RFC 2752
Identity Representation for RSVP
Identity Representation for RSVP ✨
Okay bestie, let's set the scene 🎀 This is RFC 2752, called Identity Representation for RSVP, and it's dated January 2000 in the Standards Track category 💅 It came from the Network Working Group and was written by S. Yadav, R. Yavatkar, R. Pabbati, P. Ford, T. Moore and S. Herzog, with the authors coming from Intel, Microsoft and IPHighway 🦋 The title block doesn't list any RFCs that this one obsoletes or updates, so it's a fresh start 🌸
Status of this Memo
Okay, this one is an Internet standards track protocol for the Internet community 🔥 It's asking for discussion and suggestions for improvements, so bring your ideas! For the standardization state and status, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited ✨
Copyright Notice
Copyright (C) The Internet Society (2000). All Rights Reserved. 🌈
Abstract
Okay so this doc explains how identity info gets represented inside the POLICY_DATA object [POL-EXT], so RSVP can do policy based admission control 🔐 The big goal is letting a process on a system securely identify the owner and the application of the communicating process (think user id 🙈), and then sending that info in RSVP messages (PATH or RESV) in a secure way.
We describe how identities get encoded as an RSVP policy element, and we spell out the processing rules for making identity policy elements for multicast merged flows 🦋 Then we cover how user identities are represented for Kerberos and Public Key based user authentication mechanisms. To wrap it up, we talk about using all this identity info in an operational setting. It's giving full-circle energy 💜
1. Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC-2119]. 💖
2. Introduction
So RSVP [RFC 2205] is a resource reservation setup protocol built for an integrated services Internet [RFC 1633] ✨ Hosts use it to ask the network for a specific quality of service (QoS) for particular application data streams or flows. Routers use it too, to deliver those QoS requests to all the nodes along the path(s) of the flows, and to set up and maintain the state that provides the requested service 🧚
Honestly, RSVP requests usually end up reserving resources at each node along the data path 🍓 It lets particular users get preferential access to network resources, but only under an admission control mechanism. A reservation gets approved based on two things: whether the requested resources are actually available along the data path, and whether the policy rules are satisfied 💅 Policy based admission control based on user identity or application is a major requirement, no cap 👑
To make this work, you need to be able to identify the user and/or application making an RSVP request. Identity based policy control is required for exactly this reason 🫶
This document proposes a way to send identification info in RSVP messages, so that authorization decisions can be made based on both policy and identity 🎀
Here's the flow. We describe the authentication policy element (AUTH_DATA) that's contained in the POLICY_DATA object 🔥 A user process can generate an AUTH_DATA policy element and hand it to the RSVP process (service) on the originating host. The RSVP service then inserts AUTH_DATA into the RSVP message, so the owner (user and/or application) making the request for network resources is identified 🦋 Network elements, such as routers, authenticate the request using the credentials presented in AUTH_DATA, and then admit the RSVP message based on admission policy. Once a request has been authenticated, the first hop router installs the RSVP state and forwards the new policy element that the Policy Decision Point (PDP) [POL-FRAME] returned. Main character energy, literally 👑
3. Policy Element for Authentication Data
Okay, this section is where the actual format lives 🧚
3.1 Policy Data Object Format
POLICY_DATA objects hold policy information, and RSVP messages carry them 💜 For a detailed description of the POLICY_DATA object format, check "RSVP Extensions for Policy Control" [POL-EXT] 🌸
3.2 Authentication Data Policy Element
In this section we describe a policy element (PE) called authentication data (AUTH_DATA) 🎀 The AUTH_DATA policy element holds a list of authentication attributes, and its layout looks like this:
+-------------+-------------+-------------+-------------+
| Length | P-Type = Identity Type |
+-------------+-------------+-------------+-------------+
// Authentication Attribute List //
+-------------------------------------------------------+Length: The length of the policy element is counted in octets, and it includes the Length and P-Type fields 📏 It MUST be a multiple of 4, and it marks where the authentication attribute list ends 🍓
P-Type (Identity Type): This is the type of identity info in the policy element, supplied as the policy element type (P-type) 💖 The Internet Assigned Numbers Authority (IANA) runs the registry for policy element types for identity, as described in [POL-EXT]. To start, the registry has these P-Types for identity:
1 AUTH_USER Authentication scheme to identify users
2 AUTH_APP Authentication scheme to identify
applicationsAuthentication Attribute List: Authentication attributes hold info that's specific to the authentication method and the type of AUTH_DATA ✨ This policy element is the thing that groups a whole collection of authentication attributes together 🫶
3.3 Authentication Attributes
Here's the big rule for attributes: they MUST be encoded as a multiple of 4 octets 🔥 Any attribute that isn't a multiple of 4 octets long MUST be padded out to a 4-octet boundary 🌈
+--------+--------+--------+--------+
| Length | A-Type |SubType |
+--------+--------+--------+--------+
| Value ...
+--------+--------+--------+--------+Length: The length field is two octets, and it shows the actual length of the attribute in octets, including the Length and A-Type fields 🦋 The length does NOT include any padding bytes added to the value field to make the attribute a multiple of 4 octets long. Bestie, don't count the padding 💅
A-Type: The authentication attribute type (A-Type) field is one octet. IANA runs the registry for A-Types, as described in section 9, IANA Considerations 🎀 To start, the registry has these A-Types:
1 POLICY_LOCATOR Unique string for locating the
admission policy (such as X.500 DN
described in [RFC 1779]).
2 CREDENTIAL User credential such as Kerberos
ticket, or digital certificate.
Application credential such as
application ID.
3 DIGITAL_SIGNATURE Digital signature of the
authentication data policy element.
4 POLICY_ERROR_OBJECT Detailed information on policy
failures.SubType: The authentication attribute sub-type field is one octet, and what the SubType means depends on the A-type 🧚
Value: The value field holds the attribute specific information 🍓
3.3.1 Policy Locator
POLICY_LOCATOR is used to find the admission policy for the user or application 🔍 A Distinguished Name (DN) is unique for each user or application, so a DN gets used as the policy locator. Iconic design choice 👑
+-------+-------+-------+-------+
| Length |A-Type |SubType|
+-------+-------+-------+-------+
| OctetString ...
+-------+-------+-------+--------Length: This is the length of the attribute, and it MUST be >= 4 ✨
A-Type: POLICY_LOCATOR 💖
SubType: These are the sub-types defined for POLICY_LOCATOR. IANA runs the registry for POLICY_LOCATOR sub-types, as described in section 9, IANA Considerations. To start, the registry has these sub-types:
1 ASCII_DN OctetString contains the X.500 DN as described
in the RFC 1779 as an ASCII string.
2 UNICODE_DN OctetString contains the X.500 DN described in
the RFC 1779 as an UNICODE string.
3 ASCII_DN_ENCRYPT OctetString contains the encrypted X.500
DN. The Kerberos session key or digital
certificate private key is used for encryption.
For Kerberos encryption the format is the same
as returned from gss_seal [RFC 1509].
4 UNICODE_DN_ENCRYPT OctetString contains the encrypted
UNICODE X.500 DN. The Kerberos session key or
digital certificate private key is used for
encryption. For Kerberos encryption the format
is the same as returned from gss_seal [RFC
1509].OctetString: This field contains the DN 🌸
3.3.2 Credential
CREDENTIAL shows the credential of the user or application that's being authenticated 🎀 For Kerberos authentication, the CREDENTIAL object contains the Kerberos session ticket. For public key based authentication, this field contains a digital certificate 🔐
Here's the CREDENTIAL attribute format. The fields go out from left to right 🦋
+-------+-------+-------+-------+
| Length |A-Type |SubType|
+-------+-------+-------+-------+
| OctetString ...
+-------+-------+-------+--------Length: This is the length of the attribute, and it MUST be >= 4 ✨
A-Type: CREDENTIAL 💅
SubType: IANA runs the registry for CREDENTIAL sub-types, as described in section 9, IANA Considerations. To start, the registry has these sub-types:
1 ASCII_ID OctetString contains user or application
identification in plain ASCII text string.
2 UNICODE_ID OctetString contains user or application
identification in plain UNICODE text string.
3 KERBEROS_TKT OctetString contains Kerberos ticket.
4 X509_V3_CERT OctetString contains X.509 V3 digital
certificate [X.509].
5 PGP_CERT OctetString contains PGP digital certificate.OctetString: This contains the user or application credential 🫶
3.3.3 Digital Signature
Okay bestie, the DIGITAL_SIGNATURE attribute MUST be the very last attribute in the attribute list 💅 It holds the digital signature of the AUTH_DATA policy element, and it signs everything in that policy element up to the DIGITAL_SIGNATURE itself 🔐 Which algorithm gets used? That depends on the authentication method named in the CREDENTIAL SubType field 🧚
Here's the format summary:
+-------+-------+-------+-------+
| Length |A-Type |SubType|
+-------+-------+-------+-------+
| OctetString ...
+-------+-------+-------+--------- Length: the length of the attribute, which MUST be >= 4.
- A-Type:
ti3 A-Type, which isDIGITAL_SIGNATURE🦋 - SubType: no sub types for DIGITAL_SIGNATURE are currently defined. This field MUST be set to
0🌸 - OctetString: contains the digital signature of the AUTH_DATA ✨
3.3.4 Policy Error Object
This attribute carries any specific policy control errors a node generates while processing or validating an Authentication Data Policy Element 🙈 When an RSVP policy node (a local policy decision point or a remote PDP) gets a request that fails policy control because of its Authentication Policy Element, it SHOULD add a POLICY_ERROR_CODE with more info about why the failure happened into the policy element. That then causes an appropriate PATH_ERROR or RESV_ERROR message to be generated, carrying the policy element and the right RSVP error code, and it gets sent back to the request's source 💌
The AUTH_DATA policy element in the PATH or RSVP message SHOULD not contain the POLICY_ERROR_OBJECT attribute. These only get inserted into PATH_ERROR and RESV_ERROR messages when they're generated by policy aware intermediate nodes 🫶
+----------+----------+----------+----------+
| Length | A-Type |SubType(0)|
+----------+----------+----------+----------+
| 0 (Reserved) | ErrorValue |
+----------+----------+----------+----------+
| OctetString ...
+----------+----------+----------+----------+- Length: the length of the attribute, which MUST be >= 8.
- A-Type:
POLICY_ERROR_CODE👑 - ErrorValue: a 32-bit bit code with the reason the policy decision point couldn't process the policy element. These values have been defined:
1 ERROR_NO_MORE_INFO No information is available.
2 UNSUPPORTED_CREDENTIAL_TYPE This type of credentials is
not supported.
3 INSUFFICIENT_PRIVILEGES The credentials do not have
sufficient privilege.
4 EXPIRED_CREDENTIAL The credential has expired.
5 IDENTITY_CHANGED Identity has changed.- OctetString: holds info from the policy decision point that MAY include extra details about the policy failure. For example, it could be a human-readable message in ASCII text 💜
4. Authentication Data Formats
Authentication attributes get grouped into a policy element to represent the identity credentials 🎀
4.1 Simple User Authentication
Okay so in simple user authentication, the user's login ID (plain ASCII or UNICODE text) gets encoded as a CREDENTIAL attribute. Here's what the simple user AUTH_DATA policy element looks like 🍓
+--------------+--------------+--------------+--------------+
| Length | P-type = AUTH_USER |
+--------------+--------------+--------------+--------------+
| Length |POLICY_LOCATOR| SubType |
+--------------+--------------+--------------+--------------+
| OctetString (User's Distinguished Name) ...
+--------------+--------------+--------------+--------------+
| Length |CREDENTIAL | ASCII_ID |
+--------------+--------------+--------------+--------------+
| OctetString (User's login ID) ...
+--------------+--------------+--------------+--------------+4.2 Kerberos User Authentication
Kerberos [RFC 1510] authentication uses a trusted third party, the Kerberos Distribution Center (KDC), to authenticate the user to a network server 🔥 It's assumed that a KDC is present, and that both the host and the verifier of the authentication info (router or PDP) implement Kerberos authentication 💖
Here's the Kerberos AUTH_DATA policy element:
+--------------+--------------+--------------+--------------+
| Length | P-type = AUTH_USER |
+--------------+--------------+--------------+--------------+
| Length |POLICY_LOCATOR| SubType |
+--------------+--------------+--------------+--------------+
| OctetString (User's Distinguished Name) ...
+--------------+--------------+--------------+--------------+
| Length | CREDENTIAL | KERBEROS_TKT |
+--------------+--------------+--------------+--------------+
| OctetString (Kerberos Session Ticket) ...
+--------------+--------------+--------------+--------------+4.2.1. Operational Setting using Kerberos Identities
An RSVP enabled host is set up to build and insert an AUTH_DATA policy element into its RSVP messages whenever it wants to use the Kerberos method (KERBEROS_TKT) 🧚 When an RSVP session starts up, the user application contacts the KDC to get a Kerberos ticket for the next network node or its PDP 🦋 A router generating an RSVP message does the same thing: it contacts the KDC for a Kerberos ticket for the next hop network node or its PDP 🌈 The identity of that PDP or next network hop can be statically configured, learned via DHCP, or kept in a directory service ✨ The Kerberos ticket then goes to the next network node (which may be a router or a host) inside an RSVP message. The KDC is used to validate the ticket and authenticate the user who sent the RSVP message 👑
4.3 Public Key based User Authentication
With public key based user authentication, a digital certificate is encoded as the user's credentials, and a digital signature is used to authenticate the user 🔐 Here's the public key user AUTH_DATA policy element:
+--------------+--------------+--------------+--------------+
| Length | P-type = AUTH_USER |
+--------------+--------------+--------------+--------------+
| Length |POLICY_LOCATOR| SubType |
+--------------+--------------+--------------+--------------+
| OctetString (User's Distinguished Name) ...
+--------------+--------------+--------------+--------------+
| Length | CREDENTIAL | SubType |
+--------------+--------------+--------------+--------------+
| OctetString (User's Digital Certificate) ...
+--------------+--------------+--------------+--------------+
| Length |DIGITAL_SIGN. | 0 |
+--------------+--------------+--------------+--------------+
| OctetString (Digital signature) ...
+--------------+--------------+--------------+--------------+4.3.1. Operational Setting for public key based authentication
Public key based authentication assumes the following:
- RSVP service requestors have a pair of keys (a private key and a public key) 🗝️
- The private key is secured with the user.
- Public keys are stored in digital certificates, and a trusted party, a certificate authority (CA), issues these digital certificates 📜
- The verifier (PDP or router) has the ability to verify the digital certificate ✅
The RSVP requestor uses its private key to generate the DIGITAL_SIGNATURE. User Authenticators (router or PDP) use the user's public key (stored in the digital certificate) to verify the signature and authenticate the user 💅
4.4 Simple Application Authentication
The application authentication method encodes the application identification, like an executable filename, as plain ASCII or UNICODE text 🎀
+----------------+--------------+--------------+--------------+
| Length | P-type = AUTH_APP |
+----------------+--------------+--------------+--------------+
| Length |POLICY_LOCATOR| SubType |
+----------------+--------------+--------------+--------------+
| OctetString (Application Identity attributes in
| the form of a Distinguished Name) ...
+----------------+--------------+--------------+--------------+
| Length | CREDENTIAL | ASCII_ID |
+----------------+--------------+--------------+--------------+
| OctetString (Application Id, e.g., vic.exe)
+----------------+--------------+--------------+--------------+5. Operation
Here's the big picture 🌸
+-----+ +-----+
| PDP |-------+ | PDP |
+-----+ | ................... +-----+
| : : |
+--------+ : Transit : +-------+
+----| Router |------: Network : -------| Router|--+
| +--------+ : : +-------+ |
| | :.................: | |
| | | |
Host A B C D
Figure 1: User and Application Authentication using AUTH_DATA PENetwork nodes (hosts or routers) generate AUTH_DATA policy elements, and what's inside depends on the identity type and the authentication method being used 🧚 These usually carry authentication credentials (a Kerberos ticket or a digital certificate) and policy locators (which can be the X.500 Distinguished Name of the user or network node, or application names) 💖 Network nodes generate an AUTH_DATA policy element containing the authentication identity when they make an RSVP request or forward an RSVP message ✨
Network nodes generate the user AUTH_DATA policy element using these rules:
- For unicast sessions, the user policy locator is copied from the previous hop. The authentication credentials are for the current network node identity.
- For multicast messages, the user policy locator is for the current network node identity. The authentication credentials are for the current network node.
Network nodes generate the application AUTH_DATA policy element using these rules:
- For unicast sessions, the application AUTH_DATA is copied from the previous hop.
- For multicast messages, the application AUTH_DATA is either the first application AUTH_DATA in the message or chosen by the PDP.
6. Message Processing Rules
6.1 Message Generation (RSVP Host) 🎀
okay bestie, so the RSVP host builds its message the normal way from [RFC2205], just with a few extra glow-ups ✨
- An RSVP message MAY contain multiple
AUTH_DATApolicy elements. 💖 - The authentication policy element (
AUTH_DATA) gets created, and itsIdentityTypefield is set to show the identity type inside the policy element. 🪪- The
DNgoes in as thePOLICY_LOCATORattribute. - Credentials, like a Kerberos ticket or a digital certificate, go in as the
CREDENTIALattribute.
- The
- The
POLICY_DATAobject (the one holding theAUTH_DATApolicy element) gets slotted into the RSVP message in the appropriate place. If anINTEGRITYobject isn't computed for the RSVP message, then anINTEGRITYobject SHOULD be computed for thisPOLICY_DATAobject, as described in [POL_EXT], and SHOULD be inserted as a Policy Data option. 🔐
6.2 Message Reception (Router) 🛣️
the router processes the RSVP message as [RFC2205] says, with a couple of tweaks:
- If the router is not policy aware, it SHOULD send the RSVP message to the PDP and wait for a response. If the router is policy unaware, it just ignores the policy data objects and keeps on processing the RSVP message. 🙈
- Reject the message if the response from the PDP is negative. 🚫
- Continue processing the RSVP message. ✅
6.3 Authentication (Router/PDP) 🕵️♀️
this is where the detective work happens 🔍
- Grab the
AUTH_DATApolicy element. Check the PE type field, and return an error if the identity type isn't supported. 🙅♀️ - Verify the user credential:
- Simple authentication: for example, get the user ID and validate it, or get the executable name and validate it. 🧾
- Kerberos: send the Kerberos ticket to the KDC to get the session key. Then use that session key to authenticate the user. 🎟️
- Public Key: check that the certificate was issued by a trusted Certificate Authority (CA), then authenticate the user or application by verifying the digital signature. 📜
7. Error Signaling 🚨
if the PDP fails to verify the AUTH_DATA policy element, it MUST return policy control failure (Error Code = 02) to the PEP. The error values are described in [RFC 2205] and [POL-EXT]. The PDP SHOULD also supply a policy data object containing an AUTH_DATA Policy Element with A-Type=POLICY_ERROR_CODE, which gives more details on the Policy Control failure (see section 3.3.4). The PEP will include this Policy Data object in the outgoing RSVP Error message. 😭
8. IANA Considerations 🗂️
following the policies in [IANA-CONSIDERATIONS], authentication attribute types (A-Type) in the range 0-127 are allocated through an IETF Consensus action. A-Type values between 128-255 are reserved for Private Use and are not assigned by IANA. 💅
following the same policies in [IANA-CONSIDERATIONS], POLICY_LOCATOR SubType values in the range 0-127 are allocated through an IETF Consensus action. POLICY_LOCATOR SubType values between 128-255 are reserved for Private Use and are not assigned by IANA. 🪄
and once more, with feeling, following the policies in [IANA-CONSIDERATIONS]: CREDENTIAL SubType values in the range 0-127 are allocated through an IETF Consensus action. CREDENTIAL SubType values between 128-255 are reserved for Private Use and are not assigned by IANA. 🌸
9. Security Considerations 🔐💀
this is the serious part, so listen up 👑
the whole point of this memo is to describe a mechanism for authenticating RSVP requests based on user identity in a secure manner. The RSVP INTEGRITY object protects the policy object carrying user identity information from security (replay) attacks. Put the AUTH_DATA policy element and the INTEGRITY object together, and you get a secure access control that enforces authentication based on both the identity of the user and the identity of the originating node. It's giving fortress 🏰
Simple authentication doesn't carry a credential that can be securely authenticated, so it's inherently less secure. 😬
The Kerberos authentication mechanism is reasonably well secured. 🎫
User authentication using a public key certificate is known to provide the strongest security. 🏆
10. Acknowledgments 🫶
we would like to thank Andrew Smith, Bob Lindell and many others for their valuable comments on this memo. they're literally the best 💜
11. References 📚
- [ASCII] Coded Character Set -- 7-Bit American Standard Code for Information Interchange, ANSI X3.4-1986.
- [IANA-CONSIDERATIONS] Alvestrand, H. and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 2434, October 1998.
- [POL-EXT] Herzog, S., "RSVP Extensions for Policy Control", RFC 2750, January 2000.
- [POL-FRAME] Yavatkar, R., Pendarakis, D. and R. Guerin, "A Framework for Policy-based Admission Control RSVP", RFC 2753, January 2000.
- [RFC 1510] Kohl, J. and C. Neuman, "The Kerberos Network Authentication Service (V5)", RFC 1510, September 1993.
- [RFC 1704] Haller, N. and R. Atkinson, "On Internet Authentication", RFC 1704, October 1994.
- [RFC 1779] Killie, S., "A String Representation of Distinguished Names", RFC 1779, March 1995.
- [RFC 2205] Braden, R., Zhang, L., Berson, S., Herzog, S. and S. Jamin, "Resource ReSerVation Protocol (RSVP) - Version 1 Functional Specification", RFC 2205, September 1997.
- [RFC 2209] Braden, R. and L. Zhang, "Resource ReSerVation Protocol (RSVP) - Version 1 Message Processing Rules", RFC 2209, September 1997.
- [UNICODE] The Unicode Consortium, "The Unicode Standard, Version 2.0", Addison-Wesley, Reading, MA, 1996.
- [X.509] Housley, R., Ford, W., Polk, W. and D. Solo, "Internet X.509 Public Key Infrastructure Certificate and CRL Profile", RFC 2459, January 1999.
- [X.509-ITU] ITU-T (formerly CCITT) Information technology - Open Systems Interconnection - The Directory: Authentication Framework Recommendation X.509 ISO/IEC 9594-8
12. Author Information 🖊️🦋
Satyendra Yadav
Intel, JF3-206
2111 NE 25th Avenue
Hillsboro, OR 97124
EMail: Satyendra.Yadav@intel.com
Raj Yavatkar
Intel, JF3-206
2111 NE 25th Avenue
Hillsboro, OR 97124
EMail: Raj.Yavatkar@intel.com
Ramesh Pabbati
Microsoft
1 Microsoft Way
Redmond, WA 98054
EMail: rameshpa@microsoft.com
Peter Ford
Microsoft
1 Microsoft Way
Redmond, WA 98054
EMail: peterf@microsoft.com
Tim Moore
Microsoft
1 Microsoft Way
Redmond, WA 98054
EMail: timmoore@microsoft.com
Shai Herzog
IPHighway, Inc.
55 New York Avenue
Framingham, MA 01701
EMail: herzog@iphighway.com13. Full Copyright Statement ⚖️
Copyright (C) The Internet Society (2000). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement 💜
Funding for the RFC Editor function is currently provided by the Internet Society. ✨
📦 where this page comes from
- ietf: rfc2752 2000-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms