RFC 4775
Procedures for Protocol Extensions and Variations
RFC 4775 💖 Procedures for Protocol Extensions and Variations
okay bestie, let's start with the title block 🎀 This one is BCP 125, which means it's a Best Current Practice (not a standard, but the IETF's official advice). It was published in December 2006 by the Network Working Group. The authors are S. Bradner (Harvard), B. Carpenter, Ed. (editor, no affiliation listed), and T. Narten (IBM). The title block doesn't list anything it obsoletes or updates. 🦋
Status of This Memo 📜
this document is a Best Current Practice for the Internet Community 🌸 it's asking everyone to talk about it and send in suggestions for making it better. distribution of the memo is unlimited, so anyone can share it 🫶
Copyright Notice ©️
the IETF Trust holds the copyright, and the notice says (2006) 💅
Abstract ✨
this doc is all about the procedures for extending IETF protocols, like when it's fine to add an extension with little or no review, and when an extension or variation needs review from the wider IETF community 👀 experience has shown that extending a protocol without early IETF review can be risky 😭 the doc also recommends that major extensions or variations only happen through normal IETF processes or in coordination with the IETF 🔥
it's aimed mainly at other Standards Development Organizations (SDOs) and vendors who are thinking about asking for extensions to IETF protocols 💜 it doesn't change any formal IETF processes, so nothing about how the IETF runs itself is changing 🙈
Table of Contents 🍓
1. Introduction ....................................................2
2. Technical Risks in Extensions ...................................3
3. General Considerations ..........................................4
3.1. The Importance of Interoperability .........................4
3.2. Registered Values and the Importance of IANA Assignments ...5
3.3. Significant Extensions Require Technical Review ............5
3.4. Quality and Consistency ....................................6
3.5. The Role of Formal Liaisons ................................6
4. Procedure for Review of Extensions ..............................7
5. Some Specific Issues ...........................................10
6. Intellectual Property ..........................................10
7. Security Considerations ........................................10
8. IANA Considerations ............................................11
9. Acknowledgements ...............................................11
10. References ....................................................11
10.1. Normative References .....................................11
10.2. Informative References ...................................121. Introduction 🎀
okay so BCP 9 [RFC2026] is the current definition of the IETF standards track 📚 this process covers not just the first definition of a protocol but also any later updates, so that interoperability keeps working 🔥 the tricky part is that it isn't always clear whether an extension should go through the IETF process, especially when it starts outside the IETF community 🤔 this doc lays down the guidelines and procedures for those extensions 💅
when IETF Working Groups (WGs) develop protocols, they usually include ways for those protocols to be extended in the future 🧚 designing in extensibility is a really good principle, honestly, because a common sign of a successful protocol is that people end up using it in ways nobody planned for 😭 good extensibility mechanisms help protocols evolve and make it easier to roll out small changes in an interoperable way 🌈 but experience has also shown that extensibility features should stay limited to what's clearly needed when the protocol is built 🙈 any later extensions need to be done carefully, with a full understanding of the base protocol, existing implementations, and current operational practice 💀 this doc is not about describing the architectural principles of good extensibility design though, so that's a different conversation 🦋
when extensions to IETF protocols happen inside the IETF, the normal IETF process gets followed, including the normal processes for IETF-wide review and IESG approval 👑 extensions done this way should respect the same architectural principles and technical criteria as any other IETF work ✨
other SDOs, vendors, and technology fora may also spot a need for an extension to an IETF protocol 💜 this doc is about how those bodies should proceed, and there are a few possible scenarios:
- The requirement is straightforward and within the scope of whatever extension mechanism the base protocol includes.
- The requirement is, or may be, outside that scope, and:
- The IETF still has an active WG in the area;
- The IETF has no active WG, but has relevant expertise;
- The IETF no longer has a nucleus of relevant expertise.
especially in the latter three cases, there are technical risks in extension design, which the next section covers 😬 those risks get higher when extensions to IETF protocols happen outside the IETF and without consulting the IETF at all 🫠
the whole point of this doc is to find the right procedures and practices so that extensions built outside the IETF don't run into these risks 🛡️ otherwise they could end up useless or, worse, damaging to interoperability 💀 architectural considerations are documented somewhere else, and again this doc is aimed mainly at other SDOs and vendors thinking about extensions to IETF protocols, and it doesn't modify formal IETF processes 🙈
the IETF claims no special position here 🌸 everything said about IETF protocols would apply with equal force to protocols specified by any SDO 🫶 and if the IETF spots a need for an extension to another SDO's protocol, the IETF should follow whatever procedures that SDO sets out for extensions to its own protocols 🎀
2. Technical Risks in Extensions 😬
extensions can get made without anyone fully understanding why the existing protocol was designed the way it is 🙃 for example, what ideas came up during the original development and got rejected because of some problem with them 👀 extensions can also accidentally break a key function of the existing protocol, like security or congestion control 😭 design choices can be made without checking their impact on the protocol as a whole, and the basic underlying architectural principles of the protocol can get violated 💔 there's also a risk that mutually incompatible extensions get developed independently of each other 💀
and yes, the IETF itself isn't immune to these mistakes 🙈 that's why WGs should document their design decisions (including the paths they rejected) and their reasoning, for the benefit of people inside the IETF and outside it, maybe even years later 🦋
documentation for non-IETF extensions can be hard to get hold of sometimes 😩 so checking the quality of the specification, verifying interoperability, and verifying compatibility with other extensions (past and future ones too) can be really hard or even impossible 💀
a set of interrelated extensions across multiple protocols usually carries a bigger danger of interoperability issues or incompatibilities than a simple, single extension 🔥 so it's important that those proposals get earlier and more in-depth review than single, unitary extensions 👑
everything said about extensions applies with equal or greater force to variations 😭 by definition, protocol variations damage interoperability, so they have to be intensely scrutinized 🔍 an extension adds features and, if it's well designed, lets old and new implementations interoperate 🫶 a variation modifies features in a way that means old and new implementations may not interoperate at all 💔 so throughout this doc, anything said about extensions also applies to variations 🎀
3. General Considerations 🌈
3.1. The Importance of Interoperability 🧚
according to its Mission Statement [RFC3935], the IETF produces high quality, relevant technical and engineering documents, including protocol standards ✨ the mission statement goes on to say that the benefit of these standards to the Internet "is in interoperability - that multiple products implementing a standard are able to work together in order to deliver valuable functions to the Internet's users" 💖
one big consequence of that mission is that the IETF designs protocols for the single Internet 🌐 the IETF expects its protocols to work the same everywhere 🫶 protocol extensions designed for limited environments can be reasonable, as long as products with those extensions interoperate with products without them 🙌 extensions that break interoperability are unacceptable when products with and without the extension get mixed 🚫 the IETF's experience is that this tends to happen on the Internet even when the extension's original designers didn't expect it 😭
another consequence of this definition of interoperability is that the IETF values being able to swap one product implementing a protocol for another 🔁 the IETF often specifies mandatory-to-implement functionality as part of its protocols, so there's a core set of functionality for interoperability that every product implements 👑 the IETF tries to avoid situations where protocols need to be profiled to specify which optional features are required for a given environment, because doing that harms interoperability across the Internet as a whole 💔
the IETF, and especially the IESG, will apply these considerations when evaluating protocol extensions, whether they're proposed inside or outside the IETF 🔍
3.2. Registered Values and the Importance of IANA Assignments 🦋
an extension is often going to use additional values added to an existing IANA registry (in lots of cases, just by adding a new "TLV" (type-length-value) field) 🎀 it's essential that these new values get properly registered through the applicable procedures, including expert review where that applies (see BCP 26, [RFC2434]) 💅 extensions may even need to create brand new IANA registries in some cases 🌸
this is honestly underestimated a lot during extension design 😬 designers sometimes assume that a new codepoint is theirs for the asking, or even just for the taking 🙃 this is hazardous, because it's far too likely that someone who just takes a protocol value will find that the same value gets formally assigned to another function later, which guarantees an interoperability problem 💀
IANA assignment requests often trigger a thorough technical review of the proposal by a designated IETF expert reviewer 🧐 requests do sometimes get refused after that review ❌ so extension designers have to pay particular attention to any IANA assignments they need and to the criteria that apply to them 💖
3.3. Significant Extensions Require Technical Review ✨
okay so some extensions are lowkey minor (like sliding a straightforward new TLV into an application protocol, which only touches a subset of hosts 🧚) and some are majorrr (like adding a new IP option type, which could potentially hit every single node on the Internet 😭). it's essentially a judgment call 💅. one take is that anything needing at most Expert Review in [RFC2434] is probably minor, and anything beyond that is major. BUT even an extension that seems minor can have unforeseen consequences for interoperability 🙈. so the minor-vs-major label matters less than making sure the right amount of technical review happens either way 🎀. usually the expertise for that review lives in the same SDO that developed the original protocol, so for IETF protocols, the expertise lives in the IETF 🌸.
there may be times when it's unclear whether a proposal is even a protocol extension at all 🤔. when in doubt, it's better to err on the side of more review ✨. but if an "extension" just registers a new value with IANA in a First Come First Served registry [RFC2434], this document is not meant to require formal IETF review 💖. informal review by experts can still be super valuable though 🫶. in other cases (Section 5), there's a well-specified procedure for extensions that should be followed 📋.
the only safe rule? even if an extension feels minor to the person proposing it, early review by subject matter experts is advisable 💅. for protocols developed in the IETF, the right forum for that review is the IETF, either the relevant WG or Area, or individual IETF experts if no such WG exists 🦋.
3.4. Quality and Consistency
to get properly reviewed by relevant experts, a proposed extension has to be documented in a clear, well-written specification that IETF subject matter experts can access and review 📚. ideally it'd be published as an Internet Draft, using terminology and content that's consistent enough with the unextended specification that experts can spot the technical changes early on 🔍.
3.5. The Role of Formal Liaisons
the IETF has formal liaisons in place with a bunch of SDOs, and the liaison process is documented in [RFC4052], [RFC4053], and [RFC4691] 🤝. these liaison channels should be used as relevant for discussing and reviewing extensions, and so should informal engineering-level chat (for example, experts from other SDOs are welcome to join IETF meetings and mailing lists) 💬. where there's no formal liaison, the point of contact in the IETF should be the Chairs of relevant WGs, the most appropriate Area Director, or, in case of doubt, the IESG as a whole 👑.
4. Procedure for Review of Extensions 📜
in some cases, the relevant RFCs explicitly make provision for extending individual IETF protocols 🧚. nothing in this document overrides those procedures. a few of those cases are mentioned in Section 5 ✨.
there are several ways an extension to an IETF protocol can be considered for publication as an RFC 💖:
- Extensions to IETF protocols developed within the IETF will be subject to the normal IETF process, exactly like new designs. it's not a panacea, lol 🙃, so appropriate cross-working-group and cross-area review is needed within the IETF to avoid oversights and mistakes.
- Extensions to IETF protocols discussed in an IRTF Research Group may well be the prelude to regular IETF discussion. however, a Research Group may want to specify an experimental extension before the work is mature enough for IETF processing. in this case, the Research Group is required to involve appropriate IETF or IANA experts in their process to avoid oversights. 🔬
- Extensions to IETF protocols described in Independent Submissions to the RFC Editor are subject to IESG review, currently described in BCP 92 [RFC3932]. if appropriate, the IESG advises the RFC Editor that full IETF processing is needed, or that relevant IANA procedures need to be followed before publication can proceed. note that Independent Submissions cannot be placed on the IETF Standards Track; they would need to enter full IETF processing 🚫.
when vendors or other SDOs identify a requirement for extending an IETF protocol, their first step should be to consider the scenarios listed in Section 1 👀. if the requirement is straightforward and within the scope of a documented extension mechanism, the way is clear, and the documented mechanism must be followed ✅. if those two conditions aren't met, the next step should be to contact the relevant IETF Area Director to check whether there's an active WG in the area or, at least, relevant expertise available in the IETF 📞. at that point, it'll be possible to pick the most appropriate of the three routes above 🛣️. regular IETF process is most likely to be suitable, assuming enough interest can be found in the IETF community 💜. IRTF process is unlikely to be suitable unless there's a genuine research context for the proposed extension 🧪.
if the IETF no longer has relevant expertise, there are still two choices to talk through with the Area Director 😬: bring the work to the IETF (i.e., the IETF imports expertise) or reach mutual agreement to do the work elsewhere (i.e., the IETF explicitly exports change control) 🤝.
when an SDO identifies a requirement for a standardized extension, a standards development process within the IETF (while maintaining appropriate liaison) is strongly recommended over publishing a non-IETF standard 🌈. otherwise, the implementor community would be faced with a standard split into two or more parts in different styles, obtained from different sources, with no unitary control over quality, compatibility, interoperability, and intellectual property conditions 💀. note that, since participation in the IETF is open, there's no formality or restriction for participants in other SDOs who want to work in the IETF as well 🥰. in some cases (see Section 5), the IETF has well-defined procedures for this already in place 📋.
SDOs can and do develop scenarios, requirements, and architectures based on IETF specifications, obviously 💅. only actual protocol extensions and changes need to go through the IETF process. but there's a big risk of wasted effort if significant investment is made in planning for use of IETF technology without early review and feedback from the IETF 😩. other SDOs are encouraged to communicate informally or formally with the IETF as early as possible to avoid false starts 🚩. early technical review in a collaborative spirit is of great value ✨. each SDO can "own" its ideas and discuss them in its own fora, but should start talking to the IETF experts about those ideas the moment the idea is well formulated 🫶. it's understood that close collaboration may be needed so the IETF experts correctly understand the systems architecture the other SDO has in mind 🏗️. this is much preferable to a situation where another SDO presents the IANA and the IETF with a 'fait accompli.' 🙅♀️
vendors that identify a requirement for an extension are strongly recommended to start informal discussion in the IETF and to publish a preliminary Internet Draft describing the requirements 📝. this lets the vendor and the community evaluate whether there's community interest and whether there are any major or fundamental issues 🔎. however, if a vendor identifies a requirement for a proprietary extension that doesn't generate interest in the IETF (or IRTF) communities, an Independent Submission to the RFC Editor is strongly recommended over publishing a proprietary document 🎁. not only does this bring the draft to the community's attention, it also ensures a minimum of review [RFC3932], and (if published as an RFC) makes the proprietary extension available to the whole community 🌸.
if, despite these recommendations, a vendor or SDO does choose to publish its own specification for an extension to an IETF protocol, the following guidance applies 🧾:
- Extensions to IETF protocols should be well, and publicly, documented, and reviewed at an early stage by the IETF community, to be sure that the extension does not undermine basic assumptions and safeguards designed into the protocol (such as security functions) or its architectural integrity 🔐.
- Vendors and other SDOs are formally requested to submit any such proposed publications for IETF review, and are invited to actively participate in the IETF process. submission may be through an established liaison channel if one exists, or by direct communication with the relevant WG or the IESG. this should be done at an early stage, before a large investment of effort has taken place, in case basic problems are revealed. when there's a formal liaison in place between the other SDO and the IETF, the liaison channel should be used to ensure that review takes place, both by relevant experts and by established review teams or Directorates within the IETF. if there's no formal liaison, the other SDO or vendor should ask the IESG (or a relevant Area Director) to obtain such reviews. note that general aspects such as security, internationalization, and management may need review, as well as the protocol itself 🧐.
- In the case of extensions involving only routine IANA parameter assignments, for which there's an underlying IETF specification containing clear IANA Considerations, this request is satisfied as long as those considerations are satisfied (see [RFC2434]). anything beyond this requires an explicit protocol review by experts within the IETF 🙌.
- Note that, like IETF specifications, such proposed publications must include an IANA Considerations section, to ensure that protocol parameter assignments needed to deploy extensions are not made until after a proposed extension has received adequate review, and then to ensure that IANA has precise guidance on how to make those assignments 📋💖.
5. Some Specific Issues 💅
okay so MIB modules are basically all extensions of the SMI data model, and they get defined or extended outside the IETF all the time 🫶 BCP 111 [RFC4181] has detailed guidance for authors and reviewers, so go read that bestie 📚
a bunch of protocols have planned ahead with experimental values for certain IANA parameters, so people can test experimental usages and extensions without needing a special parameter assignment 🧪 but it has to be stressed that those values are not meant for production use, and they are not a way to dodge the type of technical review this document describes 🙅 see [RFC3692] and [RFC4727].
RADIUS [RFC2865] is built to carry attributes and lets you define new ones ✨ but discussion of new attributes really needs the IETF community of experts who know the protocol's architecture and how it's already used, so everyone can fully understand what a proposed extension implies 🧠 adding new attributes without that discussion creates a high risk of interoperability or functionality failure 😭 for this reason among others, the IETF has an active RADIUS Extensions WG at the time of writing 👑
there are certain documents that specify a change process for specific IETF protocols, like:
- The SIP change process [RFC3427]
- The (G)MPLS change process [CHANGEPROC]
and this document does not override those specific change processes 🤝
6. Intellectual Property 🎀
all IETF documents fall under the IETF's intellectual property rules, which are BCP 78 [RFC3978] and BCP 79 [RFC3979], as amended 📜 the big things here are that there are restrictions on making derivative works, and that rights stay with the original authors 🔒 so anybody outside the IETF who's thinking about building an extension based on an IETF document needs to keep these legal restrictions and rights in mind, no cap 💼
7. Security Considerations 🔐
an extension must not introduce new security risks without also providing an adequate counter-measure 🛡️ and in particular it must not inadvertently defeat security measures in the unextended protocol 💀 this aspect must always be considered during IETF review, periodt 😤
8. IANA Considerations 🍓
the IETF asks IANA to pay attention to the requirements of this document when it's asked to make protocol parameter assignments for vendors or other SDOs 📋 basically, respect the IANA Considerations of every RFC that has them, plus the general considerations of BCP 26 [RFC2434] 💅
9. Acknowledgements 🫶
this document is heavily based on an earlier draft under a different title by Scott Bradner and Thomas Narten 💖
that earlier draft said: "The initial version of this document was put together by the IESG in 2002. Since then, it has been reworked in response to feedback from John Loughney, Henrik Levkowetz, Mark Townsley, Randy Bush, Bernard Aboba, and others." 🌸
Ted Hardie, Scott Brim, Dan Romascanu, Jari Arkko, Loa Andersson, Adrian Farrel, Roy Fielding, Keith Moore, Bernard Aboba, Elwyn Davies, Stephen Trowbridge, and Ted Ts'o also left valuable comments on this document ✨
Sam Hartman contributed the section on interoperability 🧚
and this document was produced using the xml2rfc tool [RFC2629] 🦋
10. References 📚
10.1. Normative References
[RFC2026] Bradner, S., "The Internet Standards Process -- Revision
3", BCP 9, RFC 2026, October 1996.
[RFC2434] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 2434,
October 1998.
[RFC3427] Mankin, A., Bradner, S., Mahy, R., Willis, D., Ott, J.,
and B. Rosen, "Change Process for the Session Initiation
Protocol (SIP)", BCP 67, RFC 3427, December 2002.
[RFC3692] Narten, T., "Assigning Experimental and Testing Numbers
Considered Useful", BCP 82, RFC 3692, January 2004.
[RFC3932] Alvestrand, H., "The IESG and RFC Editor Documents:
Procedures", BCP 92, RFC 3932, October 2004.
[RFC3935] Alvestrand, H., "A Mission Statement for the IETF",
BCP 95, RFC 3935, October 2004.
[RFC3978] Bradner, S., "IETF Rights in Contributions", BCP 78,
RFC 3978, March 2005.
[RFC3979] Bradner, S., "Intellectual Property Rights in IETF
Technology", BCP 79, RFC 3979, March 2005.
[RFC4052] Daigle, L. and Internet Architecture Board, "IAB
Processes for Management of IETF Liaison Relationships",
BCP 102, RFC 4052, April 2005.
[RFC4053] Trowbridge, S., Bradner, S., and F. Baker, "Procedures
for Handling Liaison Statements to and from the IETF",
BCP 103, RFC 4053, April 2005.
[RFC4181] Heard, C., "Guidelines for Authors and Reviewers of MIB
Documents", BCP 111, RFC 4181, September 2005.
[RFC4727] Fenner, B., "Experimental Values In IPv4, IPv6, ICMPv4,
ICMPv6, UDP, and TCP Headers", RFC 4727, November 2006.10.2. Informative References
[CHANGEPROC] Andersson, L. and A. Farrel, "Change Process for
Multiprotocol Label Switching (MPLS) and Generalized
MPLS (GMPLS) Protocols and Procedures", Work in
Progress, October 2006.
[RFC2629] Rose, M., "Writing I-Ds and RFCs using XML", RFC 2629,
June 1999.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)",
RFC 2865, June 2000.
[RFC4691] Andersson, L., "Guidelines for Acting as an IETF Liaison
to Another Organization", RFC 4691, October 2006.Authors' Addresses 🎀
Scott Bradner
Harvard University
29 Oxford St.
Cambridge, MA 02138
US
EMail: sob@harvard.edu
Brian Carpenter, Ed.
IBM
8 Chemin de Blandonnet
1214 Vernier
Switzerland
EMail: brc@zurich.ibm.com
Thomas Narten
IBM
3039 Cornwallis Ave.
PO Box 12195 - BRQA/502
Research Triangle Park, NC 27709-2195
US
EMail: narten@us.ibm.comFull Copyright Statement 🌈
Copyright (C) The IETF Trust (2006).
this document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights 🔏
this document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST, AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 📢
Intellectual Property 💜
the IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available 🤷 nor does it represent that it has made any independent effort to identify any such rights 🔍 information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79 📖
copies of IPR disclosures made to the IETF Secretariat, and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification, can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr 🔗
the IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard 📮 please address the information to the IETF at ietf-ipr@ietf.org 💌
Acknowledgement 🌸
funding for the RFC Editor function is currently provided by the Internet Society 💖✨
📦 where this page comes from
- ietf: rfc4775 2006-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms