rfc-6915

Flow Identity Extension for HTTP-Enabled Location Delivery (HELD)

R. Bellis

date2013-04 streamIETF arearai wggeopriv statusPROPOSED STANDARD pages9 canonicalhttps://www.rfc-editor.org/rfc/rfc6915 doi10.17487/RFC6915

RFC 6155 specifies an extension for the HTTP-Enabled Location Delivery (HELD) protocol, allowing the use of an IP address and port number to request a Device location based on an individual packet flow. However, certain kinds of NAT require that identifiers for both ends of the packet flow must be specified in order to unambiguously satisfy the location request. This document specifies an XML Schema and a URN Sub-Namespace for a Flow Identity Extension for HELD to support this requirement. This document updates RFC 6155 by deprecating the port number elements specified therein.

updates

rfc-6155 — Use of Device Identity in HTTP-Enabled Location Delivery (HELD)

Extracted elements (14)

design-rationale §1

Certain NAT types, particularly Carrier Grade NATs, require the complete 6-tuple (Layer 3 protocol, Layer 4 protocol, source address, source port, destination address, destination port) to unambiguously identify a flow and thus the true Device. The RFC 6155 port-only approach is insufficient for these NAT scenarios.

nat, realtime, sip

design-rationale §1

The extension is designed to provide a more generally applicable means of identifying a Device based on the parameters of a network flow of which it is an endpoint, rather than being limited to the specific port-only approach of RFC 6155, in order to accommodate a broader range of NAT configurations.

nat

interoperability-note §1

Server implementations of this specification may still encounter requests formed by clients that have implemented only RFC 6155, and those requests might contain the deprecated port element. Servers must handle such legacy requests gracefully.

nat

normative-requirement §3 MUST

The <flow> element MUST contain a 'layer3' attribute with a value of 'ipv4' or 'ipv6'.

normative-requirement §3 MUST

The <flow> element MUST contain a 'layer4' attribute with a value of 'udp', 'tcp', 'sctp', 'dccp', or a decimal integer representing any applicable protocol from the IANA Assigned Internet Protocol Numbers Registry.

ip, registry

normative-requirement §3 MUST

The <flow> element MUST contain a <src> element and a <dst> element whose child elements contain the Layer 3 address (which MUST conform to the relevant 'IPv4address' or 'IPv6address' grammar as defined in RFC 3986) and the Layer 4 port number of each end of the flow.

normative-requirement §1 MUST NOT

The port number elements from Section 3.3 of RFC 6155 are deprecated and MUST NOT be used in new client implementations, because the full flow identity tuple is necessary for Carrier Grade NAT environments.

nat

privacy-consideration §6

All privacy considerations from RFC 6155 apply. In environments where the Location Server does not already have access to internal NAT state, a flow identity query reveals information about the client's communications that the server would not otherwise be able to discern, representing additional privacy exposure.

privacy, nat

protocol-element §3

The <flow> element MAY optionally contain a 'target' attribute with a value of 'src' (default) or 'dst' to indicate which end of the flow corresponds to the Target of the <locationRequest> with respect to the HELD protocol.

registry §5.1

This document registers a new XML namespace URN 'urn:ietf:params:xml:ns:geopriv:held:flow' per RFC 3688 guidelines, for the HELD Flow Identity extension.

registry

registry §5.2

This document registers an XML Schema under the URI 'urn:ietf:params:xml:ns:geopriv:held:flow' per RFC 3688, with the full schema defined in Section 4 of this document.

registry

security-consideration §7

This document introduces no new security considerations beyond those in RFC 6155; implementers should refer to that document for applicable security guidance.

security

wire-format §4

The flowEndpoint XML complex type contains an <address> element (xs:token) and a <port> element (xs:unsignedShort with minInclusive value of 1), identifying one end of the network flow.

wire-format §4

The flowIdentity XML complex type contains a required sequence of <src> and <dst> flowEndpoint elements, a required 'layer3' attribute (restricted to 'ipv4' or 'ipv6'), a required 'layer4' attribute (restricted to 'udp|tcp|sctp|dccp|\d+'), and an optional 'target' attribute defaulting to 'src'.