RFC 5685
Redirect Mechanism for the Internet Key Exchange Protocol Version 2 (IKEv2)
RFC 5685: Redirect Mechanism for the Internet Key Exchange Protocol Version 2 (IKEv2) 🎀
okay bestie, this one is from November 2009 and was written by V. Devarapalli (WiChorus) and K. Weniger (Unaffiliated) 🦋 It's a Standards Track document, so it's a real spec people build against. Its header doesn't list anything it obsoletes or updates, so it stands on its own 💅
Abstract ✨
IKEv2 is the protocol that sets up VPN tunnels from a remote spot to a gateway, so the VPN client can reach the services behind that gateway 🌸 This document adds an IKEv2 extension that lets an overloaded VPN gateway, or one getting shut down for maintenance, send the VPN client over to a different gateway 🔥 The same idea can also work in Mobile IPv6, where a home agent redirects a mobile node to another home agent 🧚
Status of This Memo
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the BSD License.
This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English.
Table of Contents 🌈
1. Introduction ....................................................2
2. Terminology .....................................................3
3. IKEv2 Initial Exchange with Redirect ............................3
4. Use of Anycast Addresses with the Redirect Mechanism ............5
5. Redirect during an Active Session ...............................6
6. Redirect during IKE_AUTH Exchange ...............................7
7. Handling Redirect Loops .........................................8
8. Using the Redirect Mechanism with Mobile IPv6 ...................8
9. Redirect Messages ...............................................9
9.1. REDIRECT_SUPPORTED .........................................9
9.2. REDIRECT ..................................................10
9.3. REDIRECTED_FROM ...........................................11
10. Use of the Redirect Mechanism between IKEv2 Peers .............12
11. Security Considerations .......................................12
12. IANA Considerations ...........................................13
13. Acknowledgements ..............................................13
14. References ....................................................14
14.1. Normative References .....................................14
14.2. Informative References ...................................141. Introduction 💖
IKEv2 [2] is what gets used to set up IPsec-based [7] VPNs. You can hardcode the VPN gateway's IP address into the VPN client, but that gets messy fast when there are lots of gateways 💀 Using DNS to find gateways dynamically is pretty popular too, except DNS isn't very flexible when you want to hand out a gateway based on how loaded each one is. The VPN client usually tries whichever gateway IP shows up first in the DNS response. If that tunnel setup fails, it moves on to the other gateways listed in the response ✨
This document proposes a redirect mechanism for IKEv2 that lets a VPN gateway send the VPN client to a different VPN gateway, for example because of the load situation 🫶 The redirect can happen during the IKE_SA_INIT or the IKE_AUTH exchange. A gateway can also redirect a client in the middle of an active session. The redirect mechanism can be combined with anycast addresses too. In that case, DNS stores one anycast address for the whole cluster of VPN gateways, instead of a list of unicast IP addresses for each gateway 🦋
Redirects can also happen for administrative or optimal-routing reasons. This document doesn't try to give an exhaustive list of reasons to redirect a VPN client to another VPN gateway 🍓
2. Terminology 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [1].
3. IKEv2 Initial Exchange with Redirect 🦋
This section covers using the redirect mechanism during the IKE_SA_INIT exchange. Gateway-initiated redirects during an active session, and redirects during the IKE_AUTH exchange, get their own sections later 💅
The VPN client shows it supports the IKEv2 redirect mechanism, and that it's willing to be redirected, by putting a REDIRECT_SUPPORTED notification message in its initial IKE_SA_INIT request (see Section 9.1). The gateway MUST keep track of which clients said they support the redirect mechanism and which ones didn't 👑
To redirect an IKEv2 session to another VPN gateway, the VPN gateway that first got the IKE_SA_INIT request picks another VPN gateway (how it picks is outside the scope of this document) and replies with an IKE_SA_INIT response that has a REDIRECT notification message (see Section 9.2). That notification includes info about the picked VPN gateway, plus the nonce data from the Ni payload in the IKE_SA_INIT request. If the IKE_SA_INIT request didn't indicate support for the redirect mechanism, the responder MUST NOT send the REDIRECT payload to the VPN client. This applies to every REDIRECT scenario in this document 🙈
Quick note: when the IKE_SA_INIT response includes the REDIRECT notification, the exchange doesn't create an IKE_SA, and the responder Security Parameter Index (SPI) is zero 🧚
Initiator Responder (initial VPN GW)
--------- -------------------------
(IP_I:500 -> Initial_IP_R:500)
HDR(A,0), SAi1, KEi, Ni, -->
N(REDIRECT_SUPPORTED)
(Initial_IP_R:500 -> IP_I:500)
<-- HDR(A,0), N(REDIRECT, New_GW_ID, Ni_data)When the client gets the IKE_SA_INIT response, it MUST verify that the nonce data matches the value it sent in the IKE_SA_INIT request. If the values don't match, the client MUST silently discard the response and keep waiting for another one. This helps prevent certain denial-of-service (DoS) attacks on the initiator, which could happen if an attacker injects IKE_SA_INIT responses carrying REDIRECT payloads 🔥
After checking the nonce data, the client starts a new IKE_SA_INIT exchange with the VPN gateway listed in the REDIRECT payload, as long as its Peer Authorization Database (PAD) entries allow it 💖 In that new IKE_SA_INIT exchange, the client MUST include the REDIRECTED_FROM payload (see Section 9.3). The VPN client puts the IP address of the original VPN gateway, the one that redirected it, into the REDIRECTED_FROM notification. After that, the IKEv2 exchange carries on just as it would have with the original VPN gateway ✨
Initiator Responder (Selected VPN GW)
--------- ---------------------------
(IP_I:500 -> IP_R:500)
HDR(A,0), SAi1, KEi, Ni, -->
N(REDIRECTED_FROM, Initial_IP_R)
(IP_R:500 -> IP_I:500)
<-- HDR(A,B), SAr1, KEr, Nr,[CERTREQ]
(IP_I:500 -> IP_R:500)
HDR(A,B), SK {IDi, [CERT,] [CERTREQ,]
[IDr,]AUTH, SAi2, TSi, TSr} -->
(IP_R:500 -> IP_I:500)
<-- HDR(A,B), SK {IDr, [CERT,] AUTH,
SAr2, TSi, TSr}The client MAY get redirected again by the new VPN gateway if that gateway can't serve it either 🌸 After a redirect, the client doesn't have to include the REDIRECT_SUPPORTED payload again in the IKE_SA_INIT exchange with the new gateway. The presence of the REDIRECTED_FROM payload in that exchange tells the new gateway that the client supports the redirect mechanism 🦋
When the client gets redirected, it MUST use the same Peer Authorization Database (PAD) and Security Policy Database (SPD) entries it would have used with the original gateway. Getting a redirect notification MUST NOT result in any PAD or SPD entries being modified. In practice, that means the new gateway either has to use the same responder identity (IDr) as the original gateway, or both should be part of a group of responders that the same PAD entry authorizes. See Section 4.4.3.1 of [7] for using DNS names to represent a group of peers in a PAD entry 🫶
This document lets the client be redirected in several protocol states. In some of them, the gateway is already authenticated at the point of the redirect, and in others it isn't. The rules above about the identity of the new gateway and the PAD and SPD entries apply equally to all of these scenarios 👑
4. Use of Anycast Addresses with the Redirect Mechanism ✨
okay so anycast is lowkey genius bc you don't have to hardcode one specific VPN gateway's IP in the DNS 🫶 instead, the DNS stores the anycast address that represents the whole group of gateways. when the VPN client looks up the gateway, it gets that anycast address back in the DNS response 🦋
if the DNS resolution of a Fully Qualified Domain Name (FQDN) hands back an anycast address, the VPN client sends its IKE_SA_INIT request to that anycast address. the REDIRECT_SUPPORTED payload goes in that IKE_SA_INIT request too 💅 the request gets routed to one of the VPN gateways in the anycast group, and that gateway answers with an IKE_SA_INIT reply coming from the anycast address 🌸
Initiator Responder (any VPN GW)
--------- -------------------------
(IP_I:500 -> ANYCAST:500)
HDR(A,0), SAi1, KEi, Ni) -->
N(REDIRECT_SUPPORTED)
(ANYCAST:500 -> IP_I:500)
<-- HDR(A,0), N(REDIRECT, New_GW_ID, Ni_data)okay the important part 🌈 if the destination address on the IKE_SA_INIT request is an anycast address, the VPN gateway that received it MUST include the REDIRECT payload to redirect the VPN client to a unicast address of one of the VPN gateways 💜 the gateway that got the request MAY also redirect the client to its own unicast address, as long as it isn't overloaded 🙈
the rest of the IKEv2 exchange is the same as what we covered in Section 3 🎀
5. Redirect during an Active Session
the redirect mechanism can also be used by a VPN gateway to move the client to another VPN gateway in the middle of a session 🧚 so to redirect a client, the gateway should send an INFORMATIONAL message with the REDIRECT Notify payload. the REDIRECT payload MUST carry information about the new VPN gateway 💖 and the gateway MUST NOT include any nonce data in the REDIRECT payload. why? bc it's a gateway-initiated redirect and it's already protected by the IKEv2 security association 🔐 literally so secure
when the client gets this message, it sends back a response (usually empty) to the gateway 🫶 and the gateway keeps retransmitting the redirect INFORMATIONAL message as described in [2], until it actually gets a response 😭 here's how the gateway-initiated redirect exchange looks:
Initiator (VPN client) Responder (VPN GW)
---------------------- ------------------
<-- HDR, SK {N(REDIRECT, New_GW_ID)}
HDR, SK {} -->this INFORMATIONAL exchange is protected by the existing IKEv2 SA between the client and the gateway, so it's all locked down 🔒
once the client sends its acknowledgement to the gateway, it SHOULD delete the existing security associations with the old gateway by sending an INFORMATIONAL message with a DELETE payload 🧹 the gateway MAY also decide to delete the security associations without any signaling from the client, again with an INFORMATIONAL message carrying a DELETE payload 💅 but ngl it should give the client sufficient time to set up the required security associations with the new security gateway first. this time period should be configurable on the gateway ⏳
6. Redirect during IKE_AUTH Exchange
if the gateway decides to redirect the client during the IKE_AUTH exchange, based on the identity the client presented in the IKE_AUTH request message, it stops the creation of a CHILD SA and sends the REDIRECT payload in the IKE_AUTH response 🎀 the gateway MUST verify the client's AUTH payload before it sends the REDIRECT payload, and the client MUST verify the gateway's AUTH payload before it acts on the REDIRECT payload 🔍 since both AUTH payloads were exchanged and successfully verified, the IKEv2 security association is valid ✨ when the client gets the IKE_AUTH response with the REDIRECT payload, it SHOULD delete the IKEv2 security association with the gateway by sending an INFORMATIONAL message with a DELETE payload 🧹
Initiator Responder (VPN GW)
--------- ------------------
(IP_I:500 -> IP_R:500)
HDR(A,0), SAi1, KEi, Ni, -->
N(REDIRECTED_SUPPORTED)
(IP_R:500 -> IP_I:500)
<-- HDR(A,B), SAr1, KEr, Nr,[CERTREQ]
(IP_I:500 -> IP_R:500)
HDR(A,B), SK {IDi, [CERT,] [CERTREQ,]
[IDr,]AUTH, SAi2, TSi, TSr} -->
(IP_R:500 -> IP_I:500)
<-- HDR(A,B), SK {IDr, [CERT,] AUTH,
N(REDIRECT, New_GW_ID)}now the tricky bit 🙃 if the IKE_AUTH exchange uses Extensible Authentication Protocol (EAP) authentication (as described in Section 2.16 of RFC 4306 [2]) or multiple authentication methods (as described in RFC 4739 [6]), the gateway may decide to redirect the client based on its interaction with the Authentication, Authorization, and Accounting (AAA) server or the external authentication server. in this case the gateway MUST send the REDIRECT Notify payload in either the first or the last IKE_AUTH response 🫶 and the client and the gateway MUST verify the AUTH payloads as described above.
when EAP is in use, the gateway MAY also redirect the client based on the unauthenticated identity the client presented in the first IKE_AUTH exchange 🕵️ because EAP is the authentication mechanism, the client doesn't include an AUTH payload to authenticate its identity. but the server MUST still include its own AUTH payload, and the client MUST verify it 💜 also, the IKEv2 SA is not created in this case, so the client doesn't have to explicitly delete it 🌸
in all of the cases above, the client MUST accept the REDIRECT notification ONLY in the first IKE_AUTH response or the last IKE_AUTH response. it MUST NOT accept the REDIRECT notification in an intermediate IKE_AUTH response. no exceptions, bestie 🚫
7. Handling Redirect Loops
the client could end up getting redirected multiple times in a row, either because of a wrong configuration or a DoS attack 💀 it could even get stuck in a loop where two or more gateways keep redirecting it to each other. that could deny service to the client 😭 to prevent this, the client SHOULD be configured to not accept more than a certain number of redirects (MAX_REDIRECTS) within a short time period (REDIRECT_LOOP_DETECT_PERIOD) for a particular IKEv2 SA setup 🛑 the default value for the MAX_REDIRECTS configuration variable is 5, and the default value for the REDIRECT_LOOP_DETECT_PERIOD configuration variable is 300 seconds ⏱️ client implementations may allow these variables to be configured, depending on the deployment or system configuration 🎀
8. Using the Redirect Mechanism with Mobile IPv6
Mobile IPv6 [3] may use IKEv2 for mutual authentication between the mobile node and the home agent, for home address configuration, and for setting up security associations that protect Mobile IPv6 signaling messages [4] 🦋 if IKEv2 is used, the IKEv2 exchange comes before the Mobile IPv6 signaling messages get exchanged. so the mechanism in this document can also be used by a Mobile IPv6 home agent to redirect a mobile node to another home agent 🧚
there's also a Home Agent Switch mechanism for redirecting a mobile node to another home agent, described in [5] 👑 the catch is that it can only be used after the binding cache has been created at the home agent for the mobile node. the disadvantage is that quite a bit of state gets created on the home agent before the mobile node can be redirected. the mechanism in this document, though, can redirect a mobile node before any state related to the Mobile IPv6 binding is created on the home agent 🌈 big brain move
when you run IKEv2 between a Mobile IPv6 mobile node (MN) and home agent (HA), redirecting the IKEv2 exchange to another HA is NOT enough 🙅 the Mobile IPv6 signaling also needs to be sent to the new HA address. the MN MAY treat the information it gets in the IKE_SA_INIT response in a similar way to how it would treat HA discovery information from other unauthenticated (and potentially untrustworthy) sources, such as DNS lookups that aren't protected with DNS Security (DNSSEC) 🤔 however, if the MN has authenticated information about its home agent, it MUST NOT be updated based on the IKE_SA_INIT response 🔐
if the REDIRECT notification is received during the IKE_AUTH exchange (after the HA has been authenticated; see Section 6), the MN MAY pass the new address to Mobile IPv6 and handle it similarly to information from the Home Agent Switch message [5] ✨
gateway-initiated REDIRECT notifications exchanged in INFORMATIONAL exchanges (see Section 5) MUST NOT result in updating any Mobile IPv6 state 🙅♀️ in those cases, the Home Agent Switch message specified in [5] is used instead 💅
9. Redirect Messages
9.1. REDIRECT_SUPPORTED
the REDIRECT_SUPPORTED payload is included in the initial IKE_SA_INIT request by the initiator to say "hey, I support the IKEv2 redirect mechanism described in this document" 🙋♀️
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Payload |C| RESERVED | Payload Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Protocol ID(=0)| SPI Size (=0) | Notify Message Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the Next Payload, Payload Length, Protocol ID, SPI Size, and Notify Message Type fields are the same as described in Section 3.10 of [2] 📦 the SPI Size field MUST be set to 0 to show that the SPI isn't present in this message 🙅 and the Protocol ID MUST be set to 0, since the notification isn't specific to a particular security association 💜
the Payload Length field is set to the length in octets of the entire payload, including the generic payload header 📏 and the Notify Message Type field is set to indicate the REDIRECT_SUPPORTED payload (16406) 🎀
9.2. REDIRECT 🎀
Okay so, when the responder wants to send the initiator over to a different VPN gateway, it slips a REDIRECT payload into either an IKE_SA_INIT response or an INFORMATIONAL message. The payload carries the new responder's IP address or DNS name, so the initiator knows where to go next 🦋
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Payload |C| RESERVED | Payload Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Protocol ID(=0)| SPI Size (=0) | Notify Message Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| GW Ident Type | GW Ident Len | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~
~ New Responder GW Identity ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
~ Nonce Data ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The Next Payload, Payload Length, Protocol ID, SPI Size, and Notify Message Type fields work exactly like they do in Section 3.10 of [2] 💅 The SPI Size field MUST be set to 0, because the SPI isn't present in this message. The Protocol ID MUST be set to 0 too, since this notification isn't tied to any particular security association 🫶
The Payload Length field holds the length in octets of the whole payload, generic payload header included ✨ The Notify Message Type is set to 16407 to say "this is a REDIRECT payload" 🔥 The GW Ident Type field tells you what kind of info is being sent to identify the new VPN gateway, and these values are valid in the REDIRECT payload:
1 - IPv4 address of the new VPN gateway
2 - IPv6 address of the new VPN gateway
3 - FQDN of the new VPN gatewayThe GW Ident Len field is the length of the gateway identity info, and the identity itself lives in the New Responder GW Identity field 🌸 The IPv4 address, IPv6 address, or FQDN of the new VPN gateway MUST be encoded as described in Section 3.5 of [2] 🍓
The Nonce Data field carries the nonce data from the Ni payload that the initiator sent 🧚 The nonce size MUST be between 16 and 256 bytes, as described in Section 3.9 of [2]. This field only shows up in the REDIRECT payload when that payload is sent in the IKE_SA_INIT response message. It MUST NOT be included if the payload is sent in an IKE_AUTH response or in a gateway-initiated redirect message 🙈
9.3. REDIRECTED_FROM 🦋
The REDIRECTED_FROM Notify payload goes in the IKE_SA_INIT request, from the initiator over to the new VPN gateway 💜 It tells the new gateway the IP address of the original VPN gateway that did the redirecting, and that address is included in the message. If the IKE_SA_INIT request was sent to an anycast address (see Section 4), the anycast address gets included too. This payload also does a second job: it signals support for the redirect mechanism to the new VPN gateway after a redirect has happened 👑
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Payload |C| RESERVED | Payload Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Protocol ID(=0)| SPI Size (=0) | Notify Message Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| GW Ident Type | GW Ident Len | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~
~ Original Responder GW Identity ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The Next Payload, Payload Length, Protocol ID, SPI Size, and Notify Message Type fields are the same as in Section 3.10 of [2] 🌈 The SPI Size field MUST be set to 0 (no SPI in this message), and the Protocol ID MUST be set to 0, since the notification isn't specific to a security association 💖
The Payload Length field is the length in octets of the entire payload, including the generic payload header. The Notify Message Type is set to 16408 to mean REDIRECTED_FROM 🍓 The GW Identity Type field says what kind of info identifies the VPN gateway, and these values are valid in the REDIRECTED_FROM payload:
1 - IPv4 address of the original VPN gateway
2 - IPv6 address of the original VPN gatewayThe GW Ident Len field is the length of the gateway identity info, and the identity of the original VPN gateway goes in the Original Responder GW Identity field 🧚
10. Use of the Redirect Mechanism between IKEv2 Peers 🌸
The redirect mechanism in this document is mainly meant for client-gateway setups 💅 But it can also be used between any two IKEv2 peers. Just know that this protocol is asymmetric, which means only the original responder can redirect the original initiator to another server 👀
11. Security Considerations 💀
Okay this section is serious, so buckle up 😭
An eavesdropper sitting on the path between a VPN client and server can send a redirect to the client as soon as it sees an IKE_SA_INIT message from that client. This isn't a new DoS problem for the VPN connection, because an on-path attacker could just drop the IKE_SA_INIT requests and stop the client from getting VPN access anyway. The real worry is that an eavesdropper on that path can redirect a large number of clients to one victim, and that victim then gets flooded with IKE_SA_INIT requests. Flooding only really happens if lots of clients start IKEv2 exchanges at almost the same moment, which is considered a rare event. It can still happen, though: for example, if a home agent or VPN server goes down for maintenance and every client has to re-establish its VPN connection with another home agent or VPN server, or if an on-path attacker forces all IPsec security associations to expire by dropping every IKEv2 message it receives 🚨
The REDIRECTED_FROM payload exists to discourage a rogue VPN gateway from redirecting a large number of VPN clients to one particular VPN gateway. It does not prevent that kind of DoS attack 🙅♀️
The redirect mechanism MUST NOT update any state on the client apart from the VPN gateway information. When it's used with Mobile IPv6, care must be taken to make sure the home agent information the mobile node has configured isn't modified wrongly by the redirect message ⚠️
Redirecting based on the unauthenticated identities from the client might leak information about the user. An active attacker, pretending to be a VPN client, could find out which gateway the real user was redirected to. And if redirection depends on some internal information about the user, it might leak details about that user to the attacker, details that might not be obtainable any other way. To prevent these kinds of attacks, redirection based on unauthenticated IDs should be avoided, and it should only happen after the client has also authenticated itself 🔐
12. IANA Considerations 🍓
This document defines three new IKEv2 Notify Message Types, as described in Section 9. Those three Notify Message Types got these values:
16406 - REDIRECT_SUPPORTED
16407 - REDIRECT
16408 - REDIRECTED_FROMThis document also creates a brand new namespace called the "Gateway Identity Type" 🗂️ It indicates what kind of gateway info goes in the REDIRECT (Section 9.2) and REDIRECTED_FROM (Section 9.3) Notify payloads. These values have been assigned:
1 - IPv4 address of the VPN gateway
2 - IPv6 address of the VPN gateway
3 - FQDN of the VPN gatewayValue 0 is reserved. Values 4-240 are unassigned, and new values can be allocated by Expert Review [8]. Values 241-255 are set aside for private use. Any specification that extends this registry MUST also mention which of the new values are valid in which Notify payload 🌟
13. Acknowledgements 🫶
The use of anycast addresses with IKEv2 was first proposed by K. Weniger and F. Dupont, in the context of home agent assignment in Mobile IPv6 / Network Mobility (NEMO) bootstrapping. It was then added to an early version of [4] and later removed before the RFC was published. The authors of RFC 5026 get a shoutout too 🌷
Thanks to Pasi Eronen, with whom the solution in this document was extensively discussed 💜 Thanks to Tero Kivinen for suggesting the use of the REDIRECTED_FROM payload and for other comments that helped improve the document 🧚 The authors would also like to thank Yaron Sheffer, Sunil Kumar, Fan Zhao, Yoav Nir, Richard Graveman, Kanagavel Rajan, Srini Addepalli, Raj Singh, and Arnaud Ebalard for their reviews and comments. Everyone in this list is iconic 👑
14. References 📚
14.1. Normative References
- [1] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [2] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", RFC 4306, December 2005.
14.2. Informative References
- [3] Johnson, D., Perkins, C., and J. Arkko, "Mobility Support in IPv6", RFC 3775, June 2004.
- [4] Giaretta, G., Kempf, J., and V. Devarapalli, "Mobile IPv6 Bootstrapping in Split Scenario", RFC 5026, October 2007.
- [5] Haley, B., Devarapalli, V., Deng, H., and J. Kempf, "Mobility Header Home Agent Switch Message", RFC 5142, January 2008.
- [6] Eronen, P. and J. Korhonen, "Multiple Authentication Exchanges in the Internet Key Exchange (IKEv2) Protocol", RFC 4739, November 2006.
- [7] Kent, S. and K. Seo, "Security Architecture for the Internet Protocol", RFC 4301, December 2005.
- [8] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.
Authors' Addresses 💌
Vijay Devarapalli
WiChorus
3590 North First St
San Jose, CA 95134
USA
EMail: vijay@wichorus.com
Kilian Weniger
Unaffiliated
EMail: kilian.weniger@googlemail.comThat's the whole thing, bestie! 🌈💖 RFC 5685 is a wrap, and you made it through every single section 🎀✨
📦 where this page comes from
- ietf: rfc5685 2009-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms