RFC 5266
Secure Connectivity and Mobility Using Mobile IPv4 and IKEv2 Mobility and Multihoming (MOBIKE)
RFC 5266: Secure Connectivity and Mobility Using Mobile IPv4 and IKEv2 Mobility and Multihoming (MOBIKE) 🦋
Okay bestie, this one is all about getting roaming users (think: someone working from a coffee shop ☕) safely into the company network while their IP address keeps changing. It's RFC 5266, published in June 2008 as a Best Current Practice (that's the BCP: 136 label, so it's official guidance, not just a suggestion 💅). The authors are V. Devarapalli from Wichorus and P. Eronen from Nokia. The title block doesn't list any RFCs it obsoletes or updates, so it stands on its own 🌸.
Status of This Memo ✨
Okay so this part is the legal-ish bit. It's an Internet Best Current Practice for the Internet Community, and the authors are asking everyone to chime in with discussion and suggestions for improvements 🫶. Distribution of this memo is unlimited, so share away 💖.
Abstract 🎀
So enterprise people need two things at once: they need to move around (switching networks, getting a brand-new IP address) and they need secure connectivity when they hop onto the company's services from wherever they are. Security is non-negotiable when the connection comes from an untrusted network 🔒. Mobility matters whether the person moves inside the enterprise network or outside it 🚶♀️.
This document is the solution, and it combines Mobile IPv4 (MIPv4) with the mobility extensions to IKEv2 (MOBIKE) to deliver secure connectivity and mobility together. It's giving two-in-one ✨.
Table of Contents 📚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Solution Overview . . . . . . . . . . . . . . . . . . . . . . 4
3.1. Access Modes . . . . . . . . . . . . . . . . . . . . . . . 6
3.1.1. Access Mode: 'c' . . . . . . . . . . . . . . . . . . . 6
3.1.2. Access Mode: 'f' . . . . . . . . . . . . . . . . . . . 6
3.1.3. Access Mode: 'mc' . . . . . . . . . . . . . . . . . . 6
3.2. Mobility within the Enterprise . . . . . . . . . . . . . . 7
3.3. Mobility When outside the Enterprise . . . . . . . . . . . 7
3.4. Crossing Security Boundaries . . . . . . . . . . . . . . . 7
3.4.1. Operation When Moving from an Untrusted Network . . . 8
3.4.2. Operation When Moving from a Trusted Network . . . . . 9
4. NAT Traversal . . . . . . . . . . . . . . . . . . . . . . . . 10
5. Security Considerations . . . . . . . . . . . . . . . . . . . 10
6. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 10
7. References . . . . . . . . . . . . . . . . . . . . . . . . . . 11
7.1. Normative References . . . . . . . . . . . . . . . . . . . 11
7.2. Informative References . . . . . . . . . . . . . . . . . . 11
Appendix A. Applicability to a Mobile Operator Network . . . . . 131. Introduction 🌈
So picture a typical enterprise network. People connect to the company's services from two places: the trusted network (the intranet 🏢) and the untrusted network (the Internet 🌐). The two are usually separated by a demilitarized zone (DMZ), and getting into the intranet is controlled by a firewall and a Virtual Private Network (VPN) gateway sitting in that DMZ 🛡️.
When people are roaming on untrusted networks, they usually have to authenticate to the VPN gateway and set up a secure tunnel before they can reach the intranet. IPsec VPNs are super common for this, so it's basically the standard move 🔐. When someone is on the trusted network, they don't use a VPN. But they still benefit a lot from session mobility between subnets, which is possible through Mobile IPv4 💜.
Now, there has been some earlier work on combining Mobile IPv4 with IPsec VPNs for roaming and secure access to an enterprise, in [RFC5265] and [RFC4093]. The one in [RFC5265] came with some restrictions. It didn't allow any modifications to the VPN gateways, and it used two layers of MIPv4, with one home agent inside the intranet and another one either on the Internet or in the DMZ in front of the VPN gateway. Honestly? That's a lot 😵💫. The per-packet overhead is very high, it's tricky to implement, and a mobile node would need two MIPv4 instances running at the same time. Also, this solution only works when Internet Key Exchange version 2 (IKEv2) IPsec VPNs are used 🙃.
This document offers a different approach that doesn't need two layers of MIPv4 ✨. When the mobile node is on the trusted network, it uses Mobile IPv4. When it's on the untrusted network, it uses MOBIKE-capable IPsec VPNs. Here's the clever part 🧠: the mobile node takes the tunnel inner address (TIA) that the IPsec VPN gateway hands out and uses it as the co-located care-of address (CoA) for its MIPv4 registration. That means there's no need for an external MIPv4 home agent, and no need to wrap the VPN tunnel inside a MIPv4 tunnel. Main character energy 👑.
Here are the assumptions this solution is built on:
- IKEv2 [RFC4306] and IPsec [RFC4301] are used to set up the VPN tunnels between the mobile node and the VPN gateway 🔑.
- The VPN gateway and the mobile node support MOBIKE extensions as defined in [RFC4555] 📱.
- When the mobile node is on the trusted network, traffic should not go through the DMZ 🚧. Current firewall and DMZ deployments assume only a small slice of total enterprise traffic goes through the DMZ. Routing through the DMZ usually means every packet gets stateful inspection by the firewalls there, and the DMZ is assumed to be less secure than the internal network. So the DMZ design only lets the least possible traffic through, which is just the traffic between the trusted network and the external network. Making all normal traffic to mobile nodes cross the DMZ would totally undo that design 🙅♀️.
- When the mobile node is on the trusted network and uses a wireless access technology, the particular access technology provides confidentiality protection for the data traffic 📶. In some networks, confidentiality protection MAY be available between the mobile node and the first hop access router. In that case, it is not required at layer 2 🫧.
This document also has a solution for the mobile node to figure out when it's on a trusted network. That way, it can drop the IPsec tunnel and use Mobile IP inside the intranet 🏠.
Last but not least, IPsec VPN gateways that use IKEv1 [RFC2409] are not covered in this document. Sorry IKEv1 fans 🙈.
2. Terminology 📖
Okay, so the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. These are the official requirement-level words, so read them carefully 🧐.
A lot of the following terms are defined in [RFC5265], but they're repeated here so this document can stand on its own 💅.
FA: Mobile IPv4 foreign agent 🛬.Co-CoA: co-located care-of address 📍.FA-CoA: foreign agent care-of address 🏷️.FW: firewall 🔥.i-FA: Mobile IPv4 foreign agent residing in the trusted (intranet) network 🏢.i-HA: Mobile IPv4 home agent residing in the trusted (intranet) network 🏠.i-MIP: The mobile node uses the home agent in the internal network 🧚.VPN-TIA: VPN tunnel inner address. This address is given out by the VPN gateway during IKE negotiation and is routable in the trusted network 🎟️.mVPN: VPN with MOBIKE functionality 🦋.
The following access modes are used to explain the protocol. They're explained in more detail in [RFC5265], so go check there if you want the full tea ☕.
f: i-MIP with FA-CoA 🌸.c: i-MIP with Co-CoA 🍓.mc: i-MIP with MOBIKE-enabled VPN, with VPN-TIA as Co-CoA 💜.
3. Solution Overview ✨
okay so the mobile node gets a home address that stays exactly the same whether it's chilling inside the enterprise network or outside it 🏠💖. It's also reachable at that same home address no matter where it's currently plugged in 🦋. When it's connected straight to the intranet, it uses Mobile IP for internal mobility 🌸.
when it roams and connects to an untrusted network outside the enterprise, it sets up a VPN tunnel to the VPN gateway 🔐. but it still keeps a valid binding cache entry at the i-HA ✨. it uses the VPN-TIA, which the VPN gateway allocates, as the co-located CoA for registering with the i-HA. if the VPN-TIA changes, or if the mobile node moves and connects to a different VPN gateway, it sends a Registration Request to the i-HA using the new co-located CoA 💅.
if the mobile node moves while it's outside the enterprise and its access network changes, it uses the MOBIKE protocol to tell the VPN gateway its current address 🫶. the internal home agent doesn't notice the movement as long as the mobile node stays attached to the same VPN gateway and the TIA stays the same 👑.
Figure 1 shows the network topology assumed for the solution, and it also shows the possible mobile node locations and access modes 🧚.
{home} (MN) [i-HA]
\ /
.-+---+-.
( )
[mVPN] `--+----'
! !
.--+--. [R]
( DMZ ) !
.-+-------+--. `--+--' .-----+------.
( ) ! ( )
( external net +---[R]----[FW]----[R]--+ internal net )
( ) ( )
`--+---------' `---+---+----'
/ / \
[DHCP] [R] [DHCP] [R] [R] [i-FA]
\ / \ / \ /
.+--+---. .-+-+--. .--+--+-.
( ) ( ) ( )
`---+---' `--+---' `---+---'
! ! !
(MN) {mc} (MN) {c} (MN) {f}
Figure 1: Network Topology Using MIPv4 and MOBIKEso the solution ends up with a Mobile IP tunnel living inside an IPsec tunnel 🎀. the Mobile IP tunnel runs between the mobile node and the home agent, and the IPsec tunnel runs between the mobile node (MN) and the mVPN gateway. the mobile node MUST reverse tunnel through the home agent [RFC3024] when the Mobile IP tunnel is inside an IPsec tunnel 💜.
the overhead of running a Mobile IP tunnel inside an IPsec tunnel can be avoided by putting the Mobile IP foreign agent functionality on the VPN gateway 🍓. that's out of scope for this document, and it's described further in [MEGHANA] 🙈.
whenever the mobile node attaches to a new link, it may run into a foreign agent 👀. the mobile node MUST not use the foreign agent care-of address with the i-HA when it's attached to an untrusted access network 🚫. the default behavior is for the mobile node to always configure an address from the access link using DHCP 🌈. then it checks whether it's attached to a trusted access network by sending a Registration Request to the i-HA in co-located care-of address mode 🔍. if it discovers that it's on a trusted access network, then it MAY start using a foreign agent care-of address with the i-HA ⭐. to do that, the mobile node has to do a new registration with the i-HA 📝.
the mobile node can use a foreign agent on an untrusted access network, as long as there's an external home agent it's able to use 🌍. running an external home agent in the untrusted access network and a home agent in the trusted access network at the same time is covered in detail in [RFC5265] 🧠.
some IPsec VPN implementations let a host send traffic directly to the Internet while it's attached to an untrusted network 😬. that traffic skips the IPsec tunnel with the VPN gateway. this document doesn't stop that traffic from leaving the host, but that traffic gets no mobility or session continuity 💀. any data traffic sent through the Mobile IP tunnel with the home agent always goes through the VPN gateway 💅✨.
3.1. Access Modes
the following access modes are used in the solution described in this document 🎟️.
3.1.1. Access Mode: 'c'
this access mode is standard Mobile IPv4 [RFC3344] with a co-located care-of address 🌷. the mobile node must detect that it's connected to an internal trusted network before using this mode 🏢. the co-located care-of address is assigned by the access network the mobile node is attached to 🦋.
3.1.2. Access Mode: 'f'
this access mode is standard Mobile IPv4 [RFC3344] with a foreign agent care-of address 🌸. the mobile node can only use this mode when it detects that it's connected to an internal trusted network AND it also detects a foreign agent on the access network 👑.
3.1.3. Access Mode: 'mc'
this one is the big mood 💖. it involves using both Mobile IPv4 and a MOBIKE-enabled IPsec VPN gateway, which gives you a Mobile IP tunnel inside an IPsec tunnel 🔐. the mobile node uses the VPN-TIA as the co-located CoA when it registers with the home agent 🫶. this mode is only used when the mobile node is attached to an untrusted network and needs to set up an IPsec tunnel with a VPN gateway to get access to the trusted network 🏰.
3.2. Mobility within the Enterprise
when the mobile node is inside the enterprise network and attached to the intranet, it uses Mobile IPv4 [RFC3344] for subnet mobility 🏢✨. it always configures a care-of address through DHCP on the access link and uses that as the co-located care-of address 🎀. the mobile node MAY use a foreign agent care-of address if a foreign agent is available 🧚. however, the foreign agent care-of address only gets used when the mobile node is attached to the trusted access network 🔒. the mobile node tries Foreign Agent discovery and CoA address acquisition through DHCP at the same time, so it doesn't get stuck waiting on a foreign agent that isn't there ⏱️. the mobile node keeps a valid binding cache entry at all times at the home agent, mapping the home address to the current CoA 💜. whenever the mobile node moves, it sends a Registration Request to update the binding cache entry 📬.
the Mobile IP signaling messages between the mobile node and the home agent are authenticated as described in [RFC3344] 🛡️.
the mobile node keeps a valid binding cache entry at the home agent even when it's outside the enterprise network 🌍💖.
3.3. Mobility When outside the Enterprise
when the mobile node is attached to an untrusted network, it sets up an IPsec VPN tunnel with the VPN gateway so it can get into the enterprise network 🔐🌸. if the mobile node moves and its IP address changes, it starts the MOBIKE protocol [RFC4555] to update the address on the VPN gateway 🦋.
the mobile node keeps a binding at the home agent even when it's outside the enterprise network 🫶. if the TIA changes because the mobile node reconnects to the VPN gateway or attaches to a different VPN gateway, the mobile node should send a Registration Request to its home agent to update the binding cache with the new TIA 💅.
3.4. Crossing Security Boundaries
security boundary detection is based on whether the i-HA can be reached from the mobile node's current point of attachment 🚧. whenever the mobile node notices a change in network connectivity, it sends a Registration Request to the i-HA without any VPN encapsulation 📨. if it gets a Registration Reply with the Trusted Networks Configured (TNC) extension from the i-HA, then it assumes it's on a trusted network 🥳. the TNC extension is described in [RFC5265] 📖. the mobile node MUST check that the Registration Reply is integrity protected using the mobile node-home agent mobility security association before it concludes it's attached to a trusted network 🔍. this security boundary detection is based on the mechanism described in [RFC5265] to detect attachment to the internal trusted network 💜. the mobile node should re-transmit the Registration Request if it doesn't get the Registration Reply within a timeout period ⏳. how many times the mobile node should re-transmit the Registration Request, and the timeout period for getting the Registration Reply, are configurable on the mobile node ⚙️.
when the mobile node is attached to an untrusted network and using an IPsec VPN to reach the enterprise network, sending a Registration Request to the i-HA without VPN encapsulation would take some interaction between the IPsec and MIPv4 modules on the mobile node 🤓. that happens locally inside the mobile node and it's out of scope for this document 🙈.
if the mobile node has an existing VPN tunnel to its VPN gateway, it MUST send a MOBIKE message at the same time as the registration request to the i-HA whenever the IP address changes 📣. if the mobile node gets a response from the VPN gateway but not from the i-HA, it assumes it's outside the enterprise network 🌍. if it gets a response from the i-HA, then it assumes it's inside the enterprise network 🏠.
there could also be some out-of-band mechanisms, like configuring the wireless access points with information the mobile node can recognize as access points that belong to the trusted network in an enterprise network 📡. those mechanisms are beyond the scope of this document 🙃.
the mobile node should not send any normal traffic while it's trying to figure out whether it's attached to the trusted or untrusted network 🤫. this is described in more detail in [RFC5265] 📚.
3.4.1. Operation When Moving from an Untrusted Network
when the mobile node is outside the enterprise network and attached to an untrusted network, it has an IPsec VPN tunnel with its mobility aware VPN gateway, plus a valid registration with a home agent on the intranet, using the VPN-TIA as the care-of address 🎀✨.
if the mobile node moves and its IP address changes, it does the following steps 🏃♀️💨:
1a. Start an IKE mobility exchange to update the VPN gateway with the current address. If the new network is also untrusted, this is enough to set up connectivity 🌐. if the new network is trusted and the VPN gateway is reachable, this exchange lets the mobile node keep the VPN state alive while it's on the trusted side 🫶. if the VPN gateway isn't reachable from inside, then this exchange will fail 💀.
1b. At the same time as step 1, send a Mobile IPv4 Registration Request to the internal home agent without VPN encapsulation 📨.
2. If the mobile node receives a Registration Reply to the request sent in step 1b, then the current subnet is a trusted subnet, and the mobile node can communicate without VPN tunneling 🥳. the mobile node MAY tear down the VPN tunnel 💅🌈.
3.4.2. Operation When Moving from a Trusted Network 🏠
Okay, so when the mobile node is inside the enterprise and plugged into the intranet, it does not use a VPN tunnel for data traffic. Lowkey iconic, right? It has a valid binding cache entry at its home agent 💜. If the VPN gateway is reachable from the trusted network, the mobile node MAY have valid IKEv2 security associations with its VPN gateway ✨. The IPsec security associations can be created when required, and the mobile node may have to re-negotiate the IKEv2 security associations so they don't expire ⏰.
If the mobile node moves and its IP address changes, it does the following steps, no cap 🫶:
- Initiate an IKE mobility exchange to update the VPN gateway with the current address, or if there is no VPN connection, then establish a VPN tunnel with the gateway from the new local IP address. If the new network is trusted, and if the VPN gateway is reachable, this exchange will allow the mobile node to keep the VPN state alive, while in the trusted side. If the new network is trusted and if the VPN gateway is not reachable from inside, then this exchange will fail 😭.
- At the same time as step 1, send a Mobile IPv4 Registration Request to the internal home agent without VPN encapsulation 📨.
- If the mobile node receives a Registration Reply to the request sent in step 2, then the current subnet is a trusted subnet, and the mobile node can communicate without VPN tunneling, using only Mobile IP with the new care-of address 🌸. Main character energy!
- If the mobile node didn't receive the response in step 3, and if the VPN tunnel is successfully established and registered in step 1, then the mobile node sends a Registration Request over the VPN tunnel to the internal home agent. After receiving a Registration Reply from the home agent, the mobile node can start communicating over the VPN tunnel with the Mobile IP home address 🔐.
4. NAT Traversal 🌐
Okay, so there could be a Network Address Translation (NAT) device between the mobile node and the home agent in any of the access modes, 'c', 'f', and 'mc', and between the mobile node and the VPN gateway in the access mode 'mc' 👀. Mobile IPv4 NAT traversal, as described in [RFC3519], should be used by the mobile node and the home agent in access modes 'c' or 'f', when there is a NAT device present 🦋. When using access mode, 'mc', IPsec NAT traversal [RFC3947] [RFC3948] should be used by the mobile node and the VPN gateway, if there is a NAT device present 🔁.
Typically, the TIA would be a routable address inside the enterprise network 🏢. But in some cases, the TIA could be from a private address space associated with the VPN gateway. In such a case, Mobile IPv4 NAT traversal should be used in addition to IPsec NAT traversal in the 'mc' mode 🧩. It's giving layers, bestie 🎀.
5. Security Considerations 🔒
Okay, serious moment, bestie 😤. Enterprise connectivity typically requires very strong security, and the solution described in this document was designed keeping this in mind 💅.
Security concerns related to the mobile node detecting that it is on a trusted network and thereafter dropping the VPN tunnel are described in [RFC5265]. Read that one, it's a whole thing 📚.
🚨 Heads up: when the mobile node sends a Registration Request to the i-HA from an untrusted network that does not go through the IPsec tunnel, it will reveal the i-HA's address, its own identity including the NAI and the home address, and the Authenticator value in the authentication extensions to the untrusted network. This may be a concern in some deployments 💀. Not me exposing my whole identity to a random coffee shop Wi-Fi 🙈.
Please see [RFC4555] for MOBIKE-related security considerations, and [RFC3519], [RFC3947] for security concerns related to the use of NAT traversal mechanisms for Mobile IPv4 and IPsec 🛡️.
6. Acknowledgments 🫶
The authors would like to thank Henry Haverinen, Sandro Grech, Dhaval Shah, and John Cruz for their participation in developing this solution 💖.
The authors would also like to thank Henrik Levkowetz, Jari Arkko, TJ Kniveton, Vidya Narayanan, Yaron Sheffer, Hans Sjostrand, Jouni Korhonen, and Sami Vaarala for reviewing the document 🌟. Such a iconic group of reviewers, honestly 👑.
7. References 📚
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3344] Perkins, C., "IP Mobility Support for IPv4", RFC 3344,
August 2002.
[RFC4555] Eronen, P., "IKEv2 Mobility and Multihoming Protocol
(MOBIKE)", RFC 4555, June 2006.
[RFC4306] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
RFC 4306, December 2005.
[RFC4301] Kent, S. and K. Seo, "Security Architecture for the
Internet Protocol", RFC 4301, December 2005.
[RFC5265] Vaarala, S. and E. Klovning, "Mobile IPv4 Traversal across
IPsec-Based VPN Gateways", RFC 5265, June 2008.7.2. Informative References
[RFC4093] Adrangi, F. and H. Levkowetz, "Problem Statement: Mobile
IPv4 Traversal of Virtual Private Network (VPN) Gateways",
RFC 4093, August 2005.
[RFC3024] Montenegro, G., "Reverse Tunneling for Mobile IP,
revised", RFC 3024, January 2001.
[MEGHANA] Sahasrabudhe, M. and V. Devarapalli, "Optimizations to
Secure Connectivity and Mobility", Work in Progress,
February 2008.
[RFC3519] Levkowetz, H. and S. Vaarala, "Mobile IP Traversal of
Network Address Translation (NAT) Devices", RFC 3519,
April 2003.
[RFC3947] Kivinen, T., Swander, B., Huttunen, A., and V. Volpe,
"Negotiation of NAT-Traversal in the IKE", RFC 3947,
January 2005.
[RFC3948] Huttunen, A., Swander, B., Volpe, V., DiBurro, L., and M.
Stenberg, "UDP Encapsulation of IPsec ESP Packets",
RFC 3948, January 2005.
[RFC2409] Harkins, D. and D. Carrel, "The Internet Key Exchange
(IKE)", RFC 2409, November 1998.Appendix A. Applicability to a Mobile Operator Network 📡
The solution described in this document can also be applied to a Mobile Operator's network when the Operator deploys heterogeneous access networks and some of the access networks are considered as trusted networks and others as untrusted networks 🗼. Figure 2 illustrates such a network topology 🖼️.
+----------------------+
| +----+ |
+----------------+ | |i-HA| |
| | | +----+ |
(MN)----+ trusted +---+ |
| access network | | internal network |
+----------------+ | |
| |
+----------+-----------+
|
|
|
[mVPN]
+----------------+ |
| | |
(MN)----+ untrusted +--------------+
{mc} | access network |
+----------------+ Figure 2: Network Topology of a Mobile Operator with Trusted and
Untrusted NetworksAn IPsec VPN gateway provides secure connectivity to the Operator's internal network for mobile nodes attached to an untrusted access network 🔐. The VPN gateway supports MOBIKE extensions so that the IPsec tunnels survive any IP address change when the mobile node moves while attached to the untrusted access networks 🦋. Tunnels that don't snap when you move, periodt 💅.
When the mobile node is attached to the trusted access network, it uses Mobile IP with the i-HA 🏠. It uses the IP address obtained from the trusted access network as the co-located care-of address to register with the i-HA. If a foreign agent is available in the trusted access network, the mobile node may use a foreign agent care-of address 🧚. If the mobile node moves and attaches to an untrusted access network, it sets up an IPsec tunnel with the VPN gateway to access the Operator's internal network. It uses the IPsec TIA as the co-located care-of address to register with the i-HA, thereby creating a Mobile IP tunnel inside an IPsec tunnel 🪆. Tunnels inside tunnels, iykyk 🌈.
When the mobile node is attached to the trusted access network, it can either be attached to a foreign link in the trusted network or to the home link directly. This document does not impose any restrictions ✨.
Authors' Addresses ✍️
Vijay Devarapalli
Wichorus
3590 North First Street
San Jose, CA 95134
USA
EMail: vijay@wichorus.com
Pasi Eronen
Nokia Research Center
P.O. Box 407
FIN-00045 Nokia Group
Finland
EMail: pasi.eronen@nokia.comFull Copyright Statement ©️
Copyright (C) The IETF Trust (2008).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights 📜.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE ⚠️. Legal stuff, but it matters 💅.
Intellectual Property 💡
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79 📖.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr 🔗.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org 💌. And that's the tea, bestie 🍓✨.
📦 where this page comes from
- ietf: rfc5266 2008-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms