RFC 9735
Locator/ID Separation Protocol (LISP) Distinguished Name Encoding
Locator/ID Separation Protocol (LISP) Distinguished Name Encoding 🎀
- RFC number: 9735
- Stream: Internet Engineering Task Force (IETF), ISSN 2070-1721 🌸
- Category: Standards Track
- Date: February 2025
- Authors: D. Farinacci (lispers.net) and L. Iannone, Ed. (Huawei) 👑
- Obsoletes / Updates: the title block doesn't list anything this one obsoletes or updates 🙈
Abstract 🦋
Okay bestie, this doc explains how to use Address Family Identifier (AFI) 17, which is "Distinguished Name," inside the Locator/ID Separation Protocol (LISP). LISP brings in two brand-new numbering spaces: Endpoint Identifiers (EIDs) and Routing Locators (RLOCs). Distinguished Names (DNs) can show up in either EID-Records or RLOC-Records in LISP control messages to carry extra info. It's giving flexibility ✨
Status of This Memo 📜
This is an Internet Standards Track document. It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 7841.
For the current status, any errata, and how to send feedback, head to https://www.rfc-editor.org/info/rfc9735 💅
Copyright Notice 🌈
Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled out of this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Revised BSD License.
Table of Contents 🧚
1. Introduction
2. Terminology
2.1. Definition
2.2. Requirements Language
3. Distinguished Name Format
4. Mapping-System Lookups for DN EIDs
5. Example Use Cases
6. Name-Collision Considerations
7. Security Considerations
8. IANA Considerations
9. Sample LISP DN Deployment Experience
9.1. DNs to Advertise Specific Device Roles or Functions
9.2. DNs to Drive xTR Onboarding Procedures
9.3. DNs for NAT-Traversal
9.4. DNs for Self-Documenting RLOC Names
9.5. DNs Used as EID Names
10. References
10.1. Normative References
10.2. Informative References
Acknowledgments
Authors' Addresses1. Introduction ✨
Okay so LISP ([RFC9300] and [RFC9301]) brings in two new numbering spaces: Endpoint Identifiers (EIDs) and Routing Locators (RLOCs). To stay flexible for current and future apps, these values can be encoded in LISP control messages using a general syntax that includes the Address Family Identifier (AFI).
The length of addresses in EID-Records and RLOC-Records is easy to figure out from the AFI field, because the AFI value already tells you the address size. For example, AFI 1 is "IP (IP version 4)", and its address length is known to be 4 octets. AFI 17 "Distinguished Name," though, is variable-length, so you can't work out the length from the AFI value 17 alone [ADDRESS-FAMILY]. This document defines a termination character, an 8-bit value of 0, to act as a string terminator so the length can be determined 🫶
LISP DNs are useful when they're encoded in either EID-Records or RLOC-Records in LISP control messages. As EIDs, they can be registered in the Mapping System to find resources or services, or just act as a self-documenting feature that rides along with other address-specific EIDs. As RLOCs, DNs (together with RLOC-specific addresses and parameters) can label equipment type, location, or any self-documenting string a registering device wants to share 💜
The Distinguished Name field in this document has no relationship to the similarly named field in the Public-Key Infrastructure using X.509 (PKIX) specifications (e.g., [RFC5280]). Don't mix them up, bestie 🙈
2. Terminology 💅
2.1. Definition
Address Family Identifier (AFI): a term used to describe an address encoding in a packet. Right now, an address family is defined for IPv4 or IPv6 addresses. See [ADDRESS-FAMILY] for details on other types of information that can be AFI encoded.
2.2. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 🔥
3. Distinguished Name Format 🍓
An AFI 17 "Distinguished Name" is encoded like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| AFI = 17 | NULL-Terminated (0x00) ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ US-ASCII String |
~ |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+The variable-length string of characters is encoded as a NULL-terminated (0x00) US-ASCII character set, as defined in [RFC3629], where UTF-8 has the nice trait of keeping the full US-ASCII range. A NULL character MUST appear only once in the string, and it MUST be at the end of the string. No sneaking extra nulls in the middle 🙅♀️
When DNs are encoded for EIDs, the EID Mask-Len length of the EID-Records, for all LISP control messages [RFC9301], is the length of the string in bits (including the NULL-terminated 0x00 octet).
Where DNs are encoded anywhere else (i.e., nested in LISP Canonical Address Format (LCAF) encodings [RFC8060]), an explicit length field can be used to indicate the length of the ASCII string in octets. The length field MUST include the NULL octet (0x00). The string MUST still be NULL-terminated (0x00). If a NULL octet (0x00) shows up before the end of the octet field, meaning it appears before the last position in the octet fields, then the string MAY be accepted, but the octets after that NULL octet (0x00) MUST NOT be used as part of the octet string. Basically, the null is the boss here 👑
If the octet after the AFI field is the NULL octet (0x00), the string is a NULL string and MUST be accepted. In other words, an AFI 17 "Distinguished Name" encoded string MUST be at least 1 octet in length. ✨
4. Mapping-System Lookups for DN EIDs 🔍
Okay, when you're doing DN-EID lookups, Map-Request messages MUST carry an EID Mask-Len length equal to the length of the name string in bits. That tells the Mapping System to do either an exact-match or a longest-match lookup 🧠
If the DN EID is registered with the same length as the length in a Map-Request, the Map-Server (when configured for proxy Map-Replying) returns an exact-match lookup with the same EID Mask-Len length. If a less specific name is registered, then the Map-Server returns the registered name with the registered EID Mask-Len length.
For example, say the registered EID name is "ietf" with an EID Mask-Len length of 40 bits. That's the length of the string "ietf" plus the length of the NULL octet (0x00), which makes 5 octets. Then a Map-Request comes in for EID name "ietf.lisp" with an EID Mask-Len length of 80 bits. The Map-Server will return EID "ietf" with a length of 40 bits. Iconic longest-match behavior 💖
5. Example Use Cases 🌸
This section identifies three specific use-case examples for the DN format: two are used for an EID encoding and one is used for an RLOC-Record encoding. When public keys are stored in the Mapping System, as in [LISP-ECDSA], a well-known format for a public-key hash can be encoded as a DN. When street-location-to-GPS-coordinate mappings exist in the Mapping System, as in [LISP-GEO], the street location can be a free-form UTF-8 ASCII representation (with whitespace characters) encoded as a DN. An RLOC that describes an Ingress or Egress Tunnel Router (xTR) behind a NAT device can be identified by its router name, as in [LISPERS-NET-NAT]. In this case, DN encoding is used in NAT Info-Request messages after the EID-prefix field of the message. 🦋
6. Name-Collision Considerations 🧚
When a DN encoding is used to format an EID, the uniqueness and allocation concerns are no different from registering IPv4 or IPv6 EIDs to the Mapping System. See [RFC9301] for more details. Also, the use cases documented in Section 5 of this specification give allocation recommendations for their specific uses.
It is RECOMMENDED that each use case register its DNs with a unique Instance-ID. Any use cases that need different uses for DNs within an Instance-ID MUST define their own Instance-ID and syntax structure for the name registered to the Mapping System. See the encoding procedures in [LISP-VPN] for an example. 🌈
7. Security Considerations 🚨
Heads up, this one is serious. DNs are used in mappings that are part of the LISP control plane, and they may be encoded using LCAF. So the security considerations of [RFC9301] and [RFC8060] apply in full. Read those too, no skipping 💀
8. IANA Considerations 📋
This document has no IANA actions. Nothing to register here, bestie ✨
9. Sample LISP DN Deployment Experience 🌈
Practical implementations of the LISP DN, defined in this document, have been running in production networks for some time. The following sections share some examples of how it's used and the lessons learned from that experience 👑
9.1. DNs to Advertise Specific Device Roles or Functions
Here's the tea: in a practical implementation of [LISP-EXT] on LISP deployments, routers running as Proxy Egress Tunnel Routers (Proxy-ETRs) register their role with the Mapping System so they can attract traffic destined for external networks. These practical implementations use a DN as an EID to identify the Proxy-ETR role in a Map-Registration.
In this case, every Proxy-ETR that supports this function registers a common DN together with its own offered locator. The Mapping System aggregates the locators it gets from all the Proxy-ETRs into a common locator-set associated with this DN EID. The DN acts as a shared reference EID that can be requested (or subscribed to, as per [RFC9437]) to dynamically gather this Proxy-ETR list, as specified in the LISP Site External Connectivity document [LISP-EXT]. Main character energy 🎀
The DN gives descriptive info about the role being registered, and it lets the Mapping System form locator-sets tied to a specific role. Those locator-sets can be distributed on demand, based on the shared DN used as the EID. It also lets the network admin and the Mapping System pick and choose which roles and functions get registered and passed along to the rest of the participants in the network 🦋
9.2. DNs to Drive xTR Onboarding Procedures ✨
okay so bestie, this one is SO clever 💅 Following the LISP reliable transport [LISP-MAP], ETRs that want to switch over to reliable transport for holding registrations have to start with UDP registrations first 🦋 The UDP registration is what lets the Map-Server do basic authentication of the ETR, and it sets up the state needed so the reliable transport session can be established. Like, the Map-Server does a passive open on TCP port 4342 and adds the ETR RLOC to the list of allowed session peers 🔥
In the basic version of this process, ETRs have to sit around and wait until their local mappings are ready to get registered with the Mapping System 🙈 And when the Mapping System is distributed, the ETR needs one specific mapping ready for each relevant Map-Server 😭 So onboarding can get delayed, and it can also cause a bunch of unnecessary signaling every time something like a local port flap or device failure happens 💀
This is where dedicated name registrations come in and save the day 👑 They let you drive this initial ETR onboarding on the Mapping System as a deterministic process that doesn't depend on whether other mappings are available. They also give the reliable transport session more stability so it can survive transient events 🫶
In practice, LISP deployments use dedicated DNs that get registered as soon as xTRs come online with all the necessary Map-Servers in the Mapping System ✨ The mapping with the dedicated DN, together with the RLOC of each Egress Tunnel Router (ETR) in the locator-set, is used to drive the initial UDP registration and also to keep the reliable transport state stable through network condition changes 💖 On the Map-Server side, these DN registrations help set up the state needed to onboard new ETRs quickly and in a more deterministic way 🧚
9.3. DNs for NAT-Traversal 🌸
At the time of writing, the open-source lispers.net NAT-Traversal implementation [LISPERS-NET-NAT] has been deploying DNs for documenting xTRs versus Re-encapsulating Tunnel Routers (RTRs) as they appear in a locator-set for 10 years 🎀
9.4. DNs for Self-Documenting RLOC Names 🍓
At the time of writing, the open-source lispers.net implementation [LISPERS-NET-NAT] has been self-documenting RLOC names in production and pilot environments for 10 years 💜 The RLOC name is encoded with the RLOC address in DN format 🦋
9.5. DNs Used as EID Names 🌈
At the time of writing, the open-source lispers.net implementation [LISPERS-NET-NAT] has deployed xTRs that are allowed to register EIDs as DNs for 10 years 🔥 The LISP Mapping System can be used as a DNS proxy for Name-to-EID-address or Name-to-RLOC-address mappings ✨ The implementation also supports Name-to-Public-Key mappings to provide key management features in [LISP-ECDSA] 🔐💅
10. References 📚
10.1. Normative References 💖
[ADDRESS-FAMILY]
IANA, "Address Family Numbers",
<https://www.iana.org/assignments/address-family-numbers>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO
10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November
2003, <https://www.rfc-editor.org/info/rfc3629>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC9300] Farinacci, D., Fuller, V., Meyer, D., Lewis, D., and A.
Cabellos, Ed., "The Locator/ID Separation Protocol
(LISP)", RFC 9300, DOI 10.17487/RFC9300, October 2022,
<https://www.rfc-editor.org/info/rfc9300>.
[RFC9301] Farinacci, D., Maino, F., Fuller, V., and A. Cabellos,
Ed., "Locator/ID Separation Protocol (LISP) Control
Plane", RFC 9301, DOI 10.17487/RFC9301, October 2022,
<https://www.rfc-editor.org/info/rfc9301>.
[RFC9437] Rodriguez-Natal, A., Ermagan, V., Cabellos, A., Barkai,
S., and M. Boucadair, "Publish/Subscribe Functionality for
the Locator/ID Separation Protocol (LISP)", RFC 9437,
DOI 10.17487/RFC9437, August 2023,
<https://www.rfc-editor.org/info/rfc9437>.10.2. Informative References 📖
[LISP-ECDSA]
Farinacci, D. and E. Nordmark, "LISP Control-Plane ECDSA
Authentication and Authorization", Work in Progress,
Internet-Draft, draft-ietf-lisp-ecdsa-auth-13, 18 August
2024, <https://datatracker.ietf.org/doc/html/draft-ietf-
lisp-ecdsa-auth-13>.
[LISP-EXT] Jain, P., Moreno, V., and S. Hooda, "LISP Site External
Connectivity", Work in Progress, Internet-Draft, draft-
ietf-lisp-site-external-connectivity-01, 24 September
2024, <https://datatracker.ietf.org/doc/html/draft-ietf-
lisp-site-external-connectivity-01>.
[LISP-GEO] Farinacci, D., "LISP Geo-Coordinate Use-Cases", Work in
Progress, Internet-Draft, draft-ietf-lisp-geo-09, 15
January 2025, <https://datatracker.ietf.org/doc/html/
draft-ietf-lisp-geo-09>.
[LISP-MAP] Venkatachalapathy, B., Portoles-Comeras, M., Lewis, D.,
Kouvelas, I., and C. Cassar, "LISP Map Server Reliable
Transport", Work in Progress, Internet-Draft, draft-ietf-
lisp-map-server-reliable-transport-05, 4 November 2024,
<https://datatracker.ietf.org/doc/html/draft-ietf-lisp-
map-server-reliable-transport-05>.
[LISP-VPN] Moreno, V. and D. Farinacci, "LISP Virtual Private
Networks (VPNs)", Work in Progress, Internet-Draft, draft-
ietf-lisp-vpn-12, 19 September 2023,
<https://datatracker.ietf.org/doc/html/draft-ietf-lisp-
vpn-12>.
[LISPERS-NET-NAT]
Farinacci, D., "lispers.net LISP NAT-Traversal
Implementation Report", Work in Progress, Internet-Draft,
draft-farinacci-lisp-lispers-net-nat-09, 8 December 2024,
<https://datatracker.ietf.org/doc/html/draft-farinacci-
lisp-lispers-net-nat-09>.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
<https://www.rfc-editor.org/info/rfc5280>.
[RFC8060] Farinacci, D., Meyer, D., and J. Snijders, "LISP Canonical
Address Format (LCAF)", RFC 8060, DOI 10.17487/RFC8060,
February 2017, <https://www.rfc-editor.org/info/rfc8060>.Acknowledgments 🫶
The authors would like to thank the LISP WG for their review and acceptance of this document 🌷 A special thank you goes to Marc Portoles for moving this document through the process and providing deployment-experience samples 👑
Authors' Addresses 💌
Dino Farinacci
lispers.net
San Jose, CA
United States of America
Email: farinacci@gmail.com
Luigi Iannone (editor)
Huawei Technologies France S.A.S.U.
18, Quai du Point du Jour
92100 Boulogne-Billancourt
France
Email: luigi.iannone@huawei.com📦 where this page comes from
- ietf: rfc9735 2025-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms