idnits 2.17.1 draft-ietf-softwire-map-dhcp-08.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (July 25, 2014) is 3563 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 3315 (Obsoleted by RFC 8415) == Outdated reference: A later version (-21) exists of draft-ietf-dhc-sedhcpv6-03 == Outdated reference: A later version (-13) exists of draft-ietf-softwire-lw4over6-03 == Outdated reference: A later version (-08) exists of draft-ietf-softwire-map-t-04 == Outdated reference: A later version (-13) exists of draft-ietf-softwire-map-08 == Outdated reference: A later version (-08) exists of draft-ietf-softwire-unified-cpe-01 -- Obsolete informational reference (is this intentional?): RFC 6145 (Obsoleted by RFC 7915) Summary: 1 error (**), 0 flaws (~~), 6 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Softwire WG T. Mrugalski 3 Internet-Draft ISC 4 Intended status: Standards Track O. Troan 5 Expires: January 26, 2015 Cisco 6 I. Farrer 7 Deutsche Telekom AG 8 S. Perreault 9 Viagenie 10 W. Dec 11 Cisco 12 C. Bao 13 Tsinghua University 14 L. Yeh 15 CNNIC 16 X. Deng 17 Yingke Law Firm 18 July 25, 2014 20 DHCPv6 Options for configuration of Softwire Address and Port Mapped 21 Clients 22 draft-ietf-softwire-map-dhcp-08 24 Abstract 26 This document specifies DHCPv6 options, termed Softwire46 options, 27 for the provisioning of Softwire46 Customer Edge (CE) devices. 28 Softwire46 is a collective term used to refer to architectures based 29 on the notion of IPv4 Address+Port (A+P) for providing IPv4 30 connectivity across an IPv6 network. 32 Status of This Memo 34 This Internet-Draft is submitted in full conformance with the 35 provisions of BCP 78 and BCP 79. 37 Internet-Drafts are working documents of the Internet Engineering 38 Task Force (IETF). Note that other groups may also distribute 39 working documents as Internet-Drafts. The list of current Internet- 40 Drafts is at http://datatracker.ietf.org/drafts/current/. 42 Internet-Drafts are draft documents valid for a maximum of six months 43 and may be updated, replaced, or obsoleted by other documents at any 44 time. It is inappropriate to use Internet-Drafts as reference 45 material or to cite them other than as "work in progress." 47 This Internet-Draft will expire on January 26, 2015. 49 Copyright Notice 51 Copyright (c) 2014 IETF Trust and the persons identified as the 52 document authors. All rights reserved. 54 This document is subject to BCP 78 and the IETF Trust's Legal 55 Provisions Relating to IETF Documents 56 (http://trustee.ietf.org/license-info) in effect on the date of 57 publication of this document. Please review these documents 58 carefully, as they describe your rights and restrictions with respect 59 to this document. Code Components extracted from this document must 60 include Simplified BSD License text as described in Section 4.e of 61 the Trust Legal Provisions and are provided without warranty as 62 described in the Simplified BSD License. 64 Table of Contents 66 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 67 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 3 68 3. Softwire46 Overview . . . . . . . . . . . . . . . . . . . . . 3 69 4. Common Softwire46 DHCPv6 Options . . . . . . . . . . . . . . 4 70 4.1. S46 Rule Option . . . . . . . . . . . . . . . . . . . . . 5 71 4.2. S46 BR Option . . . . . . . . . . . . . . . . . . . . . . 6 72 4.3. S46 DMR Option . . . . . . . . . . . . . . . . . . . . . 7 73 4.4. S46 IPv4/IPv6 Address Binding Option . . . . . . . . . . 8 74 4.5. S46 Port Parameters Option . . . . . . . . . . . . . . . 9 75 5. Softwire46 Containers . . . . . . . . . . . . . . . . . . . . 10 76 5.1. Softwire46 MAP-E Container Option . . . . . . . . . . . . 10 77 5.2. Softwire46 MAP-T Container Option . . . . . . . . . . . . 11 78 5.3. Softwire46 LightWeight 46 Container Option . . . . . . . 11 79 6. Softwire46 Options Formatting . . . . . . . . . . . . . . . . 12 80 7. DHCPv6 Server Behavior . . . . . . . . . . . . . . . . . . . 12 81 8. DHCPv6 Client Behavior . . . . . . . . . . . . . . . . . . . 13 82 9. Security Considerations . . . . . . . . . . . . . . . . . . . 13 83 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14 84 11. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 14 85 12. References . . . . . . . . . . . . . . . . . . . . . . . . . 15 86 12.1. Normative References . . . . . . . . . . . . . . . . . . 15 87 12.2. Informative References . . . . . . . . . . . . . . . . . 15 88 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 16 90 1. Introduction 92 A number of architectural solution proposals discussed in the IETF 93 Softwire Working Group use Address and Port (A+P) as their technology 94 base for providing IPv4 connectivity to end users using CE devices 95 across a Service Provider's IPv6 network, while allowing for shared 96 or dedicated IPv4 addressing of CEs. 98 An example is Mapping of Address and Port (MAP) defined in 99 [I-D.ietf-softwire-map]. The MAP solution consists of one or more 100 MAP Border Relay (BR) routers, responsible for stateless forwarding 101 between a MAP IPv6 domain and an IPv4 network, and one or more MAP 102 Customer Edge (CE) routers, responsible for forwarding between a 103 user's IPv4 network and the MAP IPv6 network domain. Collectively, 104 the MAP CE and BR form a domain when configured with common service 105 parameters. This characteristic is common to all of the Softwire46 106 mechanisms. 108 To function in such a domain, a CE needs to be provisioned with the 109 appropriate A+P service parameters for that domain. These consist 110 primarily of the CE's IPv4 address and transport layer port-range(s). 111 Furthermore, the IPv6 transport mode (i.e. encapsulation or 112 translation) needs to be specified. Provisioning of other IPv4 113 configuration information not derived directly from the A+P service 114 parameters is not covered in this document. It is expected that 115 provisioning of other IPv4 configuration will continue to use DHCPv4 116 [RFC2131]. 118 This memo specifies a set of DHCPv6 [RFC3315] options to provision 119 Softwire46 information to CE routers. Although the focus is to 120 deliver IPv4 service to an end-user network (such as a residential 121 home network), it can equally be applied to an individual host acting 122 as a CE. Configuration of the BR is out of scope of this document. 124 2. Conventions 126 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 127 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 128 document are to be interpreted as described in RFC 2119 [RFC2119]. 130 3. Softwire46 Overview 132 This document describes a set of common DHCPv6 options for 133 configuring the MAP-E [I-D.ietf-softwire-map], MAP-T 134 [I-D.ietf-softwire-map-t] and Lightweight 4over6 135 [I-D.ietf-softwire-lw4over6] mechanisms. 137 MAP-E, MAP-T and Lightweight 4over6 are essentially providing the 138 same functionality: IPv4 service to a CE router over an IPv6 only 139 access network. MAP-E and MAP-T may embed parts of the IPv4 address 140 in IPv6 prefixes, thereby supporting many clients with a fixed set of 141 mapping rules and mesh mode (direct CE to CE communication). MAP-E 142 and MAP-T CEs may also be provisioned in hub and spoke mode, and in 143 1:1 mode (with no embedded address bits). The difference between 144 MAP-E and MAP-T is that they use different means to connect to the 145 IPv6 domain. MAP-E uses RFC2473 [RFC2473] IPv4 over IPv6 tunnelling, 146 while MAP-T uses NAT64 [RFC6145] based translation. Lightweight 147 4over6 is a hub and spoke IPv4 over IPv6 tunneling mechanism, with 148 complete independence of IPv4 and IPv6 addressing (zero embedded 149 address bits). 151 The DHCP options described here tie the provisioning parameters, and 152 hence the IPv4 service itself, to the End-user IPv6 prefix lifetime. 153 The validity of a Softwire46's IPv4 address, prefix or shared IPv4 154 address, port set and any authorization and accounting are tied to 155 the lifetime of its associated End-user IPv6 prefix. 157 To support more than one mechanism at a time and to allow for a 158 possibility of transition between them, the DHCPv6 Option Request 159 Option [RFC3315] is used. Each mechanism has a corresponding DHCPv6 160 container option. A DHCPv6 client can request a particular mechanism 161 by including the option code for a particular container option in its 162 ORO option. The provisioning parameters for that mechanism are 163 expressed by embedding the common format options within the 164 respective container option. 166 This approach implies that all of the provisioning options MUST 167 appear only within the container options. The client MUST NOT 168 request any of the provisioning options directly within an ORO. 169 Likewise, the server MUST NOT send the provisioning options directly 170 within a DHCPv6 message, without encapsulation in the corresponding 171 container option. 173 The document is organized with the common sub-options described 174 first, followed by the three container options. Some sub-options are 175 mandatory in some containers, some are optional and some are not 176 permitted at all. This is shown in Table 1. 178 4. Common Softwire46 DHCPv6 Options 180 The DHCPv6 protocol is used for Softwire46 CE provisioning following 181 regular DHCPv6 notions, with the CE assuming the role of a DHCPv6 182 client, and the DHCPv6 server providing options following DHCPv6 183 server side policies. The format and usage of the options are 184 defined in the following sub-sections. 186 Each CE needs to be provisioned with enough information to calculate 187 its IPv4 address, IPv4 prefix or shared IPv4 address. MAP-E and 188 MAP-T use the OPTION_S46_RULE, while Lightweight 4over6 uses the 189 OPTION_S46_V4V6BIND option. A CE that needs to communicate outside 190 of the A+P domain also needs the address or prefix of the BR. MAP-E 191 and Lightweight 4over6 use the OPTION_S46_BR option to communicate 192 the IPv6 address of the BR. MAP-T forms an IPv6 destination address 193 by embedding an IPv4 destination address into the BR's IPv6 prefix 194 conveyed via the OPTION_S46_DMR option. Optionally, all mechanisms 195 can include OPTION_S46_PORTPARAMS to specify parameters and port sets 196 for the port range algorithm. 198 4.1. S46 Rule Option 200 Figure 1 shows the format of the S46 Rule option (OPTION_S46_RULE) 201 used for conveying the Basic Mapping Rule (BMR) and Forwarding 202 Mapping Rule (FMR). 204 A server MAY send more than one OPTION_S46_RULE option in a 205 container, if it is configured to do so. Clients MUST NOT send an 206 OPTION_S46_RULE option. 208 0 1 2 3 209 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 210 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 211 | OPTION_S46_RULE | option-length | 212 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 213 | flags | ea-len | prefix4-len | ipv4-prefix | 214 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 215 | (continued) | prefix6-len | 216 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 217 | ipv6-prefix | 218 | (variable length) | 219 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 220 | | 221 . S46_RULE-options . 222 . . 223 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 225 Figure 1: S46 Rule Option 227 o option-code: OPTION_S46_RULE (TBD1) 229 o option-length: length of the option, excluding option-code and 230 option-length fields, including length of all encapsulated 231 options, expressed in bytes. 233 o flags: 8 bits long field carrying flags applicable to the rule. 234 The meaning of specific bits are explained in Figure 2. 236 o ea-len: 8 bits long field that specifies the Embedded-Address (EA) 237 bit length. Allowed values range from 0 to 48. 239 o prefix4-len: 8 bits long field expressing the prefix length of the 240 IPv4 prefix specified in the rule-ipv4-prefix field. Valid values 241 0 to 32. 243 o ipv4-prefix: a fixed length 32 bit field that specifies the IPv4 244 prefix for the S46 rule. The bits in the prefix after prefix4-len 245 number of bits are reserved and MUST be initialized to zero by the 246 sender and ignored by the receiver. 248 o prefix6-len: 8 bits long field expressing the length of the IPv6 249 prefix specified in the rule-ipv6-prefix field. 251 o ipv6-prefix: a variable length field that specifies the IPv6 252 domain prefix for the S46 rule. The field is padded with follow 253 up zero bits up to the nearest octet boundary when prefix6-len is 254 not divisible by 8. 256 o S46_RULE-options: a variable field that may contain zero or more 257 options that specify additional parameters for this S46 rule. 258 This document specifies one such option, OPTION_S46_PORTPARAMS. 260 The Format of the S46 Rule Flags field is: 262 0 1 2 3 4 5 6 7 263 +-+-+-+-+-+-+-+-+ 264 |Reserved |F| 265 +-+-+-+-+-+-+-+-+ 267 Figure 2: S46 Rule Flags 269 o Reserved: 7-bits reserved for future use as flags. 271 o F-Flag: 1 bit field that specifies whether the rule is to be used 272 for forwarding (FMR). If set, this rule is used as a FMR, if not 273 set this rule is a BMR. Note: A BMR rule can also be an FMR rule 274 by setting the F flag. The BMR rule is determined by a match of 275 the Rule-IPv6-prefix against the CPE's prefix(es). 277 It is expected that in a typical mesh deployment scenario, there will 278 be a single BMR, which could also be designated as an FMR using the 279 F-Flag. 281 4.2. S46 BR Option 283 The S46 BR Option (OPTION_S46_BR) is used to convey the IPv6 address 284 of the Border Relay. Figure 4 shows the format of the OPTION_S46_BR 285 option. 287 0 1 2 3 288 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 289 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 290 | OPTION_S46_BR | option-length | 291 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 292 | br-ipv6-address | 293 | | 294 | | 295 | | 296 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 298 Figure 3: S46 BR Option 300 o option-code: OPTION_S46_BR (TBD2) 302 o option-length: 16 304 o br-ipv6-address: a fixed length field of 16 octets that specifies 305 the IPv6 address for the S46 BR. 307 BR redundancy can be implemented by using an anycast address for the 308 BR IPv6 address. Multiple OPTION_S46_BR options MAY be included in 309 the container; this document does not further explore the use of 310 multiple BR IPv6 addresses. 312 4.3. S46 DMR Option 314 The S46 DMR Option (OPTION_S46_DMR) is used to convey values for the 315 Default Mapping Rule (DMR). Figure 4 shows the format of the 316 OPTION_S46_DMR option used for conveying a DMR. 318 0 1 2 3 319 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 320 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 321 | OPTION_S46_DMR | option-length | 322 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 323 |dmr-prefix6-len| dmr-ipv6-prefix | 324 +-+-+-+-+-+-+-+-+ (variable length) | 325 . . 326 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 328 Figure 4: S46 DMR Option 330 o option-code: OPTION_S46_DMR (TBD3) 332 o option-length: 1 + length of dmr-ipv6-prefix specified in bytes. 334 o dmr-prefix6-len: 8 bits long field expressing the bit mask length 335 of the IPv6 prefix specified in the dmr-ipv6-prefix field. 337 o dmr-ipv6-prefix: a variable length field specifying the IPv6 338 prefix or address for the BR. This field is right padded with 339 zeros to the nearest octet boundary when dmr-prefix6-len is not 340 divisible by 8. 342 4.4. S46 IPv4/IPv6 Address Binding Option 344 The IPv4 address Option (OPTION_S46_V4V6BIND) MAY be used to specify 345 the full or shared IPv4 address of the CE. The IPv6 prefix field is 346 used by the CE to identify the correct prefix to use for the tunnel 347 source. 349 0 1 2 3 350 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 351 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 352 | OPTION_S46_V4V6BIND | option-length | 353 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 354 | ipv4-address | 355 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 356 |bindprefix6-len| bind-ipv6-prefix | 357 +-+-+-+-+-+-+-+-+ (variable length) | 358 . . 359 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 360 | | 361 . S46_V4V6BIND-options . 362 . . 363 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 365 Figure 5: S46 IPv4/IPv6 Address Binding Option 367 o option-code: OPTION_S46_V4V6BIND (TBD4) 369 o option-length: 4 371 o ipv4-address: A fixed field of 4 octets specifying an IPv4 372 address. 374 o bindprefix6-len: 8 bits long field expressing the bit mask length 375 of the IPv6 prefix specified in the bind-ipv6-prefix field. 377 o bind-ipv6-prefix: a variable length field specifying the IPv6 378 prefix or address for the S46. This field is right padded with 379 zeros to the nearest octet boundary when bindprefix6-len is not 380 divisible by 8. 382 o S46_V4V6BIND-options: a variable field that may contain zero or 383 more options that specify additional parameters. This document 384 specifies one such option, OPTION_S46_PORTPARAMS. 386 4.5. S46 Port Parameters Option 388 The Port Parameters Option (OPTION_S46_PORTPARAMS) specifies optional 389 Port Set information that MAY be provided to CEs. 391 See [I-D.ietf-softwire-map], Section 5.1 for a description of MAP 392 algorithm, explaining all of the parameters in detail. 394 0 1 2 3 395 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 396 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 397 | OPTION_S46_PORTPARAMS | option-length | 398 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 399 | offset | PSID-len | PSID | 400 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 402 Figure 6: S46 Port Parameters Option 404 o option-code: OPTION_S46_PORTPARAMS (TBD5) 406 o option-length: 4 408 o offset: (PSID offset) 8 bits long field that specifies the numeric 409 value for the S46 algorithm's excluded port range/offset bits 410 (A-bits), as per section 5.1.1 of [I-D.ietf-softwire-map]. 411 Allowed values are between 0 and 15. Default values for this 412 field are specific to the softwire mechanism being implemented and 413 are defined in the relevant specification document. 415 o PSID-len: Bit length value of the number of significant bits in 416 the PSID field. (also known as 'k'). When set to 0, the PSID 417 field is to be ignored. After the first 'a' bits, there are k 418 bits in the port number representing the value of the Port Set 419 Identifier (PSID). Consequently, the address sharing ratio would 420 be 2^k. 422 o PSID: Explicit 16-bit (unsigned word) PSID value. The PSID value 423 algorithmically identifies a set of ports assigned to a CE. The 424 first k bits on the left of this field contain the PSID value. 425 The remaining (16-k) bits on the right are padding zeros. 427 When receiving the OPTION_S46_PORTPARAMS option with an explicit 428 PSID, the client MUST use this explicit PSID in configuring its 429 softwire interface. The OPTION_S46_PORTPARAMS option with an 430 explicit PSID MUST be discarded if the softwire node isn't configured 431 with a full IPv4 address (e.g. IPv4 prefix). 433 The OPTION_S46_PORTPARAMS option with an explicit PSID MUST be 434 discarded if the softwire node isn't configured with a full IPv4 435 address (e.g. IPv4 prefix). 437 The OPTION_S46_PORTPARAMS option is contained within an 438 OPTION_S46_RULE option or an OPTION_S46_V4V6BIND option. 440 5. Softwire46 Containers 442 5.1. Softwire46 MAP-E Container Option 444 The MAP-E Container Option (OPTION_S46_CONT_MAPE) specifies the 445 container used to group all rules and optional port parameters for a 446 specified domain. 448 0 1 2 3 449 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 450 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 451 | OPTION_S46_CONT_MAPE | option-length | 452 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 453 | | 454 . encapsulated-options (variable length) . 455 . . 456 +---------------------------------------------------------------+ 458 Figure 7: MAP-E Container Option 460 o option-code: OPTION_S46_CONT_MAPE (TBD6) 462 o option-length: Length of encapsulated options 464 o encapsulated-options: options associated with this Softwire46 465 MAP-E domain. 467 The encapsulated options field conveys options specific to the 468 OPTION_S46_CONT_MAPE. Currently there are two sub-options specified, 469 OPTION_S46_RULE and OPTION_S46_BR. There MUST be at least one 470 OPTION_S46_RULE option and at least one OPTION_S46_BR option. 472 Other options applicable to a domain may be defined in the future. A 473 DHCP message MAY include multiple OPTION_S46_CONT_MAPE options 474 (representing multiple domains). 476 5.2. Softwire46 MAP-T Container Option 478 The MAP-T Container option (OPTION_S46_CONT_MAPT) specifies the 479 container used to group all rules and optional port parameters for a 480 specified domain. 482 0 1 2 3 483 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 484 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 485 | OPTION_S46_CONT_MAPT | option-length | 486 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 487 | | 488 . encapsulated-options (variable length) . 489 . . 490 +---------------------------------------------------------------+ 492 Figure 8: MAP-E Container Option 494 o option-code: OPTION_S46_CONT_MAPT (TBD7) 496 o option-length: Length of encapsulated options 498 o encapsulated-options: options associated with this Softwire46 499 MAP-T domain. 501 The encapsulated options field conveys options specific to the 502 OPTION_S46_CONT_MAPT option. Currently there are two options 503 specified, the OPTION_S46_RULE and OPTION_S46_DMR options. There 504 MUST be at least one OPTION_S46_RULE option and exactly one 505 OPTION_S46_DMR option. 507 5.3. Softwire46 LightWeight 46 Container Option 509 The LW46 Container option (OPTION_S46_CONT_LW) specifies the 510 container used to group all rules and optional port parameters for a 511 specified domain. 513 0 1 2 3 514 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 515 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 516 | OPTION_S46_CONT_LW | option-length | 517 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 518 | | 519 + encapsulated-options (variable length) . 520 . . 521 +---------------------------------------------------------------+ 523 Figure 9: LW46 Container Option 525 o option-code: OPTION_S46_CONT_LW (TBD8) 527 o option-length: Length of encapsulated options 529 o encapsulated-options: options associated with this Softwire46 530 domain. 532 The encapsulated options field conveys options specific to the 533 OPTION_S46_CONT_LW option. Currently there are two options 534 specified, OPTION_S46_V4V6BIND and OPTION_S46_BR. There MUST be at 535 most one OPTION_S46_V4V6BIND option and at least one OPTION_S46_BR 536 option. 538 6. Softwire46 Options Formatting 540 The below table shows which sub-options are mandatory, optional or 541 not permitted for each defined container option. 543 +-----------------------+-------+-------+--------------------+ 544 | Option | MAP-E | MAP-T | Lightweight 4over6 | 545 +-----------------------+-------+-------+--------------------+ 546 | OPTION_S46_RULE | M | M | N/A | 547 | | | | | 548 | OPTION_S46_BR | M | N/A | M | 549 | | | | | 550 | OPTION_S46_PORTPARAMS | O | O | O | 551 | | | | | 552 | OPTION_S46_DMR | N/A | M | N/A | 553 | | | | | 554 | OPTION_S46_V4V6BIND | N/A | N/A | O | 555 +-----------------------+-------+-------+--------------------+ 557 M - Mandatory, O - Optional, N/A - Not Applicable 559 Table 1: Option to Container Mappings 561 7. DHCPv6 Server Behavior 563 [RFC3315] Section 17.2.2 describes how a DHCPv6 client and server 564 negotiate configuration values using the ORO. As a convenience to 565 the reader, we mention here that by default, a server will not reply 566 with a Softwire46 Container Option if the client has not explicitly 567 enumerated one in its Option Request Option. 569 A CE router may support several (or all) of the mechanisms mentioned 570 here. In the case where a client requests multiple mechanisms in its 571 ORO option, the server SHOULD reply with all the corresponding 572 Softwire46 Container options. 574 8. DHCPv6 Client Behavior 576 An S46 CE acting as DHCPv6 client will request S46 configuration 577 parameters from the DHCPv6 server located in the IPv6 network. Such 578 a client SHOULD include the S46 Container option(s) that it is 579 configured for in its ORO in SOLICIT, REQUEST, RENEW, REBIND and 580 INFORMATION-REQUEST messages. 582 When processing received S46 container options the following 583 behaviour is expected: 585 o A client MUST support processing multiple received OPTION_S46_RULE 586 options in a container OPTION_S46_CONT_MAPE or 587 OPTION_S46_CONT_MAPT option 589 o A client receiving an unsupported S46 option, or an invalid 590 parameter value SHOULD discard that S46 Container option and log 591 the event. 593 The behavior of a client supporting multiple Softwire46 mechanisms, 594 is out of scope of this document. [I-D.ietf-softwire-unified-cpe] 595 describes client behaviour for the prioritization and handling of 596 multiple mechanisms simultaneously. 598 Note that system implementing CE functionality may have multiple 599 network interfaces, and these interfaces may be configured 600 differently; some may be connected to networks using a Softwire46 601 mechanism, and some may be connected to networks that are using 602 normal dual stack or other means. The CE should approach this 603 specification on an interface-by-interface basis. For example, if 604 the CE system is MAP-E capable and is attached to multiple networks 605 that provide the OPTION_S46_CONT_MAPE option, then the CE MUST 606 configure MAP-E for each interface separately. 608 9. Security Considerations 610 Section 23 of [RFC3315] discusses DHCPv6-related security issues. 612 By successfully compromising DHCPv6 server that provisions MAP 613 configuration, the attacker can influence not only IPv6 614 configuration, but also IPv4. In that sense, this widens the impact 615 in case of successful attack on clients. This affects only clients 616 that support and attempt to use MAP. 618 As with all DHCPv6-derived configuration state, it is possible that 619 configuration is actually being delivered by a third party (Man In 620 The Middle). As such, there is no basis on which access over MAP or 621 lw4o6 can be trusted. Therefore, softwires should not bypass any 622 security mechanisms such as IP firewalls. 624 In IPv6-only networks that lack any IPv4 firewalls, a device 625 supporting MAP could be tricked to enable its IPv4 stack, thus 626 exposing itself to previously infeasible IPv4 attack vectors. 628 MAP options are more complex then typical other DHCPv6 options. 629 Malicious client may repeatedly request all Softwire container 630 options to induce increased server load required for generating more 631 complex responses. For a properly implemented server this attack 632 vector should not pose significant problem. 634 Section 11 of [I-D.ietf-softwire-map] discusses security issues of 635 the MAP mechanism. 637 Readers concerned with security of MAP provisioning over DHCPv6 are 638 encouraged to read [I-D.ietf-dhc-sedhcpv6]. 640 10. IANA Considerations 642 IANA is kindly requested to allocate the following DHCPv6 option 643 codes: 645 TBD1 for OPTION_S46_RULE 647 TBD2 for OPTION_S46_BR 649 TBD3 for OPTION_S46_DMR 651 TBD4 for OPTION_S46_V4V6BIND 653 TBD5 for OPTION_S46_PORTPARAMS 655 TBD6 for OPTION_S46_CONT_MAPE 657 TBD7 for OPTION_S46_CONT_MAPT 659 TBD8 for OPTION_S46_CONT_LW 661 All values should be added to the DHCPv6 option code space defined in 662 Section 24.3 of [RFC3315]. 664 11. Acknowledgements 665 This document was created as a product of a MAP design team. 666 Following people were members of that team: Congxiao Bao, Mohamed 667 Boucadair, Gang Chen, Maoke Chen, Wojciech Dec, Xiaohong Deng, Jouni 668 Korhonen, Xing Li, Satoru Matsushima, Tomasz Mrugalski, Tetsuya 669 Murakami, Jacni Qin, Necj Scoberne, Qiong Sun, Tina Tsou, Dan Wing, 670 Leaf Yeh and Jan Zorz. 672 The authors would like to thank Bernie Volz and Tom Taylor for their 673 insightful comments and suggestions. 675 12. References 677 12.1. Normative References 679 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 680 Requirement Levels", BCP 14, RFC 2119, March 1997. 682 [RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., 683 and M. Carney, "Dynamic Host Configuration Protocol for 684 IPv6 (DHCPv6)", RFC 3315, July 2003. 686 12.2. Informative References 688 [I-D.ietf-dhc-sedhcpv6] 689 Jiang, S., Shen, S., Zhang, D., and T. Jinmei, "Secure 690 DHCPv6 with Public Key", draft-ietf-dhc-sedhcpv6-03 (work 691 in progress), June 2014. 693 [I-D.ietf-softwire-lw4over6] 694 Cui, Y., Qiong, Q., Boucadair, M., Tsou, T., Lee, Y., and 695 I. Farrer, "Lightweight 4over6: An Extension to the DS- 696 Lite Architecture", draft-ietf-softwire-lw4over6-03 (work 697 in progress), November 2013. 699 [I-D.ietf-softwire-map-t] 700 Li, X., Bao, C., Dec, W., Troan, O., Matsushima, S., and 701 T. Murakami, "Mapping of Address and Port using 702 Translation (MAP-T)", draft-ietf-softwire-map-t-04 (work 703 in progress), September 2013. 705 [I-D.ietf-softwire-map] 706 Troan, O., Dec, W., Li, X., Bao, C., Matsushima, S., 707 Murakami, T., and T. Taylor, "Mapping of Address and Port 708 with Encapsulation (MAP)", draft-ietf-softwire-map-08 709 (work in progress), August 2013. 711 [I-D.ietf-softwire-unified-cpe] 712 Boucadair, M., Farrer, I., Perreault, S., and S. 713 Sivakumar, "Unified IPv4-in-IPv6 Softwire CPE", draft- 714 ietf-softwire-unified-cpe-01 (work in progress), May 2013. 716 [RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC 717 2131, March 1997. 719 [RFC2473] Conta, A. and S. Deering, "Generic Packet Tunneling in 720 IPv6 Specification", RFC 2473, December 1998. 722 [RFC6145] Li, X., Bao, C., and F. Baker, "IP/ICMP Translation 723 Algorithm", RFC 6145, April 2011. 725 Authors' Addresses 727 Tomasz Mrugalski 728 Internet Systems Consortium, Inc. 729 950 Charter Street 730 Redwood City, CA 94063 731 USA 733 Phone: +1 650 423 1345 734 Email: tomasz.mrugalski@gmail.com 735 URI: http://www.isc.org/ 737 Ole Troan 738 Cisco Systems, Inc. 739 Philip Pedersens vei 1 740 Lysaker 1366 741 Norway 743 Email: ot@cisco.com 745 Ian Farrer 746 Deutsche Telekom AG 747 CTO-ATI, Landgrabenweg 151 748 Bonn, NRW 53227 749 Germany 751 Email: ian.farrer@telekom.de 752 Simon Perreault 753 Viagenie 754 246 Aberdeen 755 Quebec, QC G1R 2E1 756 Canada 758 Phone: +1 418 656 9254 759 Email: simon.perreault@viagenie.ca 761 Wojciech Dec 762 Cisco Systems, Inc. 763 The Netherlands 765 Email: wdec@cisco.com 766 URI: http://cisco.com 768 Congxiao Bao 769 CERNET Center/Tsinghua University 770 Room 225, Main Building, Tsinghua University 771 Beijing 100084 772 CN 774 Phone: +86 10-62785983 775 Email: congxiao@cernet.edu.cn 777 Leaf Y. Yeh 778 CNNIC 779 4, South 4th Street, Zhong_Guan_Cun 780 Beijing 100190 781 P. R. China 783 Email: leaf.yeh.sdo@gmail.com 785 Xiaohong Deng 786 Yingke Law Firm 787 6 Floor, C Block, DaCheng International Center Chaoyang District 788 Beijing 100124 789 China 791 Phone: +61 3858 3128 792 Email: dxhbupt@gmail.com