenig, "Discovering
Location-to-Service Translation (LoST) Servers Using the
Dynamic Host Configuration Protocol (DHCP)", <a href="./rfc5223">RFC 5223</a>,
August 2008.
[<a id="ref-RFC5687">RFC5687</a>] Tschofenig, H. and H. Schulzrinne, "GEOPRIV Layer 7
Location Configuration Protocol: Problem Statement and
Requirements", <a href="./rfc5687">RFC 5687</a>, March 2010.
[<a id="ref-RFC5808">RFC5808</a>] Marshall, R., "Requirements for a Location-by-Reference
Mechanism", <a href="./rfc5808">RFC 5808</a>, May 2010.
<span class="grey">Thomson & Winterbottom Standards Track [Page 15]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-16" ></span>
<span class="grey"><a href="./rfc5986">RFC 5986</a> LIS Discovery September 2010</span>
Authors' Addresses
Martin Thomson
Andrew Corporation
Andrew Building (39)
Wollongong University Campus
Northfields Avenue
Wollongong, NSW 2522
AU
Phone: +61 2 4221 2915
EMail: martin.thomson@andrew.com
James Winterbottom
Andrew Corporation
Andrew Building (39)
Wollongong University Campus
Northfields Avenue
Wollongong, NSW 2522
AU
Phone: +61 2 4221 2938
EMail: james.winterbottom@andrew.com
Thomson & Winterbottom Standards Track [Page 16]
</pre>
|
