RFC 6994
Shared Use of Experimental TCP Options
RFC 6994: Shared Use of Experimental TCP Options 💖
Internet Engineering Task Force (IETF) 🌸 this one is by J. Touch from USC/ISI, and it's Request for Comments: 6994. It's a Standards Track doc, dated August 2013, with ISSN 2070-1721. The title block doesn't list anything it obsoletes or updates, so it's standing on its own, no cap 💅
Abstract ✨
okay so this doc is about how the experimental TCP option codepoints can support multiple TCP extensions at once, even in the same connection 😭 It does that with a brand new IANA TCP experiment identifier. The approach is solid even for experiments that aren't registered, and for ones that don't use this sharing mechanism at all. It is recommended for all new TCP options that use these codepoints 🫶
Status of This Memo 🎀
This is an Internet Standards Track document.
This doc is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, and it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 5741 🦋
Info about the current status of this doc, any errata, and how to send feedback is at http://www.rfc-editor.org/info/rfc6994.
Copyright Notice 💜
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the date this document was published. Please read these carefully, because they explain your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 🙈
Table of Contents 🧚
1. Introduction ....................................................2
2. Conventions Used in This Document ...............................3
3. TCP Experimental Option Structure ...............................4
3.1. Selecting an ExID ..........................................5
3.2. Impact on TCP Option Processing ............................6
4. Reducing the Impact of False Positives ..........................7
5. Migration to Assigned Options ...................................7
6. Rationale .......................................................8
7. Security Considerations .........................................9
8. IANA Considerations .............................................9
9. References .....................................................10
9.1. Normative References ......................................10
9.2. Informative References ....................................10
10. Acknowledgments ...............................................111. Introduction 🦋
okay so TCP has options that let you turn on new protocol capabilities, but only where they're needed and supported [RFC793]. The thing is, the space for identifying these options is tiny. There are 256 values, and only 30 are assigned as of this doc's publication [IANA]. Two of those codepoints (253, 254) are set aside for experiments [RFC4727]. They're meant for testing, or for when an assigned codepoint isn't warranted or isn't available, like when the capability is still Experimental or Informational instead of Standards Track 💅
Here, "experimental TCP options" means options that use the TCP experimental option codepoints [RFC4727]. Those experiments can be described in an RFC of any status (Experimental, Informational, etc.). They're meant for controlled environments, and they're allowed in public deployments as long as they aren't enabled by default [RFC3692]. Nothing stops multiple experiments from running in the same environment, controlled or public 🌈 Some protocols are specified in Experimental or Informational RFCs, and those might include parameters or design choices that aren't fully understood yet, or that might not be widely deployed [RFC2026]. Usually these TCP options can't get assigned codepoints [RFC2780], so they need a way to share the experimental ones ✨
Right now there's no mechanism for sharing the TCP experimental option codepoints. That's true whether different experiments are on different connections, or when more than two experimental options show up in the same connection 😭 Experimental options 253 and 254 are already deployed in operational code to support an early version of TCP authentication. Option 253 is also documented for the experimental TCP Cookie Transaction option [RFC6013]. Sharing like this causes collisions, where one codepoint can show up multiple times in a single TCP segment and nobody can tell which use is which. Total mess, bestie 💀
Some codepoints have been used without being assigned (called "squatting"). The notable ones are 31-32 (TCP cookie transactions, as first distributed and in its API doc) and 76-78 (tcpcrypt) [Bi11] [Si11]. Commercial products also reportedly use unassigned options 33, 69-70, and 76-78. These uses aren't authorized, but they still hurt the legit assignees right now 😤
Both kinds of misuse (squatting on experimental and on assigned codepoints) are expected to keep happening. There are still a few ways to ease the damage for the folks who play by the rules. One proposal relaxes the requirements for assignment of TCP options, so protocols that haven't gone through the IETF process can be assigned more easily [RFC5226]. Another proposal gives a bigger pool to the TCP experiment option codepoints and manages sharing through IANA coordination [Ed11] 🎀
The approach in this document doesn't need any extra TCP option codepoints. It's robust to people who don't support it or don't register their experiments. The solution adds a field to the experimental TCP option structure. That field holds an "experiment identifier" (ExID) defined as part of a specific option experiment. The ExID lowers the chance of collisions between independent experiments that use the same option codepoint. This works for people who follow this doc (with registered ExIDs) and for people who don't (squatters who ignore this extension or don't register their ExIDs) 🧚
The solution in this document is recommended for all new protocols that use TCP experimental option codepoints. The techniques here may also enable shared use of other experimental codepoints, but that's out of scope for this doc 💅
2. Conventions Used in This Document 💖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
These words only carry that RFC 2119 meaning when they're in ALL CAPS. Lowercase uses of these words don't have RFC 2119 significance, so don't read into them 🙈
Also, in this doc, a >> in front of an indented line marks a compliance requirement that uses the key words above. That makes it easy for reviewers to spot the explicit compliance requirements in this RFC 🔥
3. TCP Experimental Option Structure 🌸
TCP options have the current common structure [RFC793]. The first byte is the codepoint (Kind), and the second byte is the length of the option in bytes (Length):
0 1 2 3
01234567 89012345 67890123 45678901
+--------+--------+--------+--------+
| Kind | Length | ... |
+--------+--------+--------+--------+
| ...
+--------Figure 1. TCP Option Structure [RFC793]
This doc extends the option structure for the experimental codepoints (253, 254) with an experiment identifier (ExID). The ExID is either 2 or 4 bytes long. It's used to tell experiments apart, and it's the first field after Kind and Length, like this:
0 1 2 3
01234567 89012345 67890123 45678901
+--------+--------+--------+--------+
| Kind | Length | ExID |
+--------+--------+--------+--------+
| option contents...
+--------+--------+--------+---Figure 2. TCP Experimental Option with a 16-bit ExID
0 1 2 3
01234567 89012345 67890123 45678901
+--------+--------+--------+--------+
| Kind | Length | ExID |
+--------+--------+--------+--------+
| ExID (con't) | option contents...
+--------+--------+--------+---Figure 3. TCP Experimental Option with a 32-bit ExID
This mechanism is encouraged for all TCP options that aren't eligible for assigned codepoints yet. Here's the rule for those:
>> Protocols that need new TCP option codepoints but aren't eligible for assigned values SHOULD use the existing TCP experimental option codepoints (253, 254) with ExIDs, as described in this document. ✨
This mechanism is also encouraged for all TCP options using the current experimental codepoints in controlled environments. Here's that rule:
>> All protocols using the TCP experimental option codepoints (253, 254), even ones deployed in controlled environments, SHOULD use ExIDs as described in this document. 💅
This mechanism is required for all TCP options using the current experimental codepoints that are deployed publicly, whether they're enabled by default or not. Here's the rule:
>> All protocols using the TCP experimental option codepoints (253, 254) that are deployed outside controlled environments, such as on the public Internet, MUST use ExIDs as described in this document. 😭
Once a TCP option uses the mechanism in this document, registering the ExID with IANA is required. Here's the rule for that:
>> All protocols using ExIDs as described in this document MUST register those ExIDs with IANA. 🔥
Applicants register their desired ExID by contacting IANA [IANA] 🫶
3.1. Selecting an ExID 💖
okay so ExIDs get picked at design time, when the protocol designer first implements or specifies the experimental option 🎀 They can be 16 bits or 32 bits, and in both cases the value sits in the header in network-standard (big-endian) byte order. ExIDs are lowkey a mashup of IANA registered codepoints and "magic numbers" ✨
All ExIDs MUST be either 16 bits or 32 bits long.
Using an ExID, whether it's 16 bit or 32 bit, helps cut down the chance of a false positive collision with people who either don't register their experiment or don't implement this mechanism 🙈
To conserve TCP option space, whether that's for one specific option or so there's room for other options 🫶:
Options implementing the mechanism of this document SHOULD use 16-bit ExIDs, except where explicitly motivating the need for 32-bit ExIDs, e.g., to avoid false positives or maintain alignment with an expected future assigned codepoint.
ExIDs get registered with IANA on a "first come, first served" (FCFS) basis, based on the first two bytes 🍓 Those two bytes are enough to figure out which experimental option is in the option field, so that's the main event 👑
All ExIDs MUST be unique based on their first 16 bits.
The second two bytes are the "magic number" 🌈 A magic number is a self-picked codepoint whose whole thing is being unlikely to collide with what someone else picked. Other protocols do this too, like bootstrap protocol (BOOTP) [RFC951] and DHCP [RFC2131] 💅
Those extra magic number bytes also help the option contents line up in the TCP header the same way they would if (or when) a regular, non-experiment TCP option codepoint gets assigned ✨ Matching alignment cuts down on implementation errors, especially around the same word-alignment padding, if the same software gets changed later to use a conventional codepoint 🧚 And the longer 32-bit ExID lowers the chance of a false positive even more compared to a shorter 16-bit ExID 💜
Using an ExID does eat TCP option space, but it lets the experimental codepoints run side by side and protects against false positives. The tradeoff is that less space is left for other options, including other experiments 😭 A 32-bit ExID takes up more space, but gives more protection against false positives.
3.2. Impact on TCP Option Processing 🦋
The ExID is considered part of the TCP option, not the TCP option header 🎀 Having an ExID bumps the effective option Length field up by the size of the ExID. That means implementations that don't support TCP options can't see it, so it's totally transparent to them 🌸
During TCP processing, the ExIDs in experimental options get matched against the ExIDs for each implemented protocol 💖 The rest of the option is defined by that particular experimental protocol.
Experimental options with ExIDs that do not match implemented protocols MUST be ignored.
The ExID mechanism has to be coordinated during connection establishment, just like any other TCP option ✨
TCP ExID, if used in any TCP segment of a connection, MUST be present in TCP SYN segments of that connection.
TCP experimental option ExIDs, if used in any TCP segment of a connection, SHOULD be used in all TCP segments of that connection in which any experimental option is present.
Using an ExID takes up extra space in the TCP header and means experimental protocols need extra processing 🙈 Since these are experiments, neither of those is a huge deal 💅 A finalized protocol can dodge both problems later by getting a dedicated option codepoint assigned 👑
4. Reducing the Impact of False Positives 🛡️
okay so false positives happen when the registered ExID of an experiment matches the value of an option that doesn't use ExIDs 💀 That kind of collision can make an option get handled by the wrong processing routine, which is so not it 😭 Checksums or signatures might help an experiment use the shorter ExID while dialing down the extra false positive risk that comes with it 🔥
Experiments that are not robust to ExID false positives SHOULD implement other detection measures, such as checksums or minimal digital signatures over the experimental options they support.
5. Migration to Assigned Options 🦋
Some experiments might graduate from being experimental and become eligible for an assigned TCP option codepoint ✨ This document doesn't recommend a specific migration plan for moving from the experimental TCP options/ExIDs over to an assigned codepoint 🌸
Still, once an assigned codepoint is allocated, using an ExID is just extra overhead it doesn't need 🧚 So:
Once a TCP option codepoint is assigned to a protocol, that protocol SHOULD NOT continue to use an ExID as part of that assigned codepoint.
This document doesn't say whether or how an implementation of an assigned codepoint can stay backward compatible with the experimental codepoint/ExID 🤷♀️
Some implementers might be tempted to put both the experimental and assigned codepoints in the same segment, like in a SYN to keep backward compatibility during connection establishment 🙈 That's a poor use of limited resources, so to keep the TCP option space conserved:
A TCP segment MUST NOT contain both an assigned TCP option codepoint and a TCP experimental option codepoint for the same protocol.
Instead, a TCP that wants backward compatibility could send multiple SYNs with alternates of the same option, then throw out all but the most desired successful connection 💅 Yes, that can resolve more slowly or take extra effort at the endpoints, but it's still way better than burning through TCP option space 💜
6. Rationale 🌈
The ExIDs in this document mix the properties of IANA FCFS-registered values with magic numbers ✨ IANA FCFS registries are super common, but so are people who either fail to register or who 'squat' by deliberately using codepoints that belong to someone else 😤 This approach is meant to recognize that reality and handle the fallout better than a conventional IANA FCFS registry would 👑
The ID spaces considered as ExIDs while developing this mechanism included the IEEE Organizationally Unique Identifier (OUI) and IANA Private Enterprise Numbers (PENs) [IEEE802] [OUI] [RFC1155] 🎀
OUIs are 24-bit identifiers that get combined with 24 to 40 bits of privately assigned space to make identifiers that are commonly assigned to one unique piece of hardware 🧚 OUIs are already longer than the smaller ExID value, and getting one is pricey (currently $1,885.00 USD) 💀 You could get an OUI for each experiment, but that could be considered expensive 😭 An OUI already assigned to an organization could be shared if extended to support multiple experiments within that organization, but that would either need coordination inside the organization or an IANA registry. The first is prohibitive, and the second is more complicated than just having IANA manage the entire space 🙅♀️
PENs were originally used in the Simple Network Management Protocol (SNMP) [RFC1157] 🌸 PENs are identifiers you can get from IANA for free [PEN] ✨ Even with the current registry, the size of the PEN assignment space is currently undefined and has only recently been proposed (as 32 bits) [IANA-PEN] 🤔 PENs are currently assigned to organizations, and there's no current process for assigning them to individuals 💅 And if PENs end up being 32 bits as expected, they'd be bigger than needed in lots of cases 🫶
7. Security Considerations 🔐
The mechanism described in this document is not intended to enhance the existing state of security for TCP option processing, and it doesn't weaken it either 🛡️ Nothing here changes the security picture, so no new vibes of danger, bestie 💜
8. IANA Considerations 📋
IANA has created a "TCP Experimental Option Experiment Identifiers (TCP ExIDs)" registry 🎀 The registry records both 16-bit and 32-bit ExIDs, plus a reference (a description, a document pointer, or an assignee name and e-mail contact) for each entry 💖 ExIDs are registered for use with both TCP experimental option codepoints, meaning the TCP options with values of 253 and 254 ✨
Entries are assigned on a First Come, First Served (FCFS) basis [RFC5226] 👑 The registry runs FCFS on the first two bytes of the ExID (in network-standard order), but records the entire ExID (also in network-standard order) 🧚 Some examples:
0x12340000collides with a previous registration of0x1234abcd0x5678collides with a previous registration of0x567801230xabcd1234collides with a previous registration of0xabcd
IANA will advise applicants of duplicate entries to pick an alternate value, as per typical FCFS processing 💅
IANA will record known duplicate uses to help the community debug assigned uses and fix unauthorized duplicate uses 🔍
IANA should impose no requirements on making a registration other than indicating the desired codepoint and providing a point of contact 🌈 A short description or acronym for the use is desired but should not be required 🫶
9. References 📚
9.1. Normative References 🦋
[RFC793] Postel, J., "Transmission Control Protocol", STD 7, RFC
793, September 1981.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4727] Fenner, B., "Experimental Values In IPv4, IPv6, ICMPv4,
ICMPv6, UDP, and TCP Headers", RFC 4727, November 2006.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226,
May 2008.9.2. Informative References ✨
okay bestie, here are the informative references 📚🫶 these are the extra reads that help you understand the vibe, but nothing in them is a requirement 💅
[Bi11] Bittau, A., Boneh, D., Hamburg, M., Handley, M., Mazieres,
D., and Q. Slack, "Cryptographic protection of TCP
Streams", Work in Progress, September 2012.
[Ed11]
Eddy, W., "Additional TCP Experimental-Use Options", Work
in Progress, August 2011.
[IANA] IANA, <http://www.iana.org/>.
[IANA-PEN] Liang, P. and A. Melnikov, "Private Enterprise Number
(PEN) Practices and Internet Assigned Numbers: Authority
(IANA) Considerations for Registration Procedures", Work
in Progress, June 2012.
[IEEE802] IEEE, "IEEE Standard for Local and Metropolitan Area
Networks: Overview and Architecture", IEEE 802-2001, 8
March 2002.
[OUI] IEEE, "Organizationally Unique Identifier (OUI) or
'Company_ID'",
<http://standards.ieee.org/develop/regauth/oui/>.
[PEN] IANA, "Private Enterprise Numbers",
<http://www.iana.org/assignments/enterprise-numbers>.
[RFC951] Croft, W. and J. Gilmore, "Bootstrap Protocol", RFC 951,
September 1985.
[RFC1155] Rose, M. and K. McCloghrie, "Structure and Identification
of Management Information for TCP/IP-Based Internets", STD
16, RFC 1155, May 1990.
[RFC1157] Case, J., Fedor, M., Schoffstall, M., and J. Davin,
"Simple Network Management Protocol (SNMP)", RFC 1157, May
1990.
[RFC2026] Bradner, S., "The Internet Standards Process -- Revision
3", BCP 9, RFC 2026, October 1996.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC
2131, March 1997.
[RFC2780] Bradner, S. and V. Paxson, "IANA Allocation Guidelines For
Values In the Internet Protocol and Related Headers", BCP
37, RFC 2780, March 2000.
[RFC3692] Narten, T., "Assigning Experimental and Testing Numbers
Considered Useful", BCP 82, RFC 3692, January 2004.
[RFC6013] Simpson, W., "TCP Cookie Transactions (TCPCT)", RFC 6013,
January 2011.
[Si11] Simpson, W., "TCP Cookie Transactions (TCPCT) Sockets
Application Program Interface (API)", Work in Progress,
April 2011.These are all the references we're pulling in, so you can go chase any of them 🦋
10. Acknowledgments 🌸
this doc was motivated by discussions on the IETF TCPM mailing list and by Wes Eddy's proposal [Ed11] 💜 huge thanks to Yoshifumi Nishida, Pasi Sarolathi, and Michael Scharf for giving such detailed feedback ✨🙌
this document was originally prepared using 2-Word-v2.0.template.dot 💖
Author's Address 🧚
Joe Touch
USC/ISI
4676 Admiralty Way
Marina del Rey, CA 90292-6695 U.S.A.
Phone: +1 (310) 448-9151
EMail: touch@isi.eduand that's the whole spec, bestie 🌈👑 periodt 💅
📦 where this page comes from
- ietf: rfc6994 2013-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms