RFC 2207
RSVP Extensions for IPSEC Data Flows
RSVP Extensions for IPSEC Data Flows ✨
okay bestie, this one's RFC 2207 🎀 It's by L. Berger from FORE Systems and T. O'Malley from BBN, and it's a Standards Track doc from September 1997. It doesn't obsolete or update anything, since the title block doesn't list any earlier RFCs. 💅
Status of this Memo 📋
This is an Internet standards track protocol spec for the Internet community, and the authors are asking for discussion and suggestions for improvements 🫶 For where this protocol stands in standardization, check the current edition of "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
Abstract 🦋
So this doc adds extensions to Version 1 of RSVP ✨ They let you support individual data flows that use RFC 1826, IP Authentication Header (AH), or RFC 1827, IP Encapsulating Security Payload (ESP). Here's the tea: RSVP Version 1 as it's currently specified can support the IPSEC protocols, but only per address, per protocol 😭 It can't do per flow. The new extensions work with both IPv4 and IPv6 💖
Table of Contents 🌸
1 Introduction . . . . . . . . . . . . . . . . . . . . . . . 2
2 Overview of Extensions . . . . . . . . . . . . . . . . . . 3
3 Object Definition. . . . . . . . . . . . . . . . . . . . . 4
3.1 SESSION Class . . . . . . . . . . . . . . . . . . . . 5
3.2 FILTER_SPEC Class . . . . . . . . . . . . . . . . . . 5
3.3 SENDER_TEMPLATE Class . . . . . . . . . . . . . . . . 6
4 Processing Rules . . . . . . . . . . . . . . . . . . . . . 6
4.1 Required Changes. . . . . . . . . . . . . . . . . . . 6
4.2 Merging Flowspecs . . . . . . . . . . . . . . . . . . 7
4.2.1 FF and SE Styles. . . . . . . . . . . . . . . . . . 7
4.2.2 WF Styles . . . . . . . . . . . . . . . . . . . . . 8
5 IANA Considerations. . . . . . . . . . . . . . . . . . . . 8
6 Security Considerations. . . . . . . . . . . . . . . . . . 8
7 References . . . . . . . . . . . . . . . . . . . . . . . .10
8 Acknowledgments . . . . . . . . . . . . . . . . . . . . .10
9 Authors' Addresses . . . . . . . . . . . . . . . . . . . .10
A Options Considered . . . . . . . . . . . . . . . . . . . .11
A.1 UDP Encapsulation . . . . . . . . . . . . . . . . . .11
A.2 FlowID Header Encapsulation . . . . . . . . . . . . .12
A.3 IPSEC Protocol Modification . . . . . . . . . . . . .12
A.4 AH Transparency . . . . . . . . . . . . . . . . . . .131. Introduction 🚀
Standards Track RFCs have been published recently that define protocol mechanisms for IP level security 🔐 These are the IP Security (IPSEC) protocols. They give you packet level authentication ([RFC 1826]) and integrity and confidentiality ([RFC 1827]). Lots of interoperable implementations already exist, and several vendors have announced commercial products that will use these mechanisms 💅
The IPSEC protocols work by adding a new header between a packet's IP header and the transport (e.g. UDP) protocol header ✨ There are two security headers. The Authentication Header (AH) handles authentication, and the Encapsulating Security Payload (ESP) handles integrity and confidentiality 🦋
RSVP is being developed as a resource reservation (dynamic QoS setup) protocol 🎀 The RSVP spec as it stands ([RFC 2205]) is built for IP packets that carry protocols with TCP or UDP-like ports. Protocols without those ports, like the IPSEC protocols, can be supported, but only with limitations 😭 For flows of IPSEC data packets specifically, flow definition can only be done per IP address, per protocol.
So this memo proposes extensions to RSVP so that data flows carrying IPSEC protocols can be controlled at a granularity similar to what's already specified for UDP and TCP 🫶 The extensions work with both IPv4 and IPv6. Section 2 gives an overview of the extensions. Section 3 describes the extended protocol mechanisms. Section 4 presents the extended processing rules. Section 5 defines the additional RSVP data objects.
2. Overview of Extensions 🧚
The big idea is to extend RSVP to use the IPSEC Security Parameter Index, or SPI, in place of the UDP/TCP-like ports 👑 That means a new FILTER_SPEC object, which will contain the IPSEC SPI, and a new SESSION object.
SPIs are allocated based on destination address, but they're usually tied to one particular sender. So two senders to the same unicast destination will usually have different SPIs 💜 To control multiple independent flows between a source and destination IP address, the SPI gets included as part of the FILTER_SPEC. Now, when using WF, all flows to the same IP destination address using the same IP protocol ID will share the same reservation 😭 (This limitation exists because the IPSEC transport headers don't have a destination demultiplexing value like the UDP/TCP destination port. Not me being sad about it, but it is what it is.)
The RESV message format is not changing, but RESV processing needs modification 🔥 How the new IPSEC FILTER_SPEC gets processed depends on the new SESSION object and on the protocol ID in the session definition. When the new FILTER_SPEC is used, the complete four bytes of the SPI need to be pulled out of the FILTER_SPEC so the packet classifier can use them. Where the SPI sits in the transport header of the IPSEC packets depends on the protocol ID field 🌈
PATH processing also needs a change, specifically how the port field in a session definition is used 💅 An RSVP session is defined by the triple (DestAddress, protocol ID, DstPort). [RFC 2205] defines one type of SESSION object, which contains UDP/TCP destination ports. Those are described as "a 16-bit quantity carried at the octet offset +2 in the transport header" or zero for protocols that lack such a field. The IPSEC protocols don't have that field, but there's still a need to demultiplex sessions beyond the IP destination address 🙈 To meet that need, this spec introduces a virtual destination port, or vDstPort. The vDstPort value is carried in the new SESSION object but not in the IPSEC transport header. It lets you tell apart multiple IPSEC sessions going to the same IP address. See Section 5 for a discussion of vDstPort ranges.
In PATH messages, the SENDER_TEMPLATE for IPSEC flows has the same format as the modified FILTER_SPEC ✨ A new SESSION object is used to clearly signal that a virtual destination port is in play.
Traffic gets mapped (classified) to reservations based on the SPIs in FILTER_SPECs 🎀 That means that with WF, all flows to the same IP destination address with the same IP protocol ID share the same reservation. Iconic behaviour, and it's connected to the limitation above.
The perks of this approach: no changes to RFC 1826 or 1827 are needed, and there's no extra overhead per data packet 🦋 Appendix A talks about how this approach compares to several other alternatives. It doesn't use the IPv6 Flow Label field, so greater efficiency might be possible for IPv6 flows. The details of IPv6 Flow Label usage are left for the future 🔮
3. Object Definition 💖
The FILTER_SPEC and SENDER_TEMPLATE used with IPSEC protocols each contain a four byte field that carries the SPI 🌸 Instead of labelling the modified field with an IPSEC specific label, SPI, the field is labelled "Generalized Port Identifier", or GPI. That way these objects can be reused for non-IPSEC uses in the future 🧚 The objects are named IPv4/GPI FILTER_SPEC, IPv6/GPI FILTER_SPEC, IPv4/GPI SENDER_TEMPLATE, and IPv6/GPI SENDER_TEMPLATE. The new SESSION objects are the IPv4/GPI SESSION and the IPv6/GPI SESSION. When talking about the new objects, the IP version isn't included unless the difference between IPv4 and IPv6 actually matters 💅
3.1. SESSION Class ⭐
SESSION Class = 1.
- IPv4/GPI SESSION object: Class = 1, C-Type = 3
+-------------+-------------+-------------+-------------+
| IPv4 DestAddress (4 bytes) |
+-------------+-------------+-------------+-------------+
| Protocol ID | Flags | vDstPort |
+-------------+-------------+-------------+-------------+- IPv6/GPI SESSION object: Class = 1, C-Type = 4
+-------------+-------------+-------------+-------------+
| |
+ +
| |
+ IPv6 DestAddress (16 bytes) +
| |
+ +
| |
+-------------+-------------+-------------+-------------+
| Protocol ID | Flags | vDstPort |
+-------------+-------------+-------------+-------------+3.2. FILTER_SPEC Class 🍓
FILTER_SPEC class = 10.
- IPv4/GPI FILTER_SPEC object: Class = 10, C-Type = 4
+-------------+-------------+-------------+-------------+
| IPv4 SrcAddress (4 bytes) |
+-------------+-------------+-------------+-------------+
| Generalized Port Identifier (GPI) |
+-------------+-------------+-------------+-------------+- IPv6/GPI FILTER_SPEC object: Class = 10, C-Type = 5
+-------------+-------------+-------------+-------------+
| |
+ +
| |
+ IPv6 SrcAddress (16 bytes) +
| |
+ +
| |
+-------------+-------------+-------------+-------------+
| Generalized Port Identifier (GPI) |
+-------------+-------------+-------------+-------------+3.3. SENDER_TEMPLATE Class 🫧
SENDER_TEMPLATE class = 11.
- IPv4/GPI SENDER_TEMPLATE object: Class = 11, C-Type = 4
Definition same as IPv4/GPI FILTER_SPEC object.
- IPv6/GPI SENDER_TEMPLATE object: Class = 11, C-Type = 5
Definition same as IPv6/GPI FILTER_SPEC object.
4. Processing Rules 🔥
This section adds to the Processing Rules presented in [RFC 2209] 💖 These additions are required so the GPI SESSION and FILTER_SPEC objects get processed properly. Values for the error codes referenced here can be found in [RFC 2205]. Just like the other RSVP documents, values for internally reported (API) errors aren't defined ✨
4.1. Required Changes 💅✨
Okay bestie, both RESV and PATH processing need a glow-up to support the new objects 🦋 The changes keep everything consistent and extend port processing 🎀
The following PATH message processing changes are required:
- When a session is defined using the GPI SESSION object, only the GPI SENDER_TEMPLATE MAY be used. If that rule gets broken, end-stations SHOULD report a "Conflicting C-Type" API error to the application 😭
- For PATH messages that contain the GPI SESSION object, end-stations MUST verify that the protocol ID matches a protocol known to use the GPI SESSION object. Values 51 (AH) or 50 (ESP) MUST be supported by implementations that support the described IPSEC extensions. If an unknown protocol ID shows up, the API SHOULD report an "API Error" to the application 🧚
- For these messages, the vDstPort value SHOULD be recorded 🌸 It becomes part of the recorded state and is used to match Resv messages, but it is not passed to traffic control. Non-zero values of vDstPort are required. This is what keeps a non-GPI SESSION object from ever merging with a GPI SESSION object 👑 Breaking this condition causes an "Invalid Destination Port" API error 💀
The changes to RESV message processing are:
- When a RESV message contains a GPI FILTER_SPEC, the session MUST be defined using the GPI SESSION object. Otherwise, that's a message formatting error 🙈
- The GPI in the FILTER_SPEC MUST match the GPI in the SENDER_TEMPLATE. If it doesn't, a "No sender information for this Resv message" error gets generated 🍓
- When the GPI FILTER_SPEC is used, each node MUST create a data classifier for the flow described by the quadruple:
(DestAddress, protocol ID, SrcAddress, GPI). The data classifier needs to look for the four byte GPI at transport header offset +4 for AH, and at transport header offset +0 for ESP 🦋
4.2. Merging Flowspecs 🌈
When this extension is used for IPSEC data flows, RSVP sessions are defined by the triple (DestAddress, protocol Id, vDstPort). Senders are defined by the tuple (SrcAddress, GPI), where the GPI field is a four byte representation of a generalized source port. These extensions have some ramifications depending on the reservation style, so let's get into it ✨
4.2.1. FF and SE Styles 🎀
In the FF and SE Styles, the FILTER_SPEC object contains the (SrcAddress, GPI) pair. This lets the receiver uniquely identify senders based on both elements of the pair 💖 When merging explicit sender descriptors, the senders may only be considered identical when both elements are identical 🫶
4.2.2. WF Styles 🥀
These extensions provide very limited service when used with WF style reservations, ngl 😭 As described, the SENDER_TEMPLATE and FILTER_SPEC each contain the GPI. In a WF style reservation, the RESV message does NOT contain a FILTER_SPEC (after all, it's a wildcard filter), and the SENDER_TEMPLATE is ignored (again, because any sender is allowed). So classifiers may match all packets that contain both the session's destination IP address and protocol ID for those WF reservations 🙈
Although a solution for this limitation is not proposed, it isn't seen as significant, since IPSEC applications are less likely to use WF style reservations ✨
5. IANA Considerations 🧚
The range of possible vDstPort values is broken into sections, kind of like the UDP/TCP port ranges 🌈
0 Illegal Value
1 - 10 Reserved. Contact authors.
11 - 8191 Assigned by IANA
8192 - 65535 DynamicIANA is directed to assign the well-known vDstPorts using the following criteria: anyone who asks for an assigned vDstPort MUST provide a) a Point of Contact, b) a brief description of intended use, and c) a short name to be associated with the assignment (e.g. "ftp") 📝
6. Security Considerations 💀🔥
Okay this section is serious, so read it carefully bestie 🫶 The same considerations stated in [RFC 2205], [RFC 1826], and [RFC 1827] apply to the extensions described in this note. There are two additional issues related to these extensions.
First, the vDstPort mechanism is another data element about the IP Flow that might be available to an adversary. That data could be useful to someone doing traffic analysis by watching not only the data packets of the IP Flow but also the RSVP control messages associated with that Flow 👀 Protection against traffic analysis attacks is outside the scope of this mechanism. One possible approach to preventing such attacks would be deploying and using appropriate link-layer confidentiality mechansisms, such as encryption 🔐
Secondly, changes in SPI values for a given flow will affect RSVP flows and reservations. These changes happen whenever that flow changes its Security Association, which happens when a flow is rekeyed (i.e. to use a new key). Rekeying intervals are typically set based on traffic levels, key size, threat environment, and the crypto algorithm in use. When an SPI change occurs, it will in most cases be necessary to update (send) the corresponding SENDER_TEMPLATEs and FILTER_SPECs. IPSEC implementations, RSVP applications, and RSVP end-station implementations will need to take the possibility of SPI changes into account to ensure proper reservation behavior 🧠 This issue is likely to be tolerable, since rekeying intervals are under the control of local administrators 🌸
Many, if not most, RSVP sessions won't need to deal with this rekeying issue 🙌 For the applications that do need to handle SPI changes during a session, the impact of sending new PATH and RESV messages varies based on the reservation style being used. Builders of such applications MAY want to select a reservation style based on how it interacts with SPI changes 🎀
The least impact of an SPI change falls on WF style reservations. For these, a new SENDER_TEMPLATE needs to be sent, but no new RESV is required. For SE style reservations, both a new SENDER_TEMPLATE and a new RESV need to be sent. This changes state, but it SHOULD NOT affect data packet delivery or actual resource allocation in any way 🦋 The FF style gets impacted the most. Like SE, both PATH and RESV messages need to be sent. But since FF style reservations result in the sender receiving its own resource allocation, resources get allocated twice for a period of time. Or, even worse, there won't be enough resources to support the new flow without first freeing the old flow 😭
There is a way around this FF/SPI-change problem 🧚♀️ Applications that want FF style reservations can use multiple SE reservations. Each real sender would have a separate SESSION (vDstPort) definition. When it's time to switch SPIs, a shared reservation can be made for the new SPI while the old SPI is still active. Once the new SPI is in use, the old reservation can be torn down. This is less than optimal, but it will provide uninterrupted service for a set of applications 👑
7. References 📚
[RFC 2205] Braden, R., Ed., Zhang, L., Estrin, D., Herzog, S.,
and S. Jamin, "Resource ReSerVation Protocol (RSVP)
-- Version 1 Functional Specification", RFC 2205,
September 1997.
[RFC 2209] Braden, R., Ed., Zhang, "Resource ReSerVation
Protocol (RSVP) -- Version 1 Message Processing
Rules", RFC 2209, September 1997.
[RFC 1825] Atkinson, R., "Security Architecture for the Internet
Protocol", RFC 1825, NRL, August 1995.
[RFC 1826] Atkinson, R., "IP Authentication Header", RFC 1826, NRL,
August 1995.
[RFC 1827] Atkinson, R., "IP Encapsulating Security Payload", RFC
1827, NRL, August 1995.8. Acknowledgments 🫶
This note includes ideas originated and reviewed by a number of individuals who didn't participate in writing it, so the authors want to give them a shoutout 💖 Thank you to Ran Atkinson <rja@cisco.com>, Fred Baker <fred@cisco.com>, Greg Troxel <gdt@bbn.com>, and John Krawczyk <jkrawczyk@BayNetworks.com> for the much appreciated input and feedback. Special appreciation goes to Bob Braden <braden@isi.edu> for his detailed editorial and technical comments 👑 We also thank Buz Owen, Claudio Topolcic, Andy Veitch, and Luis Sanchez for their help coming up with the proposed approach 🌸 If any brain-damage exists in this note, it originated solely from the authors 🙈
9. Authors' Addresses 🎀
Lou Berger Tim O'Malley
FORE Systems BBN Corporation
6905 Rockledge Drive 10 Moulton Street
Suite 800 Cambridge, MA 02138
Bethesda, MD 20817
Phone: 301-571-2534 Phone: 617-873-3076
EMail: lberger@fore.com EMail: timo@bbn.comA. Options Considered 🦋
This section reviews other approaches that were explored while developing the described extensions. They're included here to give extra context on the general problem 🧠 All listed options were rejected by the working group 💅
Four other options were considered:
- UDP Encapsulation: Add a UDP header between the IP and the IPSEC AH or ESP headers.
- FlowID Header Encapsulation: Add a new type of header between the IP and the IPSEC AH or ESP headers.
- IPSEC modification: Modify IPSEC headers so that there are appropriate fields in the same location as UDP and TCP ports.
- AH Transparency: Skip over the Authentication Header packet classifier processing.
A.1. UDP Encapsulation 🧚
Since the current SESSION and FILTER objects expect UDP or TCP ports, this proposal says let's just give them UDP ports 💖 The basic concept is to add a UDP port between the IP and AH/ESP headers. The UDP ports would provide the granularity of control needed to associate specific flows with reservations.
Source and destination ports would be used, as normal, in RSVP session definition and control. The port fields would also need to be used to identify the real transport level protocol (e.g. ESP) being used. Also, since many UDP ports are assigned as well-known ports, the use of port numbers would be limited. So the port fields would need to be used to unambiguously identify 1) the next level protocol, 2) the RSVP session, and 3) the RSVP reservation 🌈
The advantage of this option is that no RSVP changes are required. The disadvantage is that, since the headers aren't in the expected location, RFC 1826 and RFC 1827 are violated 😭
A.2. FlowID Header Encapsulation ✨
[This option was originally proposed by Greg Troxel <gdt@bbn.com>.]
okay so this one is basically option 1's cooler, more generic cousin 💅 and it could honestly be adopted as a standard solution 🔥. The whole idea is to use UDP-like ports just for flow identification 🦋. RSVP would treat this new protocol exactly the same as UDP, so it's giving consistency 🎀
The difference from UDP encapsulation shows up in destination host processing 👀. The destination host would basically ignore the port info and check a new field, the protocol ID, to figure out which protocol should process the packet next. Protocol IDs for TCP, UDP, ESP, or AH are some examples 💖
here's the FlowID Header format bestie 🧚
+---------------+---------------+---------------+---------------+
| Source Port | Dest Port |
+---------------+---------------+---------------+---------------+
| Ver | Len | Protocol ID | Checksum |
+---------------+---------------+---------------+---------------+
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8
2 bytes source port 4 bits length-32 (2)
2 bytes dest port 8 bits protocol ID
4 bits version (1) 16 bits checksumThe advantage here is that flow identification gets separated from all other protocol processing ✨ The disadvantage is that adding a header violates RFC 1826 and 1827 😭 and also that applications using RSVP will need to add this extra header on all data packets whose transport headers do not have UDP/TCP-like ports 🙈
A.3. IPSEC Protocol Modification 🔐
The basic notion of this option is to leave RSVP as currently specified and use the Security Association Identifier (SPI) found in the IPSEC headers for flow identification 💜 There are two issues with using the SPI. The first is that the SPI is in the wrong location when using Authentication (AH) 😬 The second issue is how to actually make use of the SPI.
The first issue is easy to fix, but it violates RFC 1826. UDP and TCP have port assignments in the first 4 bytes of their headers, each two bytes long, with source first and then destination. The ESP header has the SPI in the same location as the UDP/TCP ports, but AH doesn't 🥲
The IP Authentication Header has the following syntax:
+---------------+---------------+---------------+---------------+
| Next Header | Length | RESERVED |
+---------------+---------------+---------------+---------------+
| Security Parameters Index |
+---------------+---------------+---------------+---------------+
| |
+ Authentication Data (variable number of 32-bit words) |
| |
+---------------+---------------+---------------+---------------+
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8Simply reversing the first 4 bytes puts the SPI in the location that RSVP expects 🙃 but that would be non-standard, or require a major (i.e. not backward compatible) change to RSVP 1826. Not it 💀
The second issue is how to make use of the SPI 😤 Per the current RSVP specification, the first two bytes of a flow's SPI would need to be carried in the PATH message and the second two bytes in the RESV message. The biggest problem is that the SPI is normally selected by the receiver and is likely to be different for EACH sender 🫠 (There is a special case where the same SPI is used by all senders in a multicast group, but that's just a special case.) It's possible to have the SPI selected prior to starting the RSVPsession. This works for unicast and the special multicast case, but it means setup time will usually get extended by at least 1 round trip time ⏳ Its not clear how to support SE and WF style reservations 😵💫
The advantage of this approach is no change to RSVP ✨ The disadvantages are the modification to RFC1827 and limited support of RSVP reservation styles 💔
A.4. AH Transparency 🦋
The source of the RSVP support of IPSEC protocols problem is that the real transport header is not in the expected location 🧐 With ESP packets, the real source and destination ports are encrypted and therefore useless to RSVP. This is not the case for authentication! For AH, the real header just follows the Authentication Header. So it would be possible to use the real transport header for RSVP session definition and reservation 🎀
To use the transport header, all that would need to be done is for the flow classifier to skip over AHs before classifying packets. No modification to RSVP formats or setup processing would be required. Applications would make reservations based on transport (i.e., UDP or TCP) ports as usual 💅
The advantages of this approach are no changes to either IPSEC protocols or RSVP formats 🥳 The major disadvantage is that routers and hosts must skip all AHs before classifying packets. The working group decided that it was best to have a consistent solution for both AH and ESP 🫶
📦 where this page comes from
- ietf: rfc2207 1997-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms