| Network Working Group | M. Boucadair |
| Internet-Draft | C. Jacquenet |
| Intended status: Standards Track | Orange |
| Expires: April 21, 2019 | T. Reddy |
| McAfee | |
| October 18, 2018 |
DHCP Options for 0-RTT TCP Converters
draft-boucadair-tcpm-dhc-converter-01
Because of the lack of Multipath TCP (MPTCP) support at the server side, some service providers now consider a network-assisted model that relies upon the activation of a dedicated function called Converters. Network-assisted MPTCP deployment models are designed to facilitate the adoption of MPTCP for the establishment of multi-path communications without making any assumption about the support of MPTCP by the communicating peers. Converters located in the network are responsible for establishing multi-path communications on behalf of endpoints, thereby taking advantage of MPTCP capabilities to achieve different goals that include (but are not limited to) optimization of resource usage (e.g., bandwidth aggregation), of resiliency (e.g., primary/backup communication paths), and traffic offload management.
This document focuses on the explicit deployment scheme where the identity of the Converters is explicitly configured on connected hosts. This document specifies DHCP (IPv4 and IPv6) options to configure hosts with Converters parameters.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on April 21, 2019.
Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
One of the promising deployment scenarios for Multipath TCP (MPTCP, [RFC6824]) is to enable a host or a Customer Premises Equipment (CPE) connected to multiple networks (e.g., DSL, LTE, WLAN) to optimize the usage of such resources. A deployment scenario relies on MPTCP Conversion Points (Converters). A Converter terminates the MPTCP sessions established from a host/CPE, before redirecting traffic into a legacy TCP session. Further Network-Assisted MPTCP deployment and operational considerations are discussed in [I-D.nam-mptcp-deployment-considerations].
Figure 1 shows a deployment example of the Converters to assist establishing MPTCP connections.
+------------+ _--------_ +----------------+ | | ( LTE ) | | | Host +=======+ +===+ Backbone | | | (_ _) | Network | | | (_______) |+--------------+| | | IP Network #1 || Converter ||------> Internet | | || || | | |+--------------+| | | IP Network #2 | | | | _--------_ | | | | ( DSL ) | | | +=======+ +==+ | | | (_ _) | | +------------+ (_______) +----------------+
Figure 1: “Network-Assisted” MPTCP Design
[I-D.ietf-tcpm-converters] specifies the Converter as a function that is installed by a network operator to aid the deployment of TCP extensions and to provide the benefits of such extensions to clients. A Transport Converter supports one or more TCP extensions.
[I-D.ietf-tcpm-converters] assumes the explicit mode that consists in configuring explicitly the reachability information of the Converter(s) on a host.
This document defines DHCPv4 [RFC2131] and DHCPv6 [RFC3315] options that can be used to configure hosts with Converter IP addresses.
This specification assumes a Converter is reachable through one or multiple IP addresses. As such, a list of IP addresses can be returned in the DHCP MPTCP option. Also, it assumes the various network attachments provided to an MPTCP-enabled CPE are managed by the same administrative entity.
This document makes use of the following terms:
The DHCPv6 Converter option can be used to configure a list of IPv6 addresses of a Converter.
The format of this option is shown in Figure 2. As a reminder, this format follows the guidelines for creating new DHCPv6 options (Section 5.1 of [RFC7227]).
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | OPTION_V6_CONVERT | Option-length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | ipv6-address | | | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | ipv6-address | | | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ... | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2: DHCPv6 Converter option
Figure 2 are as follows:
Clients MAY request option OPTION_V6_CONVERT, as defined in [RFC3315], Sections 17.1.1, 18.1.1, 18.1.3, 18.1.4, 18.1.5, and 22.7. As a convenience to the reader, we mention here that the client includes requested option codes in the Option Request Option.
The DHCPv6 client MUST be prepared to receive multiple instances of OPTION_V6_CONVERT; each instance is to be treated separately as it corresponds to a given Converter: there are as many Converters as instances of the OPTION_V6_CONVERT option.
If an IPv4-mapped IPv6 address is received in OPTION_V6_CONVERT, it indicates that the Converter has the corresponding IPv4 address.
The DHCPv6 client MUST silently discard multicast and host loopback addresses [RFC6890] conveyed in OPTION_V6_CONVERT.
The DHCPv4 Converter option can be used to configure a list of IPv4 addresses of a Converter. The format of this option is illustrated in Figure 3.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | List-Length | List of | +-+-+-+-+-+-+-+-+ | / Converter IPv4 Addresses / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ --- | List-Length | List of | | +-+-+-+-+-+-+-+-+ | | / Converter IPv4 Addresses / | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | . ... . Optional +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | List-Length | List of | | +-+-+-+-+-+-+-+-+ | | / Converter IPv4 Addresses / | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ---
Figure 3: DHCPv4 Converter option
0 8 16 24 32 40 48
+-----+-----+-----+-----+-----+-----+--
| a1 | a2 | a3 | a4 | a1 | a2 | ...
+-----+-----+-----+-----+-----+-----+--
IPv4 Address 1 IPv4 Address 2 ...
The fields of the option shown in Figure 3 are as follows:
This format assumes that an IPv4 address is encoded as a1.a2.a3.a4.
Figure 4: Format of the List of Converter IPv4 Addresses
[RFC3396] MUST be used if OPTION_V4_CONVERT exceeds the maximum DHCPv4 option size of 255 octets.
Some guidelines for DHCP servers are elaborated in Appendix A.
To discover one or more Converters, the DHCPv4 client MUST include OPTION_V4_CONVERT in a Parameter Request List Option [RFC2132].
The DHCPv4 client MUST be prepared to receive multiple lists of Converter IPv4 addresses in the same OPTION_V4_CONVERT; each list is to be treated as a separate Converter instance.
The DHCPv4 client MUST silently discard multicast and host loopback addresses [RFC6890] conveyed in OPTION_V4_CONVERT.
The security considerations in [RFC2131] and [RFC3315] are to be considered.
Generic Convert security considerations are discussed in [I-D.ietf-tcpm-converters].
MPTCP-related security considerations are discussed in [RFC6824].
Means to protect the Converter against Denial-of-Service (DoS) attacks must be enabled. Such means include the enforcement of ingress filtering policies at the boundaries of the network. In order to prevent exhausting the resources of the Converter by creating an aggressive number of simultaneous subflows for each MPTCP connection, the administrator should limit the number of allowed subflows per host for a given connection.
Attacks outside the domain can be prevented if ingress filtering is enforced. Nevertheless, attacks from within the network between a host and a Converter instance are yet another actual threat. Means to ensure that illegitimate nodes cannot connect to a network should be implemented.
Traffic theft is also a risk if an illegitimate Converter is inserted in the path. Indeed, inserting an illegitimate Converter in the forwarding path allows to intercept traffic and can therefore provide access to sensitive data issued by or destined to a host. To mitigate this threat, secure means to discover a Converter should be enabled.
IANA is requested to assign the following new DHCPv6 Option Code in the registry maintained in http://www.iana.org/assignments/dhcpv6-parameters:
| Option Name | Value |
|---|---|
| OPTION_V6_CONVERT | TBA |
IANA is requested to assign the following new DHCPv4 Option Code in the registry maintained in http://www.iana.org/assignments/bootp-dhcp-parameters/:
| Option Name | Value | Data length | Meaning |
|---|---|---|---|
| OPTION_V4_CONVERT | TBA | Variable; the minimum length is 5. | Includes one or multiple lists of Converter IP addresses; each list is treated as a separate Converter. |
Many thanks to Olivier Bonaventure for the feedback on this document. Olivier suggested to define the option as a name but that design approach was debated several times within the dhc wg.
Thanks to Dan Seibel, Bernie Volz, Niall O'Reilly, Simon Hobson, and Ted Lemon for the feedback on the dhc wg mailing list.
| [I-D.nam-mptcp-deployment-considerations] | Boucadair, M., Jacquenet, C., Bonaventure, O., Henderickx, W. and R. Skog, "Network-Assisted MPTCP: Use Cases, Deployment Scenarios and Operational Considerations", Internet-Draft draft-nam-mptcp-deployment-considerations-01, December 2016. |
| [RFC0793] | Postel, J., "Transmission Control Protocol", STD 7, RFC 793, DOI 10.17487/RFC0793, September 1981. |
| [RFC7227] | Hankins, D., Mrugalski, T., Siodelski, M., Jiang, S. and S. Krishnan, "Guidelines for Creating New DHCPv6 Options", BCP 187, RFC 7227, DOI 10.17487/RFC7227, May 2014. |
| [RFC7844] | Huitema, C., Mrugalski, T. and S. Krishnan, "Anonymity Profiles for DHCP Clients", RFC 7844, DOI 10.17487/RFC7844, May 2016. |
| [RFC7969] | Lemon, T. and T. Mrugalski, "Customizing DHCP Configuration on the Basis of Network Topology", RFC 7969, DOI 10.17487/RFC7969, October 2016. |
DHCP servers that support the DHCP Converter option can be configured with a list of IP addresses of the Converter(s). If multiple IP addresses are configured, the DHCP server MUST be explicitly configured whether all or some of these addresses refer to:
Precisely how DHCP servers are configured to separate lists of IP addresses according to which Converter they refer to is out of scope for this document. However, DHCP servers MUST NOT combine the IP addresses of multiple Converters and return them to the DHCP client as if they were belonging to a single Converter, and DHCP servers MUST NOT separate the addresses of a single Converter and return them as if they were belonging to distinct Converters. For example, if an administrator configures the DHCP server by providing a Fully Qualified Domain Name (FQDN) for a Converter, even if that FQDN resolves to multiple addresses, the DHCP server MUST deliver them within a single server address block.
DHCPv6 servers that implement this option and that can populate the option by resolving FQDNs will need a mechanism for indicating whether to query A records or only AAAA records. When a query returns A records, the IP addresses in those records are returned in the DHCPv6 response as IPv4-mapped IPv6 addresses.
Since this option requires support for IPv4-mapped IPv6 addresses, a DHCPv6 server implementation will not be complete if it does not query A records and represent any that are returned as IPv4-mapped IPv6 addresses in DHCPv6 responses. The mechanism whereby DHCPv6 implementations provide this functionality is beyond the scope of this document.
For guidelines on providing context-specific configuration information (e.g., returning a regional-based configuration), and information on how a DHCP server might be configured with FQDNs that get resolved on demand, see [RFC7969].