RFC 3308
Layer Two Tunneling Protocol (L2TP) Differentiated Services Extension
RFC 3308 🎀
Okay bestie, this is the spec for adding DiffServ (differentiated services) support to L2TP, written by Calhoun, Luo, McPherson, and Peirce. It's a Standards Track doc from November 2002, published by the Network Working Group. It doesn't list anything it obsoletes or updates. 💅
Title: Layer Two Tunneling Protocol (L2TP) Differentiated Services Extension Authors: P. Calhoun (Black Storm Networks), W. Luo (Cisco Systems, Inc.), D. McPherson (TCB), K. Peirce (Malibu Networks, Inc.) Category: Standards Track Date: November 2002
Status of this Memo 📜
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice ©️
Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract 🌈
This doc is all about letting L2TP negotiate a desired Per Hop Behavior (PHB) code, both for the L2TP control connection and for each individual session inside an L2TP tunnel. 🫶
L2TP gives us a standard way to tunnel PPP packets, but ngl, the current spec has zero provisions for Differentiated Services (diffserv) on the control connection or on the data sessions after that. So there's literally no standard way inside L2TP to negotiate service discrimination. 😭
Table of Contents 📋
1. Specification of Requirements ............................... 2
2. Introduction ................................................ 2
3. Control Connection Operation ................................ 3
3.1. Control Connection DS AVP (SCCRQ, SCCRP) .................... 4
4. Session Operation ........................................... 4
4.1. Session DS AVP (ICRQ, ICRP, OCRQ, OCRP) ..................... 6
5. DS AVPs Correlation ......................................... 6
6. PHB Encoding ................................................ 6
7. DSCP Selection .............................................. 7
8. Packet Reordering and Sequence Numbers ...................... 7
9. Crossing Differentiated Services Boundaries ................. 7
10. IANA Considerations ......................................... 8
11. Security Considerations ..................................... 8
12. Acknowledgements ............................................ 8
13. References .................................................. 8
14. Authors' Addresses .......................................... 9
15. Full Copyright Statement .................................... 101. Specification of Requirements ✨
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC 2119]. 💖
Bestie, these are the BCP 14 words. Whenever they show up in capitals, they're doing real work, so read them carefully. 🔥
2. Introduction 🌸
Right now L2TP has no mechanism for supporting diffserv (DS) at all, which is kind of a major gap. This doc fills it by defining how L2TP can indicate a desired PHB code, as defined in [RFC 3140], to be associated with an L2TP control connection and with individual sessions inside an L2TP tunnel. 🦋
The actual bit interpretation of the DS field is out of scope here and was purposefully left out. This doc only cares about defining a uniform exchange and a subsequent mapping mechanism for the DS AVPs. It's giving focus. 💅
3. Control Connection Operation 🦋
As defined in [RFC 2661], a control connection runs in-band over a tunnel and controls the establishment, release, and maintenance of sessions and of the tunnel itself. So this doc adds a way to tell L2TP control messages apart from other packets. The thing we introduce for this is the Control Connection DS (CCDS) AVP. 🧚
When the CCDS AVP is present, it tells the peer (the LAC or the LNS) that the tunnel initiator wants both the tunnel initiator and the tunnel terminator to use the per-hop behavior(s) (PHB(s)) in the AVP's PHB code for every packet in the tunnel's control connection. A PHB is a description of the externally observable forwarding behavior of a DS node applied to a particular DS behavior aggregate, as defined in [RFC 2475]. The simplest example of a PHB is one that guarantees a minimal bandwidth allocation of a link to a behavior aggregate. 🍓
Now here's the flow. When the tunnel terminator gets a Start-Control-Connection-Request (SCCRQ) with the CCDS AVP in it, and it doesn't support the CCDS AVP, it MUST ignore the AVP and send an SCCRP to the tunnel initiator without the CCDS AVP. The tunnel initiator reads a missing CCDS AVP in the SCCRP as meaning the tunnel terminator can't support CCDS. 🙈
If the tunnel initiator gets an SCCRP with no CCDS AVP, even though its SCCRQ had one, and it still wants to keep setting up the tunnel, it sends an SCCCN. Otherwise, it sends a StopCCN to the tunnel terminator to end the connection. The StopCCN control message MUST contain the Result Code 8 that indicates CCDS AVP value (47) as the reason for sending the StopCCN. 💀
If the tunnel terminator does support CCDS, it SHOULD use the Host Name AVP embedded in the SCCRQ to consult its local policy, and to figure out whether that policy allows the requested PHB code on this control connection. If it's unwilling or unable to support the requested PHB code after checking local policy, the tunnel terminator MUST send an SCCRP control message containing a CCDS AVP with the value it is willing to use. If that CCDS AVP value matches the one in the SCCRQ, it means the requested PHB code is accepted. If the value is different, it acts as a counter-offer from the tunnel terminator. 👑
If the tunnel initiator gets an SCCRP with a CCDS AVP whose value is different from the one it requested in the SCCRQ, the tunnel initiator SHOULD check that PHB code against its own policy. If it's unwilling to use that value, the tunnel initiator MUST send a StopCCN control message containing the Result Code 8 that indicates CCDS AVP value (47) as the reason for sending the StopCCN. ✨
3.1. Control Connection DS AVP (SCCRQ, SCCRP) 🎀
The CCDS AVP is encoded as Vendor ID 0, and the Attribute Type is 47. 🌸
Each CCDS AVP is encoded like this:
Vendor ID = 0
Attribute = 47
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|H|0|0|0|0| Length | 0 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 47 | PHB Code |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+This AVP MAY be present in the following message types: SCCRQ and SCCRP. 🦋 This AVP MAY be hidden (the H-bit set to 0 or 1) and is optional (M-bit not set). The length (before hiding) of this AVP MUST be 8 octets. The encoding of the PHB code is described in Section 6. 🔥
4.1. Session DS AVP (ICRQ, ICRP, OCRQ, OCRP) ✨
okay bestie, so the SDS AVP is the session-level DS AVP 🎀 It's Vendor ID 0 with an Attribute Value of 48 💖
Each SDS AVP is encoded like this 👇
Vendor ID = 0
Attribute = 48 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|M|H|0|0|0|0| Length | 0 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 48 | PHB Code |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+This AVP MAY be present in the following message types: ICRQ, ICRP, OCRQ and OCRP 🦋 It MAY be hidden (the H-bit set to 0 or 1) and is optional (M-bit is not set 0) 🌸 The length (before hiding) of this AVP MUST be 8 octets, no exceptions 💅 And the PHB code encoding is explained in Section 6, so go check that out 🧚
5. DS AVPs Correlation ✨
okay so the CCDS AVP and the SDS AVP are totally independent of each other 🫶 The CCDS AVP is for signaling diffserv on the control connection between two L2TP peers, and the SDS AVP is for the data connection 💜 The PHB code signaled in one AVP SHOULD NOT have any implication on the PHB code signaled in the other AVP 🙈 Implementations MAY choose to implement either or both DS AVPs, and operations MAY choose to enable diffserv on either or both types of connections 🌈
6. PHB Encoding ✨
the PHB code is a left-justified 16-bit field, and it uses the Per Hop Behavior (PHB) encoding from [RFC 3140] 🍓 Note that [RFC 3140] and its successor are the ultimate authority on PHB encoding, so that's the source of truth 👑
Once an L2TP tunnel control connection or an individual L2TP session is up and using the right DS AVP from this document, both the LAC and the LNS MUST use their own PHB-to-DSCP mappings for their current DS domains 🔥 That's how they map the PHB to a DSCP and drop it in the DS field of the outer IP header on packets sent over that connection 💖
7. DSCP Selection ✨
the requirements or rules for each service and its DSCP mapping are set through administrative policy mechanisms 🎀 Those are totally outside the scope of this document, so don't look for them here 🙈
8. Packet Reordering and Sequence Numbers ✨
[RFC 2474] recommends that PHB implementations not cause reordering of packets within an individual connection 🦋 [RFC 3140] requires that a set of PHBs signaled using a single PHB ID MUST NOT cause additional packet reordering within an individual connection compared to using a single PHB 💅 Since the CCDS and SDS AVPs each contain one PHB ID, using diffserv PHBs under this specification should not cause additional packet reordering within an L2TP control or data connection ✨
Sequence numbers are required to be present in all control messages, and they're what give reliable delivery on the control connection, as defined in [RFC 2661] 🫶 Packet reordering is honestly as much about the network as it is about local traffic conditioning 😭 So the chance of it happening when you use the CCDS AVP is the same as when you don't 🌸 Data messages MAY use sequence numbers to reorder packets and detect lost packets 🧚
9. Crossing Differentiated Services Boundaries ✨
okay this part is so iconic 👑 An L2TP connection can cross an arbitrary number of DS domains, so signaling PHBs via L2TP is way better than signaling DSCPs 💖 Why? Because it keeps a consistent end-to-end differentiated service for the whole L2TP connection 🌈 As per [RFC 2983], the negotiated PHBs get mapped to locally defined DSCPs of the current DS domain at the tunnel ingress node 🦋 At the DS domain boundary nodes, the DSCPs can be rewritten in the DS field of the outer IP header, so the DSCPs always match whatever DS domain the packet is currently in ✨
So yeah, it's totally acceptable for the outermost DS field of packets arriving on a given control connection or session to NOT match the DSCP value the tunnel ingress node used 💅 That's just how it goes 🙃
10. IANA Considerations ✨
this document defines 2 L2TP Differentiated Services Extension AVPs 🎀 IANA assigned the value 47 to the "CCDS AVP" defined in section 5.1, and the value 48 to the SDS AVP defined in section 6.1 💜
IANA also assigned some L2TP Result Code values: 8 for disconnecting the control connection due to a mismatching CCDS value (StopCCN), and 12 for disconnecting the call due to a mismatching SDS value (CDN) 🔥
11. Security Considerations ✨
okay, serious moment 😭 This encoding by itself doesn't raise any security issues 🫶 But users of this encoding should know that modifying a DSCP MAY constitute theft or denial of service 💀 So protocols using this encoding MUST be adequately protected, no cap 🔥 No new security issues beyond the ones discussed in [RFC 2474] and [RFC 2475] are introduced here 🛡️
12. Acknowledgements ✨
huge thanks to David Black, W. Mark Townsley, Nishit Vasavada, Andy Koscinski and John Shriver for their review and insightful feedback 🫶💖
13. References ✨
[RFC 1661] Simpson, W., "The Point-to-Point Protocol (PPP)", STD 51, RFC 1661, July 1994. 🍓
[RFC 2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 🌸
[RFC 2474] Nichols, K., Blake, S., Baker, F. and D. Black "Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers", RFC 2474, December 1998. 🦋
[RFC 2475] Blake, S., Black, D., Carlson, Z., Davies, E., Wang, Z. and W. Weiss, "An Architecture for Differentiated Services", RFC 2475, December 1998. 💜
[RFC 2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G. and B. Palter, "Layer 2 Tunnel Protocol (L2TP)", RFC 2661, August 1999. 🧚
[RFC 2983] Black, D., "Differentiated Services and Tunnels", RFC 2983, October 2000. 🌈
[RFC 3140] Black, D., Brim, S., Carpenter, B. and F. Le Faucheur, "Per Hop Behavior Identification Codes", RFC 3140, June 2001. ✨
14. Authors' Addresses ✨
these are the people behind the spec, so here's where to find them 💅
Pat R. Calhoun
110 Nortech Parkway
San Jose, CA 95134-2307
Phone: +1 408.941.0500
EMail: pcalhoun@bstormnetworks.com
Wei Luo
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134
Phone: +1 408.525.6906
EMail: luo@cisco.com
Danny McPherson
TCB
Phone: +1 303.470.9257
EMail: danny@tcb.net
Ken Peirce
Malibu Networks, Inc.
1107 Investment Blvd, Suite 250
El Dorado Hills, CA 95762
Phone: +1 916.941.8814
EMail: Ken@malibunetworks.com15. Full Copyright Statement ✨
Copyright (C) The Internet Society (2002). All Rights Reserved. 💖
okay, the legal bit, but make it bestie-friendly 💅 You can copy this document and share it with anyone, and you can make derivative works that comment on or explain it, or help with implementing it. You can prepare, copy, publish and distribute those in whole or in part, with no restrictions of any kind, as long as the copyright notice and this paragraph stay on all such copies and derivative works 🎀 BUT the document itself may not be modified in any way. That means you can't remove the copyright notice or the references to the Internet Society or other Internet organizations, UNLESS it's needed to develop Internet standards, in which case you follow the copyright procedures defined in the Internet Standards process, or you're translating it into a language other than English 🌸
The limited permissions above are perpetual, and they won't be revoked by the Internet Society or its successors or assigns 🦋
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🙈
Acknowledgement
funding for the RFC Editor function is currently provided by the Internet Society 🫶
📦 where this page comes from
- ietf: rfc3308 2002-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms