idnits 2.17.1 draft-ietf-dime-4over6-provisioning-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 1 instance of lines with non-RFC6890-compliant IPv4 addresses in the document. If these are example addresses, they should be changed. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (April 21, 2015) is 3283 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- No information found for draft-fsc-softwire-dhcp4o6-saddr-opt - is the name correct? == Outdated reference: A later version (-15) exists of draft-ietf-softwire-multicast-prefix-option-08 -- No information found for draft-softwire-dslite-multicast - is the name correct? -- Obsolete informational reference (is this intentional?): RFC 3315 (Obsoleted by RFC 8415) Summary: 0 errors (**), 0 flaws (~~), 3 warnings (==), 4 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Internet Engineering Task Force C. Zhou 3 Internet-Draft Huawei Technologies 4 Intended status: Standards Track T. Taylor 5 Expires: October 23, 2015 PT Taylor Consulting 6 Q. Sun 7 China Telecom 8 M. Boucadair 9 France Telecom 10 April 21, 2015 12 Attribute-Value Pairs For Provisioning Customer Equipment Supporting 13 IPv4-Over-IPv6 Transitional Solutions 14 draft-ietf-dime-4over6-provisioning-01 16 Abstract 18 During the transition from IPv4 to IPv6, customer equipment may have 19 to support one of the various transition methods that have been 20 defined for carrying IPv4 packets over IPv6. This document 21 enumerates the information that needs to be provisioned on a customer 22 edge router to support a list of transition techniques based on 23 tunneling IPv4 in IPv6, with a view to defining reusable components 24 for a reasonable transition path between these techniques. To the 25 extent that the provisioning is done dynamically, AAA support is 26 needed to provide the information to the network server responsible 27 for passing the information to the customer equipment. This document 28 specifies Diameter (RFC 6733) attribute-value pairs to be used for 29 that purpose. 31 Status of This Memo 33 This Internet-Draft is submitted in full conformance with the 34 provisions of BCP 78 and BCP 79. 36 Internet-Drafts are working documents of the Internet Engineering 37 Task Force (IETF). Note that other groups may also distribute 38 working documents as Internet-Drafts. The list of current Internet- 39 Drafts is at http://datatracker.ietf.org/drafts/current/. 41 Internet-Drafts are draft documents valid for a maximum of six months 42 and may be updated, replaced, or obsoleted by other documents at any 43 time. It is inappropriate to use Internet-Drafts as reference 44 material or to cite them other than as "work in progress." 46 This Internet-Draft will expire on October 23, 2015. 48 Copyright Notice 50 Copyright (c) 2015 IETF Trust and the persons identified as the 51 document authors. All rights reserved. 53 This document is subject to BCP 78 and the IETF Trust's Legal 54 Provisions Relating to IETF Documents 55 (http://trustee.ietf.org/license-info) in effect on the date of 56 publication of this document. Please review these documents 57 carefully, as they describe your rights and restrictions with respect 58 to this document. Code Components extracted from this document must 59 include Simplified BSD License text as described in Section 4.e of 60 the Trust Legal Provisions and are provided without warranty as 61 described in the Simplified BSD License. 63 Table of Contents 65 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 66 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 4 67 2. Description of the Parameters Required By Each Transition 68 Method . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 69 2.1. Parameters For Dual-Stack Lite (DS-Lite) . . . . . . . . 4 70 2.2. Light Weight IPv4 Over IPv6 (LW4over6) . . . . . . . . . 5 71 2.3. Port Set Specification . . . . . . . . . . . . . . . . . 5 72 2.4. Mapping of Address and Port with Encapsulation (MAP-E) . 6 73 2.5. Parameters For Multicast . . . . . . . . . . . . . . . . 7 74 2.6. Summary and Discussion . . . . . . . . . . . . . . . . . 7 75 3. Attribute-Value Pair Definitions . . . . . . . . . . . . . . 8 76 3.1. IP-Prefix-Length AVP . . . . . . . . . . . . . . . . . . 8 77 3.2. Border-Router-Name AVP . . . . . . . . . . . . . . . . . 8 78 3.3. 64-Multicast-Attributes AVP . . . . . . . . . . . . . . . 9 79 3.3.1. ASM-Prefix64 AVP . . . . . . . . . . . . . . . . . . 9 80 3.3.2. SSM-Prefix64 AVP . . . . . . . . . . . . . . . . . . 10 81 3.3.3. Delegated-IPv6-Prefix AVP As uPrefix64 . . . . . . . 10 82 3.4. Tunnel-Source-Pref-Or-Addr AVP . . . . . . . . . . . . . 10 83 3.4.1. Delegated-IPv6-Prefix As the IPv6 Binding Prefix . . 11 84 3.4.2. Tunnel-Source-IPv6-Address AVP . . . . . . . . . . . 11 85 3.5. Port-Set-Identifier . . . . . . . . . . . . . . . . . . . 11 86 3.6. LW4over6-Binding . . . . . . . . . . . . . . . . . . . . 12 87 3.7. MAP-E-Attributes . . . . . . . . . . . . . . . . . . . . 12 88 3.8. MAP-Mapping-Rule . . . . . . . . . . . . . . . . . . . . 13 89 3.8.1. Rule-IPv4-Addr-Or-Prefix AVP . . . . . . . . . . . . 14 90 3.8.2. Rule-IPv6-Prefix AVP . . . . . . . . . . . . . . . . 14 91 3.8.3. EA-Field-Length AVP . . . . . . . . . . . . . . . . . 15 92 3.8.4. Port-Set-Identifier AVP . . . . . . . . . . . . . . . 15 93 4. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 15 94 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 95 6. Security Considerations . . . . . . . . . . . . . . . . . . . 16 96 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 16 97 7.1. Normative References . . . . . . . . . . . . . . . . . . 16 98 7.2. Informative References . . . . . . . . . . . . . . . . . 17 99 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 18 101 1. Introduction 103 A number of transition technologies have been defined to allow IPv4 104 packets to pass between hosts and IPv4 networks over an intervening 105 IPv6 network while minimizing the number of public IPv4 addresses 106 that need to be consumed by the hosts. Different operators will 107 deploy different technologies, and sometimes one operator will use 108 more than one technology, depending on what is supported by the 109 available equipment and upon other factors both technical and 110 economic. 112 Each technique requires the provisioning of some subscriber-specific 113 information on the customer edge device. The provisioning may be by 114 DHCPv6 [RFC3315] or by some other method. This document is 115 indifferent to the specific provisioning technique used, but assumes 116 a deployment in which that information is managed by AAA 117 (Authentication, Authorization, and Accounting) servers. It further 118 assumes that this information is delivered to intermediate network 119 nodes for onward provisioning using the Diameter protocol [RFC6733]. 121 As described below, in the particular case where the Light Weight 122 IPv4 Over IPv6 (LW4o6) [I-D.ietf-softwire-lw4over6] transition method 123 has been deployed, per-subscriber-site information almost identical 124 to that passed to the subscriber site [I-D.ietf-softwire-map-dhcp] or 125 collected from it [I-D.fsc-softwire-dhcp4o6-saddr-opt] also needs to 126 be delivered to the border router serving that site. The Diameter 127 protocol may be used for this purpose too. 129 This document analyzes the information required to configure the 130 customer edge equipment for the following set of transition methods: 132 o Dual-Stack Lite (DS-Lite) [RFC6333], 134 o Light Weight IPv4 Over IPv6 (LW4over6) 135 [I-D.ietf-softwire-lw4over6], and 137 o Mapping of Address and Port with Encapsulation (MAP-E) 138 [I-D.ietf-softwire-map]. 140 [I-D.softwire-dslite-multicast] specifies a generic solution for 141 delivery of IPv4 multicast services to IPv4 clients over an IPv6 142 multicast network. The solution was developed with DS-Lite in mind 143 but it is however not limited to DS-Lite. As such, it applies also 144 for LW4over6 and MAP-E. This document analyzes the information 145 required to configure the customer edge equipment for the support of 146 multicast in the context of DS-Lite, MAP, and LW4over6 in particular. 148 On the basis of those analyses it specifies a number of attribute- 149 value pairs (AVPs) to allow the necessary subscriber-site-specific 150 configuration information to be carried in Diameter. 152 1.1. Requirements Language 154 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 155 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 156 document are to be interpreted as described in [RFC2119]. 158 The abbreviation "CE" denotes the equipment at the customer edge that 159 terminates the customer end of an IPv6 transitional tunnel. This 160 will usually be a router, but could be a host directly connected to 161 the network. 163 The term "tunnel source address" is used to denote the IPv6 source 164 address used in the outer header of packets sent from the CE through 165 an LW4over6 transitional tunnel to the border router. 167 2. Description of the Parameters Required By Each Transition Method 169 This section reviews the parameters that need to be provisioned for 170 each of the transition methods listed above. This enumeration 171 provides the justification for the AVPs defined in the next section. 173 A means is required to indicate which transition method(s) a given 174 subscriber is allowed to use. The approach taken in this document is 175 to specify grouped AVPs specific to LW4over6 and MAP-E. The operator 176 can control which of these two transition methods a given subscriber 177 uses by ensuring that AAA passes only the grouped AVP relevant to 178 that method. A grouped AVP is unnecessary for Dual-Stack Lite, since 179 (as the next section indicates) AAA has to provide only one 180 parameter. Hence the absence of either of the grouped AVPs indicates 181 that the subscriber equipment will use Dual-Stack Lite. Provisioning 182 of multicast is an orthogonal activity, since it is independent of 183 the transition method. 185 2.1. Parameters For Dual-Stack Lite (DS-Lite) 187 DS-Lite is documented in [RFC6333]. The Basic Bridging BroadBand 188 (B4) element at the customer premises needs to be provisioned with 189 the IPv6 address of the AFTR (border router). Optionally, it could 190 also be configured with the IPv4 address of the B4 interface facing 191 the tunnel, where the default value in the absence of provisioning is 192 192.0.0.2 and valid values are 192.0.0.2 through 192.0.0.7. 193 Provisioning this information through AAA is problematic because it 194 is most likely used in a case where multiple B4 instances occupy the 195 same device. This document therefore assumes that the B4 interface 196 address is determined by other means (implementation-dependent or 197 static assignment). 199 2.2. Light Weight IPv4 Over IPv6 (LW4over6) 201 Light Weight IPv4 Over IPv6 (LW4over6) is documented in 202 [I-D.ietf-softwire-lw4over6]. LW4over6 requires four items to be 203 provisioned to the customer equipment: 205 o IPv6 address of the border router. 207 o IPv6 prefix used by the CE to construct the tunnel source address. 208 In the terminology of [I-D.ietf-softwire-lw4over6], this is the 209 IPv6 Binding Prefix. 211 o an IPv4 address to be used on the external side of the CE; and 213 o if the IPv4 address is shared, a specification of the port set the 214 subscriber site is allowed to use. Please see the description in 215 Section 2.3. For LW4over6, all three of the parameters 'a', 'k', 216 and PSID described in that section are required. The default 217 value of the offset parameter 'a' is 0. 219 As discussed in Section 4 of [I-D.ietf-softwire-lw4over6], it is 220 necessary to synchronize this configuration with corresponding per- 221 subscriber configuration at the border router. The border router 222 information consists of the same public IPv4 address and port set 223 parameters that are passed to the CE, bound together with the full 224 /128 IPv6 address (not just the Binding Prefix) configured as the 225 tunnel source address at the CE. 227 [I-D.fsc-softwire-dhcp4o6-saddr-opt] proposes a means whereby a 228 DHCPv6 server can influence the choice of this address and collect it 229 from the CE. Depending on the provisioning architecture deployed in 230 a given network, it is possible that the tunnel source address is 231 passed to AAA as an intermediate step before the binding information 232 is passed on to the border router. 234 2.3. Port Set Specification 236 When an external IPv4 address is shared, LW4over6 and MAP-E restrict 237 the CE to use of a subset of all available ports on the external 238 side. Both transition methods use the the algorithm defined in 239 Appendix B of [I-D.ietf-softwire-map] to derive the values of the 240 port numbers in the port set. This algorithm features three 241 parameters, describing the positioning and value of the Port Set 242 Identifier (PSID) within each port number of the generated set: 244 o an offset 'a' from the beginning of the port number to the first 245 bit of the PSID; 247 o the length 'k' of the PSID within the port number, in bits; and 249 o the value of the PSID itself. 251 2.4. Mapping of Address and Port with Encapsulation (MAP-E) 253 Mapping of Address and Port with Encapsulation (MAP-E) is described 254 in [I-D.ietf-softwire-map]. MAP-E requires the provisioning of the 255 following per-subscriber information at the customer edge device: 257 o the IPv6 address of one or more border routers, or in MAP-E 258 terminology, MAP border relays. 260 o the unique End-user IPv6 prefix for the customer edge device. 261 This may be provided by AAA or acquired by other means. 263 o the Basic Mapping Rule for the customer edge device. This 264 includes the following parameters: 266 * the rule IPv6 prefix and length; 268 * the rule IPv4 prefix and length. A prefix length of 0 269 indicates that the entire IPv4 address or prefix is coded in 270 the Extended Address (EA) bits of the End-user IPv6 prefix 271 rather than in the mapping rule. 273 * the number of EA bits included in the End-user IPv6 prefix; 275 * port set parameters giving the set of ports the CE is allowed 276 to use when the IPv4 address is shared. Please see the 277 description of these parameters in Section 2.3. At a minimum, 278 the offset parameter 'a' is required. For MAP-E this has the 279 default value 6. The parameters 'k' and PSID are needed if 280 they cannot be derived from the mapping rule information and 281 the EA bits (final case of Section 5.2 of 282 [I-D.ietf-softwire-map]). 284 o whether the device is to operate in mesh or hub-and-spoke mode; 286 o in mesh mode only, zero or more Forwarding Mapping Rules, 287 described by the same set of parameters as the Basic Mapping Rule; 289 As indicated in Section 5, bullet 1 of the MAP-E document, a MAP CE 290 can be provisioned with multiple End-user IPv6 prefixes, each 291 associated with its own Basic Mapping Rule. This does not change the 292 basic requirement for representation of the corresponding information 293 in the form of Diameter AVPs, but adds a potential requirement for 294 multiple instances of this information to be present in the Diameter 295 message, differing in the value of the End-user IPv6 prefix (in 296 contrast to the Forward Mapping Rule instances). 298 The border router needs to be configured with the superset of the 299 Mapping Rules passed to the customer sites it serves. Since this 300 requirement does not require direct coordination with CE 301 configuration in the way LW4over6 does, it is out of scope of the 302 present document. However, the AVPs defined here may be useful if a 303 separate Diameter application is used to configure the border router. 305 2.5. Parameters For Multicast 307 [I-D.softwire-dslite-multicast] specifies a generic solution for 308 delivery of IPv4 multicast services to IPv4 clients over an IPv6 309 multicast network. The solution can be in particular deployed in a 310 DS-Lite context, but is also adaptable to LW4over6 and MAP-E. 311 [I-D.ietf-softwire-multicast-prefix-option] specifies how DHCPv6 312 [RFC3315] can be used to provision multicast-related information, 313 particularly: 315 o ASM_mPrefix64: the IPv6 multicast prefix to be used to synthesize 316 the IPv4-embedded IPv6 addresses of the multicast groups in the 317 ASM mode. 319 o SSM_mPrefix64: the IPv6 multicast prefix to be used to synthesize 320 the IPv4-embedded IPv6 addresses of the multicast groups in the 321 SSM mode. 323 o uPrefix64: the IPv6 unicast prefix to be used in SSM mode for 324 constructing the IPv4-embedded IPv6 addresses representing the 325 IPv4 multicast sources in the IPv6 domain. uPrefix64 may also be 326 used to extract the IPv4 address from the received multicast data 327 flows. The address mapping follows the guidelines documented in 328 [RFC6052]. 330 2.6. Summary and Discussion 332 It appears that two items are common to the different transition 333 methods and the corresponding AVPs to carry them can be reused: 335 o a representation of the IPv6 address of a border router; 336 o A set of prefixes for delivery of multicast services to IPv4 337 clients over an IPv6 multicast network. 339 [RFC6519] sets a precedent for representation of the IPv6 address of 340 a border router as an FQDN. This can be dereferenced to one or more 341 IP addresses by the provisioning system before being passed to the 342 customer equipment, or left as an FQDN as it as in [RFC6334]. 344 The remaining requirements are transition-method-specific: 346 o for LW4over6, a representation of a binding between (1) either the 347 IPv6 Binding Prefix or a full /128 IPv6 address, (2) a public IPv4 348 address, and (3) (if the IPv4 address is shared) a port set 349 identifier; 351 o for MAP-E, a representation of the unique End-user IPv6 prefix for 352 the CE, if not provided by other means; 354 o for MAP-E, a representation of a Mapping Rule; 356 o for MAP-E, an indication of whether mesh mode or hub-and-spoke 357 mode is to be used. 359 3. Attribute-Value Pair Definitions 361 This section provides the specifications for the AVPs needed to meet 362 the requirements summarized in Section 2.6. Within the context of 363 their usage, all of these AVPs MUST have the M bit set and the V bit 364 cleared. 366 3.1. IP-Prefix-Length AVP 368 The IP-Prefix-Length AVP (AVP code TBD00) is of type Unsignedint. It 369 provides the length of an IPv4 or IPv6 prefix. Valid values are from 370 0 to 32 for IPv4, and from 0 to 128 for IPv6. Tighter limits are 371 given below for particular contexts of use of this AVP. 373 3.2. Border-Router-Name AVP 375 Following on the precedent set by [RFC6334] and [RFC6519], this 376 document identifies a border router using an FQDN rather than an 377 address. The Border-Router-Name AVP (AVP Code TBD01) is of type 378 OctetString. The rules for encoding the FQDN are the same as those 379 for the FQDN variant of the derived type DiameterIdentity 380 (Section 4.3.1 of [RFC6733]). 382 3.3. 64-Multicast-Attributes AVP 384 The 64-Multicast-Attributes AVP (AVP Code TBD02) is of type Grouped. 385 It contains the multicast-related prefixes needed for providing IPv4 386 multicast over IPv6 using DS-Lite, MAP-E, or LW4over6, as specified 387 in [I-D.softwire-dslite-multicast]. 389 The syntax is shown in Figure 1. 391 64-Multicast-Attributes ::= < AVP Header: TBD02 > 392 [ ASM-Prefix64 ] 393 [ SSM-Prefix64 ] 394 [ Delegated-IPv6-Prefix ] 395 *[ AVP ] 397 Figure 1: 64-Multicast-Attributes AVP 399 If either ASM-Prefix64 or SSM-Prefix64 or both are present, 400 Delegated-IPv6-Prefix MUST also be present. 402 3.3.1. ASM-Prefix64 AVP 404 The ASM-Prefix64 AVP (AVP Code TBD03) conveys the value of 405 ASM_mPrefix64 as identified in Section 2.1 and specified in 406 [I-D.softwire-dslite-multicast]. The ASM-Prefix64 AVP is of type 407 Grouped, as shown in Figure 2. 409 ASM-Prefix64 ::= < AVP Header: TBD03 > 410 { IP-Address } 411 { IP-Prefix-Length } 412 *[ AVP ] 414 Figure 2: ASM-Prefix64 AVP 416 IP-Address (AVP code 518) is defined in [RFC5777] and is of type 417 Address. Within the ASM-Prefix64 AVP, it provides the value of an 418 IPv6 prefix. The AddressType field in IP-Address MUST have value 2 419 (IPv6). The conveyed multicast IPv6 prefix MUST belong to the ASM 420 range. Unused bits in IP-Address beyond the actual prefix MUST be 421 set to zeroes by the sender and ignored by the receiver. 423 The IP-Prefix-Length AVP provides the actual length of the prefix 424 contained in the IP-Address AVP. Within the ASM-Prefix64 AVP, valid 425 values of the IP-Prefix-Length AVP are from 24 to 96. 427 3.3.2. SSM-Prefix64 AVP 429 The SSM-Prefix64 AVP (AVP Code TBD04) conveys the value of 430 SSM_mPrefix64 as identified in Section 2.1 and specified in 431 [I-D.softwire-dslite-multicast]. The SSM-Prefix64 AVP is of type 432 Grouped, as shown in Figure 3. 434 SSM-Prefix64 ::= < AVP Header: TBD04 > 435 { IP-Address } 436 { IP-Prefix-Length } 437 *[ AVP ] 439 Figure 3: SSM-Prefix64 AVP 441 IP-Address (AVP code 518) provides the value of an IPv6 prefix. The 442 AddressType field in IP-Address MUST have value 2 (IPv6). The 443 conveyed multicast IPv6 prefix MUST belong to the SSM range. Unused 444 bits in IP-Address beyond the actual prefix MUST be set to zeroes by 445 the sender and ignored by the receiver. 447 The IP-Prefix-Length AVP provides the actual length of the prefix 448 contained in the IP-Address AVP. With regard to prefix length, note 449 that Section 6 of [RFC3306] requires that bits 33-95 of an SSM 450 address in the FF3x range be set to zero, meaning that the prefix 451 length for an SSM prefix is effectively 96. However, Section 1 of 452 [RFC4607] suggests that the lower limit of 32 bits be preserved to 453 allow potential future use of bits 33-95. Hence applications SHOULD 454 accept prefix lengths between 32 and 96 inclusive. 456 3.3.3. Delegated-IPv6-Prefix AVP As uPrefix64 458 Within the 64-Multicast-Attributes AVP, the Delegated-IPv6-Prefix AVP 459 (AVP Code 123) conveys the value of uPrefix64, a unicast IPv6 prefix, 460 as identified in Section 2.1 and specified in 461 [I-D.softwire-dslite-multicast]. The Delegated-IPv6-Prefix AVP is 462 defined in [RFC4818]. As specified by [RFC6052], the value in the 463 Prefix-Length field MUST be one of 32, 48, 56, 64 or 96. 465 3.4. Tunnel-Source-Pref-Or-Addr AVP 467 The Tunnel-Source-Pref-Or-Addr AVP (AVP Code TBD05) conveys either 468 the IPv6 Binding Prefix or the tunnel source address on the CE, as 469 described in Section 2.2. The Tunnel-Source-Pref-Or-Addr AVP is of 470 type Grouped, with syntax as shown in Figure 4. One of the 471 Delegated-IPv6-Prefix AVP or the Tunnel-Source-IPv6-Address AVP MUST 472 be present. 474 Tunnel-Source-Pref-Or-Addr ::= < AVP Header: TBD05 > 475 [ Delegated-IPv6-Prefix ] 476 [ Tunnel-Source-IPv6-Address ] 477 *[ AVP ] 479 Figure 4: Tunnel-Source-Pref-Or-Addr AVP 481 This AVP is defined separately from the LW4over6-Binding AVP (which 482 includes it) to provide flexibility in the transport of the tunnel 483 source address from the provisioning system to AAA while also 484 supporting the provision of a complete binding to the LW4over6 border 485 router. 487 3.4.1. Delegated-IPv6-Prefix As the IPv6 Binding Prefix 489 The Delegated-IPv6-Prefix AVP (AVP code 123) is of type Octetstring, 490 and is defined in [RFC4818]. Within the Tunnel-Source-Pref-Or-Addr 491 AVP, it conveys the IPv6 Binding Prefix assigned to the CE. Valid 492 values in the Prefix-Length field are from 0 to 128 (full address), 493 although a more restricted range is obviously more reasonable. 495 3.4.2. Tunnel-Source-IPv6-Address AVP 497 The Tunnel-Source-IPv6-Address AVP (AVP code TBD06) is of type 498 Address. It provides the address that the CE has assigned to its end 499 of an LW4over6 tunnel. The AddressType field in this AVP MUST be set 500 to 2 (IPv6). The DHCP 4o6 server described in 501 [I-D.fsc-softwire-dhcp4o6-saddr-opt] can use the Tunnel-Source- 502 IPv6-Address AVP to report the address to AAA after Step 3 of the 503 binding flow shown in Section 4 of that document. 505 3.5. Port-Set-Identifier 507 The Port-Set-Identifier AVP (AVP Code TBD07) is a structured 508 OctetString with four octets of data, hence a total AVP length of 12. 509 The description of the structure which follows refers to refers to 510 the parameters described in Section 2.3. 512 o The first (high-order) octet is the Offset field. It is 513 interpreted as an 8-bit unsigned integer giving the offset 'a' 514 from the beginning of a port number to the beginning of the port 515 set identifier (PSID) to which that port belongs. Valid values 516 are from 0 to 15. 518 o The next octet, the PSIDLength, is also interpreted as an 8-bit 519 unsigned integer and gives the length 'k' in bits of the port set 520 identifier (PSID). Valid values are from 0 to (16 - a). A value 521 of 0 indicates that the PSID is not present (probable case for 522 MAP-E, see Section 2.4), and the PSIDValue field MUST be ignored. 524 o The final two octets contain the PSIDValue field. They give the 525 value of the PSID itself, right-justified within the field. That 526 is, the value of the PSID occupies the 'k' lowest-order bits of 527 the PSIDValue field. 529 3.6. LW4over6-Binding 531 The LW4over6-Binding AVP (AVP Code TBD08) is of type Grouped. It 532 contains the elements of configuration that constitute the binding 533 between an LW4over6 tunnel and IPv4 packets sent through that tunnel, 534 as described in Section 2.2. 536 LW4over6-Binding ::= < AVP Header: TBD08 > 537 { Tunnel-Source-Pref-Or-Addr } 538 { LW4over6-External-IPv4-Addr } 539 [ Port-Set-Identifier ] 540 *[ AVP ] 542 Figure 5 544 The Tunnel-Source-Pref-Or-Addr AVP is defined in Section 3.4 and 545 provides either the Binding Prefix or the full IPv6 tunnel source 546 address. This AVP MUST be present. 548 The LW4over6-External-IPv4-Addr AVP (AVP Code TBD09) uses the Address 549 derived data format defined in Section 4.3.1 of [RFC6733]. It 550 provides the CE's external IPv4 address within the LW4over6 tunnel 551 associated with the given binding. The AddressType field MUST be set 552 to 1 (IPv4), and the total length of the AVP MUST be 14 octets. This 553 AVP MUST be present. 555 The Port-Set-Identifier AVP is defined in Section 3.5. It identifies 556 the specific set of ports assigned to the LW4over6 tunnel, when the 557 IPv4 address is being shared. 559 3.7. MAP-E-Attributes 561 The MAP-E-Attributes AVP (AVP Code TBD10) is of type Grouped. It 562 contains the configuration data identified in Section 2.4 for all of 563 the mapping rules (Basic and Forwarding) in a single MAP domain. 564 Multiple instances of this AVP will be present if the CE belongs to 565 multiple MAP domains. 567 MAP-E-Attributes ::= < AVP Header: TBD06 > 568 1*{ Border-Router-Name } 569 1*{ MAP-Mapping-Rule } 570 [ MAP-Mesh-Mode ] 571 [ Delegated-IPv6-Prefix ] 572 *[ AVP ] 574 Figure 6 576 The Border-Router-Name AVP is defined in Section 3.2. It provides 577 the FQDN of a MAP border relay at the edge of the MAP domain to which 578 the containing MAP-E-Attributes AVP relates. At least one instance 579 of this AVP MUST be present. 581 The MAP-Mapping-Rule AVP is defined in Section 3.8. At least one 582 instance of this AVP MUST be present. If the MAP-E domain supports 583 mesh mode (indicated by the presence of the MAP-Mesh-Mode AVP), 584 additional MAP-Mapping-Rule instances MAY be present. If the MAP-E 585 domain is operating in hub-and-spoke mode, additional MAP-Mapping- 586 Rule instances MUST NOT be present. 588 The MAP-Mesh-Mode AVP (AVP Code TBD11) uses the OctetString data 589 format but has no data. Hence the AVP length is always 8. The 590 absence of the mesh mode indicator attribute indicates that the CE is 591 required to operate in hub-and-spoke mode. 593 The Delegated-IPv6-Prefix AVP (AVP Code 123) provides the End-user 594 IPv6 prefix assigned to the CE for the MAP domain to which the 595 containing MAP-E-Attributes AVP relates. The AVP is defined in 596 [RFC4818]. Valid values of the Prefix-Length field range from 0 to 597 128. 599 The Delegated-IPv6-Prefix AVP is optional because, depending on 600 deployment, the End-user IPv6 prefix may be provided by AAA or by 601 other means. If multiple instances of the MAP-E-Attributes AVP 602 containing the Delegated-IPv6-Prefix AVP are present, each instance 603 of the latter MUST have a different value. 605 3.8. MAP-Mapping-Rule 607 The MAP-Mapping-Rule AVP (AVP Code TBD12) is of type Grouped, and is 608 used only in conjunction with MAP-based transition methods. Mapping 609 rules are required both by the MAP border relay and by the CE. The 610 components of the MAP-Mapping-Rule AVP provide the contents of a 611 mapping rule as described in Section 2.4. 613 The syntax of the MAP-Mapping-Rule AVP is as follows: 615 MAP-Mapping-Rule ::= < AVP Header: TBD12 > 616 { Rule-IPv4-Addr-Or-Prefix } 617 { Rule-IPv6-Prefix } 618 { EA-Field-Length } 619 { Port-Set-Identifier } 620 *[ AVP ] 622 Figure 7 624 The Rule-IPv4-Addr-Or-Prefix, Rule-IPv6-Prefix, EA-Field-Length, and 625 Port-Set-Identifier AVPs MUST all be present. 627 3.8.1. Rule-IPv4-Addr-Or-Prefix AVP 629 The Rule-IPv4-Addr-Or-Prefix AVP (AVP Code TBD13) conveys the rule 630 IPv4 prefix and length as described in Section 2.4. The Rule-IPv4- 631 Addr-Or-Prefix AVP is of type Grouped, as shown in Figure 8. 633 Rule-IPv4-Addr-Or-Prefix ::= < AVP Header: TBD13 > 634 { IP-Address } 635 { IP-Prefix-Length } 636 *[ AVP ] 638 Figure 8: Rule-IPv4-Addr-Or-Prefix AVP 640 IP-Address (AVP code 518) is defined in [RFC5777] and is of type 641 Address. Within the Rule-IPv4-Addr-Or-Prefix AVP, it provides the 642 value of a unicast IPv4 address or prefix. The AddressType field in 643 IP-Address MUST have value 1 (IPv4). Unused bits in IP-Address 644 beyond the actual prefix MUST be set to zeroes by the sender and 645 ignored by the receiver. 647 The IP-Prefix-Length AVP provides the actual length of the prefix 648 contained in the IP-Address AVP. Within the Rule-IPv4-Addr-Or-Prefix 649 AVP, valid values of the IP-Prefix-Length AVP are from 0 to 32 (full 650 address), based on the different cases identified in Section 5.2 of 651 [I-D.ietf-softwire-map]. 653 3.8.2. Rule-IPv6-Prefix AVP 655 The Rule-IPv6-Prefix AVP (AVP Code TBD14) conveys the rule IPv6 656 prefix and length as described in Section 2.4. The Rule-IPv6-Prefix 657 AVP is of type Grouped, as shown in Figure 9. 659 Rule-IPv6-Prefix ::= < AVP Header: TBD14 > 660 { IP-Address } 661 { IP-Prefix-Length } 662 *[ AVP ] 664 Figure 9: Rule-IPv6-Prefix AVP 666 IP-Address (AVP code 518) is defined in [RFC5777] and is of type 667 Address. Within the Rule-IPv6-Prefix AVP, it provides the value of a 668 unicast IPv6 prefix. The AddressType field in IP- Address MUST have 669 value 2 (IPv6). Unused bits in IP-Address beyond the actual prefix 670 MUST be set to zeroes by the sender and ignored by the receiver. 671 This AVP MUST be present. 673 The IP-Prefix-Length AVP provides the actual length of the prefix 674 contained in the IP-Address AVP. Within the Rule-IPv6-Prefix AVP, 675 the minimum valid prefix length is 0. The maximum value is bounded 676 by the length of the End-user IPv6 prefix associated with the mapping 677 rule, if present in the form of the Delegated-IPv6-Prefix AVP in the 678 enclosing MAP-E-Attributes AVP. Otherwise the maximum value is 128. 679 This AVP MUST be present. 681 3.8.3. EA-Field-Length AVP 683 The EA-Field-Length AVP (AVP Code TBD15) is of type Unsigned32. 684 Valid values range from 0 to 48. See Section 5.2 of 685 [I-D.ietf-softwire-map] for a description of the use of this 686 parameter in deriving IPv4 address and port number configuration. 687 This AVP MUST be present. 689 3.8.4. Port-Set-Identifier AVP 691 The Port-Set-Identifier AVP provides information to identify the 692 specific set of ports assigned to the CE. For more information see 693 Section 2.4 and Section 2.3. The Port-Set-Identifier AVP is defined 694 in Section 3.5. It MUST be present. 696 4. Acknowledgements 698 Huawei Technologies funded Tom Taylor's work on earlier versions of 699 this document. 701 5. IANA Considerations 703 This memo requests to IANA to register the following Diameter AVP 704 codes: 706 +-------+-----------------------------+---------------+ 707 | Code | Attribute Name | Reference | 708 +-------+-----------------------------+---------------+ 709 | TBD00 | IP-Prefix-Length | This document | 710 | TBD01 | Border-Router-Name | This document | 711 | TBD02 | 64-Multicast-Attributes | This document | 712 | TBD03 | ASM-Prefix64 | This document | 713 | TBD04 | SSM-Prefix64 | This document | 714 | TBD05 | Tunnel-Source-Pref-Or-Addr | This document | 715 | TBD06 | Tunnel-Source-IPv6-Address | This document | 716 | TBD07 | Port-Set-Identifier | This document | 717 | TBD08 | LW4over6-Binding | This document | 718 | TBD09 | LW4over6-External-IPv4-Addr | This document | 719 | TBD10 | MAP-E-Attributes | This document | 720 | TBD11 | MAP-Mesh-Mode | This document | 721 | TBD12 | MAP-Mapping-Rule | This document | 722 | TBD13 | Rule-IPv4-Addr-Or-Prefix | This document | 723 | TBD14 | Rule-IPv6-Prefix | This document | 724 | TBD15 | EA-Field-Length | This document | 725 +-------+-----------------------------+---------------+ 727 Table 1 729 6. Security Considerations 731 The AVPs defined in this document face two threats, both dependent on 732 man-in-the-middle attacks on the Diameter delivery path. The more 733 serious threat is denial of service through modification of the AVP 734 contents leading to misconfiguration. The lesser threat is 735 disclosure of subscriber addresses allowing the attacker to track 736 subscriber activity. 738 Diameter security is currently provided on a hop-by-hop basis (see 739 Section 2.2 of [RFC6733]). The Diameter end-to-end security problem 740 has not been solved, so man-in-the-middle attacks on Diameter peers 741 along the path are possible. The present document does not propose 742 to solve that general problem, but simply warn that it exists. 744 7. References 746 7.1. Normative References 748 [I-D.ietf-softwire-lw4over6] 749 Cui, Y., Sun, Q., Boucadair, M., Tsou, T., Lee, Y., and I. 750 Farrer, "Lightweight 4over6: An Extension to the DS-Lite 751 Architecture (work in progress)", March 2014. 753 [I-D.ietf-softwire-map] 754 Troan, O., Dec, W., Li, X., Bao, C., Matsushima, S., 755 Murakami, T., and T. Taylor, "Mapping of Address and Port 756 with Encapsulation (MAP) (work in progress)", January 757 2014. 759 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 760 Requirement Levels", BCP 14, RFC 2119, March 1997. 762 [RFC3306] Haberman, B. and D. Thaler, "Unicast-Prefix-based IPv6 763 Multicast Addresses", RFC 3306, August 2002. 765 [RFC4818] Salowey, J. and R. Droms, "RADIUS Delegated-IPv6-Prefix 766 Attribute", RFC 4818, April 2007. 768 [RFC5777] Korhonen, J., Tschofenig, H., Arumaithurai, M., Jones, M., 769 and A. Lior, "Traffic Classification and Quality of 770 Service (QoS) Attributes for Diameter", RFC 5777, February 771 2010. 773 [RFC6333] Durand, A., Droms, R., Woodyatt, J., and Y. Lee, "Dual- 774 Stack Lite Broadband Deployments Following IPv4 775 Exhaustion", RFC 6333, August 2011. 777 [RFC6733] Fajardo, V., Arkko, J., Loughney, J., and G. Zorn, 778 "Diameter Base Protocol", RFC 6733, October 2012. 780 7.2. Informative References 782 [I-D.fsc-softwire-dhcp4o6-saddr-opt] 783 Farrer, I., Sun, Q., and Y. Cui, "DHCPv4 over DHCPv6 784 Source Address Option (Work in progress)", June 2014. 786 [I-D.ietf-softwire-map-dhcp] 787 Mrugalski, T., Troan, O., Farrer, I., Perrault, S., Dec, 788 W., Bao, C., Yeh, L., and X. Deng, "DHCPv6 Options for 789 configuration of Softwire Address and Port Mapped Clients 790 (Work in progress)", March 2014. 792 [I-D.ietf-softwire-multicast-prefix-option] 793 Boucadair, M., Qin, J., Tsou, T., and X. Deng, "DHCPv6 794 Option for IPv4-Embedded Multicast and Unicast IPv6 795 Prefixes", draft-ietf-softwire-multicast-prefix-option-08 796 (work in progress), March 2015. 798 [I-D.softwire-dslite-multicast] 799 Qin, J., Boucadair, M., Jacquenet, C., Lee, Y., and Q. 800 Wang, "Delivery of IPv4 Multicast Services to IPv4 Clients 801 over an IPv6 Multicast Network (work in progress)", March 802 2014. 804 [RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., 805 and M. Carney, "Dynamic Host Configuration Protocol for 806 IPv6 (DHCPv6)", RFC 3315, July 2003. 808 [RFC4607] Holbrook, H. and B. Cain, "Source-Specific Multicast for 809 IP", RFC 4607, August 2006. 811 [RFC6052] Bao, C., Huitema, C., Bagnulo, M., Boucadair, M., and X. 812 Li, "IPv6 Addressing of IPv4/IPv6 Translators", RFC 6052, 813 October 2010. 815 [RFC6334] Hankins, D. and T. Mrugalski, "Dynamic Host Configuration 816 Protocol for IPv6 (DHCPv6) Option for Dual-Stack Lite", 817 RFC 6334, August 2011. 819 [RFC6519] Maglione, R. and A. Durand, "RADIUS Extensions for Dual- 820 Stack Lite", RFC 6519, February 2012. 822 Authors' Addresses 824 Cathy Zhou 825 Huawei Technologies 826 Bantian, Longgang District 827 Shenzhen 518129 828 P.R. China 830 Email: cathy.zhou@huawei.com 832 T. Taylor 833 PT Taylor Consulting 834 Ottawa 835 Canada 837 Email: tom.taylor.stds@gmail.com 838 Qiong Sun 839 China Telecom 840 P.R.China 842 Phone: 86 10 58552936 843 Email: sunqiong@ctbri.com.cn 845 M. Boucadair 846 France Telecom 847 Rennes 35000 848 France 850 Email: mohamed.boucadair@orange.com