RFC 3948
UDP Encapsulation of IPsec ESP Packets
UDP Encapsulation of IPsec ESP Packets ✨
okay bestie, this is RFC 3948 and it's giving main character 🎀
- Network Working Group 🌸
- Authors: A. Huttunen (F-Secure Corporation), B. Swander (Microsoft), V. Volpe (Cisco Systems), L. DiBurro (Nortel Networks), and M. Stenberg 🧚
- Category: Standards Track 💜
- Date: January 2005 📅
- Obsoletes / Updates: the title block doesn't list anything this RFC obsoletes or updates 🦋
Status of This Memo ✨
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice 🎀
Copyright (C) The Internet Society (2005).
Abstract 🦋
This protocol specification defines methods to encapsulate and decapsulate IP Encapsulating Security Payload (ESP) packets inside UDP packets for traversing Network Address Translators. ESP encapsulation, as defined in this document, can be used in both IPv4 and IPv6 scenarios. Whenever negotiated, encapsulation is used with Internet Key Exchange (IKE). 💖
Table of Contents 🍓
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Packet Formats . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1. UDP-Encapsulated ESP Header Format . . . . . . . . . . . 3
2.2. IKE Header Format for Port 4500 . . . . . . . . . . . . 4
2.3. NAT-Keepalive Packet Format . . . . . . . . . . . . . . 4
3. Encapsulation and Decapsulation Procedures . . . . . . . . . . 5
3.1. Auxiliary Procedures . . . . . . . . . . . . . . . . . . 5
3.1.1. Tunnel Mode Decapsulation NAT Procedure . . . . 5
3.1.2. Transport Mode Decapsulation NAT Procedure . . . 5
3.2. Transport Mode ESP Encapsulation . . . . . . . . . . . . 6
3.3. Transport Mode ESP Decapsulation . . . . . . . . . . . . 6
3.4. Tunnel Mode ESP Encapsulation . . . . . . . . . . . . . 7
3.5. Tunnel Mode ESP Decapsulation . . . . . . . . . . . . . 7
4. NAT Keepalive Procedure . . . . . . . . . . . . . . . . . . . 7
5. Security Considerations . . . . . . . . . . . . . . . . . . . 8
5.1. Tunnel Mode Conflict . . . . . . . . . . . . . . . . . . 8
5.2. Transport Mode Conflict . . . . . . . . . . . . . . . . 9
6. IAB Considerations . . . . . . . . . . . . . . . . . . . . . . 10
7. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 11
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11
8.1. Normative References . . . . . . . . . . . . . . . . . . 11
8.2. Informative References . . . . . . . . . . . . . . . . . 11
A. Clarification of Potential NAT Multiple Client Solutions . . . 12
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 14
Full Copyright Statement . . . . . . . . . . . . . . . . . . . 151. Introduction ✨
okay so this spec defines how to encapsulate and decapsulate ESP packets inside UDP packets so they can get through Network Address Translators (NATs) (see [RFC3715], section 2.2, case i). 🦋 The UDP port numbers are the same ones IKE traffic uses, as defined in [RFC3947]. 💖
the sharing of port numbers between IKE and UDP encapsulated ESP traffic was chosen because it offers better scaling (only one NAT mapping in the NAT; no need to send separate IKE keepalives), easier configuration (only one port to be configured in firewalls), and easier implementation. it's giving efficiency 💅
a client's needs should decide whether transport mode or tunnel mode gets supported (see [RFC3715], Section 3, "Telecommuter scenario"). L2TP/IPsec clients MUST support the modes as defined in [RFC3193]. IPsec tunnel mode clients MUST support tunnel mode. no exceptions, periodt 🎀
an IKE implementation supporting this protocol specification MUST NOT use the ESP SPI field zero for ESP packets. this makes sure IKE packets and ESP packets can be told apart from each other 🫶
as defined in this document, UDP encapsulation of ESP packets is written in terms of IPv4 headers. there is no technical reason why an IPv6 header could not be used as the outer header and/or as the inner header. ✨
because protecting the outer IP addresses in IPsec AH is inherently incompatible with NAT, IPsec AH was left out of the scope of this protocol specification. this protocol also assumes that IKE (IKEv1 [RFC2401] or IKEv2 [IKEv2]) is used to negotiate the IPsec SAs. manual keying is not supported. 🙈
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 📚
2. Packet Formats 🌈
2.1. UDP-Encapsulated ESP Header Format 🎀
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ESP header [RFC2406] |
~ ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the UDP header is a standard [RFC0768] header, where
- the Source Port and Destination Port MUST be the same as that used by IKE traffic,
- the IPv4 UDP Checksum SHOULD be transmitted as a zero value, and
- receivers MUST NOT depend on the UDP checksum being a zero value.
the SPI field in the ESP header MUST NOT be a zero value. 💖
2.2. IKE Header Format for Port 4500 🦋
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Non-ESP Marker |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IKE header [RFC2409] |
~ ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the UDP header is a standard [RFC0768] header and is used as defined in [RFC3947]. this document doesn't set any new requirements for the checksum handling of an IKE packet. 🌸
a Non-ESP Marker is 4 zero-valued bytes lining up with the SPI field of an ESP packet. ✨
2.3. NAT-Keepalive Packet Format 🍓
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Port | Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length | Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 0xFF |
+-+-+-+-+-+-+-+-+the UDP header is a standard [RFC0768] header, where
- the Source Port and Destination Port MUST be the same as used by UDP-ESP encapsulation of Section 2.1,
- the IPv4 UDP Checksum SHOULD be transmitted as a zero value, and
- receivers MUST NOT depend upon the UDP checksum being a zero value.
the sender MUST use a one-octet-long payload with the value 0xFF. the receiver SHOULD ignore a received NAT-keepalive packet. 🔥
3. Encapsulation and Decapsulation Procedures 💅
3.1. Auxiliary Procedures 🌷
3.1.1. Tunnel Mode Decapsulation NAT Procedure 🦋
when tunnel mode has been used to transmit packets (see [RFC3715], section 3, criteria "Mode support" and "Telecommuter scenario"), the inner IP header can contain addresses that aren't suitable for the current network. this procedure defines how those addresses get converted into suitable addresses for the current network. 🧚
depending on local policy, one of the following MUST be done:
- If a valid source IP address space has been defined in the policy for the encapsulated packets from the peer, check that the source IP address of the inner packet is valid according to the policy.
- If an address has been assigned for the remote peer, check that the source IP address used in the inner packet is the assigned IP address.
- NAT is performed for the packet, making it suitable for transport in the local network.
3.1.2. Transport Mode Decapsulation NAT Procedure 💜
when transport mode has been used to transmit packets, contained TCP or UDP headers will have incorrect checksums because parts of the IP header changed in transit. this procedure defines how to fix those checksums (see [RFC3715], section 2.1, case b). 🫶
depending on local policy, one of the following MUST be done:
- If the protocol header after the ESP header is a TCP/UDP header and the peer's real source and destination IP address have been received according to [RFC3947], incrementally recompute the TCP/UDP checksum:
- Subtract the IP source address in the received packet from the checksum.
- Add the real IP source address received via IKE to the checksum (obtained from the NAT-OA).
- Subtract the IP destination address in the received packet from the checksum.
- Add the real IP destination address received via IKE to the checksum (obtained from the NAT-OA).
Note: If the received and real address are the same for a given address (e.g., say the source address), the operations cancel and don't need to be performed.
- If the protocol header after the ESP header is a TCP/UDP header, recompute the checksum field in the TCP/UDP header.
- If the protocol header after the ESP header is a UDP header, set the checksum field to zero in the UDP header. If the protocol after the ESP header is a TCP header, and if there is an option to flag to the stack that the TCP checksum does not need to be computed, then that flag MAY be used. This SHOULD only be done for transport mode, and if the packet is integrity protected. Tunnel mode TCP checksums MUST be verified. (This is not a violation to the spirit of section 4.2.2.7 in [RFC1122] because a checksum is being generated by the sender and verified by the receiver. That checksum is the integrity over the packet performed by IPsec.)
in addition, an implementation MAY fix any contained protocols that have been broken by NAT (see [RFC3715], section 2.1, case g). 🌈
3.2. Transport Mode ESP Encapsulation 🦋
okay so here's the transport mode glow-up 💅 Before ESP/UDP, you've got the original IP header (plus any options) sitting in front of the TCP header and data:
BEFORE APPLYING ESP/UDP
----------------------------
IPv4 |orig IP hdr | | |
|(any options)| TCP | Data |
----------------------------After ESP/UDP, the UDP header and ESP header get slotted in between the IP header and everything else, and the ESP trailer and Auth go on the end. The encryption covers the TCP and data bits, and the authentication covers a bigger chunk:
AFTER APPLYING ESP/UDP
-------------------------------------------------------
IPv4 |orig IP hdr | UDP | ESP | | | ESP | ESP|
|(any options)| Hdr | Hdr | TCP | Data | Trailer |Auth|
-------------------------------------------------------
|<----- encrypted ---->|
|<------ authenticated ----->|The steps are pretty chill:
- Ordinary ESP encapsulation procedure is used. 🫶
- A properly formatted UDP header is inserted where shown. 🎀
- The Total Length, Protocol, and Header Checksum (for IPv4) fields in the IP header are edited to match the resulting IP packet. ✨
3.3. Transport Mode ESP Decapsulation 🌸
Undoing it is basically the same energy in reverse:
- The UDP header is removed from the packet. 🧚
- The Total Length, Protocol, and Header Checksum (for IPv4) fields in the new IP header are edited to match the resulting IP packet. 💜
- Ordinary ESP decapsulation procedure is used. 🌈
- Transport mode decapsulation NAT procedure is used. 👑
3.4. Tunnel Mode ESP Encapsulation 🍓
Tunnel mode is giving wrapped 🎁 The whole original IP header and its payload get tucked inside ESP, and then a brand new IP header goes on the outside. Before ESP/UDP, it looks like this:
BEFORE APPLYING ESP/UDP
----------------------------
IPv4 |orig IP hdr | | |
|(any options)| TCP | Data |
----------------------------After ESP/UDP, the new IP header is the outermost layer, then the UDP and ESP headers, then the original IP header and everything after it:
AFTER APPLYING ESP/UDP
--------------------------------------------------------------
IPv4 |new h.| UDP | ESP |orig IP hdr | | | ESP | ESP|
|(opts)| Hdr | Hdr |(any options)| TCP | Data | Trailer |Auth|
--------------------------------------------------------------
|<------------ encrypted ----------->|
|<------------- authenticated ------------>|The steps:
- Ordinary ESP encapsulation procedure is used. 💖
- A properly formatted UDP header is inserted where shown. 🦋
- The Total Length, Protocol, and Header Checksum (for IPv4) fields in the new IP header are edited to match the resulting IP packet. ⭐
3.5. Tunnel Mode ESP Decapsulation 💅
Peeling it back works the same way:
- The UDP header is removed from the packet. 🌸
- The Total Length, Protocol, and Header Checksum (for IPv4) fields in the new IP header are edited to match the resulting IP packet. 🫶
- Ordinary ESP decapsulation procedure is used. 🔥
- Tunnel mode decapsulation NAT procedure is used. ✨
4. NAT Keepalive Procedure 💌
Okay, the whole point of NAT-keepalive packets is to keep NAT mappings alive for as long as a connection between the peers is running 🦋 (see [RFC3715], Section 2.2, case j). Receiving one of these packets MUST NOT be used to figure out whether a connection is still live. Keepalives are for the mappings, not for checking vibes. 🙈
A peer MAY send a NAT-keepalive packet if one or more phase I or phase II SAs exist between the peers, or if such an SA has existed at most N minutes earlier. N is a locally configurable parameter, and its default value is 5 minutes ⏰
A peer SHOULD send a NAT-keepalive packet if a need for it is detected according to [RFC3947], and if no other packet has been sent to the peer in M seconds. M is also a locally configurable parameter, with a default value of 20 seconds 💜
5. Security Considerations 🔐
Real talk, this section is serious business, so pay attention bestie 😭
5.1. Tunnel Mode Conflict 🌪️
Implementors, I'm warning you: remote peers can totally negotiate entries that overlap at an SGW (security gateway). This is a problem for tunnel mode (see [RFC3715], section 2.1, case e). Here's the setup:
+----+ \ /
| |-------------|----\
+----+ / \ \
Ari's NAT 1 \
Laptop \
10.1.2.3 \
+----+ \ / \ +----+ +----+
| |-------------|----------+------| |----------| |
+----+ / \ +----+ +----+
Bob's NAT 2 SGW Suzy's
Laptop Server
10.1.2.3Since the SGW will now see two possible SAs that lead to 10.1.2.3, it can get super confused about where to send packets coming from Suzy's server. 😵💫 Implementors MUST devise ways of preventing this from happening. 🚨
It is RECOMMENDED that the SGW either gives Ari's and Bob's laptops locally unique IP addresses (by using a protocol such as DHCP over IPsec), or uses NAT to change their source IP addresses to these locally unique addresses before sending packets on to Suzy's server. This covers the "Scaling" criteria of section 3 in [RFC3715]. 🎀
Please see Appendix A. 🌸
5.2. Transport Mode Conflict 🌪️
Another similar issue can pop up in transport mode 🫠 with 2 clients, Ari and Bob, behind the same NAT, both talking securely to the same server (see [RFC3715], Section 2.1, case e). Then Cliff wants to talk in the clear to that same server too. Here's the layout:
+----+
| |
+----+ \
Ari's \
Laptop \
10.1.2.3 \
+----+ \ / +----+
| |-----+-----------------| |
+----+ / \ +----+
Bob's NAT Server
Laptop /
10.1.2.4 /
/
+----+ /
| |/
+----+
Cliff's
Laptop
10.1.2.5Now the transport SAs on the server look like this:
To Ari: Server to NAT, <traffic desc1>, UDP encap <4500, Y>
To Bob: Server to NAT, <traffic desc2>, UDP encap <4500, Z>Cliff's traffic is in the clear, so there's no SA for it. 🙅♀️
In that setup, <traffic desc> is the protocol and port info. The UDP encap ports are the ports used in the UDP-encapsulated ESP format from section 2.1. Y and Z are the dynamic ports the NAT assigns during the IKE negotiation. So IKE traffic from Ari's laptop goes out on UDP <4500,4500>, and it reaches the server as UDP <Y,4500>, where Y is the dynamically assigned port. 🧠
If <traffic desc1> overlaps <traffic desc2>, then simple filter lookups might not be enough to tell which SA should be used to send traffic. Implementations MUST handle this situation, either by disallowing conflicting connections or by some other means. 🚫
Now, say Cliff wants to connect to the server in the clear. This is going to be hard to configure, because the server already has a policy (from Server to the NAT's external address) for securing <traffic desc>. If the traffic descriptions don't overlap at all, it's doable. 👌
A sample server policy could look like this:
To Ari: Server to NAT, All UDP, secure
To Bob: Server to NAT, All TCP, secure
To Cliff: Server to NAT, ALL ICMP, clear textHeads up, this policy also lets Ari and Bob send cleartext ICMP to the server. 👀
The server sees every client behind the NAT as the same IP address, so setting up different policies for the same traffic descriptor is, in principle, impossible. 😭
Here's a problematic configuration on the server:
Server to NAT, TCP, secure (for Ari and Bob)
Server to NAT, TCP, clear (for Cliff)The server can't enforce its policy, because misbehaving Bob could send traffic in the clear, and that looks exactly the same as Cliff sending traffic in the clear. 💀 So it's impossible to guarantee security for some clients behind a NAT while allowing cleartext from other clients behind the SAME NAT. If the server's security policy does allow this, though, it can do best-effort security: if a client behind the NAT starts out secured, its connection will be secured. If the client sends in the clear, the server will still accept that cleartext. 🤷♀️
For security guarantees, the problematic scenario above MUST NOT be allowed on servers. For best-effort security, this scenario MAY be used. 🔒
Please see Appendix A. 🎀
6. IAB Considerations 🧚
The UNSAF [RFC3424] questions are addressed by the IPsec-NAT compatibility requirements document [RFC3715]. 🌷
7. Acknowledgments 🫶
Thanks to Tero Kivinen and William Dixon, who contributed actively to this document. 💖
Thanks to Joern Sierwald, Tamir Zegman, Tatu Ylonen, and Santeri Paavolainen, who contributed to the early documents about NAT traversal. 🌈
8. References 📚
8.1. Normative References
- [RFC0768] Postel, J., "User Datagram Protocol", STD 6, RFC 768, August 1980.
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC2401] Kent, S. and R. Atkinson, "Security Architecture for the Internet Protocol", RFC 2401, November 1998.
- [RFC2406] Kent, S. and R. Atkinson, "IP Encapsulating Security Payload (ESP)", RFC 2406, November 1998.
- [RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange (IKE)", RFC 2409, November 1998.
- [RFC3947] Kivinen, T., "Negotiation of NAT-Traversal in the IKE", RFC 3947, January 2005.
8.2. Informative References
- [RFC1122] Braden, R., "Requirements for Internet Hosts - Communication Layers", STD 3, RFC 1122, October 1989.
- [RFC3193] Patel, B., Aboba, B., Dixon, W., Zorn, G., and S. Booth, "Securing L2TP using IPsec", RFC 3193, November 2001.
- [RFC3424] Daigle, L. and IAB, "IAB Considerations for UNilateral Self-Address Fixing (UNSAF) Across Network Address Translation", RFC 3424, November 2002.
- [RFC3715] Aboba, B. and W. Dixon, "IPsec-Network Address Translation (NAT) Compatibility Requirements", RFC 3715, March 2004.
- [IKEv2] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol", Work in Progress, October 2004.
Appendix A. Clarification of Potential NAT Multiple Client Solutions 🎀
okay so this appendix is all about the situation where multiple clients sit behind the same NAT and all try to connect to the same destination IP address at once 😭 it's giving chaos, bestie
Sections 5.1 and 5.2 say that you MUST avoid this problem 💅 but here's the tea: this isn't really about the wire protocol, it's about how you implement stuff locally. so the fixes don't belong in the spec itself, which is why they're chilling down here in the appendix 🧚
picking an option will probably depend on what scenarios you're using IPsec NAT-T for 🦋 this list isn't meant to be exhaustive, so other solutions might exist too ✨ we'll start with the generic choices that fix the problem for all upper-layer protocols 💖
Generic choices for ESP transport mode:
- Tr1) Implement a built-in NAT (network address translation) above IPsec decapsulation. 🌸
- Tr2) Implement a built-in NAPT (network address port translation) above IPsec decapsulation. 🌸
- Tr3) An initiator may decide not to request transport mode once NAT is detected and may instead request a tunnel-mode SA. This may be a retry after transport mode is denied by the responder, or the initiator may choose to propose a tunnel SA initially. This is no more difficult than knowing whether to propose transport mode or tunnel mode without NAT. If for some reason the responder prefers or requires tunnel mode for NAT traversal, it must reject the quick mode SA proposal for transport mode. 🔥 this one is lowkey the easiest vibe, ngl
Generic choices for ESP tunnel mode:
- Tn1) Same as Tr1. 🌈
- Tn2) Same as Tr2. 🌈
- Tn3) This option is possible if an initiator can be assigned an address through its tunnel SA, with the responder using DHCP. The initiator may initially request an internal address via the DHCP-IPsec method, regardless of whether it knows it is behind a NAT. It may re-initiate an IKE quick mode negotiation for DHCP tunnel SA after the responder fails the quick mode SA transport mode proposal. This happens either when a NAT-OA payload is sent or because it discovers from NAT-D that the initiator is behind a NAT and its local configuration/policy will only accept a NAT connection when being assigned an address through DHCP-IPsec. 🧚 main character energy for real
okay now for the choices with limited interoperability 🙈 these ones work, but not for everything. implementors should specify which applications or protocols should work if they pick these options 💜 and yes, neither Tr4 nor Tn4 are expected to work with TCP traffic, so don't say i didn't warn you 😭
Limited interoperability choices for ESP transport mode:
- Tr4) Implement upper-layer protocol awareness of the inbound and outbound IPsec SA so that it doesn't use the source IP and the source port as the session identifier (e.g., an L2TP session ID mapped to the IPsec SA pair that doesn't use the UDP source port or the source IP address for peer uniqueness). 🦋
- Tr5) Implement application integration with IKE initiation so that it can rebind to a different source port if the IKE quick mode SA proposal is rejected by the responder; then it can repropose the new QM selector. ✨
Limited interoperability choices for ESP tunnel mode:
- Tn4) Same as Tr4. 🌈
Authors' Addresses 💌
Ari Huttunen
F-Secure Corporation
Tammasaarenkatu 7
HELSINKI FIN-00181
FI
EMail: Ari.Huttunen@F-Secure.com
Brian Swander
Microsoft
One Microsoft Way
Redmond, WA 98052
US
EMail: briansw@microsoft.com
Victor Volpe
Cisco Systems
124 Grove Street
Suite 205
Franklin, MA 02038
US
EMail: vvolpe@cisco.com
Larry DiBurro
Nortel Networks
80 Central Street
Boxborough, MA 01719
US
EMail: ldiburro@nortelnetworks.com
Markus Stenberg
FI
EMail: markus.stenberg@iki.fiFull Copyright Statement 🌸
Copyright (C) The Internet Society (2005).
this document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. 💅
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. ⚠️
Intellectual Property ✨
the IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. nor does it represent that it has made any independent effort to identify any such rights. information on the IETF's procedures with respect to rights in IETF Documents can be found in BCP 78 and BCP 79. 🧚
copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. 🦋
the IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. please address the information to the IETF at ietf-ipr@ietf.org. 💖
Acknowledgement 🫶
funding for the RFC Editor function is currently provided by the Internet Society. thank you to them 💜
📦 where this page comes from
- ietf: rfc3948 2005-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms