RFC 3620
The TUNNEL Profile
RFC 3620: The TUNNEL Profile 🎀
Network Working Group 💖 Request for Comments: 3620 ✨ Author: D. New 🦋 Date: October 2003 🌸 Category: Standards Track 👑
Status of this Memo
Okay so this doc is an Internet standards track protocol for the whole Internet community, and it's literally asking for discussion and suggestions for improvements 💅. If you want the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 📚. Distribution of this memo is unlimited 🌈.
Copyright Notice
Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract
Bestie, this memo is about a Blocks Extensible Exchange Protocol (BEEP) profile where a BEEP peer can act as an application-layer proxy 🧚. Basically, authorized users can reach services through a firewall, and it's giving main character energy 💖.
Table of Contents
1. Rationale . . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1 One-Hop Example. . . . . . . . . . . . . . . . . . . . . . 3
2.2 Two-Hop Example. . . . . . . . . . . . . . . . . . . . . . 4
2.3 Failed Set-Up Example. . . . . . . . . . . . . . . . . . . 5
2.4 Non-BEEP Example . . . . . . . . . . . . . . . . . . . . . 5
2.5 Profile Example. . . . . . . . . . . . . . . . . . . . . . 6
2.6 Endpoint Example . . . . . . . . . . . . . . . . . . . . . 8
3. Message Syntax. . . . . . . . . . . . . . . . . . . . . . . . 9
4. Message Semantics . . . . . . . . . . . . . . . . . . . . . . 10
5. Provisioning . . . . . . . . . . . . . . . . . . . . . . . . . 12
6. Reply Codes. . . . . . . . . . . . . . . . . . . . . . . . . . 13
7. Security Considerations. . . . . . . . . . . . . . . . . . . . 14
8. Normative References . . . . . . . . . . . . . . . . . . . . . 15
A. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16
A.1 Registration: BEEP Profile . . . . . . . . . . . . . . . . 16
A.2 Registration: A System (Well-Known) TCP
port number for TUNNEL . . . . . . . . . . . . . . . . . . 16
B. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 17
Author's Address . . . . . . . . . . . . . . . . . . . . . . . 17
Full Copyright Statement . . . . . . . . . . . . . . . . . . . 181. Rationale ✨
So the TUNNEL profile gives cooperating BEEP peers a way to form an application-layer tunnel 🫶. The peers swap "tunnel" elements that spell out a source route. The outermost element gets stripped off and used to pick the next hop, and the innermost, empty "tunnel" element tells the final destination that yes, it really is the final destination 💅. Any BEEP peer that isn't the initiator or the final destination gets called a "proxy" 🌸.
Here's one way this profile gets used: a BEEP peer running TUNNEL sits right next to a firewall 🔥. An initiating machine inside the firewall connects to the proxy, then asks that proxy to connect to an endpoint outside the firewall. Once that connection is up, the proxy tells the outside endpoint that it's about to tunnel. If the outside machine agrees, the proxy "gets out of the way" and just passes octets along transparently 🦋. Then both the initiating and terminating machines do a "tuning reset," kind of like how starting a TLS negotiation throws away cached session state and starts fresh 🌈.
Another use is limiting connections to outside servers based on the user identity negotiated through SASL 🔐. For example, a manager connects to a proxy, logs in with SASL, then tells the proxy to tunnel to an information service that's only for managers 👑. Since each proxy knows who the next proxy is being asked to reach, it can refuse to tunnel if not enough authorization has been set up 💀. You can also use TUNNEL to hide the true source of a BEEP connection, kind of like how a NAT translates IP addresses 🙈. Detailed discussion of those uses is out of scope for this doc though, so we're not going there today 🧚.
Once both endpoint machines are connected, the tunneling proxy doesn't interpret the data anymore 😭. In particular, it does not look for any BEEP framing. That means the two endpoints can negotiate TLS between themselves, using certificates that belong to the endpoints instead of the proxy, and the assurance is that even the proxy can't access the information being exchanged 🔒✨.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [1]. 💖
2. Examples 🦋
Okay, the semantics in Section 4 might look complicated, but the results are actually pretty simple 🍓. A few examples will show how this profile works and how it gets used 💅. In these examples, the machine trying to set up the connection is called "initial". The intermediate proxies are "proxy1" or "proxy2", and the machine hosting the service that "initial" wants is called "final". The examples also assume that the BEEP framework [2] runs on top of TCP [3], or on some other mapping where one transport connection carries all channels 🌸.
2.1 One-Hop Example 🎀
Let's start with a simple one-hop connection going through a single proxy 💖.
initial proxy1 final
----- xport connect ----->
<------- greeting -------->
--- start TUNNEL [1] ---->
----- xport connect ------>
<-------- greeting -------->
---- start TUNNEL [2] ---->
<---------- ok ------------
<------- ok -------------- [3]
<------------- greeting [4]-------------------------->Notes:
[1] The TUNNEL element looks like this:
<tunnel fqdn='final.example.com' port='604'>
<tunnel/>
</tunnel>[2] The TUNNEL element looks like this:
<tunnel/>[3] At this point, right after sending the <ok/> element, proxy1 starts passing octets transparently 🦋. It keeps doing that until either transport connection gets closed, and then it closes the other one too 💀.
[4] This greeting may include the TLS profile 🔐. That lets initial and final talk to each other without proxy1 understanding or interfering, and without getting caught 🙈.
2.2 Two-Hop Example 🧚
The second example shows the initiator connecting to its proxy, that proxy connecting to another proxy, and then that second proxy finding a service outside 🌈.
initial proxy1 proxy2 final
--- xport connect -->
<---- greeting ------>
--start TUNNEL [1]-->
-- xport connect --->
<----- greeting ----->
--start TUNNEL [2]-->
--- xport connect --->
<------- greeting ----->
---start TUNNEL [3]--->
<-------- ok ----------
<------- ok --------- [4]
<------- ok --------- [5]
<-------------------------- greeting ---------------------------->Notes:
[1] The TUNNEL element looks like this:
<tunnel fqdn='proxy2.example.com' port='604'>
<tunnel fqdn='final.example.com' port='10290'>
<tunnel/>
</tunnel>
</tunnel>[2] The TUNNEL element looks like this:
<tunnel fqdn='final.example.com' port='10290'>
<tunnel/>
</tunnel>[3] The TUNNEL element looks like this:
<tunnel/>[4] Proxy2 starts passing octets transparently after sending the <ok/> 🎀.
[5] Proxy1 starts passing octets transparently after sending the <ok/> 💖.
2.3 Failed Set-Up Example 💀
The third example shows the initiator connecting through two proxies 🙃. The second proxy tries to connect to the requested service and finds out that the destination is not a BEEP server. (Of course, asking for the telnet service is going to lead to this error 😭.) The same thing would happen if the destination didn't support the TUNNEL profile 🫠.
initial proxy1 proxy2 final
--- xport connect -->
<---- greeting ------>
--start TUNNEL [1]-->
--- xport connect -->
<----- greeting ----->
--start TUNNEL [2]-->
---- xport connect --->
<------- login: -------
----- xport close ---->
<---- <error> -------
--- xport close ---->
<---- <error> ------
--- xport close ---> [3]Notes:
[1] The TUNNEL element looks like this:
<tunnel fqdn='proxy2.example.com' port='604'>
<tunnel fqdn='final.example.com' srv='_telnet._tcp'>
<tunnel/>
</tunnel>
</tunnel>[2] The TUNNEL element looks like this:
<tunnel fqdn='final.example.com' srv='_telnet._tcp'>
<tunnel/>
</tunnel>[3] This close is optional 🌸. "Initial" may also send another <tunnel> element, for example to try contacting a different server ✨.
2.4 Non-BEEP Example 🌈
This example also has the initiator connecting through two proxies 🍓. This time, the second proxy tries to connect to the specified service and accepts that the destination isn't a BEEP server. At the protocol level there are two differences. First, the "initial" machine doesn't include the innermost "tunnel" element. Second, the final proxy ("proxy2") therefore doesn't expect a BEEP greeting 🧚.
initial proxy1 proxy2 final
--- xport connect -->
<---- greeting ------>
--start TUNNEL [1]-->
--- xport connect -->
<----- greeting ----->
--start TUNNEL [2]-->
---- xport connect --->
<------- login: -------
<------ <ok> ------- [3]
<----- login: ------ [4]
<------ <ok> --------- [3]
<----- login: -------- [4] [5]Notes:
[1] The TUNNEL element looks like this:
<tunnel fqdn='proxy2.example.com' port='604'>
<tunnel fqdn='final.example.com' svc='_telnet._tcp'>
</tunnel>
</tunnel>Note the lack of an innermost no-attribute <tunnel> element 👀.
[2] The TUNNEL element looks like this:
<tunnel fqdn='final.example.com' srv='_telnet._tcp'>
</tunnel>Note the lack of an innermost no-attribute <tunnel> element 👀.
[3] Each proxy starts forwarding octets transparently after this <ok> 🦋.
[4] Each proxy forwards any data it gets from the final host, even if that data showed up before the <ok> was sent 💖.
[5] After receiving the "ok" message, the "initial" peer can expect raw, non-BEEP data to be sent to and received from the "final" machine 🌸.
2.5 Profile Example 🎀
okay so this one shows the initiator connecting through two proxies 🧚 the starting machine knows there's a server offering the SEP2 profile somewhere past proxy1, but it doesn't need to know where. proxy1 has been locally configured to know that all SEP2 servers are past proxy2, and proxy2 has been locally configured to pick "final" as its server of choice for SEP2 services. ngl this is so organized 💅 also "final" doesn't necessarily have to offer the requested profile in its very first greeting.
initial proxy1 proxy2 final
--- xport connect -->
<---- greeting ------>
--start TUNNEL [1]-->
-- xport connect --->
<----- greeting ----->
--start TUNNEL [2]-->
--- xport connect --->
<------- greeting ----->
---start TUNNEL [3]--->
<-------- ok ----------
<------- ok --------- [4]
<------- ok --------- [5]
<-------------------------- greeting ---------------------------->Notes:
[1] 🌸 the TUNNEL element looks like this:
<tunnel profile="http://xml.resource/org/profiles/SEP2"/>notice there's no innermost no-attribute <tunnel> element in this one 👀
[2] 💖 proxy1 turns that into this, based on its local config:
<tunnel fqdn="proxy2.example.com" port="604">
<tunnel profile="http://xml.resource/org/profiles/SEP2"/>
</tunnel>then it processes the new element, strips off the outer element, and routes this to proxy2:
<tunnel profile="http://xml.resource/org/profiles/SEP2"/>[3] ✨ proxy2 gets the TUNNEL element with just the SEP2 URI in it. local provisioning maps that to:
<tunnel fqdn='final.example.com' srv='_beep._tcp'>
<tunnel/>
</tunnel>this time there IS an innermost no-attribute <tunnel> element. proxy2 then strips the outermost element, looks up the right address and port, and forwards the <tunnel/> element on to the final machine 🦋
[4] 🫶 proxy2 starts transparently forwarding octets right after this <ok>.
[5] 🔥 proxy1 starts transparently forwarding octets right after this <ok>.
2.6 Endpoint Example 🌈
this one is giving déjà vu, but with a twist 🙈 it's still two proxies. the starting machine knows there's a server called "operator console" somewhere past proxy1, and it doesn't need to know where. proxy1 is locally configured to know that "operator console" is past proxy2, and proxy2 is locally configured to use "final" as "operator console". it's almost identical to the last example, except "endpoint" is meant to route to a particular server, while "profile" is meant to route to a particular service. other than that they're basically twins 👯♀️
initial proxy1 proxy2 final
--- xport connect -->
<---- greeting ------>
--start TUNNEL [1]-->
-- xport connect --->
<----- greeting ----->
--start TUNNEL [2]-->
--- xport connect --->
<------- greeting ----->
---start TUNNEL [3]--->
<-------- ok ----------
<------- ok --------- [4]
<------- ok --------- [5]
<-------------------------- greeting ---------------------------->Notes:
[1] 💜 the TUNNEL element looks like this:
<tunnel endpoint="operator console">
</tunnel>no innermost no-attribute <tunnel> element here either 🙃
[2] 🍓 proxy1 maps it to this, based on local configuration:
<tunnel fqdn="proxy2.example.com" port="604">
<tunnel endpoint="operator console">
</tunnel>
</tunnel>then it processes the new element, strips the outer element, and routes this to proxy2:
<tunnel endpoint="operator console">
</tunnel>[3] 🧚 proxy2 receives the TUNNEL element with just the endpoint specified. local provisioning maps that to:
<tunnel fqdn='final.example.com' srv='_beep._tcp'>
<tunnel/>
</tunnel>the innermost no-attribute <tunnel> element is back. proxy2 strips the outermost element, looks up the address and port, and forwards the <tunnel/> element to the final machine ✨
[4] 🎀 proxy2 starts transparently forwarding octets after this <ok>.
[5] 🌸 proxy1 starts transparently forwarding octets after this <ok>.
3. Message Syntax ✨
the only element defined in this profile is the "tunnel" element 💖 it's described in the DTD below, plus some extra limitations we'll get to after.
<!--
DTD for the TUNNEL Profile, as of 2001-02-03
Refer to this DTD as:
<!ENTITY % TUNNEL PUBLIC "-//IETF//DTD TUNNEL//EN" "">
%TUNNEL;
-->
<!--
TUNNEL messages
role MSG RPY
====== === ===
I or L TUNNEL +: ok
-: error
-->
<!ELEMENT tunnel (tunnel?)>
<!ATTLIST tunnel
fqdn CDATA #IMPLIED
ip4 CDATA #IMPLIED
ip6 CDATA #IMPLIED
port CDATA #IMPLIED
srv CDATA #IMPLIED
profile CDATA #IMPLIED
endpoint CDATA #IMPLIED
>okay so the formats 🎀 the "fqdn" attribute is a fully qualified domain name, like "proxy.example.com". the "ip4" attribute is four sets of decimal numbers separated by periods, like "10.23.34.45". the "ip6" attribute follows what's specified in RFC2373 [4]. the "port" attribute is a decimal number from one to 65535, inclusive. the "srv" attribute is a pair of identifiers that each start with an underline and are separated by a period, like "_sep._tcp". the "profile" attribute is a URI [5]. and the "endpoint" attribute can be any string that's allowed as an attribute value 🦋
the only allowed combinations of attributes are these:
- fqdn + port;
- fqdn + srv;
- fqdn + srv + port;
- ip4 + port;
- ip6 + port;
- profile, but only on the innermost element;
- endpoint, but only on the innermost element; or,
- no attributes, but only on the innermost element.
4. Message Semantics 💅
when a TUNNEL channel starts, the listener expects a "tunnel" element from the initiator. it can show up in the "start" element on channel zero, or on the new channel that was created. as usual, if it arrives on channel zero, it gets processed before the reply is sent back 🔥
either way, the outermost "tunnel" element gets examined first. if it has no attributes, then this peer is hosting the BEEP service the initiator wants to use. in that case the listener does a tuning reset, which means:
- all channels, including channel zero, are implicitly closed.
- any previously cached information about the BEEP session is discarded.
- a new plaintext greeting is sent.
if the outermost element has a "port" attribute and an "fqdn" attribute but no "srv" attribute, then "fqdn" gets looked up as an A record via DNS so it can be translated to an IP number. an "ip4" attribute is read as the dotted-quad form of an IPv4 address, and an "ip6" attribute is read as a text representation of an IPv6 address. in each of those cases, a transport connection is set up to the server that was identified 🌸 if the outermost element has a "srv" attribute, then the "srv" value and the "fqdn" value get joined with a period in between and looked up in DNS for a SRV record [6], and the appropriate server is contacted. if that lookup fails and a "port" attribute is present, the connection is attempted as if the "srv" attribute had not been specified.
alternatively, if the outermost element has a "profile" attribute, then it must have no nested elements. the proxy processing this element is responsible for working out the right route to reach a peer that serves the BEEP profile named by the URI in the attribute's value. instead of source routing, this gives you a hop-by-hop routing mechanism to a desired service 🧚
similarly, if the outermost element has an "endpoint" attribute, then it must have no nested elements. the proxy processing this element is responsible for working out the right route to reach a peer indicated by the value of the "endpoint" attribute. again, instead of source routing, this is a hop-by-hop routing mechanism, this time to a desired machine. there are no restrictions on how machines get identified 💜
then, if the outermost element has no nested elements but does have attributes other than "profile" or "endpoint", this peer is the final BEEP hop. (this corresponds to "proxy2" in the "Non-BEEP" example above.) in this case, as soon as the final underlying transport connection is established, an "ok" element is returned over the listening session, and the tunneling of data begins. no BEEP greeting (or really any data) from the final hop is expected. starting with the octet right after the END(CR)(LF) trailer of the frame with the completion flag set (more=".") of the RPY carrying the "ok" element, the proxy copies octets directly between the two underlying transport connections, without any interpretation at all 🫶
if the identified server can't be contacted, an "error" element is returned over the listening channel, and any connection set up as an initiator gets closed. if there's a nested "tunnel" element, and the server that was contacted either doesn't offer a BEEP greeting, or offers one that doesn't include the TUNNEL profile, then that's treated as an error too 💀 the initiating transport connection is closed, and an error is returned.
if there's a nested "tunnel" element, and the identified server is contacted and offers a BEEP greeting that includes the TUNNEL profile, then the outermost element from the received "tunnel" element gets stripped off. a new TUNNEL channel is started on the initiating session, and the stripped (inner) element is sent to start the next hop. in this case, the peer is considered a "proxy" (meaning the next paragraph applies) 🍓
once the proxy has passed the "tunnel" element on the TUNNEL channel, it waits for an "error" or an "ok" element in response. if it gets an "error" element, it closes the initiated session and its underlying transport connection, then passes the "error" element back unchanged on the listening session. if it gets an "ok" element instead, it passes the "ok" element back on the listening session. starting with the octet right after the END(CR)(LF) trailer of the frame with the completion flag set (more=".") of the RPY carrying the "ok" element, the proxy copies octets directly between the two underlying transport connections, with no interpretation 🌈
5. Provisioning 🎀
okay so BEEP Framework [2] is what we're using here, and the attributes described are enough for the TCP mapping [3] of BEEP 🦋 the tunnel element's attributes might need some extra love later if we want to handle other transport layers, but for now we're good!
okay this part is so important bestie 😭 if you're using a mapping with multiple underlying transport connections, once the ok element gets passed, ALL channels get closed, including channel zero 💀 so the only connection left is the one that was originally set up, and every other underlying transport connection for the session should be closed too 🌸
ALSO 🚨 if a transport security layer (like TLS) got negotiated over the session, the TUNNEL profile semantics are ill-defined (bestie, that's a whole mess). so the TUNNEL profile MUST NOT be advertised in any greetings after transport security has been negotiated 🙅♀️💅
the IANA reserved an SRV identifier of _tunnel for this profile 🧚 so the srv attribute _tunnel._tcp MAY be used as a default for finding the right address when you're tunneling into a particular domain. it's giving convenience!
and the IANA allocated system port number 604 for TUNNEL 🍓
6. Reply Codes 💜
this section lists the three-digit error codes the TUNNEL profile may generate. here's the whole vibe check:
code meaning
==== =======
421 Service not available
(E.g., the proxy does not have sufficient resources.)
450 Requested action not taken
(E.g., DNS lookup failed or connection could not
be established. See too 550.)
500 General syntax error (E.g., poorly-formed XML)
501 Syntax error in parameters
(E.g., non-valid XML, letters in "ip4" attribute, etc.)
504 Parameter not implemented
530 Authentication required
534 Authentication mechanism insufficient
(E.g., too weak, sequence exhausted, etc.)
537 Action not authorized for user
538 Encryption already enabled
(E.g., TLS already negotiated, or a SASL that
provides encryption already negotiated.)
550 Requested action not taken
(E.g., next hop could be contacted, but
malformed greeting or no TUNNEL profile advertised.)
553 Parameter invalid
554 Transaction failed (E.g., policy violation)okay the 450 vs 550 thing is SO important, don't mix them up 😤 450 is for when the destination machine could NOT be contacted, and 550 is for when the destination machine COULD be contacted but the next phase of the protocol couldn't be negotiated 🫶 also it's suggested that the beginning of any reply from the destination machine gets included in the CDATA text of the error element, for debugging. future you will thank you 🙏✨
7. Security Considerations 🔥
okay this one is serious, so buckle up 🫶 the TUNNEL profile is a profile of BEEP. in BEEP, transport security, user authentication, and data exchange are orthogonal (fancy word, just means they're independent of each other 💅). refer to Section 8 of [2] for the full discussion.
BUT 🚨 the whole point of TUNNEL is to allow bidirectional contact between two machines that are normally separated by a firewall. since TUNNEL lets that connection happen between BEEP peers, and BEEP peers can offer a range of services with appropriate greetings, the TUNNEL profile should be configured with care 👀 it's reasonable to strictly limit the hosts and services a proxy is allowed to contact. it's also reasonable to limit use of the TUNNEL profile to authorized users, as identified by a SASL profile. main character security energy 👑
negotiating a TLS profile in an end-to-end manner after a TUNNEL has been established will stop intermediate proxies from observing or modifying the cleartext info exchanged... but ONLY if TLS certificates are properly configured during the negotiation 😭 otherwise the proxy could mount a "man in the middle" attack if public key infrastructure isn't deployed. not it 💀
in some environments, it's undesirable to expose the names of machines on one side of a firewall in unencrypted messages on the other side. so here's the trick 🦋 source routing (using the fqdn, ip4, ip6, port and srv attributes) can route a connection to the firewall proxy, with an innermost profile or endpoint attribute that the firewall proxy understands. local provisioning can let a proxy translate a particular profile or endpoint element into a new source route to reach the desired service. this can prevent two attacks:
- Attackers sniffing packets on one side of the firewall cannot see IP addresses or FQDNs of machines on the other side of the firewall; and,
- Attackers cannot exhaustively attempt to connect to many FQDNs or IP addresses via source routing and use the error messages as an indication of whether the queried machine exists. for this attack to be prevented, the proxy must allow only
profileorendpointconnections, always refusing to even attempt source-routed connections. this latter attack can also be thwarted by requiring a SASL identification before allowing a TUNNEL channel to be started, but this can have higher overhead 🐢
8. Normative References 📚
- [1] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [2] Rose, M., "The Blocks Extensible Exchange Protocol Core", RFC 3080, March 2001.
- [3] Rose, M., "Mapping the BEEP Core onto TCP", RFC 3081, March 2001.
- [4] Hinden, R. and S. Deering, "IP Version 6 Addressing Architecture", RFC 2373, July 1998.
- [5] Berners-Lee, T., Fielding, R. and L. Masinter, "Uniform Resource Identifiers (URI): Generic Syntax", RFC 2396, August 1998.
- [6] Gulbrandsen, A., Vixie, P. and L. Esibov, "A DNS RR for specifying the location of services (DNS SRV)", RFC 2782, February 2000.
Appendix A. IANA Considerations 🌈
A.1 Registration: BEEP Profile
the IANA registered the profiles in this section and picked an IANA-specific URI: http://iana.org/beep/TUNNEL 🧚
here's the registration deets:
Profile identification: http://iana.org/beep/TUNNEL
Message exchanged during channel creation: "tunnel"
Messages starting one-to-one exchanges: "tunnel"
Messages in positive replies: "ok"
Messages in negative replies: "error"
Messages in one-to-many exchanges: None.
Message syntax: See Section 3 of this document.
Message semantics: See Section 4 of this document.
Contact information: See the Author's Address appendix of this
document.and bestie, any extensions to this protocol MUST be documented in a Standards track RFC 📜💖
A.2 Registration: The System (Well-Known) TCP port number for TUNNEL
a single well-known port, 604, was allocated by the IANA to the TUNNEL profile 🍓
Protocol Number: TCP
Message Formats, Types, Opcodes, and Sequences: See Section 3.
Functions: See Section 4.
Use of Broadcast/Multicast: none
Proposed Name: TUNNEL Profile
Short name: tunnel
Contact Information: See the "Authors' Addresses" section of this
memoAppendix B. Acknowledgements 🫶
the author gratefully acknowledges the contributions of Marshall Rose, Greg Matthews, and Ben Feinstein 💜
inspiration for this profile comes from the Intrusion Detection Working Group of the IETF ✨
Author's Address 🖋️
Darren New
5390 Caminito Exquisito
San Diego, CA 92130
US
Phone: +1 858 350 9733
EMail: dnew@san.rr.comFull Copyright Statement ©️
okay the legal stuff, but make it cute 🎀 Copyright (C) The Internet Society (2003). All Rights Reserved.
this document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. however, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards, in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English 🌸
the limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns ♾️
this document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 💅
Acknowledgement 🌷
funding for the RFC Editor function is currently provided by the Internet Society 🦋
📦 where this page comes from
- ietf: rfc3620 2003-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms