One document matched: draft-ietf-geopriv-lis-discovery-05.xml
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY RFC2119 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC2131 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2131.xml">
<!ENTITY RFC2818 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2818.xml">
<!ENTITY RFC3118 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3118.xml">
<!ENTITY RFC3315 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3315.xml">
<!ENTITY RFC3396 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3396.xml">
<!ENTITY RFC3693 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3693.xml">
<!ENTITY RFC3958 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3958.xml">
<!ENTITY RFC4572 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4572.xml">
<!ENTITY RFC4702 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4702.xml">
<!ENTITY RFC4704 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4704.xml">
<!ENTITY RFC4848 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4848.xml">
<!ENTITY I-D.ietf-geopriv-http-location-delivery PUBLIC "" "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-geopriv-http-location-delivery.xml">
<!ENTITY I-D.ietf-geopriv-l7-lcp-ps PUBLIC "" "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-geopriv-l7-lcp-ps.xml">
<!-- <!ENTITY I-D.ietf-dhc-dhcpv6-opt-dnsdomain PUBLIC "" "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-dhc-dhcpv6-opt-dnsdomain.xml"> -->
]>
<?rfc symrefs="yes"?>
<?rfc sortrefs="no"?>
<?rfc iprnotified="yes"?>
<?rfc strict="yes"?>
<?rfc toc="yes"?>
<?rfc tocindent="yes"?>
<rfc category="std" ipr="full3978">
<front>
<title abbrev="LIS Discovery">
Discovering the Local Location Information Server (LIS)
</title>
<author initials="M." surname="Thomson"
fullname="Martin Thomson">
<organization>Andrew</organization>
<address>
<postal>
<street>PO Box U40</street>
<city>Wollongong University Campus</city>
<region>NSW</region>
<code>2500</code>
<country>AU</country>
</postal>
<phone>+61 2 4221 2915</phone>
<email>martin.thomson@andrew.com</email>
<uri>http://www.andrew.com/</uri>
</address>
</author>
<author initials="J." surname="Winterbottom"
fullname="James Winterbottom">
<organization>Andrew</organization>
<address>
<postal>
<street>PO Box U40</street>
<city>Wollongong University Campus</city>
<region>NSW</region>
<code>2500</code>
<country>AU</country>
</postal>
<phone>+61 2 4221 2938</phone>
<email>james.winterbottom@andrew.com</email>
<uri>http://www.andrew.com/</uri>
</address>
</author>
<date month="December" year="2008"/>
<area>Application</area>
<workgroup>GEOPRIV</workgroup>
<keyword>Internet-Draft</keyword>
<keyword>Discovery</keyword>
<keyword>DHCP</keyword>
<keyword>U-NAPTR</keyword>
<keyword>HELD</keyword>
<keyword>LIS</keyword>
<abstract>
<t>A method is described for the discovery of a Location Information Server. The method uses a Dynamic Host Configuration Protocol (DHCP) option. DHCP options are defined for both IPv4 and IPv6 DHCP. A URI-enabled NAPTR (U-NAPTR) method is described for use where the DHCP option is unsuccessful. This document defines a U-NAPTR Application Service for a LIS, with a specific Application Protocol for the HTTP Enabled Location Delivery (HELD) protocol.
</t>
</abstract>
</front>
<middle>
<section title="Introduction and Overview">
<t>The location of a device is a useful and sometimes necessary part of many services. A Location Information Server (LIS) is responsible for providing that location information to devices with an access network. The LIS uses knowledge of the access network and its physical topology to generate and serve location information to devices.
</t>
<t>Each access network requires specific knowledge about topology. Therefore, it is important to discover the LIS that has the specific knowledge necessary to locate a device. That is, the LIS that serves the current access network. Automatic discovery is important where there is any chance of movement outside a single access network. Reliance on static configuration can lead to unexpected errors if a device moves between access networks.
</t>
<t>This document describes DHCP options and DNS records that a device can use to discover a LIS.
</t>
<t>The product of a discovery process, such as the one described in this document, is the address of the service. In this document, the result is an http: or https: URI, which identifies a LIS.
</t>
<t>The URI result from the discovery process is suitable for location configuration only; that is, the client MUST dereference the URI using the process described in <xref target="I-D.ietf-geopriv-http-location-delivery">HELD</xref>. URIs discovered in this way are not "location by reference" URIs; dereferencing one of them provides the location of the requester only. Clients MUST NOT embed these URIs in fields in other protocols designed to carry the location of the client.
</t>
<section anchor="intro-dhcp" title="DHCP Discovery">
<t>DHCP (<xref target="RFC2131"/>, <xref target="RFC3315"/>) is a commonly used mechanism for providing bootstrap configuration information allowing a device to operate in a specific network environment. The bulk of DHCP information is largely static; consisting of configuration information that does not change over the period that the device is attached to the network. Physical location information might change over this time, however the address of the LIS does not. Thus, DHCP is suitable for configuring a device with the address of a LIS.
</t>
</section>
<section anchor="intro-dns" title="U-NAPTR Discovery">
<t>Where DHCP is not available, the DNS might be able to provide a URI. This document describes a method that uses <xref target="RFC4848">URI-enabled NAPTR (U-NAPTR)</xref>, a Dynamic Delegation Discovery Service (DDDS) profile that supports URI results.
</t>
<t>For the LIS discovery DDDS application, an Application Service tag <spanx style="verb">LIS</spanx> and an Application Protocol tag <spanx style="verb">HELD</spanx> are created and registered with the IANA. Taking a domain name, this U-NAPTR application uses the two tags to determine the LIS URI.
</t>
<t>A domain name is the crucial input to the U-NAPTR resolution process. <xref target="dn"/> of this document describes several methods for deriving an appropriate domain name.
</t>
</section>
<section anchor="terminology" title="Terminology">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in <xref target="RFC2119"/>.
</t>
<t>This document also uses the term "device" to refer to an end host, or client consistent with its use in HELD. In HELD and <xref target="RFC3693">RFC3693</xref> parlance, the Device is also the Target.
</t>
<t>The terms "access network" refers to the network that a device connects to for Internet access. The "access network provider" is the entity that operates the access network. This is consistent with the definition in <xref target="I-D.ietf-geopriv-l7-lcp-ps"/> which combines the Internet Access Provider (IAP) and Internet Service Provider (ISP). The access network provider is responsible for allocating the device a public IP address and for directly or indirectly providing a LIS service.
</t>
</section>
</section>
<section title="LIS Discovery Using DHCP">
<t>DHCP allows the access network provider to specify the address of a LIS as part of network configuration. If the device is able to acquire a LIS URI using DHCP then this URI is used directly; the U-NAPTR process is not necessary if this option is provided.
</t>
<t>This document registers DHCP options for a LIS address for both IPv4 and IPv6.
</t>
<section anchor="lis-auth" title="LIS Authentication">
<t>The DHCP LIS URI option includes an optional authentication method for the LIS. If an https: URI is provided for the LIS, the option can optionally include a fingerprint of the server certificate. The device can use this fingerprint to authenticate the server.
</t>
<t><xref target="RFC2818">HTTP over TLS</xref> describes how a host can be authenticated based on an expected domain name. Relying exclusively on a domain name for authentication is not appropriate for a LIS, since the domain name associated with the access network might not be known. Indeed, it is often innapropriate to attempt to assign any particular domain name to an access network.
</t>
<t>This specification defines an alternative means of establishing an expected identity for the server that uses a certificate fingerprint. The DHCP option includes a fingerprint for the server certificate that is offered by the LIS when the associated URI is accessed.
</t>
<t>An access network operator is still able to nominate authentication based on a domain name. If no fingerprint information is included, the device MUST authenticate the server using the method described in Section 3.1 of <xref target="RFC2818">RFC 2818</xref>. If a fingerprint exists, the domain name method MUST NOT be used.
</t>
<t>The certificate fingerprint can be ignored if the LIS URI doesn't indicate a protocol that supports exchange of certificates (such as http:). The LIS MUST be considered unauthenticated.
<list style="hanging">
<t hangText="Note:">Whether the device goes on to use the information provided by an unauthenticated LIS depends on device policy. A device might choose to continue with alternative methods of discovery before falling back to an unauthenticated LIS.
</t>
</list>
</t>
<t>The mechanism to generate a fingerprint is to take the hash of the DER-encoded certificate using a cryptographically strong algorithm. The hash algorithm used for generating the fingerprint is identified by a textual name taken from the IANA registry "Hash Function Textual Names" defined in <xref target="RFC4572"/>. Implementations MUST support SHA-1 as the hash algorithm and use the label <spanx style="verb">sha-1</spanx> to identify the SHA-1 algorithm.
</t>
<t>Multiple fingerprints MAY be included. If a hash algorithm is indicated, but not supported by a device, it MUST choose the first algorithm that it supports. If any supported fingerprint does not match, the LIS MUST be considered as unauthenticated. If no hash algorithm is supported by the device, it MUST consider the LIS to be unauthenticated.
</t>
</section>
<section anchor="dhcpv4" title="DHCPv4 Option for a LIS Address">
<t>This section defines a DHCP for IPv4 (DHCPv4) option for the address of a LIS.
</t>
<figure anchor="dhcpv4option" title="DHCPv4 LIS URI Option Example">
<artwork><![CDATA[
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| LIS_URI | Length | F-Code(1) | F-Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Hash-Type-Len | Hash-Type ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Fingerprint-Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| F-Code(0) | URI .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| URI (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork>
</figure>
<t><list style="hanging">
<t hangText="LIS_URI:">The IANA assigned option number (TBD). [[IANA/RFC-Editor Note: Please replace TBD with the assigned DHCPv4 option code.]]</t>
<t hangText="Length:">The length of the entire LIS URI option in octets.</t>
<t hangText="F-Code:">A single octet indicates the type of data that follows: fingerprint or URI. A value of 1 indicates that the following data includes a certificate fingerprint. A value of 0 indicates that no more supplementary data is included and the URI follows. An <spanx style="verb">F-Code</spanx> with a value of 0 MUST be included.
<vspace blankLines="1"/>
Values other than zero or one MAY be ignored. Any other value MUST be specified in a standards track RFC that SHOULD establish an IANA registry.
</t>
<t hangText="F-Length:">If the <spanx style="verb">F-Code</spanx> is non-zero, it MUST be followed by an octet that indicates the length, in octets, of the data. This value includes the sum of the lengths of: <spanx style="verb">Hash-Type-Len</spanx>, <spanx style="verb">Hash-Type</spanx>, and <spanx style="verb">Fingerprint-Value</spanx>.
</t>
<t hangText="Hash-Type-Len:">The length, in octets, of the <spanx style="verb">Hash-Type</spanx> field.
</t>
<t hangText="Hash-Type:">A text tag that identifies the hash algorithm used to generate the fingerprint. The set of values are defined in the "Hash Function Textual Names" IANA registry <xref target="RFC4572"/>.
</t>
<t hangText="Fingerprint-Value:">The octet values of the certificate fingerprint. The length of this field is defined by the hash algorithm and MUST match the remainder of the fingerprint data. If this does not equal the value of <spanx style="verb">F-Length</spanx> less the length <spanx style="verb">Hash-Type-Len</spanx> and <spanx style="verb">Hash-Type</spanx>, the fingerprint MUST be considered invalid.
<list style="hanging"><t hangText="Note:">An invalid fingerprint is not equivalent to no fingerprint.</t></list>
</t>
<t hangText="URI:">The address of the LIS. The URI takes the remainder of the DHCP option. The URI MUST NOT be NULL terminated.
<vspace blankLines="1"/>
The DHCPv4 version of this URI SHOULD NOT exceed 225 octets in length, but MAY be extended by concatenating multiple option values, as described in <xref target="RFC3396"/>.
</t>
</list>
</t>
</section>
<section anchor="dhcpv6" title="DHCPv6 Option for a LIS Address">
<t>This section defines a DHCP for IPv6 (DHCPv6) option for the address of a LIS. The DHCPv6 option for this parameter is similarly formatted to the DHCPv4 option.
</t>
<figure anchor="dhcpv6option" title="DHCPv6 LIS URI Option">
<artwork><![CDATA[
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_LIS_URI | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| F-Code(1) | F-Length | Hash-Type-Len | Hash-Type ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Fingerprint-Value ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| F-Code(0) | URI .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| URI (cont.) ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork>
</figure>
<t><list style="hanging">
<t hangText="OPTION_LIS_URI:">The IANA assigned option number (TBD). [[IANA/RFC-Editor Note: Please replace TBD with the assigned DHCPv6 option code.]]</t>
<t hangText="Length:">The length of the LIS URI option in octets.</t>
<t>The format of remainder of the LIS URI option is identical to the DHCPv4 option.
</t>
</list>
</t>
</section>
</section>
<section anchor="u-naptr" title="U-NAPTR for LIS Discovery">
<t>U-NAPTR resolution for a LIS takes a domain name as input and produces a URI that identifies the LIS. This process also requires an Application Service tag and an Application Protocol tag, which differentiate LIS-related NAPTR records from other records for that domain.
</t>
<t><xref target="iana-as"/> defines an Application Service tag of <spanx style="verb">LIS</spanx>, which is used to identify the location service for a particular domain. The Application Protocol tag <spanx style="verb">HELD</spanx>, defined in <xref target="iana-ap"/>, is used to identify a LIS that understands the <xref target="I-D.ietf-geopriv-http-location-delivery">HELD protocol</xref>.
</t>
<figure anchor="sampleNAPTR" title="Sample LIS:HELD Service NAPTR Records">
<preamble>The NAPTR records in the following example demonstrate the use of the Application Service and Protocol tags. Iterative NAPTR resolution is used to delegate responsibility for the LIS service from <spanx style="verb">zonea.example.net.</spanx> and <spanx style="verb">zoneb.example.net.</spanx> to <spanx style="verb">outsource.example.com.</spanx>.
</preamble>
<artwork><![CDATA[
zonea.example.net.
;; order pref flags
IN NAPTR 100 10 "" "LIS:HELD" ( ; service
"" ; regex
outsource.example.com. ; replacement
)
zoneb.example.net.
;; order pref flags
IN NAPTR 100 10 "" "LIS:HELD" ( ; service
"" ; regex
outsource.example.com. ; replacement
)
outsource.example.com.
;; order pref flags
IN NAPTR 100 10 "u" "LIS:HELD" ( ; service
"!*.!https://lis.example.org:4802/?c=ex!" ; regex
. ; replacement
)
]]>
</artwork>
</figure>
<t>Details for the <spanx style="verb">LIS</spanx> Application Service tag and the <spanx style="verb">HELD</spanx> Application Protocol tag are included in <xref target="iana"/>.
</t>
<t>U-NAPTR MUST only be used if the DHCP LIS URI option is not available.
</t>
<t>An https: LIS URI that is a product of U-NAPTR MUST be authenticated using the domain name method described in Section 3.1 of <xref target="RFC2818">RFC 2818</xref>.
</t>
<section anchor="dn" title="Determining a Domain Name">
<t>The U-NAPTR discovery method described requires a domain name as input. This document does not specify how that domain name is acquired by a device. If a device knows one or more of the domain names assigned to it, it MAY attempt to use each domain name as input. Static configuration of a device is possible if a domain name is known to work for this purpose.
</t>
<t>A fully qualified domain name (FQDN) for the device might be provided by a DHCP server (<xref target="RFC4702"/> for DHCPv4, <xref target="RFC4704"/> for DHCPv6). DHCPv4 option 15 <xref target="RFC2131"/> could also be used as a source of a domain name suffix for the device. If DHCP and any of these options are available, these values could be used as input the U-NAPTR procedure; however, implementers need to be aware that many DHCP servers do not provide a sensible value for these options.
</t>
<!-- If the DHC WG ever start publishing RFCs from their expired drafts, this one might be useful:
<t>DHCP for IPv6 provides a single domain name suffix that can be used in the same manner, as a described in <xref target="I-D.ietf-dhc-dhcpv6-opt-dnsdomain"/>.
</t> -->
</section>
</section>
<section anchor="procedure" title="Overall Discovery Procedure">
<t>The individual components of discovery are combined into a single discovery procedure. Some networks maintain a topology analogous to an onion and are comprised of layers, or segments, separating hosts from the Internet through intermediate networks. Applying the individual discovery methods in an order that favours a physically proximate LIS over a remote LIS is preferred.
</t>
<t>A host MUST support DHCP discovery and MAY support U-NAPTR discovery. The process described in this document is known to not work in a very common deployment scenario, namely the fixed wired environment described in Section 3.1 of <xref target="I-D.ietf-geopriv-l7-lcp-ps"/>. Alternative methods of discovery to address this limitation are likely.
</t>
<t>The following process ensures a greater likelihood of a LIS in close physical proximity being discovered:
<list style="numbers">
<t>Request the DHCP LIS URI Option for each network interface.</t>
<t>Use U-NAPTR to discover a LIS URI using all known domain names.</t>
<t>Use a statically configured LIS URI.</t>
</list>
</t>
<t>A host that has multiple network interfaces could potentially be served by a different access network on each interface, each with a different LIS. The host SHOULD attempt to discover the LIS applicable to each network interface, stopping when a LIS is successfully discovered on any interface.
</t>
<t>A host that discovers a LIS URI MUST attempt to verify that the LIS is able to provide location information. For the HELD protocol, the host MUST make a location request to the LIS. If the LIS responds to this request with the <spanx style="verb">notLocatable</spanx> error code (see Section 4.3.2 of <xref target="I-D.ietf-geopriv-http-location-delivery"/>), the host MUST continue the discovery process and not make further requests to that LIS on that network interface.
</t>
<t>DHCP discovery MUST be attempted before any other discovery method. This allows the network access provider a direct and explicit means of configuring a LIS address. Alternative methods are only specified as a means to discover a LIS where the DHCP infrastructure does not support the LIS URI option.
</t>
<t>This document does not mandate any particular source for the domain name that is used as input to U-NAPTR. Alternative methods for determining the domain name MAY be used.
</t>
<t>Static configuration MAY be used if all other discovery methods fail. Note however, that if a host has moved from its customary location, static configuration might indicate a LIS that is unable to provide a location.
</t>
<t>The product of the LIS discovery process is an http: or https: URI. Nothing distinguishes this URI from other URIs with the same scheme, aside from the fact that it is the product of this process. Only URIs produced by the discovery process can be used for location configuration using HELD. URIs that are not a product of LIS discovery MUST NOT be used for location configuration.
</t>
<section anchor="vpn" title="Virtual Private Networks (VPNs)">
<t>LIS discovery over a VPN network interface SHOULD NOT be performed. A LIS discovered in this way is unlikely to have the information necessary to determine an accurate location.
</t>
<t>Since not all interfaces connected to a VPN can be detected by hosts, a LIS SHOULD NOT provide location information in response to requests that it can identify as originating from a VPN pool. This ensures that even if a host discovers a LIS over the VPN, it does not rely on a LIS that is unable to provide accurate location information. The exception to this is where the LIS and host are able to determine a location without access network support.
</t>
</section>
</section>
<section anchor="security" title="Security Considerations">
<t>The primary attack against the methods described in this document is one that would lead to impersonation of a LIS. The LIS is responsible for providing location information and this information is critical to a number of network services; furthermore, a host does not necessarily have a prior relationship with a LIS. Several methods are described here that can limit the probablity of, or provide some protection against, such an attack.
</t>
<t>The address of a LIS is usually well-known within an access network; therefore, interception of messages does not introduce any specific concerns.
</t>
<t>If DHCP is used, the integrity of DHCP options is limited by the security of the channel over which they are provided. Physical security and separation of DHCP messages from other packets are commonplace methods that can reduce the possibility of attack within an access network; alternatively, <xref target="RFC3118">DHCP authentication</xref> can provide a degree of protection against modification.
</t>
<t>An attacker could attempt to compromise the U-NAPTR resolution. A more thorough description of the security considerations for U-NAPTR applications is included in <xref target="RFC4848"/>.
</t>
<t>In addition to considerations related to U-NAPTR, it is important to recognize that the output of this is entirely dependent on its input. An attacker who can control the domain name is therefore able to control the final URI. Any mechanism for automatically determining such a domain name MUST consider such attacks.
</t>
</section>
<section anchor="iana" title="IANA Considerations">
<section anchor="iana-dhcp" title="Registration of DHCPv4 and DHCPv6 Option Codes">
<t>The IANA is requested to assign an option code for the DHCPv4 option for a LIS address, as described in <xref target="dhcpv4"/> of this document.
</t>
<t>The IANA is requested to assign an option code for the DHCPv6 option for a LIS address, as described in <xref target="dhcpv6"/> of this document.
</t>
</section>
<section anchor="iana-as" title="Registration of a Location Server Application Service Tag">
<t>This section registers a new S-NAPTR/U-NAPTR Application Service tag for a LIS, as mandated by <xref target="RFC3958"/>.
<list style="hanging">
<t hangText="Application Service Tag:">LIS</t>
<t hangText="Intended usage:">Identifies a service that provides a host with its location information.</t>
<t hangText="Defining publication:">RFC&rfc.number;</t>
<t hangText="Related publications:"><xref target="I-D.ietf-geopriv-http-location-delivery">HELD</xref></t>
<t hangText="Contact information:">The authors of this document</t>
<t hangText="Author/Change controller:">The IESG</t>
</list>
</t>
</section>
<section anchor="iana-ap" title="Registration of a Location Server Application Protocol Tag for HELD">
<t>This section registers a new S-NAPTR/U-NAPTR Application Protocol tag for
the <xref target="I-D.ietf-geopriv-http-location-delivery">HELD</xref> protocol, as mandated by <xref target="RFC3958"/>.
<list style="hanging">
<t hangText="Application Service Tag:">HELD</t>
<t hangText="Intended Usage:">Identifies the HELD protocol.</t>
<t hangText="Applicable Service Tag(s):">LIS</t>
<t hangText="Terminal NAPTR Record Type(s):">U</t>
<t hangText="Defining Publication:">RFC&rfc.number;</t>
<t hangText="Related Publications:"><xref target="I-D.ietf-geopriv-http-location-delivery">HELD</xref></t>
<t hangText="Contact Information:">The authors of this document</t>
<t hangText="Author/Change Controller:">The IESG</t>
</list>
</t>
</section>
</section>
<section anchor="ack" title="Acknowledgements">
<t>The authors would like to thank Leslie Daigle for her work on U-NAPTR; Peter Koch for his feedback on the DNS aspects of this document; Andy Newton for constructive suggestions with regards to document direction; Hannes Tschofenig and Richard Barnes for input and reviews; Dean Willis for constructive feedback; Pasi Eronen for the certificate fingerprint concept.
</t>
</section>
</middle>
<back>
<references title="Normative References">
&RFC2131;
&RFC2818;
&RFC3315;
&RFC3396;
&RFC4572;
&RFC4702;
&RFC4704;
&RFC4848;
<!-- &I-D.ietf-dhc-dhcpv6-opt-dnsdomain; -->
&I-D.ietf-geopriv-http-location-delivery;
&RFC2119;
</references>
<references title="Informative References">
&RFC3118;
&RFC3693;
&RFC3958;
&I-D.ietf-geopriv-l7-lcp-ps;
</references>
<section title="DHCP LIS URI Option Examples">
<section title="LIS URI Only">
<t><xref target="ex-lis-uri-s"/> shows an example LIS URI option for DHCPv6 in hexadecimal form. This example is the simplest form, with an http: URI and no fingerprint information.
</t>
<figure anchor="ex-lis-uri-s" title="Example of a Simple LIS URI Option">
<preamble>Hexadecimal representation of LIS option, including the leading DHCPv4 option code and length octets: [[IANA/RFC-Editor Note: Please replace instances of "??:??" in the following example with the hexadecimal representation of the IANA allocated DHCPv6 option code; replace "???" with the decimal representation of the IANA allocated DHCPv6 option code.]]
</preamble>
<artwork><![CDATA[
??:??:00:1d:00:68:74:74:70:3a:2f:2f:6c:69:73:2e:65:78:61:6d:
70:6c:65:2e:6f:72:67:3a:34:38:30:31:2f
Octet Value Description
------- ------- --------------------------------------------------
00-01 ??:?? LIS URI Option Code (???)
02 00:1d Option Length = 29
03 00 F-Code = 0 (URI)
04- 68:74:74:70:3a:2f:2f:6c:69:73:2e:65:78:61:6d:70:
-1f 6c:65:2e:6f:72:67:3a:34:38:30:31:2f
- LIS URI = "http://lis.example.org:4801/"
]]></artwork>
</figure>
</section>
<section title="LIS URI with Fingerprint">
<t><xref target="ex-lis-uri-hh"/> shows an example LIS URI option for DHCPv4 in hexadecimal form. This example shows the inclusion of two fingerprints, the first based on SHA-256, and the second based on SHA-1.
</t>
<figure anchor="ex-lis-uri-hh" title="Example LIS URI Option with Fingerprint Data">
<preamble> Hexadecimal representation of LIS option, including the leading DHCPv4 option code and length octets: [[IANA/RFC-Editor Note: Please replace two instances of "??" in the following example with the hexadecimal representation of the IANA allocated DHCPv4 option code; replace "???" with the decimal representation of the IANA allocated DHCPv4 option code.]]
</preamble>
<artwork><![CDATA[
??:69:01:28:07:73:68:61:2d:32:35:36:49:20:77:6f:6e:64:65:72:
20:69:66:74:68:69:73:20:77:69:6c:6c:20:62:65:20:6e:6f:74:69:
63:65:64:3f:01:1a:07:73:68:61:2d:31:39:39:62:6f:74:74:6c:65:
73:6f:66:62:65:65:72:6f:6e:74:68:65:00:68:74:74:70:73:3a:2f:
2f:6c:69:73:2e:65:78:61:6d:70:6c:65:2e:6f:72:67:3a:34:38:30:
32:2f:3f:63:3d:65:78
Octet Value Description
------- ------- --------------------------------------------------
00 ?? LIS URI Option Code (???)
01 6a Option Length = 106
02 01 F-Code = 1 (Fingerprint)
03 28 F-Length = 40
04 07 Hash-Type-Len = 7
05-0b 73:68:61:2d:32:35:36
- Hash-Type = "sha-256"
0c- 49:20:77:6f:6e:64:65:72:20:69:66:74:68:69:73:20:
-2b 77:69:6c:6c:20:62:65:20:6e:6f:74:69:63:65:64:3f
- Fingerprint-Value (SHA-256 output)
2c 01 F-Code = 1 (Fingerprint)
2d 1a F-Length = 26
2e 07 Hash-Type-Len = 5
2f-33 73:68:61:2d:31
- Hash-Type = "sha-1"
34- 39:39:62:6f:74:74:6c:65:73:6f:
-47 66:62:65:65:72:6f:6e:74:68:65
- Fingerprint-Value (SHA-1 output)
48 00 F-Code = 0 (URI)
49- 68:74:74:70:73:3a:2f:2f:6c:69:73:2e:65:78:61:6d:70:
-6a 6c:65:2e:6f:72:67:3a:34:38:30:32:2f:3f:63:3d:65:78
- LIS URI = "https://lis.example.org:4802/?c=ex"
]]></artwork>
</figure>
</section>
</section>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-22 16:56:06 |