draft-ietf-sidr-rpki-rtr-23.txt   draft-ietf-sidr-rpki-rtr-24.txt 
Network Working Group R. Bush Network Working Group R. Bush
Internet-Draft Internet Initiative Japan Internet-Draft Internet Initiative Japan
Intended status: Standards Track R. Austein Intended status: Standards Track R. Austein
Expires: July 12, 2012 Dragon Research Labs Expires: July 15, 2012 Dragon Research Labs
January 9, 2012 January 12, 2012
The RPKI/Router Protocol The RPKI/Router Protocol
draft-ietf-sidr-rpki-rtr-23 draft-ietf-sidr-rpki-rtr-24
Abstract Abstract
In order to formally validate the origin ASs of BGP announcements, In order to formally validate the origin ASs of BGP announcements,
routers need a simple but reliable mechanism to receive RPKI routers need a simple but reliable mechanism to receive RPKI
[I-D.ietf-sidr-arch] prefix origin data from a trusted cache. This [I-D.ietf-sidr-arch] prefix origin data from a trusted cache. This
document describes a protocol to deliver validated prefix origin data document describes a protocol to deliver validated prefix origin data
to routers. to routers.
Requirements Language Requirements Language
skipping to change at page 1, line 41 skipping to change at page 1, line 41
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 12, 2012. This Internet-Draft will expire on July 15, 2012.
Copyright Notice Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 36 skipping to change at page 2, line 36
5.8. Cache Reset . . . . . . . . . . . . . . . . . . . . . . . 10 5.8. Cache Reset . . . . . . . . . . . . . . . . . . . . . . . 10
5.9. Error Report . . . . . . . . . . . . . . . . . . . . . . . 10 5.9. Error Report . . . . . . . . . . . . . . . . . . . . . . . 10
5.10. Fields of a PDU . . . . . . . . . . . . . . . . . . . . . 11 5.10. Fields of a PDU . . . . . . . . . . . . . . . . . . . . . 11
6. Protocol Sequences . . . . . . . . . . . . . . . . . . . . . . 13 6. Protocol Sequences . . . . . . . . . . . . . . . . . . . . . . 13
6.1. Start or Restart . . . . . . . . . . . . . . . . . . . . . 13 6.1. Start or Restart . . . . . . . . . . . . . . . . . . . . . 13
6.2. Typical Exchange . . . . . . . . . . . . . . . . . . . . . 14 6.2. Typical Exchange . . . . . . . . . . . . . . . . . . . . . 14
6.3. No Incremental Update Available . . . . . . . . . . . . . 15 6.3. No Incremental Update Available . . . . . . . . . . . . . 15
6.4. Cache has No Data Available . . . . . . . . . . . . . . . 15 6.4. Cache has No Data Available . . . . . . . . . . . . . . . 15
7. Transport . . . . . . . . . . . . . . . . . . . . . . . . . . 16 7. Transport . . . . . . . . . . . . . . . . . . . . . . . . . . 16
7.1. SSH Transport . . . . . . . . . . . . . . . . . . . . . . 17 7.1. SSH Transport . . . . . . . . . . . . . . . . . . . . . . 17
7.2. TLS Transport . . . . . . . . . . . . . . . . . . . . . . 17 7.2. TLS Transport . . . . . . . . . . . . . . . . . . . . . . 18
7.3. TCP MD5 Transport . . . . . . . . . . . . . . . . . . . . 18 7.3. TCP MD5 Transport . . . . . . . . . . . . . . . . . . . . 18
7.4. TCP-AO Transport . . . . . . . . . . . . . . . . . . . . . 18 7.4. TCP-AO Transport . . . . . . . . . . . . . . . . . . . . . 18
8. Router-Cache Set-Up . . . . . . . . . . . . . . . . . . . . . 18 8. Router-Cache Set-Up . . . . . . . . . . . . . . . . . . . . . 18
9. Deployment Scenarios . . . . . . . . . . . . . . . . . . . . . 19 9. Deployment Scenarios . . . . . . . . . . . . . . . . . . . . . 19
10. Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . 20 10. Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . 20
11. Security Considerations . . . . . . . . . . . . . . . . . . . 21 11. Security Considerations . . . . . . . . . . . . . . . . . . . 21
12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22
13. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 23 13. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 23
14. References . . . . . . . . . . . . . . . . . . . . . . . . . . 24 14. References . . . . . . . . . . . . . . . . . . . . . . . . . . 24
14.1. Normative References . . . . . . . . . . . . . . . . . . . 24 14.1. Normative References . . . . . . . . . . . . . . . . . . . 24
skipping to change at page 12, line 42 skipping to change at page 12, line 42
the router's Serial Query with a Cache Reset, which will solve the the router's Serial Query with a Cache Reset, which will solve the
problem. If, however, the serial numbers are close, the cache may problem. If, however, the serial numbers are close, the cache may
respond with a Cache Response, which may not be enough to bring respond with a Cache Response, which may not be enough to bring
the router into sync. In such cases, it's likely but not certain the router into sync. In such cases, it's likely but not certain
that the router will detect some discrepancy between the state that the router will detect some discrepancy between the state
that the cache expects and its own state. For example, the Cache that the cache expects and its own state. For example, the Cache
Response may tell the router to drop a record which the router Response may tell the router to drop a record which the router
does not hold, or may tell the router to add a record which the does not hold, or may tell the router to add a record which the
router already has. In such cases, a router will detect the error router already has. In such cases, a router will detect the error
and reset the session. The one case in which the router may stay and reset the session. The one case in which the router may stay
out of sync is when nothing in the Cache Response affects any data out of sync is when nothing in the Cache Response contradicts any
currently held by the router. data currently held by the router.
Using persistent storage for the session identifier or a clock- Using persistent storage for the session identifier or a clock-
based scheme for generating session identifiers should avoid the based scheme for generating session identifiers should avoid the
risk of session identifier collisions. risk of session identifier collisions.
The Session ID might be a pseudo-random, a monotonically The Session ID might be a pseudo-random, a monotonically
increasing value if the cache has reliable storage, etc. increasing value if the cache has reliable storage, etc.
Length: A 32 bit ordinal which has as its value the count of the Length: A 32 bit ordinal which has as its value the count of the
bytes in the entire PDU, including the eight bytes of header which bytes in the entire PDU, including the eight bytes of header which
skipping to change at page 16, line 38 skipping to change at page 16, line 38
To reduce exposure to dropped but non-terminated sessions, both To reduce exposure to dropped but non-terminated sessions, both
caches and routers SHOULD enable keep alives when available in the caches and routers SHOULD enable keep alives when available in the
chosen transport protocol. chosen transport protocol.
It is expected that, when TCP-AO [RFC5925] is available on all It is expected that, when TCP-AO [RFC5925] is available on all
platforms deployed by operators, it will become the mandatory to platforms deployed by operators, it will become the mandatory to
implement transport. implement transport.
Caches and routers MUST implement unprotected transport over TCP Caches and routers MUST implement unprotected transport over TCP
using a port, rpki-rtr, to be assigned, see Section 12. Operators using a port, rpki-rtr, to be assigned, see Section 12. Operators
SHOULD use procedural means, ACLs, ... to reduce the exposure to SHOULD use procedural means, e.g. access control lists (ACLs), ... to
authentication issues. reduce the exposure to authentication issues.
If TCP is the transport, then the cache and the router MUST be on the Caches and routers SHOULD use TCP-AO, SSH, TCP MD5, or IPsec
same trusted and controlled network. Otherwise, one of the following transport.
better protected protocols MUST be used.
If available to the operator, caches and routers SHOULD use one of If unprotected TCP is the transport, the cache and routers MUST be on
the following more protected protocols. the same trusted and controlled network.
If available to the operator, caches and routers MUST use one of the
following more protected protocols.
Caches and routers SHOULD use TCP-AO transport [RFC5925] over the Caches and routers SHOULD use TCP-AO transport [RFC5925] over the
rpki-rtr port. rpki-rtr port.
Caches and routers MAY use SSH transport [RFC4252] using using a the Caches and routers MAY use SSH transport [RFC4252] using a the normal
normal SSH port. For an example, see Section 7.1. SSH port. For an example, see Section 7.1.
Caches and routers MAY use TCP MD5 transport [RFC2385] using the Caches and routers MAY use TCP MD5 transport [RFC2385] using the
rpki-rtr port. rpki-rtr port. Note that TCP MD5 has been obsoleted by TCP-AO
[RFC5925].
Caches and routers MAY use IPsec transport [RFC4301] using the rpki- Caches and routers MAY use IPsec transport [RFC4301] using the rpki-
rtr port. rtr port.
Caches and routers MAY use TLS transport [RFC5246] using using a Caches and routers MAY use TLS transport [RFC5246] using using a
port, rpki-rtr-tls, to be assigned, see Section 12. port, rpki-rtr-tls, to be assigned, see Section 12.
7.1. SSH Transport 7.1. SSH Transport
To run over SSH, the client router first establishes an SSH transport To run over SSH, the client router first establishes an SSH transport
 End of changes. 10 change blocks. 
17 lines changed or deleted 20 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/