draft-ietf-6man-ra-pref64-08.txt | draft-ietf-6man-ra-pref64-09.txt | |||
---|---|---|---|---|
IPv6 Maintenance L. Colitti | IPv6 Maintenance L. Colitti | |||
Internet-Draft J. Linkova | Internet-Draft J. Linkova | |||
Intended status: Standards Track Google | Intended status: Standards Track Google | |||
Expires: May 30, 2020 November 27, 2019 | Expires: June 21, 2020 December 19, 2019 | |||
Discovering PREF64 in Router Advertisements | Discovering PREF64 in Router Advertisements | |||
draft-ietf-6man-ra-pref64-08 | draft-ietf-6man-ra-pref64-09 | |||
Abstract | Abstract | |||
This document specifies a Neighbor Discovery option to be used in | This document specifies a Neighbor Discovery option to be used in | |||
Router Advertisements to communicate NAT64 prefixes to hosts. | Router Advertisements to communicate NAT64 prefixes to hosts. | |||
Status of This Memo | Status of This Memo | |||
This Internet-Draft is submitted in full conformance with the | This Internet-Draft is submitted in full conformance with the | |||
provisions of BCP 78 and BCP 79. | provisions of BCP 78 and BCP 79. | |||
skipping to change at page 1, line 31 ¶ | skipping to change at page 1, line 31 ¶ | |||
Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
Task Force (IETF). Note that other groups may also distribute | Task Force (IETF). Note that other groups may also distribute | |||
working documents as Internet-Drafts. The list of current Internet- | working documents as Internet-Drafts. The list of current Internet- | |||
Drafts is at https://datatracker.ietf.org/drafts/current/. | Drafts is at https://datatracker.ietf.org/drafts/current/. | |||
Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
This Internet-Draft will expire on May 30, 2020. | This Internet-Draft will expire on June 21, 2020. | |||
Copyright Notice | Copyright Notice | |||
Copyright (c) 2019 IETF Trust and the persons identified as the | Copyright (c) 2019 IETF Trust and the persons identified as the | |||
document authors. All rights reserved. | document authors. All rights reserved. | |||
This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
(https://trustee.ietf.org/license-info) in effect on the date of | (https://trustee.ietf.org/license-info) in effect on the date of | |||
publication of this document. Please review these documents | publication of this document. Please review these documents | |||
skipping to change at page 2, line 12 ¶ | skipping to change at page 2, line 12 ¶ | |||
the Trust Legal Provisions and are provided without warranty as | the Trust Legal Provisions and are provided without warranty as | |||
described in the Simplified BSD License. | described in the Simplified BSD License. | |||
Table of Contents | Table of Contents | |||
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | |||
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 2 | 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 2 | |||
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 2 | 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 2 | |||
2. Use cases for communicating the NAT64 prefix to hosts . . . . 3 | 2. Use cases for communicating the NAT64 prefix to hosts . . . . 3 | |||
3. Why include the NAT64 prefix in Router Advertisements . . . . 3 | 3. Why include the NAT64 prefix in Router Advertisements . . . . 3 | |||
4. Usage Guidelines . . . . . . . . . . . . . . . . . . . . . . 4 | 4. Option format . . . . . . . . . . . . . . . . . . . . . . . . 4 | |||
5. Option format . . . . . . . . . . . . . . . . . . . . . . . . 5 | 4.1. Scaled Lifetime Processing . . . . . . . . . . . . . . . 5 | |||
6. Handling Multiple NAT64 Prefixes . . . . . . . . . . . . . . 6 | 5. Usage Guidelines . . . . . . . . . . . . . . . . . . . . . . 6 | |||
7. PREF64 Consistency . . . . . . . . . . . . . . . . . . . . . 7 | 5.1. Handling Multiple NAT64 Prefixes . . . . . . . . . . . . 6 | |||
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 | 5.2. PREF64 Consistency . . . . . . . . . . . . . . . . . . . 7 | |||
9. Security Considerations . . . . . . . . . . . . . . . . . . . 8 | 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 | |||
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8 | 7. Security Considerations . . . . . . . . . . . . . . . . . . . 8 | |||
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 | 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 9 | |||
11.1. Normative References . . . . . . . . . . . . . . . . . . 8 | 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 9 | |||
11.2. Informative References . . . . . . . . . . . . . . . . . 9 | 9.1. Normative References . . . . . . . . . . . . . . . . . . 9 | |||
11.3. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 10 | 9.2. Informative References . . . . . . . . . . . . . . . . . 9 | |||
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 10 | 9.3. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 11 | |||
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 11 | ||||
1. Introduction | 1. Introduction | |||
NAT64 [RFC6146] with DNS64 [RFC6147] is a widely-deployed mechanism | NAT64 [RFC6146] with DNS64 [RFC6147] is a widely-deployed mechanism | |||
to provide IPv4 access on IPv6-only networks. In various scenarios, | to provide IPv4 access on IPv6-only networks. In various scenarios, | |||
the host must be aware of the NAT64 prefix in use by the network. | the host must be aware of the NAT64 prefix in use by the network. | |||
This document specifies a Neighbor Discovery [RFC4861] option to be | This document specifies a Neighbor Discovery [RFC4861] option to be | |||
used in Router Advertisements to communicate NAT64 prefixes to hosts. | used in Router Advertisements to communicate NAT64 prefixes to hosts. | |||
1.1. Requirements Language | 1.1. Requirements Language | |||
skipping to change at page 3, line 18 ¶ | skipping to change at page 3, line 18 ¶ | |||
On networks employing NAT64, it is useful for hosts to know the NAT64 | On networks employing NAT64, it is useful for hosts to know the NAT64 | |||
prefix for several reasons, including the following: | prefix for several reasons, including the following: | |||
o Enabling DNS64 functions on end hosts. In particular: | o Enabling DNS64 functions on end hosts. In particular: | |||
* Local DNSSEC validation (DNS64 in stub-resolver mode). As | * Local DNSSEC validation (DNS64 in stub-resolver mode). As | |||
discussed in [RFC6147] section 2, the stub resolver in the host | discussed in [RFC6147] section 2, the stub resolver in the host | |||
"will try to obtain (real) AAAA RRs, and in case they are not | "will try to obtain (real) AAAA RRs, and in case they are not | |||
available, the DNS64 function will synthesize AAAA RRs for | available, the DNS64 function will synthesize AAAA RRs for | |||
internal usage." This is required in order to use DNSSEC on a | internal usage." Therefore to perform the DNS64 function the | |||
NAT64 network. | stub resolver needs to know the NAT64 prefix. This is required | |||
in order to use DNSSEC on a NAT64 network. | ||||
* Trusted DNS server. AAAA synthesis is required for the host to | * Trusted DNS server. AAAA synthesis is required for the host to | |||
be able to use a DNS server not provided by the network (e.g., | be able to use a DNS server not provided by the network (e.g., | |||
a DNS-over-TLS [RFC7858] or DNS-over-HTTPS [RFC8484] server | a DNS-over-TLS [RFC7858] or DNS-over-HTTPS [RFC8484] server | |||
with which the host has an existing trust relationship). | with which the host has an existing trust relationship). | |||
* Networks with no DNS64 server. Hosts that support AAAA | * Networks with no DNS64 server. Hosts that support AAAA | |||
synthesis and that are aware of the NAT64 prefix in use do not | synthesis and that are aware of the NAT64 prefix in use do not | |||
need the network to perform the DNS64 function at all. | need the network to perform the DNS64 function at all. | |||
skipping to change at page 4, line 20 ¶ | skipping to change at page 4, line 21 ¶ | |||
Updatability: it is possible to change the NAT64 prefix at any time, | Updatability: it is possible to change the NAT64 prefix at any time, | |||
because when it changes, it is possible to notify hosts by sending a | because when it changes, it is possible to notify hosts by sending a | |||
new Router Advertisement. | new Router Advertisement. | |||
Deployability: all IPv6 hosts and networks are required to support | Deployability: all IPv6 hosts and networks are required to support | |||
Neighbor Discovery [RFC4861] so just a minor extension to the | Neighbor Discovery [RFC4861] so just a minor extension to the | |||
existing implementation is required. Other options such as [RFC7225] | existing implementation is required. Other options such as [RFC7225] | |||
require implementing other protocols (e.g. PCP [RFC7225]) which | require implementing other protocols (e.g. PCP [RFC7225]) which | |||
could be considered an obstacle for deployment. | could be considered an obstacle for deployment. | |||
4. Usage Guidelines | 4. Option format | |||
This option specifies exactly one NAT64 prefix for all IPv4 | ||||
destinations. If the network operator desires to route different | ||||
parts of the IPv4 address space to different NAT64 devices, this can | ||||
be accomplished by routing more specifics of the NAT64 prefix to | ||||
those devices. For example, if the operator is using the RFC1918 | ||||
address space, e.g. 10.0.0.0/8 internally and would like to route | ||||
10.0.0.0/8 through NAT64 device A and the rest of the IPv4 space | ||||
through NAT64 device B, and the operator's NAT64 prefix is | ||||
2001:db8:a:b::/96, then the operator can route | ||||
2001:db8:a:b::a00:0/104 to NAT64 A and 2001:db8:a:b::/96 to NAT64 B. | ||||
This option may appear more than once in a Router Advertisement (e.g. | ||||
in case of graceful renumbering the network from one NAT64 prefix to | ||||
another). Host behaviour with regards to synthesizing IPv6 addresses | ||||
from IPv4 addresses SHOULD follow the recommendations given in | ||||
Section 3 of [RFC7050], limited to the NAT64 prefixes that have non- | ||||
zero lifetime. | ||||
In a network (or a provisioning domain) that provides both IPv4 and | ||||
NAT64, it may be desirable for certain IPv4 addresses not to be | ||||
translated. An example might be private address ranges that are | ||||
local to the network/provisioning domain and should not be reached | ||||
through the NAT64. This type of configuration cannot be conveyed to | ||||
hosts using this option, or through other NAT64 prefix provisioning | ||||
mechanisms such as [RFC7050] or [RFC7225]. This problem does not | ||||
apply in IPv6-only networks, because in such networks, the host does | ||||
not have an IPv4 address and cannot reach any IPv4 destinations | ||||
without the NAT64. | ||||
5. Option format | ||||
0 1 2 3 | 0 1 2 3 | |||
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | |||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |||
| Type | Length | Scaled Lifetime | PLC | | | Type | Length | Scaled Lifetime | PLC | | |||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | |||
| | | | | | |||
+ + | + + | |||
| Highest 96 bits of the Prefix | | | Highest 96 bits of the Prefix | | |||
+ + | + + | |||
skipping to change at page 6, line 14 ¶ | skipping to change at page 5, line 14 ¶ | |||
Type 8-bit identifier of the PREF64 option type as assigned by | Type 8-bit identifier of the PREF64 option type as assigned by | |||
IANA: TBD | IANA: TBD | |||
Length 8-bit unsigned integer. The length of the option | Length 8-bit unsigned integer. The length of the option | |||
(including the Type and Length fields) is in units of 8 | (including the Type and Length fields) is in units of 8 | |||
octets. The sender MUST set the length to 2. The receiver | octets. The sender MUST set the length to 2. The receiver | |||
MUST ignore the PREF64 option if the length field value is | MUST ignore the PREF64 option if the length field value is | |||
not 2. | not 2. | |||
Scaled 13-bit unsigned integer. The maximum time in units of 8 | Scaled 13-bit unsigned integer. The maximum time in units of 8 | |||
Lifetime seconds over which this NAT64 prefix MAY be used. The value | Lifetime seconds over which this NAT64 prefix MAY be used. See | |||
of the Scaled Lifetime field SHOULD by default be set to the | Section 4.1 for the Scaled Lifetime field processing rules. | |||
lesser of 3 x MaxRtrAdvInterval divided by 8, or 8191. The | ||||
receiver MUST multiply the Scaled Lifetime value by 8 (for | ||||
example, by logical left shift) to calculate the maximum | ||||
time in seconds the prefix MAY be used. Lifetime of 0 | ||||
indicates that the prefix SHOULD NOT be used anymore. Router | ||||
vendors SHOULD allow administrators to specify non-zero | ||||
lifetime values which are not divisible by 8. In such cases | ||||
the router SHOULD round the provided value up to the lesser | ||||
of nearest integer divisible by 8, or 65528 and divide the | ||||
result by 8 (or just perform a logical right-shift by 3) and | ||||
set the Scaled Lifetime field to the resulting value. If | ||||
such a non-zero lifetime value to be divided by 8 (to be | ||||
subjected to a logical right-shift by 3) is less than 8 then | ||||
the Scaled Lifetime field SHOULD by default be set to 1. | ||||
PLC 3-bit unsigned integer. This field encodes the NAT64 Prefix | PLC 3-bit unsigned integer. This field encodes the NAT64 Prefix | |||
(Prefix Length defined in [RFC6052]. The PLC field values 0, 1, 2, | (Prefix Length defined in [RFC6052]. The PLC field values 0, 1, 2, | |||
Length 3, 4 and 5 indicate the NAT64 prefix length of 96, 64, 56, | Length 3, 4 and 5 indicate the NAT64 prefix length of 96, 64, 56, | |||
Code) 48, 40 and 32 bits respectively. The receiver MUST ignore | Code) 48, 40 and 32 bits respectively. The receiver MUST ignore | |||
the PREF64 option if the prefix length code field is not set | the PREF64 option if the prefix length code field is not set | |||
to one of those values. | to one of those values. | |||
Highest 96-bit unsigned integer. Contains bits 0 - 95 of the NAT64 | Highest 96-bit unsigned integer. Contains bits 0 - 95 of the NAT64 | |||
96 bits prefix. | 96 bits prefix. | |||
of the | of the | |||
prefix | prefix | |||
6. Handling Multiple NAT64 Prefixes | 4.1. Scaled Lifetime Processing | |||
It would be highly undesirable for the NAT64 prefix to have a | ||||
lifetime shorter than the Router Lifetime, which is defined in the | ||||
Section 4.2 of [RFC4861] as 16-bit unsigned integer. If the NAT64 | ||||
prefix lifetime is not at least equal to the default router lifetime | ||||
it might lead to scenarios when the NAT64 prefix lifetime expires | ||||
before the arrival of the next unsolicited RA. Therefore the Scaled | ||||
Lifetime encodes the NAT64 prefix lifetime in units of 8 seconds. | ||||
The receiver MUST multiply the Scaled Lifetime value by 8 (for | ||||
example, by logical left shift) to calculate the maximum time in | ||||
seconds the prefix MAY be used. The maximum lifetime of the NAT64 | ||||
prefix is thus 65528 seconds. To ensure that the NAT64 prefix does | ||||
not expire before the default router, when using this option it is | ||||
NOT RECOMMENDED to configure default router lifetimes greater than | ||||
65528 seconds. Lifetime of 0 indicates that the prefix SHOULD NOT be | ||||
used anymore. | ||||
The value of the Scaled Lifetime field SHOULD by default be set to | ||||
the lesser of 3 x MaxRtrAdvInterval ([RFC4861]) divided by 8, or | ||||
8191. | ||||
Router vendors SHOULD allow administrators to specify non-zero | ||||
lifetime values which are not divisible by 8. In such cases the | ||||
router SHOULD round the provided value up to the nearest integer that | ||||
is divisible by 8 and smaller than 65536, then divide the result by 8 | ||||
(or perform a logical right-shift by 3), and set the Scaled Lifetime | ||||
field to the resulting value. If such a non-zero lifetime value to | ||||
be divided by 8 (to be subjected to a logical right-shift by 3) is | ||||
less than 8 then the Scaled Lifetime field SHOULD be set to 1. This | ||||
last step ensures that lifetimes under 8 seconds are encoded as a | ||||
non-zero Scaled Lifetime. | ||||
5. Usage Guidelines | ||||
This option specifies exactly one NAT64 prefix for all IPv4 | ||||
destinations. If the network operator desires to route different | ||||
parts of the IPv4 address space to different NAT64 devices, this can | ||||
be accomplished by routing more specific sub-prefixes of the NAT64 | ||||
prefix to those devices. For example, suppose an operator is using | ||||
the [RFC1918] address space 10.0.0.0/8 internally. That operator | ||||
might want to route 10.0.0.0/8 through NAT64 device A, and the rest | ||||
of the IPv4 space through NAT64 device B. If the operator's NAT64 | ||||
prefix is 2001:db8:a:b::/96, then the operator can route | ||||
2001:db8:a:b::a00:0/104 to NAT64 A and 2001:db8:a:b::/96 to NAT64 B. | ||||
This option may appear more than once in a Router Advertisement (e.g. | ||||
in case of graceful renumbering the network from one NAT64 prefix to | ||||
another). Host behaviour with regards to synthesizing IPv6 addresses | ||||
from IPv4 addresses SHOULD follow the recommendations given in | ||||
Section 3 of [RFC7050], limited to the NAT64 prefixes that have non- | ||||
zero lifetime. | ||||
In a network (or a provisioning domain) that provides both IPv4 and | ||||
NAT64, it may be desirable for certain IPv4 addresses not to be | ||||
translated. An example might be private address ranges that are | ||||
local to the network/provisioning domain and should not be reached | ||||
through the NAT64. This type of configuration cannot be conveyed to | ||||
hosts using this option, or through other NAT64 prefix provisioning | ||||
mechanisms such as [RFC7050] or [RFC7225]. This problem does not | ||||
apply in IPv6-only networks, because in such networks, the host does | ||||
not have an IPv4 address and cannot reach any IPv4 destinations | ||||
without the NAT64. | ||||
5.1. Handling Multiple NAT64 Prefixes | ||||
In some cases a host may receive multiple NAT64 prefixes from | In some cases a host may receive multiple NAT64 prefixes from | |||
different sources. Possible scenarios include (but are not limited | different sources. Possible scenarios include (but are not limited | |||
to): | to): | |||
o the host is using multiple mechanisms to discover PREF64 prefixes | o the host is using multiple mechanisms to discover PREF64 prefixes | |||
(e.g. by using PCP [RFC7225]) and/or by resolving IPv4-only fully | (e.g. by using PCP [RFC7225]) and/or by resolving IPv4-only fully | |||
qualified domain name [RFC7050] in addition to receiving the | qualified domain name [RFC7050] in addition to receiving the | |||
PREF64 RA option); | PREF64 RA option); | |||
o the PREF64 option presents in a single RA more than once; | o the PREF64 option presents in a single RA more than once; | |||
o the host receives multiple RAs with different PREF64 prefixes on | o the host receives multiple RAs with different PREF64 prefixes on a | |||
one or multiple interfaces. | given interface. | |||
When multiple PREF64 were discovered via RA PREF64 Option (the Option | When multiple PREF64 were discovered via RA PREF64 Option (the Option | |||
presents more than once in a single RA or multiple RAs were | presents more than once in a single RA or multiple RAs were | |||
received), host behaviour with regards to synthesizing IPv6 addresses | received), host behaviour with regards to synthesizing IPv6 addresses | |||
from IPv4 addresses SHOULD follow the recommendations given in | from IPv4 addresses SHOULD follow the recommendations given in | |||
Section 3 of [RFC7050], limited to the NAT64 prefixes that have non- | Section 3 of [RFC7050], limited to the NAT64 prefixes that have non- | |||
zero lifetime. | zero lifetime. | |||
When different PREF64 are discovered by using multiple mechanisms, | When different PREF64 are discovered by using multiple mechanisms, | |||
hosts SHOULD select one source of information only. The RECOMMENDED | hosts SHOULD select one source of information only. The RECOMMENDED | |||
skipping to change at page 7, line 33 ¶ | skipping to change at page 7, line 35 ¶ | |||
o PREF64 discovered via RA Option; | o PREF64 discovered via RA Option; | |||
o PREF64 resolving IPv4-only fully qualified domain name [RFC7050] | o PREF64 resolving IPv4-only fully qualified domain name [RFC7050] | |||
Note that if the network provides PREF64 both via this RA option and | Note that if the network provides PREF64 both via this RA option and | |||
[RFC7225], hosts that receive the PREF64 via RA option may choose to | [RFC7225], hosts that receive the PREF64 via RA option may choose to | |||
use it immediately before waiting for PCP to complete, and therefore | use it immediately before waiting for PCP to complete, and therefore | |||
some traffic may not reflect any more detailed configuration provided | some traffic may not reflect any more detailed configuration provided | |||
by PCP. | by PCP. | |||
7. PREF64 Consistency | The host SHOULD treat the PREF64 as being specific to the network | |||
interface it was received on. Provisioning Domain (PvD, [RFC7556]) | ||||
aware hosts MUST treat the PREF64 as being scoped to the implicit or | ||||
explicit PvD. | ||||
5.2. PREF64 Consistency | ||||
Section 6.2.7 of [RFC4861] recommends that routers inspect RAs sent | Section 6.2.7 of [RFC4861] recommends that routers inspect RAs sent | |||
by other routers to ensure that all routers onlink advertise the | by other routers to ensure that all routers onlink advertise | |||
consistent information. Routers SHOULD inspect valid PREF64 options | consistent information. Routers SHOULD inspect valid PREF64 options | |||
received on a given link and verify the consistency. Detected | received on a given link and verify the consistency. Detected | |||
inconsistencies indicate that one or more routers might be | inconsistencies indicate that one or more routers might be | |||
misconfigured. Routers SHOULD log such cases to system or network | misconfigured. Routers SHOULD log such cases to system or network | |||
management. Routers SHOULD check and compare the following | management. Routers SHOULD check and compare the following | |||
information: | information: | |||
o set of PREF64 with non-zero lifetime; | o set of PREF64 with non-zero lifetime; | |||
o set of PREF64 with zero lifetime. | o set of PREF64 with zero lifetime. | |||
Provisioning Domain (PvD, [RFC7556])-aware routers MUST only compare | Provisioning Domain (PvD, [RFC7556]) aware routers MUST only compare | |||
information scoped to the same implicit or explicit PvD. | information scoped to the same implicit or explicit PvD. | |||
8. IANA Considerations | 6. IANA Considerations | |||
The IANA is requested to assign a new IPv6 Neighbor Discovery Option | The IANA is requested to assign a new IPv6 Neighbor Discovery Option | |||
type for the PREF64 option defined in this document. | type for the PREF64 option defined in this document. | |||
+---------------+-------+ | +---------------+-------+ | |||
| Option Name | Type | | | Option Name | Type | | |||
+---------------+-------+ | +---------------+-------+ | |||
| PREF64 option | (TBD) | | | PREF64 option | (TBD) | | |||
+---------------+-------+ | +---------------+-------+ | |||
Table 1 | Table 1 | |||
The IANA registry for these options is: | The IANA registry for these options is: | |||
https://www.iana.org/assignments/icmpv6-parameters [1] | https://www.iana.org/assignments/icmpv6-parameters [1] | |||
9. Security Considerations | 7. Security Considerations | |||
Because Router Advertisements are required in all IPv6 configuration | Because Router Advertisements are required in all IPv6 configuration | |||
scenarios, on IPv6-only networks, Router Advertisements must already | scenarios, on IPv6-only networks, Router Advertisements must already | |||
be secured, e.g., by deploying RA guard [RFC6105]. Providing all | be secured, e.g., by deploying RA guard [RFC6105]. Providing all | |||
configuration in Router Advertisements reduces the attack surface to | configuration in Router Advertisements reduces the attack surface to | |||
be targeted by malicious attackers to provide hosts with invalid | be targeted by malicious attackers to provide hosts with invalid | |||
configuration as compared to distributing the configuration through | configuration as compared to distributing the configuration through | |||
multiple different mechanisms that need to be secured independently. | multiple different mechanisms that need to be secured independently. | |||
If a host is provided with an incorrect NAT64 prefix the IPv6-only | ||||
host might not be able to communicate with IPv4-only destinations. | ||||
Connectivity to destinations reachable over IPv6 would not be | ||||
impacted just by providing a host with an incorrect prefix (however | ||||
if attackers are capable of sending rogue RAs they can perform | ||||
denial-of-service or man-in-the-middle attacks, as described in | ||||
[RFC6104]). | ||||
The security measures that must already be in place to ensure that | The security measures that must already be in place to ensure that | |||
Router Advertisements are only received from legitimate sources | Router Advertisements are only received from legitimate sources | |||
eliminate the problem of NAT64 prefix validation described in section | eliminate the problem of NAT64 prefix validation described in section | |||
3.1 of [RFC7050]. | 3.1 of [RFC7050]. | |||
10. Acknowledgements | 8. Acknowledgements | |||
Thanks to the following people (in alphabetical order) for their | Thanks to the following people (in alphabetical order) for their | |||
review and feedback: Mikael Abrahamsson, Mark Andrews, Brian E | review and feedback: Mikael Abrahamsson, Mark Andrews, Brian E | |||
Carpenter, David Farmer, Nick Heatley, Robert Hinden, Martin Hunek, | Carpenter, David Farmer, Nick Heatley, Robert Hinden, Martin Hunek, | |||
Tatuya Jinmei, Erik Kline, Suresh Krishnan, David Lamparter, Jordi | Tatuya Jinmei, Benjamin Kaduk, Erik Kline, Suresh Krishnan, Warren | |||
Palet Martinez, Tommy Pauly, Alexandre Petrescu, Michael Richardson, | Kumari, David Lamparter, Barry Leiba, Jordi Palet Martinez, Tommy | |||
David Schinazi, Ole Troan, Bernie Volz. | Pauly, Alexandre Petrescu, Michael Richardson, David Schinazi, Ole | |||
Troan, Eric Vynke, Bernie Volz. | ||||
11. References | 9. References | |||
11.1. Normative References | 9.1. Normative References | |||
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
Requirement Levels", BCP 14, RFC 2119, | Requirement Levels", BCP 14, RFC 2119, | |||
DOI 10.17487/RFC2119, March 1997, | DOI 10.17487/RFC2119, March 1997, | |||
<https://www.rfc-editor.org/info/rfc2119>. | <https://www.rfc-editor.org/info/rfc2119>. | |||
[RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, | [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, | |||
"Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, | "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, | |||
DOI 10.17487/RFC4861, September 2007, | DOI 10.17487/RFC4861, September 2007, | |||
<https://www.rfc-editor.org/info/rfc4861>. | <https://www.rfc-editor.org/info/rfc4861>. | |||
skipping to change at page 9, line 29 ¶ | skipping to change at page 9, line 43 ¶ | |||
[RFC7050] Savolainen, T., Korhonen, J., and D. Wing, "Discovery of | [RFC7050] Savolainen, T., Korhonen, J., and D. Wing, "Discovery of | |||
the IPv6 Prefix Used for IPv6 Address Synthesis", | the IPv6 Prefix Used for IPv6 Address Synthesis", | |||
RFC 7050, DOI 10.17487/RFC7050, November 2013, | RFC 7050, DOI 10.17487/RFC7050, November 2013, | |||
<https://www.rfc-editor.org/info/rfc7050>. | <https://www.rfc-editor.org/info/rfc7050>. | |||
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC | [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC | |||
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, | 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, | |||
May 2017, <https://www.rfc-editor.org/info/rfc8174>. | May 2017, <https://www.rfc-editor.org/info/rfc8174>. | |||
11.2. Informative References | 9.2. Informative References | |||
[RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G., | ||||
and E. Lear, "Address Allocation for Private Internets", | ||||
BCP 5, RFC 1918, DOI 10.17487/RFC1918, February 1996, | ||||
<https://www.rfc-editor.org/info/rfc1918>. | ||||
[RFC6104] Chown, T. and S. Venaas, "Rogue IPv6 Router Advertisement | ||||
Problem Statement", RFC 6104, DOI 10.17487/RFC6104, | ||||
February 2011, <https://www.rfc-editor.org/info/rfc6104>. | ||||
[RFC6105] Levy-Abegnoli, E., Van de Velde, G., Popoviciu, C., and J. | [RFC6105] Levy-Abegnoli, E., Van de Velde, G., Popoviciu, C., and J. | |||
Mohacsi, "IPv6 Router Advertisement Guard", RFC 6105, | Mohacsi, "IPv6 Router Advertisement Guard", RFC 6105, | |||
DOI 10.17487/RFC6105, February 2011, | DOI 10.17487/RFC6105, February 2011, | |||
<https://www.rfc-editor.org/info/rfc6105>. | <https://www.rfc-editor.org/info/rfc6105>. | |||
[RFC6146] Bagnulo, M., Matthews, P., and I. van Beijnum, "Stateful | [RFC6146] Bagnulo, M., Matthews, P., and I. van Beijnum, "Stateful | |||
NAT64: Network Address and Protocol Translation from IPv6 | NAT64: Network Address and Protocol Translation from IPv6 | |||
Clients to IPv4 Servers", RFC 6146, DOI 10.17487/RFC6146, | Clients to IPv4 Servers", RFC 6146, DOI 10.17487/RFC6146, | |||
April 2011, <https://www.rfc-editor.org/info/rfc6146>. | April 2011, <https://www.rfc-editor.org/info/rfc6146>. | |||
skipping to change at page 10, line 28 ¶ | skipping to change at page 11, line 5 ¶ | |||
[RFC8305] Schinazi, D. and T. Pauly, "Happy Eyeballs Version 2: | [RFC8305] Schinazi, D. and T. Pauly, "Happy Eyeballs Version 2: | |||
Better Connectivity Using Concurrency", RFC 8305, | Better Connectivity Using Concurrency", RFC 8305, | |||
DOI 10.17487/RFC8305, December 2017, | DOI 10.17487/RFC8305, December 2017, | |||
<https://www.rfc-editor.org/info/rfc8305>. | <https://www.rfc-editor.org/info/rfc8305>. | |||
[RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS | [RFC8484] Hoffman, P. and P. McManus, "DNS Queries over HTTPS | |||
(DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018, | (DoH)", RFC 8484, DOI 10.17487/RFC8484, October 2018, | |||
<https://www.rfc-editor.org/info/rfc8484>. | <https://www.rfc-editor.org/info/rfc8484>. | |||
11.3. URIs | 9.3. URIs | |||
[1] https://www.iana.org/assignments/icmpv6-parameters | [1] https://www.iana.org/assignments/icmpv6-parameters | |||
Authors' Addresses | Authors' Addresses | |||
Lorenzo Colitti | Lorenzo Colitti | |||
Shibuya 3-21-3 | Shibuya 3-21-3 | |||
Shibuya, Tokyo 150-0002 | Shibuya, Tokyo 150-0002 | |||
JP | JP | |||
End of changes. 22 change blocks. | ||||
82 lines changed or deleted | 125 lines changed or added | |||
This html diff was produced by rfcdiff 1.47. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ |