idnits 2.17.1 draft-massar-v6ops-heartbeat-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** It looks like you're using RFC 3978 boilerplate. You should update this to the boilerplate described in the IETF Trust License Policy document (see https://trustee.ietf.org/license-info), which is required now. -- Found old boilerplate from RFC 3978, Section 5.1 on line 14. -- Found old boilerplate from RFC 3978, Section 5.5 on line 458. -- Found old boilerplate from RFC 3979, Section 5, paragraph 1 on line 435. -- Found old boilerplate from RFC 3979, Section 5, paragraph 2 on line 442. -- Found old boilerplate from RFC 3979, Section 5, paragraph 3 on line 448. ** This document has an original RFC 3978 Section 5.4 Copyright Line, instead of the newer IETF Trust Copyright according to RFC 4748. ** This document has an original RFC 3978 Section 5.5 Disclaimer, instead of the newer disclaimer which includes the IETF Trust according to RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- == No 'Intended status' indicated for this document; assuming Proposed Standard Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == Using lowercase 'not' together with uppercase 'MUST', 'SHALL', 'SHOULD', or 'RECOMMENDED' is not an accepted usage according to RFC 2119. Please use uppercase 'NOT' together with RFC 2119 keywords (if that is what you mean). Found 'MUST not' in this paragraph: In this example the server determines the inner-endpoint based on the sender IP of the packet. This could be used in all cases but is especially useful when the client is behind a NAT and doesn't know it's external address. An application MUST not use the 'sender' replacement when it knows it's public IP address. This because it adds an extra verification step to the heartbeat. -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (June 4, 2005) is 6900 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'RFC2119' is mentioned on line 376, but not defined == Missing Reference: 'RFC3053' is mentioned on line 382, but not defined == Missing Reference: 'RFC0768' is mentioned on line 370, but not defined == Missing Reference: 'RFC2234' is mentioned on line 379, but not defined ** Obsolete undefined reference: RFC 2234 (Obsoleted by RFC 4234) == Missing Reference: 'RFC1321' is mentioned on line 373, but not defined == Missing Reference: 'RFC3056' is mentioned on line 385, but not defined -- Obsolete informational reference (is this intentional?): RFC 2030 (Obsoleted by RFC 4330) -- Obsolete informational reference (is this intentional?): RFC 3300 (Obsoleted by RFC 3600) -- Obsolete informational reference (is this intentional?): RFC 3513 (Obsoleted by RFC 4291) -- No information found for draft-massar-v6ops-tic - is the name correct? Summary: 4 errors (**), 0 flaws (~~), 9 warnings (==), 11 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 IPv6 Operations J. Massar 3 Internet-Draft Unfix/SixXS 4 Expires: December 6, 2005 June 4, 2005 6 SixXS Heartbeat Protocol 7 draft-massar-v6ops-heartbeat-01 9 Status of this Memo 11 By submitting this Internet-Draft, each author represents that any 12 applicable patent or other IPR claims of which he or she is aware 13 have been or will be disclosed, and any of which he or she becomes 14 aware will be disclosed, in accordance with Section 6 of BCP 79. 16 Internet-Drafts are working documents of the Internet Engineering 17 Task Force (IETF), its areas, and its working groups. Note that 18 other groups may also distribute working documents as Internet- 19 Drafts. 21 Internet-Drafts are draft documents valid for a maximum of six months 22 and may be updated, replaced, or obsoleted by other documents at any 23 time. It is inappropriate to use Internet-Drafts as reference 24 material or to cite them other than as "work in progress." 26 The list of current Internet-Drafts can be accessed at 27 http://www.ietf.org/ietf/1id-abstracts.txt. 29 The list of Internet-Draft Shadow Directories can be accessed at 30 http://www.ietf.org/shadow.html. 32 This Internet-Draft will expire on December 6, 2005. 34 Copyright Notice 36 Copyright (C) The Internet Society (2005). 38 Abstract 40 This document proposes a heartbeat protocol for signalling 41 availability of hosts with a specific emphasis on providing a 42 signalling protocol for allowing dynamic non-24/7 endnodes to use 43 tunnel's of the various IPv6 Tunnel Brokers. 45 Table of Contents 47 1. Requirements notation . . . . . . . . . . . . . . . . . . . . 3 48 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 49 3. SixXS Heartbeat Protocol . . . . . . . . . . . . . . . . . . . 4 50 3.1 Heartbeat Command . . . . . . . . . . . . . . . . . . . . 5 51 3.2 Disable Command . . . . . . . . . . . . . . . . . . . . . 6 52 4. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 6 53 5. Security Considerations . . . . . . . . . . . . . . . . . . . 7 54 6. Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . 7 55 6.1 Host heartbeat . . . . . . . . . . . . . . . . . . . . . . 7 56 6.2 IPv6 in IPv4 tunnel heartbeat . . . . . . . . . . . . . . 8 57 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 58 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 9 59 8.1 References . . . . . . . . . . . . . . . . . . . . . . . . 9 60 8.2 Informative References . . . . . . . . . . . . . . . . . . 10 61 Author's Address . . . . . . . . . . . . . . . . . . . . . . . 10 62 Intellectual Property and Copyright Statements . . . . . . . . 11 64 1. Requirements notation 66 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 67 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 68 document are to be interpreted as described in [RFC2119]. 70 2. Introduction 72 When operating a IPv6 Tunnel Broker [RFC3053] with one or multiple 73 Tunnel Servers [RFC3053] or any other form of tunneling across the 74 Internet one doesn't want to send packets out to unsuspecting 75 endpoints. Unsuspecting endpoints are hosts which don't expect 76 traffic from the Tunnel Server. This is a common scenario when a 77 non-static but configured endpoint is used. The user enables the 78 tunnel to the current endpoint, uses it and then disconnects from the 79 Internet or gets another IP, due to dhcp policies or various other 80 reasons. Though the endpoint of the tunnel changes but there 81 currently is no way of automatically changing that endpoint or 82 notifying the Tunnel Server that it has changed. Current solutions 83 include using a script to update the endpoint on the Tunnel Broker's 84 website and various other non-standardized methods. 86 Then another host get to use the IP which terminates the tunnel and 87 suddenly it receives our tunneled packets. This could be seen as a 88 security risk as the new user of the IP could sniff the packets and 89 look at them or could even setup the tunnel and take over connections 90 which where active on that tunnel impersonating the former host using 91 the tunnel. Many hosts employ so called firewall or logging 92 facilities that will start complaining about packets being sent from 93 the Tunnel Server which they perceive as malicious. 95 The user of this firewall will in turn start complaining about abuse 96 and hack attempts which takes up time from the staff running the 97 Tunnel Broker and not even mentioning all the entities that will be 98 notified by these type of messages. 100 This protocol resolves this problem by specifying a oneway heartbeat 101 protocol. As long as the tunnel endpoint is able to send an 102 authenticated heartbeat packet the tunnel is kept configured on the 103 side of the Tunnel Server allowing two-way traffic to be sent. This 104 heartbeat protocol also allows for automatic tunnel reconfiguration 105 so that in the event of an IP change at the client side the tunnel 106 will be reconfigured allowing continued service without a (notable) 107 interruption. If the Tunnel Server doesn't receive a heartbeat for a 108 certain amount of time it can deem the endpoint as down and 109 deconfigure the tunnel. Taking these two into consideration will 110 stop the sending of tunneled packets and will thus avoid the 111 complaints which could have been brought up before. 113 This protocol covers all tunneling protocols which use at least one 114 set of inner and one set of outer addresses. Note that some of these 115 protocols already have a heartbeat mechanism in the protocol. In 116 those cases it is of course advisable to use that mechanism. 118 3. SixXS Heartbeat Protocol 120 The heartbeat packet is a UDP [RFC0768] packet to IANA assigned port 121 3740 of the server to which the signalling is to take place. 122 Schematically this will look like the following diagram. 124 +--------+ +--------+ 125 | Client | <--- Internet ---> | Server | 126 +--------+ +--------+ 128 The heartbeat packet consists out of one single line separated by 129 spaces and ending in a NULL. The first part is the command thus 130 allowing extension of this protocol if wanted in the future. 131 Extensions are allowed to put additional commands on seperate lines, 132 currently those extensions are not defined but these could be used 133 for transmitting other informations like load of the client which 134 could be useful in failover scenario's. 136 The basic heartbeat packet looks like the following in ABNF 137 [RFC2234]. The IPv6address and IPv4address ABNF are defined in 138 "APPENDIX B: ABNF Description of Text Representations" of the "IP 139 Version 6 Addressing Architecture" [RFC3513]. 141 packet = command SP epochtime SP md5-signature NULL 143 command = *%x41-5A [*(SP option)] 145 option = *VCHAR 147 epochtime = *DIGIT 149 md5-signature = 32(HEXDIG) 151 NULL = %x00 153 epochtime is the time in seconds since "00:00:00 1970-01-01 UTC" 154 which corresponds to the output of to unix "date +%s" command. Both 155 the client and the server are advised to be synchronized using NTP 156 [RFC2030] to make sure that the system clocks of the hosts don't 157 differ to much even after travelling the intermediate networks 158 between the client and the server. 160 The packet must be constructed first with the signature containing 161 the password for the tunnel. After construction the md5-signature 162 should be calculated and then replace the cleartext-password. The 163 packet can then be sent to the server. This method thus allows 164 verification of the password without sending the password over the 165 network. The Server does the same thing, taking the command part of 166 the packet, adding the password and calculating the md5 signature 167 which can then be compared with the md5-signature which was sent by 168 the client. If these match the packet can be processed further. 169 When the md5-signatures don't match the server MUST silently ignore 170 the packet. 172 Calculation of the MD5 signature [RFC1321] MUST be done over the 173 complete string excluding the NULL which is the string terminator in 174 C and most other programming languages. The scenarios section 175 demonstrates how this is performed. 177 The currently defined commands HEARTBEAT and DISABLE both use the 178 following common options to identify the endpoint for which this 179 heartbeat is meant: 181 common-options = ("HOST" endpoint | 182 "TUNNEL" outer-endpoint SP inner-endpoint) 184 outer endpoint = endpoint | "sender" 186 inner endpoint = endpoint 188 endpoint = IPv4address | IPv6address 190 An endpoint MAY also be a MAC address or other defined 'address'. 192 3.1 Heartbeat Command 194 This command is the main reason for this protocol to exist. It tells 195 the Tunnel Server that the current endpoint specified by both the 196 UDP's source address and the common-option's outer endpoint is still 197 accepting tunneled packets. 199 Specification: 201 command = "HEARTBEAT" SP common-options 203 Example's: 205 Heartbeat from client host 192.0.2.2 : 207 HEARTBEAT HOST 192.0.2.2 257209200 208 Heartbeat from client host 192.0.2.2 for IPv6 tunnel endpoint 2001: 209 db8::2 : 211 HEARTBEAT TUNNEL 2001:db8::2 192.0.2.2 409100400 213 In this example the server determines the inner-endpoint based on the 214 sender IP of the packet. This could be used in all cases but is 215 especially useful when the client is behind a NAT and doesn't know 216 it's external address. An application MUST not use the 'sender' 217 replacement when it knows it's public IP address. This because it 218 adds an extra verification step to the heartbeat. 220 HEARTBEAT TUNNEL 2001:db8::2 sender 257209200 222 3.2 Disable Command 224 The disable command explicitly sets a tunnel 'down' on the Tunnel 225 Server allowing a gracious and prompt shutdown of the tunnel on the 226 Tunnel Server. One could even employ this command to stop huge 227 traffic flows to the local endpoint which maybe could not cope with 228 the traffic passed over it through the tunnel. 230 Specification: 232 command = "DISABLE" SP common-options 234 Example: 236 Disable the tunnel endpoint 2001:db8::2 to 192.0.2.2 : 238 DISABLE TUNNEL 192.0.2.2 2001:db8::2 409100400 240 4. Acknowledgements 242 The protocol presented has formed during the existence of IPng [IPNG] 243 and SixXS [SIXXS] to allow the users of these tunnel broker systems 244 to have a dynamic non-static IPv4 endpoint. This protocol is already 245 in use by SixXS since October 2003 and has made a lot of users very 246 happy and I would like to thank the numerous users requesting the 247 support for dynamic non 24/7 reachable tunnel's. This was before 248 this protocol was implemented one of the few requirements of 249 obtaining a tunnel even when the project only consisted of one Tunnel 250 Server and was called IPng. 252 5. Security Considerations 254 The password used for creating the MD5 [RFC1321] signature should 255 never be made publicly available to 3rd parties otherwise that 3rd 256 party could sign a packet and automatically reconfigure the tunnel 257 endpoint. This could lead into the 3rd party sending traffic in both 258 directions and thus posing as the actual user. 260 The inclusion of the timestamp along with the verification on the 261 Tunnel Server side should guard against any replay attacks. The 262 Tunnel Server MUST limit that the local clock compared to the 263 timestamp from the packet MUST never differ for more than 60 seconds, 264 this allows for at least some latency and time-desync. 266 Any packet that is not well formed or contains a invalid signature 267 MUST be silently dropped. 269 A side effect of this protocol is that whenever the local host cannot 270 send a heartbeat in time to the Tunnel Server that it will 271 deconfigure the tunnel. Envision a Denial of Service over the tunnel 272 to the local endpoint. The local host's heartbeat cannot reach the 273 Tunnel Server which in turn will automatically disable the tunnel, 274 allowing the host to catch some breath again and thus effectively 275 implementing a poor mans rate limiting. 277 6. Scenarios 279 6.1 Host heartbeat 281 This scenario handles the case where a host, the client using either 282 IPv6 or IPv4, sends notifications of it's aliveness to a server. 283 This could be used for server management and fallover situations. In 284 combination with extension commands, used on the additional lines in 285 the packet the client could send along information about cpu load etc 286 allowing the server to gather information about those factors. 288 +--------+ +--------+ 289 | Client | <--- Internet ---> | Server | 290 +--------+ +--------+ 292 Server's IPv6 : 2001:db8::1/64 293 Client's IPv6 : 2001:db8::2/64 294 Password : point 295 The command, including the password and epochtime would be: 297 HEARTBEAT HOST 2001:db8::2 409100400 point 299 The packet to be transmitted, after md5 translation is: 301 HEARTBEAT HOST 2001:db8::2 409100400 302 bd72fb8d98b8698fa70cdfeb33bb7342 304 6.2 IPv6 in IPv4 tunnel heartbeat 306 This scenario handles the case where a IPv6 in IPv4 tunnel [RFC3056] 307 is setup between two hosts. This is the normal case for a Tunnel 308 Broker system with which a IPv4 only host is given acces to a IPv6 309 network. A tunnel like this can easily be setup using the Tunnel 310 Setup Protocol [I-D.vg-ngtrans-tsp], SixXS Configuration Service 311 [TIC] or similar protocols. A diagram of such a setup: 313 +--------+ +--------+ 314 | Client | <--- IPv6 in IPv4 Tunnel ---> | Server | 315 +--------+ +--------+ 317 Server's Outer IPv4 : 192.0.2.1 318 Server's Inner IPv6 : 2001:db8::1/64 319 Client's Outer IPv4 : 192.0.2.2 320 Client's Inner IPv6 : 2001:db8::2/64 321 Password : hartslag 323 The command would be: 325 HEARTBEAT TUNNEL 2001:db8::2 192.0.2.2 1051480800 hartslag 327 The data to be transmitted is: 329 HEARTBEAT TUNNEL 2001:db8::2 192.0.2.2 1051480800 330 3f0a026edb1b15e7c1a7a2d92b3c446a 332 Disabling the same tunnel can be accomplished using: 334 DISABLE TUNNEL 2001:db8::2 192.0.2.2 1055628000 hartslag 336 The data to be transmitted is: 338 DISABLE TUNNEL 2001:db8::2 192.0.2.2 1055628000 339 53d5bb7bfe4a3a80da01227da02cda24 341 The usage for which this protocol was defined in the first place is 342 signalling the server of the current IPv4 address of the client. 343 When the server receives a heartbeat packet it looks up the 344 configuration information based on the supplied Inner IPv6 address, 345 verifies that the password is correct by constructing the command and 346 generating the md5 signature. When the md5 signature is incorrect 347 the server MUST silently discard and ignore the packet. A check MUST 348 also be made comparing the Inner IPv4 address with the IPv4 address 349 from which the packet was sent, when incorrect the server MUST 350 discard and ignore the packet. Logs noting these event MAY be made 351 depending on the wishes of the administrator. When the password is 352 correct and thus the md5 verifies the server will configure the IPv6 353 in IPv4 tunnel to point at the IPv4 address specified by the Inner 354 IPv4 parameter. When the Inner IPv4 parameter is 'sender' the server 355 MUST use the IPv4 address from which the packet originates. 357 Note that TEST-NET [RFC3300] addresses could never reach a Tunnel 358 Server over the public Internet due to filtering of this 359 documentation prefix. 361 7. IANA Considerations 363 IANA already allocated port 3740 for the Heartbeat Protocol in April 364 2003. Thus no further actions from IANA are required. 366 8. References 368 8.1 References 370 [RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, 371 August 1980. 373 [RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, 374 April 1992. 376 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 377 Requirement Levels", BCP 14, RFC 2119, March 1997. 379 [RFC2234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax 380 Specifications: ABNF", RFC 2234, November 1997. 382 [RFC3053] Durand, A., Fasano, P., Guardini, I., and D. Lento, "IPv6 383 Tunnel Broker", RFC 3053, January 2001. 385 [RFC3056] Carpenter, B. and K. Moore, "Connection of IPv6 Domains 386 via IPv4 Clouds", RFC 3056, February 2001. 388 8.2 Informative References 390 [I-D.vg-ngtrans-tsp] 391 Blanchet, M., "Tunnel Setup Protocol (TSP)A Control 392 Protocol to Setup IPv6 or IPv4 Tunnels", 393 draft-vg-ngtrans-tsp-01 (work in progress), July 2002. 395 [IPNG] van Pelt, P. and J. Massar, "IPng - IPv6 Enduser 396 Deployment", . 398 [RFC2030] Mills, D., "Simple Network Time Protocol (SNTP) Version 4 399 for IPv4, IPv6 and OSI", RFC 2030, October 1996. 401 [RFC3300] Reynolds, J., Braden, R., Ginoza, S., and A. De La Cruz, 402 "Internet Official Protocol Standards", RFC 3300, 403 November 2002. 405 [RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6 406 (IPv6) Addressing Architecture", RFC 3513, April 2003. 408 [SIXXS] Massar, J. and P. van Pelt, "SixXS - IPv6 Deployment & 409 Tunnelbroker", . 411 [TIC] Massar, J., "TIC - Tunnel Information Control Protocol", 412 draft-massar-v6ops-tic-00 (work in progress), 413 January 2004, . 415 Author's Address 417 Jeroen Massar 418 Unfix/SixXS 419 Hofpoldersingel 45 420 Gouda 2807 LW 421 NL 423 Email: jeroen@unfix.org 424 URI: http://unfix.org/~jeroen/ 426 Intellectual Property Statement 428 The IETF takes no position regarding the validity or scope of any 429 Intellectual Property Rights or other rights that might be claimed to 430 pertain to the implementation or use of the technology described in 431 this document or the extent to which any license under such rights 432 might or might not be available; nor does it represent that it has 433 made any independent effort to identify any such rights. Information 434 on the procedures with respect to rights in RFC documents can be 435 found in BCP 78 and BCP 79. 437 Copies of IPR disclosures made to the IETF Secretariat and any 438 assurances of licenses to be made available, or the result of an 439 attempt made to obtain a general license or permission for the use of 440 such proprietary rights by implementers or users of this 441 specification can be obtained from the IETF on-line IPR repository at 442 http://www.ietf.org/ipr. 444 The IETF invites any interested party to bring to its attention any 445 copyrights, patents or patent applications, or other proprietary 446 rights that may cover technology that may be required to implement 447 this standard. Please address the information to the IETF at 448 ietf-ipr@ietf.org. 450 Disclaimer of Validity 452 This document and the information contained herein are provided on an 453 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 454 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET 455 ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, 456 INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE 457 INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 458 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 460 Copyright Statement 462 Copyright (C) The Internet Society (2005). This document is subject 463 to the rights, licenses and restrictions contained in BCP 78, and 464 except as set forth therein, the authors retain all their rights. 466 Acknowledgment 468 Funding for the RFC Editor function is currently provided by the 469 Internet Society.