RFC 3792

Survey of IPv4 Addresses in Currently Deployed IETF Security Area Standards Track and Experimental Documents

📅 published June 2004, from ietf

RFC 3792: Survey of IPv4 Addresses in Currently Deployed IETF Security Area Standards Track and Experimental Documents 💖

okay bestie, this one is from the Network Working Group and was published in June 2004 🍓. It's labelled Informational, which means it gives info to the Internet community and doesn't set an Internet standard of any kind. The authors are P. Nesser, II (Nesser & Nesser Consulting) and A. Bergstrom, Ed. (Ostfold University College) ✨. The title block doesn't list anything it obsoletes or updates, so there's no drama there 🫶.

Status of this Memo 🎀

This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

Copyright Notice 💅

Copyright (C) The Internet Society (2004).

Abstract 🌸

okay so this doc wants to document every single place IPv4 addresses get used in currently deployed IETF Security Area documented standards 👀. The whole Internet has to move from all IPv4 to all IPv6, and that's going to take a bunch of interim steps. One of those steps is evolving the current protocols that depend on IPv4 💅.

The hope is that these protocols (and their implementations) get redesigned so they're network address independent. If that doesn't happen, they should at least dually support IPv4 and IPv6 🦋. So the plan is to survey all Standards (Full, Draft, and Proposed) as well as Experimental RFCs and write down any dependencies 📝. Very organised, very iconic ✨.

Table of Contents 🧚

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.  Document Organisation. . . . . . . . . . . . . . . . . . . . .  2
   3.  Full Standards . . . . . . . . . . . . . . . . . . . . . . . .  2
   4.  Draft Standards. . . . . . . . . . . . . . . . . . . . . . . .  2
   5.  Proposed Standards . . . . . . . . . . . . . . . . . . . . . .  8
   6.  Experimental RFCs. . . . . . . . . . . . . . . . . . . . . . . 20
   7.  Summary of Results . . . . . . . . . . . . . . . . . . . . . . 22
       7.1.  Standards. . . . . . . . . . . . . . . . . . . . . . . . 23
       7.2.  Draft Standards. . . . . . . . . . . . . . . . . . . . . 23
       7.3.  Proposed Standards . . . . . . . . . . . . . . . . . . . 23
       7.4.  Experimental RFCs. . . . . . . . . . . . . . . . . . . . 23
   8.  Security Considerations. . . . . . . . . . . . . . . . . . . . 24
   9.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 24
   10. Normative Reference. . . . . . . . . . . . . . . . . . . . . . 24
   11. Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 24
   12. Full Copyright Statement . . . . . . . . . . . . . . . . . . . 25

1.0. Introduction ✨

This document is part of a whole document set that's aiming to document all usage of IPv4 addresses in IETF standards 🌈. To keep it manageable, the info got split into 7 documents, matching the current IETF areas: Application, Internet, Operations and Management, Routing, Security, Sub-IP, and Transport 🫶.

For the full intro, check out the introduction [1] 📚.

2.0. Document Organization 🦋

Sections 3, 4, 5, and 6 each hold the raw analysis of Full, Draft, and Proposed Standards, plus Experimental RFCs 🔥. Each RFC gets its own turn, going from RFC 1 to (around) RFC 3100. The comments are "raw" on purpose, meaning each RFC is looked at in a vacuum, so problems don't "look ahead" to see if they've already been fixed 👀.

Section 7 is where it all comes together. It analyses the data from Sections 3, 4, 5, and 6, considers all the results as a whole, and correlates the problems that got resolved in later RFCs 💜.

3.0. Full Standards 👑

Full Internet Standards (most commonly just called "Standards") are fully mature protocol specifications that are widely implemented and used all over the Internet 💅.

3.1. RFC 2289 A One-Time Password System 🔐

There are no IPv4 dependencies in this specification ✨.

4.0. Draft Standards 🌸

Draft Standards are the penultimate standard level in the IETF 🧚. A protocol can only reach draft standard when there are multiple, independent, interoperable implementations 🙌. They're usually quite mature and widely used 💖.

4.1. RFC 1864 The Content-MD5 Header Field 🍓

There are no IPv4 dependencies in this specification 🎀.

4.2. RFC 2617 HTTP Authentication: Basic and Digest Access Authentication 🔑

This one has two spots I need to flag 😭.

First, Section 3.2.1 talks about the WWW-Authenticate Response Header, and it includes this text:

   (Note: including the IP address of the client in the nonce
   would appear to offer the server the ability to limit the reuse
   of the nonce to the same client that originally got it.
   However, that would break proxy farms, where requests from a
   single user often go through different proxies in the farm.
   Also, IP address spoofing is not that hard.)

Second, Section 4.5 Replay Attacks has this text:

   Thus, for some purposes, it is necessary to protect against
   replay attacks.  A good Digest implementation can do this in
   various ways.  The server created "nonce" value is
   implementation dependent, but if it contains a digest of the
   client IP, a time-stamp, the resource ETag, and a private
   server key (as recommended above) then a replay attack is not
   simple.  An attacker must convince the server that the request
   is coming from a false IP address and must cause the server to
   deliver the document to an IP address different from the
   address to which it believes it is sending the document.  An
   attack can only succeed in the period before the time-stamp
   expires.  Digesting the client IP and time-stamp in the nonce
   permits an implementation which does not maintain state between
   transactions.

Both of these statements are IP version independent, and they must rely on the implementers discretion 🫶. So basically the IPv4 stuff here is up to whoever implements it 💅.

4.3. RFC 2865 Remote Authentication Dial In User Service (RADIUS) ✨

Okay bestie, RADIUS (RFC 2865) gets its own spotlight here 🎀 Section 3. Packet Format has two notes you need to know:

Identifier

The Identifier field is one octet, and it helps match requests with replies 🧚 The RADIUS server can detect a duplicate request if it has the same client source IP address, source UDP port, and Identifier within a short span of time ⏰

And

A RADIUS server MUST use the source IP address of the RADIUS UDP packet to decide which shared secret to use, so that RADIUS requests can be proxied. 🔐

This text is version neutral, but implementers should allow for the use of both IPv4 and IPv6 addresses. 🌈

Section 5. Attributes defines a bunch of IP specific attributes:

     4      NAS-IP-Address
     8      Framed-IP-Address
     9      Framed-IP-Netmask
    10      Framed-Routing
    14      Login-IP-Host
    22      Framed-Route

It also defines the "value" field for this type:

address   32 bit value, most significant octet first.

Here's how each attribute is defined, bestie 💅

5.4. NAS-IP-Address

Description

This Attribute indicates the identifying IP Address of the NAS that is requesting authentication of the user, and it SHOULD be unique to the NAS within the scope of the RADIUS server. NAS-IP-Address is only used in Access-Request packets. Either NAS-IP-Address or NAS-Identifier MUST be present in an Access-Request packet. 🙌

Note that NAS-IP-Address MUST NOT be used to select the shared secret used to authenticate the request. The source IP address of the Access-Request packet MUST be used to select the shared secret. 🚫

A summary of the NAS-IP-Address Attribute format is shown below. The fields are transmitted from left to right.

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |     Type      |    Length     |            Address
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
             Address (cont)         |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Type

4 for NAS-IP-Address.

Length

Address

The Address field is four octets.

5.8. Framed-IP-Address

Description

This Attribute indicates the address to be configured for the user. It MAY be used in Access-Accept packets. It MAY be used in an Access-Request packet as a hint by the NAS to the server that it would prefer that address, but the server is not required to honor the hint. 🦋

A summary of the Framed-IP-Address Attribute format is shown below. The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |            Address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
            Address (cont)         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Type

8 for Framed-IP-Address.

Length

Address

The Address field is four octets. The value 0xFFFFFFFF indicates that the NAS Should allow the user to select an address (e.g., Negotiated). The value 0xFFFFFFFE indicates that the NAS should select an address for the user (e.g., Assigned from a pool of addresses kept by the NAS). Other valid values indicate that the NAS should use that value as the user's IP address. 🌸

5.9. Framed-IP-Netmask

Description

This Attribute indicates the IP netmask to be configured for the user when the user is a router to a network. It MAY be used in Access-Accept packets. It MAY be used in an Access-Request packet as a hint by the NAS to the server that it would prefer that netmask, but the server is not required to honor the hint. 🍓

A summary of the Framed-IP-Netmask Attribute format is shown below. The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |            Address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
            Address (cont)         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Type

9 for Framed-IP-Netmask.

Length

Address

The Address field is four octets specifying the IP netmask of the user. 💜

Description

"This Attribute indicates the system with which to connect the user, when the Login-Service Attribute is included. It MAY be used in Access-Accept packets. It MAY be used in an Access-Request packet as a hint to the server that the NAS would prefer to use that host, but the server is not required to honor the hint." 🧚

A summary of the Login-IP-Host Attribute format is shown below. The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |            Address
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
            Address (cont)         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Type

14 for Login-IP-Host.

Length

Address

The Address field is four octets. The value 0xFFFFFFFF indicates that the NAS SHOULD allow the user to select an address. The value 0 indicates that the NAS SHOULD select a host to connect the user to. Other values indicate the address the NAS SHOULD connect the user to. 🎯

5.22. Framed-Route

Description

This Attribute provides routing information to be configured for the user on the NAS. It is used in the Access-Accept packet and can appear multiple times. 🛣️

A summary of the Framed-Route Attribute format is shown below. The fields are transmitted from left to right.

    0                   1                   2
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |  Text ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Type

22 for Framed-Route.

Length

>= 3

Text

The Text field is one or more octets, and its contents are implementation dependent. It is intended to be human readable and MUST NOT affect operation of the protocol. It is recommended that the message contain UTF-8 encoded 10646 [7] characters. 📝

For IP routes, it SHOULD contain a destination prefix in dotted quad form, optionally followed by a slash and a decimal length specifier stating how many high order bits of the prefix to use. That is followed by a space, a gateway address in dotted quad form, a space, and one or more metrics separated by spaces. For example, "192.168.1.0/24 192.168.1.1 1 2 -1 3 400". The length specifier may be omitted, in which case it defaults to 8 bits for class A prefixes, 16 bits for class B prefixes, and 24 bits for class C prefixes. For example, "192.168.1.0 192.168.1.1 1".

Whenever the gateway address is specified as "0.0.0.0", the IP address of the user SHOULD be used as the gateway address. 🙈

There are also several example authentication sequences that use the attributes discussed above, and hence have IPv4 addresses.

Although the definitions in this RFC are limited to IPv4 addresses, the specification is easily extensible for new attribute types. It is therefore relatively simple to create new IPv6 specific attributes. 🌟

5.0. Proposed Standards

Proposed Standards are introductory level documents. There are no requirements for even a single implementation. In many cases Proposed are never implemented or advanced in the IETF standards process. They therefore are often just proposed ideas that are presented to the Internet community. Sometimes flaws are exposed, or they are one of many competing solutions to problems. In these later cases, no discussion is presented, as it would not serve the purpose of this discussion. 🫶