One document matched: draft-thomson-geopriv-lis-discovery-03.xml
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY RFC1034 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.1034.xml">
<!ENTITY RFC2119 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC2131 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2131.xml">
<!ENTITY RFC2782 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2782.xml">
<!ENTITY RFC3118 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3118.xml">
<!ENTITY RFC3315 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3315.xml">
<!ENTITY RFC3396 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3396.xml">
<!ENTITY RFC3693 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3693.xml">
<!ENTITY RFC3958 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3958.xml">
<!ENTITY RFC4033 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4033.xml">
<!ENTITY RFC4367 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4367.xml">
<!ENTITY RFC4702 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4702.xml">
<!ENTITY RFC4704 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4704.xml">
<!ENTITY RFC4848 PUBLIC "" "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4848.xml">
<!ENTITY I-D.ietf-geopriv-http-location-delivery PUBLIC "" "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-geopriv-http-location-delivery.xml">
<!ENTITY I-D.ietf-geopriv-l7-lcp-ps PUBLIC "" "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-geopriv-l7-lcp-ps.xml">
<!ENTITY I-D.ietf-behave-rfc3489bis PUBLIC "" "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-behave-rfc3489bis.xml">
<!ENTITY I-D.ietf-dhc-dhcpv6-opt-dnsdomain PUBLIC "" "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-dhc-dhcpv6-opt-dnsdomain.xml">
]>
<?rfc symrefs="yes"?>
<?rfc sortrefs="no"?>
<?rfc iprnotified="yes"?>
<?rfc strict="yes"?>
<?rfc toc="yes"?>
<?rfc tocindent="yes"?>
<rfc category="std" ipr="full3978" docName="draft-thomson-geopriv-lis-discovery-03.txt">
<front>
<title abbrev="LIS Discovery">
Discovering the Local Location Information Server (LIS)
</title>
<author initials="M." surname="Thomson"
fullname="Martin Thomson">
<organization>Andrew</organization>
<address>
<postal>
<street>PO Box U40</street>
<city>Wollongong University Campus</city>
<region>NSW</region>
<code>2500</code>
<country>AU</country>
</postal>
<phone>+61 2 4221 2915</phone>
<email>martin.thomson@andrew.com</email>
<uri>http://www.andrew.com/</uri>
</address>
</author>
<author initials="J." surname="Winterbottom"
fullname="James Winterbottom">
<organization>Andrew</organization>
<address>
<postal>
<street>PO Box U40</street>
<city>Wollongong University Campus</city>
<region>NSW</region>
<code>2500</code>
<country>AU</country>
</postal>
<phone>+61 2 4221 2938</phone>
<email>james.winterbottom@andrew.com</email>
<uri>http://www.andrew.com/</uri>
</address>
</author>
<date month="September" year="2007"/>
<area>Application</area>
<workgroup>GEOPRIV</workgroup>
<keyword>Internet-Draft</keyword>
<keyword>Discovery</keyword>
<keyword>DHCP</keyword>
<keyword>U-NAPTR</keyword>
<keyword>HELD</keyword>
<keyword>LIS</keyword>
<abstract>
<t>A method is described for the discovery of a Location Information Server. The method consists of attempting to use a Dynamic Host Configuration Protocol (DHCP) option, followed by a URI-enabled NAPTR (U-NAPTR). DHCP options are defined for both IPv4 and IPv6 DHCP. This document also defines a U-NAPTR Application Service for a LIS, with a specific Application Protocol for the HTTP Enabled Location Delivery (HELD) protocol.
</t>
</abstract>
</front>
<middle>
<section title="Introduction and Overview">
<t>Discovering a Location Information Server (LIS) is an important part of the location acquisition process. The LIS is an access network service that needs to be discovered before it can be used. This document describes a method that a host can use to discover a URI for a LIS.
</t>
<t>The product of a discovery process, such as the one described in this document, is the address of the service. In this document, the result is a URI, which identifies a LIS. A URI permits identification of a LIS that includes information about protocols and other supplementary information.
</t>
<t>The discovery process requires that the host first attempt LIS discovery using Dynamic Host Configuration protocol (DHCP). If DHCP is not available, or the option is not supported by the network, the host attempts to discover the LIS using the DNS and URI-enabled Naming Authority Pointer (U-NAPTR). Finally, the host can rely on proprietary methods for determining the address of the LIS, including static configuration.
</t>
<section anchor="intro-dhcp" title="DHCP Discovery">
<t>DHCP (<xref target="RFC2131"/>, <xref target="RFC3315"/>) is a commonly used mechanism for providing bootstrap configuration information allowing a host to operate in a specific network environment. The bulk of DHCP information is largely static; consisting of configuration information that does not change over the period that the host is attached to the network. Physical location information might change over this time, however the address of the LIS does not. Thus, DHCP is suitable for configuring a host with the address of a LIS.
</t>
</section>
<section anchor="intro-dns" title="U-NAPTR Discovery">
<t>Where DHCP is not available, the DNS might be able to provide a URI. For DNS methods, alternative discovery techniques <xref target="RFC2782">SRV records</xref> or <xref target="RFC3958">Straightforward NAPTR (S-NAPTR)</xref> provide an indication of a service for a domain, but these methods cannot be used; SRV and S-NAPTR only permit the return of a hostname and port, not a URI. <xref target="RFC4848">URI-enabled NAPTR (U-NAPTR)</xref>, which is based on S-NAPTR, describes a method of applying the Dynamic Delegation Discovery Service (DDDS) for URI results.
</t>
<t>For the LIS discovery DDDS application, an Application Service tag <spanx style="verb">LIS</spanx> and an Application Protocol tag <spanx style="verb">HELD</spanx> are created and registered with the IANA. Taking a domain name, this U-NAPTR application uses the two tags to determine the LIS URI.
</t>
<t>Determining the domain name to be used is a critical part of the resolution process. The second part of this document describes how a domain name can be derived. Several methods are described that address different scenarios.
</t>
</section>
<section anchor="terminology" title="Terminology">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT",
"RECOMMENDED", "MAY", and "OPTIONAL" in
this document are to be interpreted as described in <xref target="RFC2119"/>.
</t>
<t>This document also uses the term "host" to refer to an end host. In <xref target="RFC3693">RFC3693</xref> parlance, the host is the Device, which might also be the Target.
</t>
<t>The terms "access network" refers to the network that a host connects to for Internet access. The "access network provider" is the entity that operates the access network. This is consistent with the definition in <xref target="I-D.ietf-geopriv-l7-lcp-ps"/> which combines the Internet Access Provider (IAP) and Internet Service Provider (ISP). The access network provider is responsible for allocating the host an IP address and for directly or indirectly providing a LIS service.
</t>
</section>
</section>
<section title="LIS Discovery Using DHCP">
<t>DHCP allows the access network provider to specify the address of a LIS as part of network configuration. This document registers DHCP options for a LIS address for both IPv4 and IPv6.
</t>
<section anchor="dhcpv4" title="DHCPv4 Option for a LIS Address">
<t>This section defines a DHCP for IPv4 (DHCPv4) option for the address of a LIS.
</t>
<figure anchor="dhcpv4option" title="DHCPv4 LIS URI Option">
<artwork><![CDATA[
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| LIS_URI | Length | URI ... .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| URI ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork>
</figure>
<t><list style="hanging">
<t hangText="LIS_URI:">The IANA assigned option number (TBD).</t>
<t hangText="Length:">The length of the URI in octets.</t>
<t hangText="URI:">The address of the LIS. This URI SHOULD NOT be more than 253 bytes in length, but MAY be extended by concatenating multiple option values, as described in <xref target="RFC3396"/>. The URI MUST NOT be NULL terminated.
</t>
</list>
</t>
</section>
<section anchor="dhcpv6" title="DHCPv6 Option for a LIS Address">
<t>This section defines a DHCP for IPv6 (DHCPv6) option for the address of a LIS. The DHCPv6 option for this parameter is similarly formatted to the DHCPv4 option.
</t>
<figure anchor="dhcpv6option" title="DHCPv6 LIS URI Option">
<artwork><![CDATA[
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_LIS_URI | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| URI ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
]]></artwork>
</figure>
<t><list style="hanging">
<t hangText="OPTION_LIS_URI:">The IANA assigned option number (TBD).</t>
<t hangText="Length:">The length of the URI in octets.</t>
<t hangText="URI:">The address of the LIS. The URI MUST NOT be NULL terminated.</t>
</list>
</t>
</section>
</section>
<section anchor="u-naptr" title="U-NAPTR for LIS Discovery">
<t>U-NAPTR resolution for a LIS takes a domain name as input and produces a URI that identifies the LIS. This process also requires an Application Service tag and an Application Protocol tag, which differentiate LIS-related NAPTR records from other records for that domain.
</t>
<t><xref target="iana-as"/> defines an Application Service tag of <spanx style="verb">LIS</spanx>, which is used to identify the location service for a particular domain. The Application Protocol tag <spanx style="verb">HELD</spanx>, defined in <xref target="iana-ap"/>, is used to identify a LIS that understands the <xref target="I-D.ietf-geopriv-http-location-delivery">HELD protocol</xref>.
</t>
<figure anchor="sampleNAPTR" title="Sample LIS:HELD Service NAPTR Records">
<preamble>The NAPTR records in the following example demonstrate the use of the Application Service and Protocol tags. Iterative NAPTR resolution is used to delegate responsibility for the LIS service from <spanx style="verb">zonea.example.com.</spanx> and <spanx style="verb">zoneb.example.com.</spanx> to <spanx style="verb">outsource.example.com.</spanx>.
</preamble>
<artwork><![CDATA[
zonea.example.com.
;; order pref flags
IN NAPTR 100 10 "" "LIS:HELD" ( ; service
"" ; regex
outsource.example.com. ; replacement
)
zoneb.example.com.
;; order pref flags
IN NAPTR 100 10 "" "LIS:HELD" ( ; service
"" ; regex
outsource.example.com. ; replacement
)
outsource.example.com.
;; order pref flags
IN NAPTR 100 10 "u" "LIS:HELD" ( ; service
"!*.!https://lis.outsource.example.com/!" ; regex
. ; replacement
)
]]>
</artwork>
</figure>
<t>Details for the <spanx style="verb">LIS</spanx> Application Service tag and the <spanx style="verb">HELD</spanx> Application Protocol tag are included in <xref target="iana"/>.
</t>
</section>
<section anchor="dn" title="Determining the Access Network Domain Name">
<t>The U-NAPTR discovery method described in <xref target="u-naptr"/> requires that the domain name applicable to the access network is known. An unconfigured host might not have this information, therefore it must determine this value before the U-NAPTR method can be attempted.
</t>
<t>This section describes several methods for discovering a domain name for the local access network. Each method is attempted where applicable until a domain name is derived. If a domain name is successfully derived but that domain name does not produce any U-NAPTR records, alternative methods can be attempted to determine additional domain names. Reattempting with different methods is particularly applicable when NAT is used, as is shown in <xref target="publicip"/>.
</t>
<section anchor="dn-dhcp" title="DHCP Domain Name Option">
<t>For IP version 4, Dynamic Host Configuration Protocol (DHCP) option 15 <xref target="RFC2131"/> includes the domain name suffix for the host.
If DHCP and option 15 are available, this value should be used as input the U-NAPTR procedure.
</t>
<t>DHCP for IPv6 provides a single domain name suffix that can be used in the same manner, as a described in <xref target="I-D.ietf-dhc-dhcpv6-opt-dnsdomain"/>.
</t>
<t>Alternatively, a fully qualified domain name (FQDN) for the host might be provided by the server (<xref target="RFC4702"/> for DHCPv4, <xref target="RFC4704"/> for DHCPv6). This domain name is used as input to the U-NAPTR resolution and is obtained from the FQDN by removing the first label. If the host has provided a fully qualified domain name using this option, it SHOULD NOT be used - the domain known to the host might not be the same as that of the access network.
</t>
<t>Either DHCP method SHOULD be attempted first if DHCP is available. Note that this method is only attempted if the LIS address option is not available.</t>
</section>
<section anchor="dn-reversedns" title="Reverse DNS">
<t>DNS <spanx style="verb">PTR</spanx> records in the <spanx style="verb">in-addr.arpa.</spanx> domain can be used to determine the domain name of a host, and therefore, the name of the domain for that host. The use of the <spanx style="verb">in-addr.arpa.</spanx> domain is described in <xref target="RFC1034"/> and results in the domain name of the host. Likewise, IPv6 hosts use the <spanx style="verb">ip6.arpa.</spanx> domain. In the majority of cases, the domain part of this name (everything excluding the first label) is also the domain name for the access network. Assuming that this is true, this domain name can be used as input to the U-NAPTR process.
</t>
<t>For example, if the for <spanx style="verb">10.1.2.3</spanx> address, if the <spanx style="verb">PTR</spanx> record at <spanx style="verb">3.2.1.10.in-addr.arpa.</spanx> refers to <spanx style="verb">host.example.com</spanx>, this results in a U-NAPTR search for <spanx style="verb">example.com</spanx>.
</t>
<t>The DNS hierarchy does not necessarily directly map onto a network topology (see <xref target="RFC4367"/>); therefore, this method MUST only be used for the domain name determined by removing the first label only. This method assumes that the access network provider also provides the reverse DNS record and they control the domain that is indicated in the <spanx style="verb">PTR</spanx> record.
</t>
<t>Furthermore, this method might not apply where a host is given a domain name that is different from the domain name of the access network. This might occur in some hosting configurations, such as where a number of web server hosts, with widely varying domain names, are co-located. From the above example, the access network provider allocated <spanx style="verb">10.1.2.3</spanx> to the host; therefore, they also need to control the DNS domain <spanx style="verb">example.com</spanx> and the associated NAPTR records. <xref target="RFC4033">DNS Security Extensions (DNSSEC)</xref> provides a cryptographic means of validating this association, through data origin authentication.
</t>
<section anchor="publicip" title="Determining an External IP Address">
<t>Reverse DNS relies on knowing the IP address of a host within the access domain. Initially, this SHOULD be attempted using the IP address that is assigned to a local interface on the host. However, when a NAT device is used, the IP address of the NAT device is substituted for the source IP address. If a NAT device exists between the host and the access network, the host does not have any direct way to determine the IP address that it is effectively using within the access network. The IP address of the NAT device and the corresponding domain name can be used to discover the LIS.
</t>
<t>In order to use reverse DNS in this configuration, the hosts need to know the IP address that the NAT device uses. The following sections describe some possible methods.
</t>
<t>These methods are particularly useful in residential broadband configurations. A large proportion of residential broadband services employ a NAT device so that several hosts can share the same Internet access. Since the network behind the NAT device are generally very small, both in numbers and geographical area, it isn't necessary for a LIS to operate within that network; the hosts are able to access a LIS in the access network outside of the NAT device.
</t>
<section anchor="upnp" title="UPnP">
<t>If a NAT device complies with the <xref target="UPnP-IGD-WANIPConnection1">Universal Plug and Play (UPnP) specification</xref>, the WANIPConnection part can be used to query the device for its public IP address. The <spanx style="verb">GetExternalIPAddress</spanx> function provides the external address for a particular network connection.
</t>
<t>UPnP defines a method for discovering UPnP-enabled hosts in a network; the host does not need any prior configuration to employ this method.
</t>
</section>
<section anchor="stun" title="STUN">
<t>A host can use the <xref target="I-D.ietf-behave-rfc3489bis">Session Traversal Utilities for NAT (STUN)</xref> to determine a public IP address. The host uses the <spanx style="verb">Binding Request</spanx> message and the resulting <spanx style="verb">XOR-MAPPED-ADDRESS</spanx> parameter that is returned in the response.
</t>
<t>Using STUN requires cooperation from a publicly accessible STUN server. The host also requires configuration information that identifies the STUN server, or a domain name that can be used for STUN server discovery.
</t>
</section>
<section anchor="http" title="Other Options">
<t>The source IP address in any IP packet can be used to determine the public IP address of a host. While the STUN method uses a small part of a more sophisticated protocol, this principle can be applied using any other protocol. Like STUN, this method requires prior knowledge of the publicly accessible server and the method that it supports.
</t>
<t>For instance, a publicly accessible host could be configured to respond to a UDP packet on a predefined port; the data of the response could contain the source IP address that was in the request. Alternatively, a HTTP server at a particular URL could be configured to respond to a GET request with a <spanx style="verb">text/plain</spanx> body containing the IP address of the requester. HTTP proxies render this method unusable; in particular, transparent HTTP proxies might affect the results of this method without the knowledge of the host. Such services already exist on the public Internet.
</t>
</section>
</section>
</section>
</section>
<section title="Discovery Order">
<t>The previous sections described a set of procedures that allow a device to determine the LIS associated with the local access network. Some networks maintain a topology analogous to an onion and are comprised of layers, or segments, separating hosts from the Internet through intermediate networks. It is best therefore for a host to discover the LIS logically closest to it, and this can best be done by applying the discovery techniques in the following order:
<list style="numbers">
<t>DHCP LIS URI Option</t>
<t>DNS U-NAPTR Discovery, using the domain name from:
<list style="numbers">
<t>DHCP Domain Name Option</t>
<t>Reverse DNS, using the hosts IP address from:
<list style="numbers">
<t>the local network interface and immediate network segment</t>
<t>the network segment adjacent to the immediate segment, as revealed by UPnP</t>
<t>the public Internet, as revealed by STUN; or the network segment where the STUN server resides</t>
</list>
<list style="format (%d.)">
<t>any network segment, as revealed by other method</t>
</list>
</t>
</list>
</t>
<t>Static configuration</t>
</list>
</t>
<t>DHCP discovery MUST be attempted before DNS discovery. This allows the network access provider a direct and explicit means of configuring a LIS address. DNS discovery is used as a failsafe, providing a means to discover a LIS where the DHCP infrastructure does not support the LIS URI option.
</t>
<t>Static host configuration MAY be used to provide a LIS address if both DHCP and DNS methods fail. Note however, that if a host has moved from its customary location, static configuration might indicate a LIS that is unable to provide a location. User interaction is NOT RECOMMENDED; the discovery process is not easily diagnosed by a user.
</t>
<t>LIS discovery through DNS requires the host to determine the domain name of the local access network. Where DHCP is available, the DHCP domain name option (<xref target="dn-dhcp"/>) can be used to provide this information. If the domain name cannot be determined from DHCP, or the resulting domain name fails to yield a valid LIS address then reverse DNS is used.
</t>
<t>The discovery procedure assumes that the correct LIS is in a network segment that is closer to the host. Each network segment between the host and LIS decreases the chance that the LIS is able to correctly determine a location for the host.
</t>
<t>Discovery methods follow an order of precedence. The exception is for alternative methods of determining the hosts IP address in each network segment; precedence is given to addresses in the network segments closer to the host. Therefore, the host MUST attempt to use the IP address assigned to its local network interface before attempting to determine its IP address. Precedence is given to methods, like UPnP that provide an IP address in adjacent network segments. Methods for determining addresses on the public Internet are given lower precedence.
</t>
<t>To claim compliance with this document, a host MUST support both DHCP discovery and U-NAPTR discovery. Further, the host MUST support retrieval of domain name from DHCP and reverse DNS, using a local interface address, UPnP and STUN. Additional methods for determining the IP address of the host in different network segments are optional.
</t>
<section anchor="vpn" title="Virtual Private Networks (VPNs)">
<t>Where a host has multiple network interfaces the host MAY independently discover the LIS corresponding to the access networks reached by each network interface. Resolving which LIS to contact for location information is a host application issue.
</t>
<t>LIS discovery over a VPN network interface SHOULD NOT be performed since such a LIS does not have the physical presence generally necessary to determine location. However, since not all VPN interfaces can be detected by hosts, a LIS SHOULD NOT respond to requests originating from a VPN pool. This ensures that even if a host discovers a LIS over the VPN, it does not rely on a LIS that is unable to provide accurate location information. The exception to this is where the LIS and host are able to determine a location without access network support.
</t>
<t>TBD: Is there an advantage in providing a HELD error code that indicates that the host has reached the LIS over a VPN?
</t>
</section>
</section>
<section anchor="security" title="Security Considerations">
<t>The primary attack against the methods described in this document is one that would lead to impersonation of a LIS. The LIS is responsible for providing location information and this information is critical to a number of network services; furthermore, a host does not necessarily have a prior relationship with a LIS. Several methods are described here that can limit the probablity of, or provide some protection against, such an attack.
</t>
<t>The address of a LIS is usually well-known within an access network; therefore, interception of messages does not introduce any specific concerns.</t>
<t>If DHCP is used, the integrity of DHCP options is limited by the security of the channel over which they are provided. Physical security and separation of DHCP messages from other packets are commonplace methods that can reduce the possibility of attack within an access network; alternatively, <xref target="RFC3118">DHCP authentication</xref> can provide a degree of protection against modification.
</t>
<t>An attacker could attempt to compromise the U-NAPTR resolution. A description of the security considerations for U-NAPTR applications is included in <xref target="RFC4848"/>.
</t>
<t>In addition to considerations related to U-NAPTR, it is important to recognize that the output of this is entirely dependent on its input. An attacker who can control the domain name can also control the final URI. Because a number of methods are provided for determining the domain name, a host implementation needs to consider attacks against each of the methods that are used.
</t>
<t>Reverse DNS is subject to the maintenance of the <spanx style="verb">in-addr.arpa.</spanx> or <spanx style="verb">ip6.arpa.</spanx> domain and the integrity of the results that it provides. <xref target="RFC4033">DNSSEC</xref> provides some measures that can improve the reliability of DNS results. In particular, DNSSEC SHOULD be applied to ensure that the reverse DNS record and the resulting domain are provided by the same entity before this method is used. Without this assurance, the host cannot be certain that the access network provider has provided the NAPTR record for the domain name that is provided.
</t>
<t>Hosts behind NAT devices are also subject to attacks when retrieving their public IP address. <xref target="I-D.ietf-behave-rfc3489bis"/> describes some means of mitigating this attack for STUN.
</t>
</section>
<section anchor="iana" title="IANA Considerations">
<section anchor="iana-dhcp" title="Registration of DHCPv4 and DHCPv6 Option Codes">
<t>The IANA is requested to assign an option code for the DHCPv4 option for a LIS address, as described in <xref target="dhcpv4"/> of this document.
</t>
<t>The IANA is requested to assign an option code for the DHCPv6 option for a LIS address, as described in <xref target="dhcpv6"/> of this document.
</t>
</section>
<section anchor="iana-as" title="Registration of a Location Server Application Service Tag">
<t>This section registers a new S-NAPTR/U-NAPTR Application Service tag for a LIS, as mandated by <xref target="RFC3958"/>.
<list style="hanging">
<t hangText="Application Service Tag:">LIS</t>
<t hangText="Intended usage:">Identifies a service that provides a host with its location information.</t>
<t hangText="Defining publication:">RFC&rfc.number;</t>
<t hangText="Related publications:"><xref target="I-D.ietf-geopriv-http-location-delivery">HELD</xref></t>
<t hangText="Contact information:">The authors of this document</t>
<t hangText="Author/Change controller:">The IESG</t>
</list>
</t>
</section>
<section anchor="iana-ap" title="Registration of a Location Server Application Protocol Tag for HELD">
<t>This section registers a new S-NAPTR/U-NAPTR Application Protocol tag for
the <xref target="I-D.ietf-geopriv-http-location-delivery">HELD</xref> protocol, as mandated by <xref target="RFC3958"/>.
<list style="hanging">
<t hangText="Application Service Tag:">HELD</t>
<t hangText="Intended Usage:">Identifies the HELD protocol.</t>
<t hangText="Applicable Service Tag(s):">LIS</t>
<t hangText="Terminal NAPTR Record Type(s):">U</t>
<t hangText="Defining Publication:">RFC&rfc.number;</t>
<t hangText="Related Publications:"><xref target="I-D.ietf-geopriv-http-location-delivery">HELD</xref></t>
<t hangText="Contact Information:">The authors of this document</t>
<t hangText="Author/Change Controller:">The IESG</t>
</list>
</t>
</section>
</section>
<section anchor="ack" title="Acknowledgements">
<t>The authors would like to thank Leslie Daigle for her work on U-NAPTR; Peter Koch for his feedback on the DNS aspects of this document; Andy Newton for constructive suggestions with regards to document direction; Hannes Tschofenig for input and reviews.
</t>
</section>
</middle>
<back>
<references title="Normative References">
&RFC1034;
&RFC2131;
&RFC3315;
&RFC3396;
&RFC4702;
&RFC4704;
&RFC4848;
&I-D.ietf-behave-rfc3489bis;
&I-D.ietf-dhc-dhcpv6-opt-dnsdomain;
&RFC2119;
</references>
<references title="Informative References">
&RFC2782;
&RFC3118;
&RFC3693;
&RFC3958;
&RFC4033;
&RFC4367;
&I-D.ietf-geopriv-l7-lcp-ps;
&I-D.ietf-geopriv-http-location-delivery;
<reference anchor="UPnP-IGD-WANIPConnection1">
<front>
<title>
Internet Gateway Device (IGD) Standardized Device Control Protocol V 1.0: WANIPConnection:1 Service Template Version 1.01 For UPnP Version 1.0
</title>
<author>
<organization>UPnP Forum</organization>
</author>
<date day="12" month="Nov" year="2001"/>
</front>
<seriesInfo name="DCP" value="05-001"/>
</reference>
</references>
<section title="Residential Broadband LIS Discovery Example">
<t>This example shows how LIS discovery using U-NAPTR and DNS might be performed in a residential broadband scenario. The assumed network topology for this network is shown in <xref target="topfig"/>.
</t>
<t>
<figure anchor="topfig" title="Example Network Topology">
<artwork><![CDATA[
__________ __________
+----------------+ ( ) ( )
| NAT | ( ACCESS ) ( )
| (Home Router) |-------( NETWORK )-------( INTERNET )
| 192.0.2.75 | ( my.isp.net ) ( )
+----------------+ ( ) ( )
| ---------- ----------
| :
| :
+----------------+ +-----------------+
| DEVICE | | VOICE SERVICE |
| | | PROVIDER (VSP) |
| 192.168.0.55 | | STUN SERVER |
+----------------+ +-----------------+
]]>
</artwork>
</figure>
</t>
<t>In this example, the host sits behind a home router that includes a NAT function. The host is assigned an address from the private 192.168.x.x address range, in this case 192.168.0.55. The outbound IP address provided to the home router is public and and belongs to the my.isp.net domain; in this example the home router is assigned 192.0.2.75, which is also given the domain name 192-0-2-75.my.isp.net.
</t>
<t>In this example, several methods are not possible due to the configuration of the devices and network. The DHCP server on the home router does not support the LIS URI option, and a domain name is not configured on the router. In addition to this, the UPnP service on home router is disabled. Therefore, the host attempts these methods and is unsuccessful.
</t>
<t>The example first covers the unsuccessful attempts to discover the LIS, followed by a successful application of DNS discovery based on an address provided by a STUN server. In this situation, the STUN server is provided by a Voice Service Provider (VSP) that the owner of the host purchases a voice service from. The address of the STUN server is configured on the host. The VSP is a separate entity on the public Internet with no relation to the access network provider.
</t>
<figure anchor="flowfig" title="LIS Discovery Sequence">
<preamble>The sequence diagram below shows each of the failed attempts to discover the LIS, followed by the successful discovery using the STUN server, reverse DNS and the DNS discovery method.
</preamble>
<artwork><![CDATA[
+-------+ +--------+ +-----+ +-----+ +--------+
| HOST | | HOME | | DNS | | LIS | | STUN |
| | | ROUTER | | | | | | SERVER |
+---+---+ +----+---+ +--+--+ +--+--+ +---+----+
| | | | |
1 +--- DHCPINFORM -->| | | |
| | | | |
2 |<---- DHCPACK ----+ | | |
| | | | |
3 +------- DNS: PTR ------------->| | |
| 55.0.168.192.in-addr.arpa. | | |
| | | | |
4 |<------ DNS: no domain --------+ | |
| | | | |
5 +----- UPnP: ----->| | | |
| ssdp:discover | | | |
| | | | |
6 | (no response) | | | |
| | | | |
7 +---------------- STUN: Binding Request --------------->|
| | | | |
8 |<------- STUN: XOR-MAPPED-ADDRESS = (192.0.2.75) ------+
| | | | |
9 +------- DNS: PTR ------------->| | |
| 75.2.0.192.in-addr.arpa. | | |
| | | | |
10 |<--- 192-0-2-205.my.isp.net ---+ | |
| | | | |
11 +--- DNS: NAPTR my.isp.net ---->| | |
| | | | |
12 |<--- https://lis.my.isp.net/ --+ | |
| | | | |
13 +-------- HELD: locationRequest ----------->| |
| | | | |
. . . . .
]]>
</artwork>
</figure>
<t>
<list style="numbers">
<t>The host makes a DHCP request for the LIS URI option. To reduce the overall time required in case the LIS URI is unknown, the host also requests the domain name option.
</t>
<t>The DHCP server (in the home router) responds but does not have either datum. Therefore, the host is unable to use the DHCP method, or use the domain name to perform U-NAPTR discovery.
</t>
<t>The host then attempts reverse DNS based on its IP address (192.168.0.55). The host makes a DNS PTR request for <spanx style="verb">55.0.168.192.in-addr.arpa.</spanx>
</t>
<t>The DNS server has no knowledge of the private network segment and so indicates that there is no such domain.
</t>
<t>The host then must determine its address in a different network segment. It first attempts to discover this using UPnP. The host broadcasts a UPnP discovery message, attempting to locate a UPnP capable device that supports the WANIPConnection profile.
</t>
<t>There are no UPnP devices on the network and the UPnP discovery message is unanswered.
</t>
<t>The host contacts a STUN server, which is configured on the host. It sends a Binding Request to the STUN server.
</t>
<t>The STUN server responds to the Binding Request, including the XOR-MAPPED-ADDRESS parameter. The host decodes this parameter, which reveals the IP address of the home router: 192.0.2.75.
</t>
<t>The host requests the domain name assigned to 192.0.2.75. It makes a DNS PTR request to <spanx style="verb">75.2.0.192.in-addr.arpa.</spanx>
</t>
<t>The DNS server indicates that 192.0.2.75 is assigned the name <spanx style="verb">192-0-2-75.my.isp.net.</spanx>
</t>
<t>The host removes the host part of the domain name and makes a DNS NAPTR request for the domain <spanx style="verb">my.isp.net.</spanx>
</t>
<t>The DNS server provides all NAPTR records for the <spanx style="verb">my.isp.net.</spanx> domain. The host finds the record with a service tag of <spanx style="verb">LIS:HELD</spanx> and retrieves the URI from the regexp field. The URI of the LIS is found to be <spanx style="verb">https://lis.my.isp.net/</spanx>.
</t>
<t>The host sends a HELD <spanx style="verb">locationRequest</spanx> to the LIS.
</t>
</list>
</t>
</section>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-21 20:37:33 |