draft-ietf-sidr-rpki-rtr-21.txt   draft-ietf-sidr-rpki-rtr-22.txt 
Network Working Group R. Bush Network Working Group R. Bush
Internet-Draft Internet Initiative Japan Internet-Draft Internet Initiative Japan
Intended status: Standards Track R. Austein Intended status: Standards Track R. Austein
Expires: June 19, 2012 Dragon Research Labs Expires: June 21, 2012 Dragon Research Labs
December 17, 2011 December 19, 2011
The RPKI/Router Protocol The RPKI/Router Protocol
draft-ietf-sidr-rpki-rtr-21 draft-ietf-sidr-rpki-rtr-22
Abstract Abstract
In order to formally validate the origin ASs of BGP announcements, In order to formally validate the origin ASs of BGP announcements,
routers need a simple but reliable mechanism to receive RPKI routers need a simple but reliable mechanism to receive RPKI
[I-D.ietf-sidr-arch] prefix origin data from a trusted cache. This [I-D.ietf-sidr-arch] prefix origin data from a trusted cache. This
document describes a protocol to deliver validated prefix origin data document describes a protocol to deliver validated prefix origin data
to routers. to routers.
Requirements Language Requirements Language
skipping to change at page 1, line 41 skipping to change at page 1, line 41
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on June 19, 2012. This Internet-Draft will expire on June 21, 2012.
Copyright Notice Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 32 skipping to change at page 2, line 32
5.4. Cache Response . . . . . . . . . . . . . . . . . . . . . . 7 5.4. Cache Response . . . . . . . . . . . . . . . . . . . . . . 7
5.5. IPv4 Prefix . . . . . . . . . . . . . . . . . . . . . . . 8 5.5. IPv4 Prefix . . . . . . . . . . . . . . . . . . . . . . . 8
5.6. IPv6 Prefix . . . . . . . . . . . . . . . . . . . . . . . 9 5.6. IPv6 Prefix . . . . . . . . . . . . . . . . . . . . . . . 9
5.7. End of Data . . . . . . . . . . . . . . . . . . . . . . . 9 5.7. End of Data . . . . . . . . . . . . . . . . . . . . . . . 9
5.8. Cache Reset . . . . . . . . . . . . . . . . . . . . . . . 10 5.8. Cache Reset . . . . . . . . . . . . . . . . . . . . . . . 10
5.9. Error Report . . . . . . . . . . . . . . . . . . . . . . . 10 5.9. Error Report . . . . . . . . . . . . . . . . . . . . . . . 10
5.10. Fields of a PDU . . . . . . . . . . . . . . . . . . . . . 11 5.10. Fields of a PDU . . . . . . . . . . . . . . . . . . . . . 11
6. Protocol Sequences . . . . . . . . . . . . . . . . . . . . . . 13 6. Protocol Sequences . . . . . . . . . . . . . . . . . . . . . . 13
6.1. Start or Restart . . . . . . . . . . . . . . . . . . . . . 13 6.1. Start or Restart . . . . . . . . . . . . . . . . . . . . . 13
6.2. Typical Exchange . . . . . . . . . . . . . . . . . . . . . 14 6.2. Typical Exchange . . . . . . . . . . . . . . . . . . . . . 14
6.3. No Incremental Update Available . . . . . . . . . . . . . 14 6.3. No Incremental Update Available . . . . . . . . . . . . . 15
6.4. Cache has No Data Available . . . . . . . . . . . . . . . 15 6.4. Cache has No Data Available . . . . . . . . . . . . . . . 15
7. Transport . . . . . . . . . . . . . . . . . . . . . . . . . . 15 7. Transport . . . . . . . . . . . . . . . . . . . . . . . . . . 16
7.1. SSH Transport . . . . . . . . . . . . . . . . . . . . . . 16 7.1. SSH Transport . . . . . . . . . . . . . . . . . . . . . . 17
7.2. TLS Transport . . . . . . . . . . . . . . . . . . . . . . 17 7.2. TLS Transport . . . . . . . . . . . . . . . . . . . . . . 17
7.3. TCP MD5 Transport . . . . . . . . . . . . . . . . . . . . 17 7.3. TCP MD5 Transport . . . . . . . . . . . . . . . . . . . . 18
7.4. TCP-AO Transport . . . . . . . . . . . . . . . . . . . . . 18 7.4. TCP-AO Transport . . . . . . . . . . . . . . . . . . . . . 18
8. Router-Cache Set-Up . . . . . . . . . . . . . . . . . . . . . 18 8. Router-Cache Set-Up . . . . . . . . . . . . . . . . . . . . . 18
9. Deployment Scenarios . . . . . . . . . . . . . . . . . . . . . 19 9. Deployment Scenarios . . . . . . . . . . . . . . . . . . . . . 19
10. Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . 20 10. Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . 20
11. Security Considerations . . . . . . . . . . . . . . . . . . . 21 11. Security Considerations . . . . . . . . . . . . . . . . . . . 21
12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22
13. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 23 13. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 23
14. References . . . . . . . . . . . . . . . . . . . . . . . . . . 23 14. References . . . . . . . . . . . . . . . . . . . . . . . . . . 24
14.1. Normative References . . . . . . . . . . . . . . . . . . . 23 14.1. Normative References . . . . . . . . . . . . . . . . . . . 24
14.2. Informative References . . . . . . . . . . . . . . . . . . 24 14.2. Informative References . . . . . . . . . . . . . . . . . . 25
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 24 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 25
1. Introduction 1. Introduction
In order to formally validate the origin ASs of BGP announcements, In order to formally validate the origin ASs of BGP announcements,
routers need a simple but reliable mechanism to receive RPKI routers need a simple but reliable mechanism to receive RPKI
[I-D.ietf-sidr-arch] formally validated prefix origin data from a [I-D.ietf-sidr-arch] formally validated prefix origin data from a
trusted cache. This document describes a protocol to deliver trusted cache. This document describes a protocol to deliver
validated prefix origin data to routers. validated prefix origin data to routers.
Section 3 describes the deployment structure and Section 4 then Section 3 describes the deployment structure and Section 4 then
skipping to change at page 12, line 15 skipping to change at page 12, line 15
PDU Type: An ordinal, denoting the type of the PDU, e.g. IPv4 PDU Type: An ordinal, denoting the type of the PDU, e.g. IPv4
Prefix, etc. Prefix, etc.
Serial Number: The serial number of the RPKI Cache when this ROA was Serial Number: The serial number of the RPKI Cache when this ROA was
received from the cache's up-stream cache server or gathered from received from the cache's up-stream cache server or gathered from
the global RPKI. A cache increments its serial number when the global RPKI. A cache increments its serial number when
completing an rigorously validated update from a parent cache, for completing an rigorously validated update from a parent cache, for
example via rcynic. See [RFC1982] on DNS Serial Number Arithmetic example via rcynic. See [RFC1982] on DNS Serial Number Arithmetic
for too much detail on serial number arithmetic. for too much detail on serial number arithmetic.
Session ID: When a cache server is started, it generates a session Session ID: When a cache server is started, it generates a Session
identifier to identify the instance of the cache and to bind it to ID to identify the instance of the cache and to bind it to the
the sequence of Serial Numbers that cache instance will generate. sequence of Serial Numbers that cache instance will generate.
This allows the router to restart a failed session knowing that This allows the router to restart a failed session knowing that
the Serial Number it is using is commensurate with that of the the Serial Number it is using is commensurate with that of the
cache. If, at any time, either the router or the cache finds the cache. If, at any time, either the router or the cache finds the
value of the session identifiers they hold disagree, they MUST value of the session identifiers they hold disagree, they MUST
completely drop the session and the router MUST flush all data completely drop the session and the router MUST flush all data
learned from that cache. learned from that cache.
Should a cache erroneously reuse a Session ID so that a router
does not realize that the session has changed (old session ID and
new session ID have same numeric value), the router may become
confused as to the content of the cache. The time it takes the
router to discover it is confused will depend on whether the
serial numbers are also reused. If the serial numbers in the old
and new sessions are different enough, the cache will respond to
the router's Serial Query with a Cache Reset, which will solve the
problem. If, however, the serial numbers are close, the cache may
respond with a Cache Response, which may not be enough to bring
the router into sync. In such cases, it's likely but not certain
that the router will detect some discrepancy between the state
that the cache expects and its own state. For example, the Cache
Response may tell the router to drop a record which the router
does not hold, or may tell the router to add a record which the
router already has. In such cases, a router will detect the error
and reset the session. The one case in which the router may stay
out of sync is when nothing in the Cache Response affects any data
currently held by the router.
Using persistent storage for the session identifier or a clock-
based scheme for generating session identifiers should avoid the
risk of session identifier collisions.
The Session ID might be a pseudo-random, a monotonically The Session ID might be a pseudo-random, a monotonically
increasing value if the cache has reliable storage, etc. An increasing value if the cache has reliable storage, etc.
implementation which uses a fine granularity of time for the
Serial Number might never change the Session ID.
Length: A 32 bit ordinal which has as its value the count of the Length: A 32 bit ordinal which has as its value the count of the
bytes in the entire PDU, including the eight bytes of header which bytes in the entire PDU, including the eight bytes of header which
end with the length field. end with the length field.
Flags: The lowest order bit of the Flags field is 1 for an Flags: The lowest order bit of the Flags field is 1 for an
announcement and 0 for a withdrawal, whether this PDU announces a announcement and 0 for a withdrawal, whether this PDU announces a
new right to announce the prefix or withdraws a previously new right to announce the prefix or withdraws a previously
announced right. A withdraw effectively deletes one previously announced right. A withdraw effectively deletes one previously
announced IPvX Prefix PDU with the exact same Prefix, Length, Max- announced IPvX Prefix PDU with the exact same Prefix, Length, Max-
 End of changes. 10 change blocks. 
18 lines changed or deleted 40 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/