RFC 3304

RFC 3304: Middlebox Communications (midcom) Protocol Requirements ✨

Okay bestie, this one is the midcom requirements doc 🎀. It's RFC 3304, an Informational document from August 2002, so it's a "here's what we need" guide and not an official standard. The authors are R. P. Swale (BTexact Technologies), P. A. Mart (Marconi Communications), P. Sijben (Lucent Technologies), and S. Brim and M. Shore (Cisco Systems). Nothing in the title block says it obsoletes or updates another RFC. 💅

Status of this Memo 🌸

This memo gives information to the Internet community. It is not an Internet standard of any kind. Anyone can distribute it, with no limits.

Copyright Notice 🦋

Copyright (C) The Internet Society (2002). All Rights Reserved.

Abstract 🍓

This doc lists the requirements the Middlebox Communication (midcom) protocol has to meet so that applications can influence the middlebox function. The requirements were written with a focus on network address translation and firewall middleboxes, so yes, NATs and firewalls are the main characters here 🔥.

1. Introduction ✨

So this doc is one of two that the midcom working group wrote to cover the requirements and framework for a protocol between middleboxes and "midcom agents." This one is the requirements part. [MCFW] is the context and framework part. It also has the terminology and definitions, so you should read the two together 🧚.

The requirements came from going through the midcom framework and pulling out every requirement that was there, both the ones stated outright and the ones implied 💜.

2. Requirements 💖

Each requirement is a statement, followed by a bit of explanation where it helps. Terminology is defined in [MCFW]. Requirements can overlap with each other, which is totally normal 🫶.

2.1. Protocol machinery ⚙️

2.1.1.

The Midcom protocol must enable a Midcom agent that needs a middlebox's services to set up an authorized association between itself and the middlebox.

This means the protocol has to let the middlebox identify an agent that's asking for services, and then decide whether that agent is allowed to get them 🔐.

2.1.2.

The Midcom protocol must allow a Midcom agent to talk to more than one middlebox at the same time.

Unless the network is super simple, an agent will probably want to influence more than one middlebox. The protocol design must not rule that out 🌈.

2.1.3.

The Midcom protocol must allow a middlebox to talk to more than one Midcom agent at the same time.

There can be several instances of one application, or several different applications, that all want service from the same middlebox, and different agents might be speaking for each of them. The protocol design must not rule that out either 👑.

2.1.4.

Where several Midcom agents are interacting with a given middlebox, the Midcom protocol must provide mechanisms ensuring that the overall behavior is deterministic.

This means the protocol needs ways to avoid race conditions and other messy situations where one agent's requests could change the results of another agent's requests in a way nobody can predict 😭.

2.1.5.

The Midcom protocol must enable the middlebox and any associated Midcom agents to establish a known and stable state. This must include the case of power failure, or other failure, where the protocol must ensure that any resources used by a failed element can be released.

This states that the protocol must provide clear identification for requests and results, and that protocol operations must be atomic with respect to the midcom protocol. So even if something crashes, everyone should know where they stand and nothing should be left hanging 🧹.

2.1.6.

The middlebox must be able to report its status to a Midcom agent with which it is associated.

2.1.7.

The protocol must support unsolicited messages from middlebox to agent, for reporting conditions detected asynchronously at the middlebox.

Here's the tea: exceptional conditions or other events at the middlebox, like resource shortages or intrusion mitigation, may make it close pinholes or release resources without checking with the associated Midcom agent first. When that happens, the protocol must let the middlebox tell the agent about it 🚨.

2.1.8.

The Midcom protocol must provide for the mutual authentication of Midcom agent and middlebox to one another.

Besides the obvious need for the Midcom agent to authenticate itself to the middlebox, there are some attacks on the protocol that can be mitigated by having the middlebox authenticate to the agent too. See [MCFW] 🛡️.

2.1.9.

The Midcom protocol must allow either the Midcom agent or the middlebox to terminate the Midcom session between a Midcom Agent and a middlebox.

This lets either side close the session for maintenance, security, or other reasons. Both sides get the power to hang up 📞.

2.1.10.

A Midcom agent must be able to determine whether or not a request was successful.

This states that a middlebox must return a success or failure indication to a request made by an agent ✅.

2.1.11.

The Midcom protocol must contain version interworking capabilities to enable subsequent extensions to support different types of middlebox and future requirements of applications not considered at this stage.

We assume there will be later revisions of this protocol. The initial version focuses on communication with firewalls and NATs, and the protocol may need changes as support for other middlebox types gets added. These version interworking capabilities may include (but are not limited to) a protocol version number 🔢.

2.1.12.

It must be possible to deterministically predict the behavior of the middlebox in the presence of overlapping rules.

The protocol must rule out nondeterministic behavior when rulesets overlap, for example by making sure some known precedence is applied 📏.

2.2. Midcom Protocol Semantics 🧠

2.2.1.

The syntax and semantics of the Midcom protocol must be extensible to allow the requirements of future applications to be adopted.

This is related to versioning support, but it's a different thing. As support for more middlebox types gets added, the protocol might need new message types 🧩.

2.2.2.

The Midcom protocol must support the ability of an agent to install a ruleset that governs multiple types of middlebox actions (e.g. firewall and NAT).

This states that the protocol must support rules and actions for a variety of middlebox types. A Midcom agent ought to be able to have a single Midcom session with a middlebox and use that one Midcom interface to reach different middlebox functions on the same box 🎯.

2.2.3.

The protocol must support the concept of a ruleset group comprising a multiple of individual rulesets to be treated as an aggregate.

Applications that use more than one data stream may find it easier and more efficient to tear down, extend, and manipulate all the middlebox rulesets used by one instance of the application with single messages 🍭.

2.2.4.

The protocol must allow the midcom agent to extend the lifetime of an existing ruleset that otherwise would be deleted by the middlebox.

2.2.5.

If a peer does not understand an option, it must be clear whether the action required is to proceed without the unknown attribute being taken into account or the request is to be rejected. Where attributes may be ignored if not understood, a means may be provided to inform the client about what has been ignored.

This states that failure modes must be robust, giving the agent or middlebox enough information to deal with the failure or to retry with a new option that's more likely to work 🔁.

2.2.6.

To enable management systems to interact with the Midcom environment, the protocol must include failure reasons that allow the Midcom Agent behavior to be modified as a result of the information contained in the reason. Failure reasons need to be chosen such that they do not make an attack on security easier.

Failure reasons are useful, but they can't hand attackers a helpful hint 🤫.

2.2.7.

The Midcom protocol must not preclude multiple authorized agents from working on the same ruleset.

2.2.8.

The Midcom protocol must be able to carry filtering rules, including but not limited to the 5-tuple, from the midcom agent to the middlebox.

By "5-tuple", we mean the standard <source address, source port, destination address, destination port, transport protocol> tuple. Other filtering elements may be carried as well 🎀.

2.2.9.

When the middlebox performs a port mapping function, the protocol should allow the Midcom agent to request that the external port number have the same oddity as the internal port.

This requirement supports the RTP and RTCP [RFC1889] "oddity" requirements 🎶.

2.2.10.

When the middlebox performs a port mapping function, the protocol should allow the Midcom agent to request that a consecutive range of external port numbers be mapped to consecutive internal ports. This requirement supports the RTP and RTCP "sequence" requirements 🔢.

2.2.11.

It should be possible to define rulesets that contain a more specific filter spec than an overlapping ruleset. This should allow agents to request actions for the subset that contradict those of the overlapping set.

This should allow a Midcom agent to ask a Midcom server controlling a firewall function that a subset of the traffic the overlapping ruleset would allow gets specifically disallowed 🚫.

2.3. General Security Requirements 🔒

2.3.1.

The Midcom protocol must provide for message authentication, confidentiality, and integrity.

2.3.2.

The Midcom protocol must allow for optional confidentiality protection of control messages. If provided, the mechanism should allow a choice in the algorithm to be used.

2.3.3.

The Midcom protocol must operate across un-trusted domains, between the Midcom agent and middlebox in a secure fashion.

2.3.4.

The Midcom protocol must define mechanisms to mitigate replay attacks on the control messages.

Security is the whole vibe here, bestie. Every one of these requirements is about keeping agents, middleboxes, and control messages safe, so none of them can be skipped 💀🔐.

3. Intellectual Property ✨

okay so the IETF is not picking a side here 💅 It takes no position on whether any intellectual property or other rights someone claims over the tech in this doc are valid or how far they reach, and it's not saying anyone went hunting for those rights either 🙈 If a license might or might not be available, that's between you and the rights holder. The IETF's rules about rights in standards-track and standards-related docs live in BCP-11. Claims of rights that were filed for publication, any promises to license, and results of any attempt to get a general license or permission for implementers or users of this spec can all be requested from the IETF Secretariat 🎀

bestie, the IETF also wants you to tell them about any copyrights, patents, patent applications, or other proprietary rights that might cover tech you'd need to implement this standard 🦋 Send that info to the IETF Executive Director 💜

4. Security Considerations 🔐

this section is short but it's giving SERIOUS energy 😭 The security requirements for a midcom protocol are discussed in section 2.3. Go back and read it, it's the real tea 🫶

5. Normative References 📚

[MCFW]    Srisuresh, S., Kuthan, J., Rosenberg, J., Molitor, A. and
          A.  Rayhan, "Middlebox communication architecture and
          framework", RFC 3303, Date.*

[RFC1889] Schulzrinne, H., Casner, S., Frederick, R. and V. Jacobson,
          "RTP: A Transport Protocol for Real-Time Applications", RFC
          1889, January 1996.

6. Informative References 🧚

[RFC2026] Bradner, S. "The Internet Standards Process -- Revision 3",
          BCP 9, RFC 2026. October 1996.

Authors' Addresses 💌

the squad behind this doc, all in one place bc they deserve the shoutout 🌈

Richard Swale
BTexact Technologies
Callisto House
Adastral Park
Ipswich United Kingdom
EMail:  richard.swale@bt.com

Paul Sijben
Lucent Technologies EMEA BV
Huizen
Netherlands
EMail: paul.sijben@picopoint.com

Philip Mart
Marconi Communications Ltd.
Edge Lane
Liverpool
United Kingdom
EMail: philip.mart@marconi.com

Scott Brim
Cisco Systems
146 Honness Lane
Ithaca, NY 14850
EMail: sbrim@cisco.com

Melinda Shore
Cisco Systems
809 Hayts Road
Ithaca, NY 14850
EMail: mshore@cisco.com

Full Copyright Statement ⚖️

Copyright (C) The Internet Society (2002). All Rights Reserved.

okay the legal part, and yes it matters 🙈 This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

the permissions above are perpetual and will not be revoked by the Internet Society or its successors or assigns 💖

and this one is in all caps for a reason 📢 This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🌸

funding for the RFC Editor function is currently coming from the Internet Society, so a big thank you to them 🫶

---

the end, bestie! you made it through the whole RFC 3304 🎀✨