idnits 2.17.1 draft-ietf-dime-4over6-provisioning-04.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 2 instances of lines with non-RFC6890-compliant IPv4 addresses in the document. If these are example addresses, they should be changed. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (July 20, 2015) is 3203 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-18) exists of draft-ietf-softwire-dslite-multicast-09 == Outdated reference: A later version (-15) exists of draft-ietf-softwire-multicast-prefix-option-08 -- Obsolete informational reference (is this intentional?): RFC 3315 (Obsoleted by RFC 8415) Summary: 0 errors (**), 0 flaws (~~), 4 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Internet Engineering Task Force C. Zhou 3 Internet-Draft Huawei Technologies 4 Intended status: Standards Track T. Taylor 5 Expires: January 21, 2016 PT Taylor Consulting 6 Q. Sun 7 China Telecom 8 M. Boucadair 9 France Telecom 10 July 20, 2015 12 Attribute-Value Pairs For Provisioning Customer Equipment Supporting 13 IPv4-Over-IPv6 Transitional Solutions 14 draft-ietf-dime-4over6-provisioning-04 16 Abstract 18 During the transition from IPv4 to IPv6, customer equipment may have 19 to support one of the various transition methods that have been 20 defined for carrying IPv4 packets over IPv6. This document 21 enumerates the information that needs to be provisioned on a customer 22 edge router to support a list of transition techniques based on 23 tunneling IPv4 in IPv6, with a view to defining reusable components 24 for a reasonable transition path between these techniques. To the 25 extent that the provisioning is done dynamically, AAA support is 26 needed to provide the information to the network server responsible 27 for passing the information to the customer equipment. This document 28 specifies Diameter (RFC 6733) attribute-value pairs to be used for 29 that purpose. 31 Status of This Memo 33 This Internet-Draft is submitted in full conformance with the 34 provisions of BCP 78 and BCP 79. 36 Internet-Drafts are working documents of the Internet Engineering 37 Task Force (IETF). Note that other groups may also distribute 38 working documents as Internet-Drafts. The list of current Internet- 39 Drafts is at http://datatracker.ietf.org/drafts/current/. 41 Internet-Drafts are draft documents valid for a maximum of six months 42 and may be updated, replaced, or obsoleted by other documents at any 43 time. It is inappropriate to use Internet-Drafts as reference 44 material or to cite them other than as "work in progress." 46 This Internet-Draft will expire on January 21, 2016. 48 Copyright Notice 50 Copyright (c) 2015 IETF Trust and the persons identified as the 51 document authors. All rights reserved. 53 This document is subject to BCP 78 and the IETF Trust's Legal 54 Provisions Relating to IETF Documents 55 (http://trustee.ietf.org/license-info) in effect on the date of 56 publication of this document. Please review these documents 57 carefully, as they describe your rights and restrictions with respect 58 to this document. Code Components extracted from this document must 59 include Simplified BSD License text as described in Section 4.e of 60 the Trust Legal Provisions and are provided without warranty as 61 described in the Simplified BSD License. 63 Table of Contents 65 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 66 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 4 67 2. Description of the Parameters Required By Each Transition 68 Method . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 69 2.1. Parameters For Dual-Stack Lite (DS-Lite) . . . . . . . . 5 70 2.2. Lightweight 4over6 (lw4o6) . . . . . . . . . . . . . . . 5 71 2.3. Port Set Specification . . . . . . . . . . . . . . . . . 6 72 2.4. Mapping of Address and Port with Encapsulation (MAP-E) . 6 73 2.5. Parameters For Multicast . . . . . . . . . . . . . . . . 7 74 2.6. Summary and Discussion . . . . . . . . . . . . . . . . . 8 75 3. Attribute-Value Pair Definitions . . . . . . . . . . . . . . 8 76 3.1. IP-Prefix-Length AVP . . . . . . . . . . . . . . . . . . 9 77 3.2. Border-Router-Name AVP . . . . . . . . . . . . . . . . . 9 78 3.3. 64-Multicast-Attributes AVP . . . . . . . . . . . . . . . 9 79 3.3.1. ASM-mPrefix64 AVP . . . . . . . . . . . . . . . . . . 9 80 3.3.2. SSM-mPrefix64 AVP . . . . . . . . . . . . . . . . . . 10 81 3.3.3. Delegated-IPv6-Prefix AVP As uPrefix64 . . . . . . . 11 82 3.4. Tunnel-Source-Pref-Or-Addr AVP . . . . . . . . . . . . . 11 83 3.4.1. Delegated-IPv6-Prefix As the IPv6 Binding Prefix . . 11 84 3.4.2. Tunnel-Source-IPv6-Address AVP . . . . . . . . . . . 11 85 3.5. Port-Set-Identifier . . . . . . . . . . . . . . . . . . . 12 86 3.6. Lw4o6-Binding AVP . . . . . . . . . . . . . . . . . . . . 12 87 3.6.1. Lw4o6-External-IPv4-Addr AVP . . . . . . . . . . . . 13 88 3.7. MAP-E-Attributes . . . . . . . . . . . . . . . . . . . . 13 89 3.8. MAP-Mesh-Mode . . . . . . . . . . . . . . . . . . . . . . 14 90 3.9. MAP-Mapping-Rule . . . . . . . . . . . . . . . . . . . . 14 91 3.9.1. Rule-IPv4-Addr-Or-Prefix AVP . . . . . . . . . . . . 15 92 3.9.2. Rule-IPv6-Prefix AVP . . . . . . . . . . . . . . . . 15 93 3.9.3. EA-Field-Length AVP . . . . . . . . . . . . . . . . . 16 94 4. Attribute Value Pair Flag Rules . . . . . . . . . . . . . . . 16 95 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18 96 6. Security Considerations . . . . . . . . . . . . . . . . . . . 18 97 6.1. Man-In-The-Middle (MITM) Attacks . . . . . . . . . . . . 18 98 6.2. Privacy . . . . . . . . . . . . . . . . . . . . . . . . . 19 99 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 19 100 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 19 101 8.1. Normative References . . . . . . . . . . . . . . . . . . 19 102 8.2. Informative References . . . . . . . . . . . . . . . . . 20 103 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 21 105 1. Introduction 107 A number of transition techniques have been defined to allow IPv4 108 packets to pass between hosts and IPv4 networks over an intervening 109 IPv6 network while minimizing the number of public IPv4 addresses 110 that need to be consumed by the hosts. Different operators will 111 deploy different technologies, and sometimes one operator will use 112 more than one technology, depending on what is supported by the 113 available equipment and upon other factors both technical and 114 economic. 116 Each technique requires the provisioning of some subscriber-specific 117 information on the customer edge device. The provisioning may be by 118 DHCPv6 [RFC3315] or by some other method. This document is 119 indifferent to the specific provisioning technique used, but assumes 120 a deployment in which that information is managed by AAA 121 (Authentication, Authorization, and Accounting) servers. It further 122 assumes that this information is delivered to intermediate network 123 nodes for onward provisioning using the Diameter protocol [RFC6733]. 125 As described below, in the particular case where the Lightweight 126 4over6 (lw4o6) [I-D.ietf-softwire-lw4over6] transition method has 127 been deployed, per-subscriber-site information almost identical to 128 that passed to the subscriber site [I-D.ietf-softwire-map-dhcp] also 129 needs to be delivered to the border router serving that site. The 130 Diameter protocol may be used for this purpose too. 132 This document analyzes the information required to configure the 133 customer edge equipment for the following set of transition methods: 135 o Dual-Stack Lite (DS-Lite) [RFC6333], 137 o Lightweight 4over6 (lw4o6) [I-D.ietf-softwire-lw4over6], and 139 o Mapping of Address and Port with Encapsulation (MAP-E) 140 [I-D.ietf-softwire-map]. 142 [I-D.ietf-softwire-dslite-multicast] specifies a generic solution for 143 delivery of IPv4 multicast services to IPv4 clients over an IPv6 144 multicast network. The solution was developed with DS-Lite in mind 145 but it is however not limited to DS-Lite. As such, it applies also 146 for lw4o6 and MAP-E. This document analyzes the information required 147 to configure the customer edge equipment for the support of multicast 148 in the context of DS-Lite, MAP-E, and Lightweight 4over6 in 149 particular. 151 On the basis of those analyses it specifies a number of attribute- 152 value pairs (AVPs) to allow the necessary subscriber-site-specific 153 configuration information to be carried in Diameter. 155 This document doesn't specify any new commands or Application-Ids. 156 The specified AVPs could be used for any Diameter application 157 suitable for provisioning. 159 1.1. Requirements Language 161 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 162 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 163 document are to be interpreted as described in [RFC2119]. 165 The abbreviation "CE" denotes the equipment at the customer edge that 166 terminates the customer end of an IPv6 transitional tunnel. This 167 will usually be a router, but could be a host directly connected to 168 the network. 170 The term "tunnel source address" is used to denote the IPv6 source 171 address used in the outer header of packets sent from the CE through 172 an lw4o6 transitional tunnel to the border router. 174 2. Description of the Parameters Required By Each Transition Method 176 This section reviews the parameters that need to be provisioned for 177 each of the transition methods listed above. This enumeration 178 provides the justification for the AVPs defined in the next section. 180 A means is required to indicate which transition method(s) a given 181 subscriber wants to use. The approach taken in this document is to 182 specify Grouped AVPs specific to lw4o6 and MAP-E. The operator can 183 control which of these two transition methods a given subscriber uses 184 by ensuring that AAA passes only the Grouped AVP relevant to that 185 method. A Grouped AVP is unnecessary for Dual-Stack Lite, since AAA 186 has only to provide the Fully Qualified Domain Name (FQDN) of the DS- 187 Lite Address Family Transition Router (AFTR) (see Section 2.1). 188 Hence when no Grouped AVP is provided either for lw4o6 or MAP-E and 189 only the AFTR's FQDN is present, this indicates that the subscriber 190 equipment will use the Dual-Stack Lite transition method. 192 Provisioning of multicast is an orthogonal activity, since it is 193 independent of the transition method. 195 2.1. Parameters For Dual-Stack Lite (DS-Lite) 197 DS-Lite is documented in [RFC6333]. The Basic Bridging BroadBand 198 (B4) element at the customer premises needs to discover the IPv6 199 address of the AFTR (border router). For the reasons discussed in 200 Section 3.2, the AAA server provision the B4 element with the AFTR's 201 Fully Qualified Domain Name (FQDN) that is passed to a B4's IP 202 resolution library. The AFTR's FQDN is contained in the Border- 203 Router-Name AVP (see Section 3.2). 205 The B4 element could also be configured with the IPv4 address of the 206 B4 interface facing the tunnel, with valid values from 192.0.0.2 to 207 192.0.0.7 and the default value of 192.0.0.2 in the absence of 208 provisioning. Provisioning such information through AAA is 209 problematic because it is most likely used in a case where multiple 210 B4 instances occupy the same device. This document therefore assumes 211 that the B4 interface address is determined by other means than AAA 212 (implementation-dependent or static assignment). 214 2.2. Lightweight 4over6 (lw4o6) 216 Lightweight 4over6 (lw4o6) is documented in 217 [I-D.ietf-softwire-lw4over6]. Lw4o6 requires four items to be 218 provisioned to the customer equipment: 220 o IPv6 address of the border router. 222 o IPv6 prefix used by the CE to construct the tunnel source address. 223 In the terminology of [I-D.ietf-softwire-lw4over6], this is the 224 IPv6 Binding Prefix. 226 o an IPv4 address to be used on the external side of the CE; and 228 o if the IPv4 address is shared, a specification of the port set the 229 subscriber site is allowed to use. Please see the description in 230 Section 2.3. For lw4o6, all three of the parameters 'a', 'k', and 231 PSID described in that section are required. The default value of 232 the offset parameter 'a' is 0. 234 As discussed in Section 4 of [I-D.ietf-softwire-lw4over6], it is 235 necessary to synchronize this configuration with corresponding per- 236 subscriber configuration at the border router. The border router 237 information consists of the same public IPv4 address and port set 238 parameters that are passed to the CE, bound together with the full 239 /128 IPv6 address (not just the Binding Prefix) configured as the 240 tunnel source address at the CE. 242 2.3. Port Set Specification 244 When an external IPv4 address is shared, lw4o6 and MAP-E restrict the 245 CE to use of a subset of all available ports on the external side. 246 Both transition methods use the algorithm defined in Appendix B of 247 [I-D.ietf-softwire-map] to derive the values of the port numbers in 248 the port set. This algorithm features three parameters, describing 249 the positioning and value of the Port Set Identifier (PSID) within 250 each port number of the generated set: 252 o an offset 'a' from the beginning of the port number to the first 253 bit of the PSID; 255 o the length 'k' of the PSID within the port number, in bits; and 257 o the value of the PSID itself. 259 2.4. Mapping of Address and Port with Encapsulation (MAP-E) 261 Mapping of Address and Port with Encapsulation (MAP-E) is described 262 in [I-D.ietf-softwire-map]. MAP-E requires the provisioning of the 263 following per-subscriber information at the customer edge device: 265 o the IPv6 address of one or more border routers, or in MAP-E 266 terminology, MAP-E border relays. 268 o the unique End-user IPv6 prefix for the customer edge device. 269 This may be provided by AAA or acquired by other means. 271 o the Basic Mapping Rule for the customer edge device. This 272 includes the following parameters: 274 * the rule IPv6 prefix and length; 276 * the rule IPv4 prefix and length. A prefix length of 0 277 indicates that the entire IPv4 address or prefix is coded in 278 the Extended Address (EA) bits of the End-user IPv6 prefix 279 rather than in the mapping rule. 281 * the number of EA bits included in the End-user IPv6 prefix; 283 * port set parameters giving the set of ports the CE is allowed 284 to use when the IPv4 address is shared. Please see the 285 description of these parameters in Section 2.3. At a minimum, 286 the offset parameter 'a' is required. For MAP-E this has the 287 default value 6. The parameters 'k' and PSID are needed if 288 they cannot be derived from the mapping rule information and 289 the EA bits (final case of Section 5.2 of 290 [I-D.ietf-softwire-map]). 292 o whether the device is to operate in mesh or hub-and-spoke mode; 294 o in mesh mode only, zero or more Forwarding Mapping Rules, 295 described by the same set of parameters as the Basic Mapping Rule; 297 As indicated in Section 5, bullet 1 of [I-D.ietf-softwire-map], a MAP 298 CE can be provisioned with multiple End-user IPv6 prefixes, each 299 associated with its own Basic Mapping Rule. This does not change the 300 basic requirement for representation of the corresponding information 301 in the form of Diameter AVPs, but adds a potential requirement for 302 multiple instances of this information to be present in the Diameter 303 message, differing in the value of the End-user IPv6 prefix (in 304 contrast to the Forward Mapping Rule instances). 306 The border router needs to be configured with the superset of the 307 Mapping Rules passed to the customer sites it serves. Since this 308 requirement does not require direct coordination with CE 309 configuration in the way lw4o6 does, it is out of scope of the 310 present document. However, the AVPs defined here may be useful if a 311 separate Diameter application is used to configure the border router. 313 2.5. Parameters For Multicast 315 [I-D.ietf-softwire-dslite-multicast] specifies a generic solution for 316 delivery of IPv4 multicast services to IPv4 clients over an IPv6 317 multicast network. The solution can be in particular deployed in a 318 DS-Lite context, but is also adaptable to lw4o6 and MAP-E. For 319 example, [I-D.ietf-softwire-multicast-prefix-option] specifies how 320 DHCPv6 [RFC3315] can be used to provision multicast-related 321 information. The following lists the multicast-related information 322 that needs to be provisioned: 324 o ASM-mPrefix64: the IPv6 multicast prefix to be used to synthesize 325 the IPv4-embedded IPv6 addresses of the multicast groups in the 326 Any-Source Multicast (ASM) mode. This is achieved by 327 concatenating the ASM-mPrefix64 and a IPv4 multicast address; the 328 IPv4 multicast address is inserted in the last 32 bits of the 329 IPv4-embedded IPv6 multicast address. 331 o SSM-mPrefix64: the IPv6 multicast prefix to be used to synthesize 332 the IPv4-embedded IPv6 addresses of the multicast groups in the 333 Source-Specific Multicast (SSM, [RFC4607]) mode. This is achieved 334 by concatenating the SSM-mPrefix64 and a IPv4 multicast address; 335 the Pv4 multicast address is inserted in the last 32 bits of the 336 IPv4-embedded IPv6 multicast address. 338 o uPrefix64: the IPv6 unicast prefix to be used in SSM mode for 339 constructing the IPv4-embedded IPv6 addresses representing the 340 IPv4 multicast sources in the IPv6 domain. uPrefix64 may also be 341 used to extract the IPv4 address from the received multicast data 342 flows. The address mapping follows the guidelines documented in 343 [RFC6052]. 345 2.6. Summary and Discussion 347 There are two items that are common to the different transition 348 methods, and the corresponding AVPs to carry them can be reused: 350 o a representation of the IPv6 address of a border router; 352 o A set of prefixes for delivery of multicast services to IPv4 353 clients over an IPv6 multicast network. 355 [RFC6519] sets a precedent for representation of the IPv6 address of 356 a border router as an FQDN. This can be dereferenced to one or more 357 IP addresses by the provisioning system before being passed to the 358 customer equipment, or left as an FQDN as it as in [RFC6334]. 360 The remaining requirements are transition-method-specific: 362 o for lw4o6, a representation of a binding between (1) either the 363 IPv6 Binding Prefix or a full /128 IPv6 address, (2) a public IPv4 364 address, and (3) (if the IPv4 address is shared) a port set 365 identifier; 367 o for MAP-E, a representation of the unique End-user IPv6 prefix for 368 the CE, if not provided by other means; 370 o for MAP-E, a representation of a Mapping Rule; 372 o for MAP-E, an indication of whether mesh mode or hub-and-spoke 373 mode is to be used. 375 3. Attribute-Value Pair Definitions 377 This section provides the specifications for the AVPs needed to meet 378 the requirements summarized in Section 2.6. 380 3.1. IP-Prefix-Length AVP 382 The IP-Prefix-Length AVP (AVP code TBD00) is of type Unsigned32. It 383 provides the length of an IPv4 or IPv6 prefix. Valid values are from 384 0 to 32 for IPv4, and from 0 to 128 for IPv6. Tighter limits are 385 given below for particular contexts of use of this AVP. 387 NOTE: The IP-Prefix-Length AVP is only relevant when associated 388 with an IP-Address AVP in a Grouped AVP. 390 3.2. Border-Router-Name AVP 392 Following on the precedent set by [RFC6334] and [RFC6519], this 393 document identifies a border router using an FQDN rather than an 394 address. The Border-Router-Name AVP (AVP Code TBD01) is of type 395 OctetString. The FQDN encoding MUST follow the Name Syntax defined 396 in [RFC1035][RFC1123][RFC2181] and are represented in ASCII form. 398 3.3. 64-Multicast-Attributes AVP 400 The 64-Multicast-Attributes AVP (AVP Code TBD02) is of type Grouped. 401 It contains the multicast-related IPv6 prefixes needed for providing 402 IPv4 multicast over IPv6 using DS-Lite, MAP-E, or lw4o6, as mentioned 403 in Section 2.5. 405 The syntax is shown in Figure 1. 407 64-Multicast-Attributes ::= < AVP Header: TBD02 > 408 [ ASM-mPrefix64 ] 409 [ SSM-mPrefix64 ] 410 [ Delegated-IPv6-Prefix ] 411 *[ AVP ] 413 Figure 1: 64-Multicast-Attributes AVP 415 64-Multicast-Attributes AVP MUST include the ASM-mPrefix64 AVP or the 416 SSM-mPrefix64 AVP, and it MAY include both. 418 The Delegated-IPv6-Prefix AVP MUST be present when the SSM-mPrefix64 419 AVP is present. The Delegated-IPv6-Prefix AVP MAY be present when 420 the ASM-mPrefix64 AVP is present. 422 3.3.1. ASM-mPrefix64 AVP 424 The ASM-mPrefix64 AVP (AVP Code TBD03) conveys the value of 425 ASM_mPrefix64 as mentioned in Section 2.5. The ASM-mPrefix64 AVP is 426 of type Grouped, as shown in Figure 2. 428 ASM-mPrefix64 ::= < AVP Header: TBD03 > 429 { IP-Address } 430 { IP-Prefix-Length } 431 *[ AVP ] 433 Figure 2: ASM-mPrefix64 AVP 435 IP-Address (AVP code 518) is defined in [RFC5777] and is of type 436 Address. Within the ASM-mPrefix64 AVP, it provides the value of an 437 IPv6 prefix. The AddressType field in IP-Address MUST have value 2 438 (IPv6). The conveyed multicast IPv6 prefix MUST belong to the ASM 439 range. Unused bits in IP-Address beyond the actual prefix MUST be 440 set to zeroes by the sender and ignored by the receiver. 442 The IP-Prefix-Length AVP (AVP code TBD00) provides the actual length 443 of the prefix contained in the IP-Address AVP. Within the ASM- 444 mPrefix64 AVP, valid values of the IP-Prefix-Length AVP are from 24 445 to 96. 447 3.3.2. SSM-mPrefix64 AVP 449 The SSM-mPrefix64 AVP (AVP Code TBD04) conveys the value of 450 SSM_mPrefix64 as mentioned in Section 2.5. The SSM-mPrefix64 AVP is 451 of type Grouped, as shown in Figure 3. 453 SSM-mPrefix64 ::= < AVP Header: TBD04 > 454 { IP-Address } 455 { IP-Prefix-Length } 456 *[ AVP ] 458 Figure 3: SSM-mPrefix64 AVP 460 IP-Address (AVP code 518) provides the value of an IPv6 prefix. The 461 AddressType field in IP-Address MUST have value 2 (IPv6). The 462 conveyed multicast IPv6 prefix MUST belong to the SSM range. Unused 463 bits in IP-Address beyond the actual prefix MUST be set to zeroes by 464 the sender and ignored by the receiver. 466 The IP-Prefix-Length AVP (AVP code TBD00) provides the actual length 467 of the prefix contained in the IP-Address AVP. With regard to prefix 468 length, note that Section 6 of [RFC3306] requires that bits 33-95 of 469 an SSM address in the FF3x range be set to zero, meaning that the 470 prefix length for an SSM prefix is effectively 96. However, 471 Section 1 of [RFC4607] suggests that the lower limit of 32 bits be 472 preserved to allow potential future use of bits 33-95. Hence 473 applications SHOULD accept prefix lengths between 32 and 96 474 inclusive. 476 3.3.3. Delegated-IPv6-Prefix AVP As uPrefix64 478 Within the 64-Multicast-Attributes AVP, the Delegated-IPv6-Prefix AVP 479 (AVP Code 123) conveys the value of uPrefix64, a unicast IPv6 prefix, 480 as mentioned in Section 2.5. The Delegated-IPv6-Prefix AVP is 481 defined in [RFC4818]. As specified by [RFC6052], the value in the 482 Prefix-Length field MUST be one of 32, 48, 56, 64 or 96. 484 3.4. Tunnel-Source-Pref-Or-Addr AVP 486 The Tunnel-Source-Pref-Or-Addr AVP (AVP Code TBD05) conveys either 487 the IPv6 Binding Prefix or the tunnel source address on the CE, as 488 described in Section 2.2. The Tunnel-Source-Pref-Or-Addr AVP is of 489 type Grouped, with syntax as shown in Figure 4. The Tunnel-Source- 490 Pref-Or-Addr AVP MUST contain either the Delegated-IPv6-Prefix AVP or 491 the Tunnel-Source-IPv6-Address AVP, not both. 493 Tunnel-Source-Pref-Or-Addr ::= < AVP Header: TBD05 > 494 [ Delegated-IPv6-Prefix ] 495 [ Tunnel-Source-IPv6-Address ] 496 *[ AVP ] 498 Figure 4: Tunnel-Source-Pref-Or-Addr AVP 500 This AVP is defined separately from the lw4o6-Binding AVP (which 501 includes it) to provide flexibility in the transport of the tunnel 502 source address from the provisioning system to AAA while also 503 supporting the provision of a complete binding to the lw4o6 border 504 router. 506 3.4.1. Delegated-IPv6-Prefix As the IPv6 Binding Prefix 508 The Delegated-IPv6-Prefix AVP (AVP code 123) is of type Octetstring, 509 and is defined in [RFC4818]. Within the Tunnel-Source-Pref-Or-Addr 510 AVP, it conveys the IPv6 Binding Prefix assigned to the CE. Valid 511 values in the Prefix-Length field are from 0 to 128 (full address), 512 although a more restricted range is obviously more reasonable. 514 3.4.2. Tunnel-Source-IPv6-Address AVP 516 The Tunnel-Source-IPv6-Address AVP (AVP code TBD06) is of type 517 Address. It provides the address that the CE has assigned to its end 518 of an lw4o6 tunnel. The AddressType field in this AVP MUST be set to 519 2 (IPv6). 521 3.5. Port-Set-Identifier 523 The Port-Set-Identifier AVP (AVP Code TBD07) is a structured 524 OctetString with four octets of data, hence a total AVP length of 12. 525 The description of the structure which follows refers to refers to 526 the parameters described in Section 2.3 (see Figure 5). 528 o The first (high-order) octet is the Offset field. It is 529 interpreted as an 8-bit unsigned integer giving the offset 'a' 530 from the beginning of a port number to the beginning of the port 531 set identifier (PSID) to which that port belongs. Valid values 532 are from 0 to 15. 534 o The next octet, the PSIDLength, is also interpreted as an 8-bit 535 unsigned integer and gives the length 'k' in bits of the port set 536 identifier (PSID). Valid values are from 0 to (16 - a). A value 537 of 0 indicates that the PSID is not present (probable case for 538 MAP-E, see Section 2.4), and the PSIDValue field MUST be ignored. 540 o The final two octets contain the PSIDValue field. They give the 541 value of the PSID itself, right-justified within the field. That 542 is, the value of the PSID occupies the 'k' lowest-order bits of 543 the PSIDValue field. 545 0 1 2 3 546 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 547 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 548 | Offset | Length | PSID Value | 549 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 551 Figure 5: Port Set 553 3.6. Lw4o6-Binding AVP 555 The Lw4o6-Binding AVP (AVP Code TBD08) is of type Grouped. It 556 contains the elements of configuration that constitute the binding 557 between an lw4o6 tunnel and IPv4 packets sent through that tunnel, as 558 described in Section 2.2. 560 Lw4o6-Binding ::= < AVP Header: TBD08 > 561 { Tunnel-Source-Pref-Or-Addr } 562 { Lw4o6-External-IPv4-Addr } 563 [ Port-Set-Identifier ] 564 *[ AVP ] 566 Figure 6: Lw4o6-Binding AVP 568 The Tunnel-Source-Pref-Or-Addr AVP is defined in Section 3.4 and 569 provides either the Binding Prefix or the full IPv6 tunnel source 570 address. 572 The Lw4o6-External-IPv4-Addr AVP is defined in Section 3.6.1. 574 The Port-Set-Identifier AVP is defined in Section 3.5. It identifies 575 the specific set of ports assigned to the lw4o6 tunnel, when the IPv4 576 address is being shared. 578 3.6.1. Lw4o6-External-IPv4-Addr AVP 580 The Lw4o6-External-IPv4-Addr AVP (AVP Code TBD09) uses the Address 581 derived data format defined in Section 4.3.1 of [RFC6733]. It 582 provides the CE's external IPv4 address within the lw4o6 tunnel 583 associated with the given binding. The AddressType field MUST be set 584 to 1 (IPv4), and the total length of the AVP MUST be 14 octets. 586 3.7. MAP-E-Attributes 588 The MAP-E-Attributes AVP (AVP Code TBD10) is of type Grouped. It 589 contains the configuration data identified in Section 2.4 for all of 590 the mapping rules (Basic and Forwarding) in a single MAP domain. 591 Multiple instances of this AVP will be present if the CE belongs to 592 multiple MAP domains. 594 MAP-E-Attributes ::= < AVP Header: TBD06 > 595 1*{ Border-Router-Name } 596 1*{ MAP-Mapping-Rule } 597 [ MAP-Mesh-Mode ] 598 [ Delegated-IPv6-Prefix ] 599 *[ AVP ] 601 Figure 7: MAP-E-Attributes AVP 603 The Border-Router-Name AVP is defined in Section 3.2. It provides 604 the FQDN of a MAP border relay at the edge of the MAP domain to which 605 the containing MAP-E-Attributes AVP relates. At least one instance 606 of this AVP MUST be present. 608 The MAP-Mapping-Rule AVP is defined in Section 3.9. At least one 609 instance of this AVP MUST be present. If the MAP-E domain supports 610 mesh mode (indicated by the presence of the MAP-Mesh-Mode AVP), 611 additional MAP-Mapping-Rule instances MAY be present. If the MAP-E 612 domain is operating in hub-and-spoke mode, additional MAP-Mapping- 613 Rule instances MUST NOT be present. 615 The MAP-Mesh-Mode AVP is defined in Section 3.8. The absence of the 616 mesh mode indicator attribute indicates that the CE is required to 617 operate in hub-and-spoke mode. 619 The Delegated-IPv6-Prefix AVP (AVP Code 123) provides the End-user 620 IPv6 prefix assigned to the CE for the MAP domain to which the 621 containing MAP-E-Attributes AVP relates. The AVP is defined in 622 [RFC4818]. Valid values of the Prefix-Length field range from 0 to 623 128. 625 The Delegated-IPv6-Prefix AVP is optional because, depending on 626 deployment, the End-user IPv6 prefix may be provided by AAA or by 627 other means. If multiple instances of the MAP-E-Attributes AVP 628 containing the Delegated-IPv6-Prefix AVP are present, each instance 629 of the latter MUST have a different value. 631 3.8. MAP-Mesh-Mode 633 The MAP-Mesh-Mode AVP (AVP Code TBD11) is of type Enumerated and 634 indicates whether the CE has to operate in mesh mode or hub-and-spoke 635 when using MAP-E. The following values are supported: 637 0 MESH 639 1 HUB_AND_SPOKE 641 The absence of the mesh mode indicator attribute indicates that the 642 CE is required to operate in hub-and-spoke mode. 644 3.9. MAP-Mapping-Rule 646 The MAP-Mapping-Rule AVP (AVP Code TBD12) is of type Grouped, and is 647 used only in conjunction with MAP-based transition methods. Mapping 648 rules are required both by the MAP border relay and by the CE. The 649 components of the MAP-Mapping-Rule AVP provide the contents of a 650 mapping rule as described in Section 2.4. 652 The syntax of the MAP-Mapping-Rule AVP is as follows: 654 MAP-Mapping-Rule ::= < AVP Header: TBD12 > 655 { Rule-IPv4-Addr-Or-Prefix } 656 { Rule-IPv6-Prefix } 657 { EA-Field-Length } 658 { Port-Set-Identifier } 659 *[ AVP ] 661 Figure 8: MAP-Mapping-Rule AVP 663 The Rule-IPv4-Addr-Or-Prefix, Rule-IPv6-Prefix, EA-Field-Length, and 664 Port-Set-Identifier AVPs MUST all be present. 666 The Port-Set-Identifier AVP provides information to identify the 667 specific set of ports assigned to the CE. For more information see 668 Section 2.4 and Section 2.3. The Port-Set-Identifier AVP is defined 669 in Section 3.5. 671 3.9.1. Rule-IPv4-Addr-Or-Prefix AVP 673 The Rule-IPv4-Addr-Or-Prefix AVP (AVP Code TBD13) conveys the rule 674 IPv4 prefix and length as described in Section 2.4. The Rule-IPv4- 675 Addr-Or-Prefix AVP is of type Grouped, as shown in Figure 9. 677 Rule-IPv4-Addr-Or-Prefix ::= < AVP Header: TBD13 > 678 { IP-Address } 679 { IP-Prefix-Length } 680 *[ AVP ] 682 Figure 9: Rule-IPv4-Addr-Or-Prefix AVP 684 IP-Address (AVP code 518) is defined in [RFC5777] and is of type 685 Address. Within the Rule-IPv4-Addr-Or-Prefix AVP, it provides the 686 value of a unicast IPv4 address or prefix. The AddressType field in 687 IP-Address MUST have value 1 (IPv4). Unused bits in IP-Address 688 beyond the actual prefix MUST be set to zeroes by the sender and 689 ignored by the receiver. 691 The IP-Prefix-Length AVP (AVP code TBD00) provides the actual length 692 of the prefix contained in the IP-Address AVP. Within the Rule-IPv4- 693 Addr-Or-Prefix AVP, valid values of the IP-Prefix-Length AVP are from 694 0 to 32 (full address), based on the different cases identified in 695 Section 5.2 of [I-D.ietf-softwire-map]. 697 3.9.2. Rule-IPv6-Prefix AVP 699 The Rule-IPv6-Prefix AVP (AVP Code TBD14) conveys the rule IPv6 700 prefix and length as described in Section 2.4. The Rule-IPv6-Prefix 701 AVP is of type Grouped, as shown in Figure 10. 703 Rule-IPv6-Prefix ::= < AVP Header: TBD14 > 704 { IP-Address } 705 { IP-Prefix-Length } 706 *[ AVP ] 708 Figure 10: Rule-IPv6-Prefix AVP 710 IP-Address (AVP code 518) is defined in [RFC5777] and is of type 711 Address. Within the Rule-IPv6-Prefix AVP, it provides the value of a 712 unicast IPv6 prefix. The AddressType field in IP- Address MUST have 713 value 2 (IPv6). Unused bits in IP-Address beyond the actual prefix 714 MUST be set to zeroes by the sender and ignored by the receiver. 716 The IP-Prefix-Length AVP (AVP code TBD00) provides the actual length 717 of the prefix contained in the IP-Address AVP. Within the Rule- 718 IPv6-Prefix AVP, the minimum valid prefix length is 0. The maximum 719 value is bounded by the length of the End-user IPv6 prefix associated 720 with the mapping rule, if present in the form of the Delegated- 721 IPv6-Prefix AVP in the enclosing MAP-E-Attributes AVP. Otherwise the 722 maximum value is 128. 724 3.9.3. EA-Field-Length AVP 726 The EA-Field-Length AVP (AVP Code TBD15) is of type Unsigned32. 727 Valid values range from 0 to 48. See Section 5.2 of 728 [I-D.ietf-softwire-map] for a description of the use of this 729 parameter in deriving IPv4 address and port number configuration. 731 4. Attribute Value Pair Flag Rules 732 +---------+ 733 |AVP flag | 734 |rules | 735 +----+----+ 736 AVP Section | |MUST| 737 Attribute Name Code Defined Value Type |MUST| NOT| 738 +-------------------------------------------------------+----+----+ 739 |IP-Prefix-Length TBD00 3.1 Unsigned32 | | V | 740 +-------------------------------------------------------+----+----+ 741 |Border-Router-Name TBD01 3.2 OctetString | | V | 742 +-------------------------------------------------------+----+----+ 743 |64-Multicast-Attributes TBD02 3.3 Grouped | | V | 744 +-------------------------------------------------------+----+----+ 745 |ASM-mPrefix64 TBD03 3.3.1 Grouped | | V | 746 +-------------------------------------------------------+----+----+ 747 |SSM-mPrefix64 TBD04 3.3.2 Grouped | | V | 748 +-------------------------------------------------------+----+----+ 749 |Tunnel-Source-Pref-Or-Addr TBD05 3.4 Grouped | | V | 750 +-------------------------------------------------------+----+----+ 751 |Tunnel-Source-IPv6-Address TBD06 3.4.2 Address | | V | 752 +-------------------------------------------------------+----+----+ 753 |Port-Set-Identifier TBD07 3.5 OctetString | | V | 754 +-------------------------------------------------------+----+----+ 755 |Lw4o6-Binding TBD08 3.6 Grouped | | V | 756 +-------------------------------------------------------+----+----+ 757 |Lw4o6-External-IPv4-Addr TBD09 3.6.1 Address | | V | 758 +-------------------------------------------------------+----+----+ 759 |MAP-E-Attributes TBD10 3.7 Grouped | | V | 760 +-------------------------------------------------------+----+----+ 761 |MAP-Mesh-Mode TBD11 3.8 Enumerated | | V | 762 +-------------------------------------------------------+----+----+ 763 |MAP-Mapping-Rule TBD12 3.9 Grouped | | V | 764 +-------------------------------------------------------+----+----+ 765 |Rule-IPv4-Addr-Or-Prefix TBD13 3.9.1 Grouped | | V | 766 +-------------------------------------------------------+----+----+ 767 |Rule-IPv6-Prefix TBD14 3.9.2 Grouped | | V | 768 +-------------------------------------------------------+----+----+ 769 |EA-Field-Length TBD15 3.9.3 Unsigned32 | | V | 770 +-------------------------------------------------------+----+----+ 772 As described in the Diameter base protocol [RFC6733], the M-bit usage 773 for a given AVP in a given command may be defined by the application. 775 5. IANA Considerations 777 This memo requests to IANA to register the following Diameter AVP 778 codes: 780 +-------+----------------------------+---------------+ 781 | Code | Attribute Name | Reference | 782 +-------+----------------------------+---------------+ 783 | TBD00 | IP-Prefix-Length | This document | 784 | TBD01 | Border-Router-Name | This document | 785 | TBD02 | 64-Multicast-Attributes | This document | 786 | TBD03 | ASM-mPrefix64 | This document | 787 | TBD04 | SSM-mPrefix64 | This document | 788 | TBD05 | Tunnel-Source-Pref-Or-Addr | This document | 789 | TBD06 | Tunnel-Source-IPv6-Address | This document | 790 | TBD07 | Port-Set-Identifier | This document | 791 | TBD08 | Lw4o6-Binding | This document | 792 | TBD09 | Lw4o6-External-IPv4-Addr | This document | 793 | TBD10 | MAP-E-Attributes | This document | 794 | TBD11 | MAP-Mesh-Mode | This document | 795 | TBD12 | MAP-Mapping-Rule | This document | 796 | TBD13 | Rule-IPv4-Addr-Or-Prefix | This document | 797 | TBD14 | Rule-IPv6-Prefix | This document | 798 | TBD15 | EA-Field-Length | This document | 799 +-------+----------------------------+---------------+ 801 Table 1 803 6. Security Considerations 805 6.1. Man-In-The-Middle (MITM) Attacks 807 The AVPs defined in this document face two threats, both dependent on 808 man-in-the-middle (MITM) attacks on the Diameter delivery path. The 809 first threat is denial-of-service (DoS) through modification of the 810 AVP contents leading to misconfiguration (e.g., a subscriber may fail 811 to access its connectivity service if an invalid IP address was 812 configured, the subscriber's traffic can be intercepted by a 813 misbehaving node if a fake Border Node has been configured, etc.). 814 The second one is related to privacy (see Section 6.2). 816 Diameter security is currently provided on a hop-by-hop basis (see 817 Section 2.2 of [RFC6733]). The Diameter end-to-end security problem 818 has not been solved, so MITM attacks on Diameter peers along the path 819 are possible. The present document does not propose to solve that 820 general problem, but simply warn that it exists. 822 Diameter-related security considerations are discussed in Section 13 823 of [RFC6733]. 825 6.2. Privacy 827 The AVPs defined in this document reveal privacy-related information 828 (e.g., subscriber addresses) that can be used for tracking proposes. 829 Considerations discussed in Section 13.3 of [RFC6733] MUST be 830 followed. 832 7. Acknowledgements 834 Huawei Technologies funded Tom Taylor's work on earlier versions of 835 this document. 837 Special thanks to Lionel Morand for the detailed review. 839 Many thanks to Russ Housley for the review and comments. 841 8. References 843 8.1. Normative References 845 [I-D.ietf-softwire-lw4over6] 846 Cui, Y., Qiong, Q., Boucadair, M., Tsou, T., Lee, Y., and 847 I. Farrer, "Lightweight 4over6: An Extension to the DS- 848 Lite Architecture", draft-ietf-softwire-lw4over6-13 (work 849 in progress), November 2014. 851 [I-D.ietf-softwire-map] 852 Troan, O., Dec, W., Li, X., Bao, C., Matsushima, S., 853 Murakami, T., and T. Taylor, "Mapping of Address and Port 854 with Encapsulation (MAP)", draft-ietf-softwire-map-13 855 (work in progress), March 2015. 857 [RFC1035] Mockapetris, P., "Domain names - implementation and 858 specification", STD 13, RFC 1035, November 1987. 860 [RFC1123] Braden, R., "Requirements for Internet Hosts - Application 861 and Support", STD 3, RFC 1123, October 1989. 863 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 864 Requirement Levels", BCP 14, RFC 2119, March 1997. 866 [RFC2181] Elz, R. and R. Bush, "Clarifications to the DNS 867 Specification", RFC 2181, July 1997. 869 [RFC3306] Haberman, B. and D. Thaler, "Unicast-Prefix-based IPv6 870 Multicast Addresses", RFC 3306, August 2002. 872 [RFC4818] Salowey, J. and R. Droms, "RADIUS Delegated-IPv6-Prefix 873 Attribute", RFC 4818, April 2007. 875 [RFC5777] Korhonen, J., Tschofenig, H., Arumaithurai, M., Jones, M., 876 and A. Lior, "Traffic Classification and Quality of 877 Service (QoS) Attributes for Diameter", RFC 5777, February 878 2010. 880 [RFC6333] Durand, A., Droms, R., Woodyatt, J., and Y. Lee, "Dual- 881 Stack Lite Broadband Deployments Following IPv4 882 Exhaustion", RFC 6333, August 2011. 884 [RFC6733] Fajardo, V., Arkko, J., Loughney, J., and G. Zorn, 885 "Diameter Base Protocol", RFC 6733, October 2012. 887 8.2. Informative References 889 [I-D.ietf-softwire-dslite-multicast] 890 Qin, J., Boucadair, M., Jacquenet, C., Lee, Y., and Q. 891 Wang, "Delivery of IPv4 Multicast Services to IPv4 Clients 892 over an IPv6 Multicast Network", draft-ietf-softwire- 893 dslite-multicast-09 (work in progress), March 2015. 895 [I-D.ietf-softwire-map-dhcp] 896 Mrugalski, T., Troan, O., Farrer, I., Perreault, S., Dec, 897 W., Bao, C., Yeh, L., and X. Deng, "DHCPv6 Options for 898 configuration of Softwire Address and Port Mapped 899 Clients", draft-ietf-softwire-map-dhcp-12 (work in 900 progress), March 2015. 902 [I-D.ietf-softwire-multicast-prefix-option] 903 Boucadair, M., Qin, J., Tsou, T., and X. Deng, "DHCPv6 904 Option for IPv4-Embedded Multicast and Unicast IPv6 905 Prefixes", draft-ietf-softwire-multicast-prefix-option-08 906 (work in progress), March 2015. 908 [RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., 909 and M. Carney, "Dynamic Host Configuration Protocol for 910 IPv6 (DHCPv6)", RFC 3315, July 2003. 912 [RFC4607] Holbrook, H. and B. Cain, "Source-Specific Multicast for 913 IP", RFC 4607, August 2006. 915 [RFC6052] Bao, C., Huitema, C., Bagnulo, M., Boucadair, M., and X. 916 Li, "IPv6 Addressing of IPv4/IPv6 Translators", RFC 6052, 917 October 2010. 919 [RFC6334] Hankins, D. and T. Mrugalski, "Dynamic Host Configuration 920 Protocol for IPv6 (DHCPv6) Option for Dual-Stack Lite", 921 RFC 6334, August 2011. 923 [RFC6519] Maglione, R. and A. Durand, "RADIUS Extensions for Dual- 924 Stack Lite", RFC 6519, February 2012. 926 Authors' Addresses 928 Cathy Zhou 929 Huawei Technologies 930 Bantian, Longgang District 931 Shenzhen 518129 932 P.R. China 934 Email: cathy.zhou@huawei.com 936 Tom Taylor 937 PT Taylor Consulting 938 Ottawa 939 Canada 941 Email: tom.taylor.stds@gmail.com 943 Qiong Sun 944 China Telecom 945 P.R.China 947 Phone: 86 10 58552936 948 Email: sunqiong@ctbri.com.cn 950 Mohamed Boucadair 951 France Telecom 952 Rennes 35000 953 France 955 Email: mohamed.boucadair@orange.com