idnits 2.17.1 draft-templin-v6ops-pdhost-13.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (October 2, 2017) is 2395 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- == Unused Reference: 'RFC0791' is defined on line 406, but no explicit reference was found in the text ** Obsolete normative reference: RFC 3315 (Obsoleted by RFC 8415) ** Obsolete normative reference: RFC 3633 (Obsoleted by RFC 8415) == Outdated reference: A later version (-13) exists of draft-ietf-v6ops-unique-ipv6-prefix-per-host-12 == Outdated reference: A later version (-08) exists of draft-templin-6man-rio-redirect-04 Summary: 2 errors (**), 0 flaws (~~), 4 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group F. Templin, Ed. 3 Internet-Draft Boeing Research & Technology 4 Intended status: Informational October 2, 2017 5 Expires: April 5, 2018 7 IPv6 Prefix Delegation for Hosts 8 draft-templin-v6ops-pdhost-13.txt 10 Abstract 12 IPv6 prefixes are typically delegated to requesting routers which 13 then use them to number their downstream-attached links and networks. 14 This document considers the case when the requesting router is a node 15 that acts as a host on behalf of its local applications and as a 16 router on behalf of any downstream networks. 18 Status of This Memo 20 This Internet-Draft is submitted in full conformance with the 21 provisions of BCP 78 and BCP 79. 23 Internet-Drafts are working documents of the Internet Engineering 24 Task Force (IETF). Note that other groups may also distribute 25 working documents as Internet-Drafts. The list of current Internet- 26 Drafts is at https://datatracker.ietf.org/drafts/current/. 28 Internet-Drafts are draft documents valid for a maximum of six months 29 and may be updated, replaced, or obsoleted by other documents at any 30 time. It is inappropriate to use Internet-Drafts as reference 31 material or to cite them other than as "work in progress." 33 This Internet-Draft will expire on April 5, 2018. 35 Copyright Notice 37 Copyright (c) 2017 IETF Trust and the persons identified as the 38 document authors. All rights reserved. 40 This document is subject to BCP 78 and the IETF Trust's Legal 41 Provisions Relating to IETF Documents 42 (https://trustee.ietf.org/license-info) in effect on the date of 43 publication of this document. Please review these documents 44 carefully, as they describe your rights and restrictions with respect 45 to this document. Code Components extracted from this document must 46 include Simplified BSD License text as described in Section 4.e of 47 the Trust Legal Provisions and are provided without warranty as 48 described in the Simplified BSD License. 50 Table of Contents 52 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 53 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 5 54 3. Multi-Addressing Considerations . . . . . . . . . . . . . . . 6 55 4. Multi-Addressing Alternatives for Delegated Prefixes . . . . 6 56 5. MLD/DAD Implications . . . . . . . . . . . . . . . . . . . . 7 57 6. Dynamic Routing Protocol Implications . . . . . . . . . . . . 7 58 7. IPv6 Neighbor Discovery Implications . . . . . . . . . . . . 8 59 8. ICMPv6 Implications . . . . . . . . . . . . . . . . . . . . . 8 60 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 61 10. Security Considerations . . . . . . . . . . . . . . . . . . . 9 62 11. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 9 63 12. References . . . . . . . . . . . . . . . . . . . . . . . . . 10 64 12.1. Normative References . . . . . . . . . . . . . . . . . . 10 65 12.2. Informative References . . . . . . . . . . . . . . . . . 11 66 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 12 68 1. Introduction 70 IPv6 Prefix Delegation (PD) entails 1) the communication of a prefix 71 from a delegating router to a requesting router, 2) a representation 72 of the prefix in the delegating router's routing table, and 3) a 73 control messaging service between the delegating and requesting 74 routers to maintain prefix lifetimes. Following delegation, the 75 prefix is available for the requesting router's exclusive use and is 76 not shared with any other nodes. This document considers the case 77 when the requesting router is a node that acts as a host on behalf of 78 its local applications and as a router on behalf of any downstream 79 networks. The following paragraphs present possibilities for node 80 behavior upon receipt of a delegated prefix. 82 For nodes that connect downstream-attached networks (e.g., a 83 cellphone that connects a "tethered" Internet of Things (IoT) 84 network), a Delegating Router 'D' delegates a prefix 'P' to a 85 Requesting node 'R' as shown in Figure 1: 87 +---------------------+ 88 |Delegating Router 'D'| 89 | (Delegate 'P') | 90 +----------+----------+ 91 | 92 | Upstream link 93 | 94 +----------+----------+ 95 | Upstream Interface | 96 +---------------------+ 97 | | 98 | Requesting node 'R' | 99 | (Receive 'P') | 100 | | 101 +--+-+--+-+--+-----+--+ 102 |A1| |A2| |A3| ... |Aj| 103 +--+-+--+-+--+-----+--+ 104 | Downstream Interface| 105 +----------+----------+ 106 | 107 | Downstream link 108 | 109 X----+-------------+--------+----+---------------+---X 110 | | | | 111 +---++-+--+ +---++-+--+ +---++-+--+ +---++-+--+ 112 | |Ak| | | |Al| | | |Am| | | |A*| | 113 | +--+ | | +--+ | | +--+ | | +--+ | 114 | Host H1 | | Host H2 | | Host H3 | ... | Host Hn | 115 +---------+ +---------+ +---------+ +---------+ 117 <-------------- Downstream Network -------------> 119 Figure 1: Classic Routing Model 121 In this figure, when Delegating Router 'D' delegates prefix 'P', it 122 inserts 'P' into its routing table with Requesting node 'R' as the 123 next hop. Meanwhile, 'R' receives 'P' via an upstream interface and 124 sub-delegates 'P' to its downstream external (physical) and/or 125 internal (virtual) networks. 'R' assigns addresses 'A(*)' taken from 126 'P' to downstream interfaces, and Hosts 'H(i)' on downstream networks 127 assign addresses 'A(*)' taken from 'P' to their interface attachments 128 to the downstream link. 'R' then acts as a router between hosts 129 'H(i)' on downstream networks and correspondents reachable via other 130 interfaces. 'R' can also act as a host on behalf of its local 131 applications. 133 This document also considers the case when 'R' does not have any 134 downstream interfaces, and can use 'P' solely for its own internal 135 addressing purposes. In that case, 'R' assigns 'P' to a virtual 136 interface (e.g., a loopback) that fills the role of a downstream 137 interface. 139 'R' can then function under the weak end system (aka "weak host") 140 model [RFC1122][RFC8028] by assigning addresses taken from 'P' to a 141 virtual interface as shown in Figure 2: 143 +---------------------+ 144 |Delegating Router 'D'| 145 | (Delegate 'P') | 146 +----------+----------+ 147 | 148 | Upstream link 149 | 150 +----------+----------+ 151 | Upstream Interface | 152 +---------------------+ 153 | | 154 | Requesting node 'R' | 155 | (Receive 'P') | 156 | | 157 +--+-+--+-+--+-----+--+ 158 |A1| |A2| |A3| ... |An| 159 +--+-+--+-+--+-----+--+ 160 | Virtual Interface | 161 +---------------------+ 163 Figure 2: Weak End System Model 165 'R' could instead function under the strong end system (aka "strong 166 host") model [RFC1122][RFC8028] by assigning IPv6 addresses taken 167 from 'P' to an upstream interface as shown in Figure 3: 169 +---------------------+ 170 |Delegating Router 'D'| 171 | (Delegate 'P') | 172 +----------+----------+ 173 | 174 | Upstream link 175 | 176 +----------+----------+ 177 | Upstream Interface | 178 +--+-+--+-+--+-----+--+ 179 |A1| |A2| |A3| ... |An| 180 +--+-+--+-+--+-----+--+ 181 | | 182 | Requesting node 'R' | 183 | (Receive 'P') | 184 | | 185 +---------------------+ 186 | Virtual Interface | 187 +---------------------+ 189 Figure 3: Strong End System Model 191 The major benefit for a node managing a delegated prefix in either 192 the weak or strong end system models is multi-addressing. With IPv6 193 PD-based multi-addressing, the node can configure an unlimited supply 194 of addresses to make them available for local applications without 195 requiring coordination with other nodes on upstream interfaces. 197 The following sections present considerations for nodes that employ 198 IPv6 PD mechanisms. 200 2. Terminology 202 The terminology of the normative references apply, and the terms 203 "node", "host" and "router" are the same as defined in [RFC8200]. 205 The following terms are defined for the purposes of this document: 207 shared prefix 208 an IPv6 prefix that may be advertised to more than one node on the 209 link, e.g., in a Router Advertisement (RA) message Prefix 210 Information Option (PIO) [RFC4861]. 212 individual prefix 213 an IPv6 prefix that is advertised to exactly one node on the link, 214 where the node may be unaware that the prefix is individual and 215 may not participate in prefix maintenance procedures. An example 216 individual prefix service is documented in 217 [I-D.ietf-v6ops-unique-ipv6-prefix-per-host]. 219 delegated prefix 220 an IPv6 prefix that is explicitly delegated to a node for its own 221 exclusive use, where the node is an active participant in prefix 222 delegation and maintenance procedures. An example IPv6 PD service 223 is the Dynamic Host Configuration Protocol for IPv6 (DHCPv6) 224 [RFC3315][RFC3633]. An alternative service based solely on IPv6 225 Neighbor Discovery (ND) messaging has also been proposed 226 [I-D.pioxfolks-6man-pio-exclusive-bit]. 228 3. Multi-Addressing Considerations 230 IPv6 allows nodes to assign multiple addresses to a single interface. 231 [RFC7934] discusses options for multi-addressing as well as use cases 232 where multi-addressing may be desirable. Address configuration 233 options for multi-addressing include StateLess Address 234 AutoConfiguration (SLAAC) [RFC4862], DHCPv6 address configuration 235 [RFC3315], manual configuration, etc. 237 Nodes configure addresses from a shared or individual prefix and 238 assign them to the upstream interface over which the prefix was 239 received. When the node assigns the addresses, it is required to use 240 Multicast Listener Discovery (MLD) [RFC3810] to join the appropriate 241 solicited-node multicast group(s) and to use the Duplicate Address 242 Detection (DAD) algorithm [RFC4862] to ensure that no other node 243 configures a duplicate address. 245 In contrast, a node that configures addresses from a delegated prefix 246 can assign them without invoking MLD/DAD on an upstream interface, 247 since the prefix has been delegated to the node for its own exclusive 248 use and is not shared with any other nodes. 250 4. Multi-Addressing Alternatives for Delegated Prefixes 252 When a node receives a delegated prefix, it has many alternatives for 253 provisioning the prefix to its local interfaces and/or downstream 254 networks. [RFC7278] discusses alternatives for provisioning a prefix 255 obtained by a User Equipment (UE) device under the 3rd Generation 256 Partnership Program (3GPP) service model. This document considers 257 the more general case when the node receives a delegated prefix 258 explicitly provided for its own exclusive use. 260 When the node receives the prefix, it can distribute the prefix to 261 downstream networks and configure one or more addresses for itself on 262 downstream interfaces. The node then acts as a router on behalf of 263 its downstream networks and configures a default route via a neighbor 264 on an upstream interface. 266 The node could instead (or in addition) use portions of the delegated 267 prefix for its own multi-addressing purposes. In a first 268 alternative, the node can assign as many addresses as it wants from 269 the prefix to virtual interfaces. In that case, applications running 270 on the node can use the addresses according to the weak end system 271 model. 273 In a second alternative, the node can assign as many addresses as it 274 wants from the prefix to the upstream interface over which the prefix 275 was received. In that case, applications running on the node can use 276 the addresses according to the strong end system model. 278 In both of these latter two cases, the node assigns the prefix itself 279 to a virtual interface so that unused addresses from the prefix are 280 correctly identified as unreachable. The node then acts as a host on 281 behalf of its local applications even though neighbors on the 282 upstream link see it as a router. 284 5. MLD/DAD Implications 286 When a node configures addresses for itself from a shared or 287 individual prefix, it performs MLD/DAD by sending multicast messages 288 over upstream interfaces to test whether there is another node on the 289 link that configures a duplicate address. When there are many such 290 addresses and/or many such nodes, this could result in substantial 291 multicast traffic that affects all nodes on the link. 293 When a node configures addresses for itself from a delegated prefix, 294 it can configure as many addresses as it wants but does not perform 295 MLD/DAD for any of the addresses over upstream interfaces. This 296 means that the node can configure arbitrarily many addresses without 297 causing any multicast messaging over the upstream interface that 298 could disturb other nodes. 300 6. Dynamic Routing Protocol Implications 302 The node can be configured to either participate or not participate 303 in a dynamic routing protocol over the upstream interface, according 304 to the deployment model. When there are many nodes on the upstream 305 link, dynamic routing protocol participation might be impractical due 306 to scaling limitations, and may also be exacerbated by factors such 307 as node mobility. 309 Unless it participates in a dynamic routing protocol, the node 310 initially has only a default route pointing to a neighbor via an 311 upstream interface. This means that packets sent by the node over an 312 upstream interface will initially go through a default router even if 313 there is a better first-hop node on the link. 315 7. IPv6 Neighbor Discovery Implications 317 The node acts as a simple host to send Router Solicitation (RS) 318 messages over upstream interfaces (i.e., the same as described in 319 Section 4.2 of [RFC7084]) but also sets the "Router" flag to TRUE in 320 its Neighbor Advertisement messages. The node considers the upstream 321 interfaces as non-advertising interfaces [RFC4861], i.e., it does not 322 send RA messages over the upstream interfaces. 324 The current first-hop router may send a Redirect message that updates 325 the node's neighbor cache so that future packets can use a better 326 first-hop node on the link. The Redirect can apply either to a 327 singleton destination address, or to an entire destination prefix as 328 described in [I-D.templin-6man-rio-redirect]. 330 8. ICMPv6 Implications 332 The Internet Control Message Protocol for IPv6 (ICMPv6) includes a 333 set of control message types [RFC4443] including Destination 334 Unreachable (DU). 336 According to [RFC4443], routers should return DU messages (subject to 337 rate limiting) with code 0 ("No route to destination") when a packet 338 arrives for which there is no matching entry in the routing table, 339 and with code 3 ("Address unreachable") when the IPv6 destination 340 address cannot be resolved. 342 According to [RFC4443], hosts should return DU messages (subject to 343 rate limiting) with code 3 to internal applications when the IPv6 344 destination address cannot be resolved, and with code 4 ("Port 345 unreachable") if the IPv6 destination address is one of its own 346 addresses but the transport protocol has no listener. 348 Nodes that obtain and manage delegated prefixes per this document 349 observe the same procedures as described for both routers and hosts 350 above. 352 9. IANA Considerations 354 This document introduces no IANA considerations. 356 10. Security Considerations 358 Security considerations for IPv6 Neighbor Discovery [RFC4861] and any 359 applicable PD mechanisms apply to this document. 361 Additionally, the node may receive unwanted IPv6 packets via an 362 upstream interface that match a delegated prefix but do not match 363 either a configured IPv6 address or a transport listener. In that 364 case, the node drops the packets and observes the "Destination 365 Unreachable - Address/Port unreachable" procedures discussed in 366 Section 8. 368 The node may also receive IPv6 packets via an upstream interface that 369 do not match any of the node's delegated prefixes. In that case, the 370 node drops the packets and observes the "Destination Unreachable - No 371 route to destination" procedures discussed in Section 8. Dropping 372 the packets is necessary to avoid a reflection attack that would 373 cause the node to forward packets received from an upstream interface 374 via the same or a different upstream interface. 376 In all cases, the node must decide whether or not to send DUs 377 according to the specific operational scenario. In trusted networks, 378 the node should send DU messages to provide useful information to 379 potential correspondents. In untrusted networks, the node can 380 refrain from sending DU messages to avoid providing sensitive 381 information to potential attackers. 383 11. Acknowledgements 385 This work was motivated by discussions on the v6ops list. Mark Smith 386 pointed out the need to consider MLD as well as DAD for the 387 assignment of addresses to interfaces. Ricardo Pelaez-Negro, Edwin 388 Cordeiro, Fred Baker, Naveen Lakshman, Ole Troan, Bob Hinden, Brian 389 Carpenter, Joel Halpern and Albert Manfredi provided useful comments 390 that have greatly improved the document. 392 This work is aligned with the NASA Safe Autonomous Systems Operation 393 (SASO) program under NASA contract number NNA16BD84C. 395 This work is aligned with the FAA as per the SE2025 contract number 396 DTFAWA-15-D-00030. 398 This work is aligned with the Boeing Information Technology (BIT) 399 MobileNet program and the Boeing Research & Technology (BR&T) 400 enterprise autonomy program. 402 12. References 404 12.1. Normative References 406 [RFC0791] Postel, J., "Internet Protocol", STD 5, RFC 791, 407 DOI 10.17487/RFC0791, September 1981, 408 . 410 [RFC3315] Droms, R., Ed., Bound, J., Volz, B., Lemon, T., Perkins, 411 C., and M. Carney, "Dynamic Host Configuration Protocol 412 for IPv6 (DHCPv6)", RFC 3315, DOI 10.17487/RFC3315, July 413 2003, . 415 [RFC3633] Troan, O. and R. Droms, "IPv6 Prefix Options for Dynamic 416 Host Configuration Protocol (DHCP) version 6", RFC 3633, 417 DOI 10.17487/RFC3633, December 2003, 418 . 420 [RFC3810] Vida, R., Ed. and L. Costa, Ed., "Multicast Listener 421 Discovery Version 2 (MLDv2) for IPv6", RFC 3810, 422 DOI 10.17487/RFC3810, June 2004, 423 . 425 [RFC4443] Conta, A., Deering, S., and M. Gupta, Ed., "Internet 426 Control Message Protocol (ICMPv6) for the Internet 427 Protocol Version 6 (IPv6) Specification", STD 89, 428 RFC 4443, DOI 10.17487/RFC4443, March 2006, 429 . 431 [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, 432 "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, 433 DOI 10.17487/RFC4861, September 2007, 434 . 436 [RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless 437 Address Autoconfiguration", RFC 4862, 438 DOI 10.17487/RFC4862, September 2007, 439 . 441 [RFC8200] Deering, S. and R. Hinden, "Internet Protocol, Version 6 442 (IPv6) Specification", STD 86, RFC 8200, 443 DOI 10.17487/RFC8200, July 2017, 444 . 446 12.2. Informative References 448 [I-D.ietf-v6ops-unique-ipv6-prefix-per-host] 449 Brzozowski, J. and G. Velde, "Unique IPv6 Prefix Per 450 Host", draft-ietf-v6ops-unique-ipv6-prefix-per-host-12 451 (work in progress), September 2017. 453 [I-D.pioxfolks-6man-pio-exclusive-bit] 454 Kline, E. and M. Abrahamsson, "IPv6 Router Advertisement 455 Prefix Information Option eXclusive Flag", draft- 456 pioxfolks-6man-pio-exclusive-bit-02 (work in progress), 457 March 2017. 459 [I-D.templin-6man-rio-redirect] 460 Templin, F. and j. woodyatt, "Route Information Options in 461 IPv6 Neighbor Discovery", draft-templin-6man-rio- 462 redirect-04 (work in progress), August 2017. 464 [RFC1122] Braden, R., Ed., "Requirements for Internet Hosts - 465 Communication Layers", STD 3, RFC 1122, 466 DOI 10.17487/RFC1122, October 1989, 467 . 469 [RFC7084] Singh, H., Beebee, W., Donley, C., and B. Stark, "Basic 470 Requirements for IPv6 Customer Edge Routers", RFC 7084, 471 DOI 10.17487/RFC7084, November 2013, 472 . 474 [RFC7278] Byrne, C., Drown, D., and A. Vizdal, "Extending an IPv6 475 /64 Prefix from a Third Generation Partnership Project 476 (3GPP) Mobile Interface to a LAN Link", RFC 7278, 477 DOI 10.17487/RFC7278, June 2014, 478 . 480 [RFC7934] Colitti, L., Cerf, V., Cheshire, S., and D. Schinazi, 481 "Host Address Availability Recommendations", BCP 204, 482 RFC 7934, DOI 10.17487/RFC7934, July 2016, 483 . 485 [RFC8028] Baker, F. and B. Carpenter, "First-Hop Router Selection by 486 Hosts in a Multi-Prefix Network", RFC 8028, 487 DOI 10.17487/RFC8028, November 2016, 488 . 490 Author's Address 492 Fred L. Templin (editor) 493 Boeing Research & Technology 494 P.O. Box 3707 495 Seattle, WA 98124 496 USA 498 Email: fltemplin@acm.org