idnits 2.17.1 draft-iab-service-id-considerations-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- == No 'Intended status' indicated for this document; assuming Proposed Standard == It seems as if not all pages are separated by form feeds - found 0 form feeds but 8 pages Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) ** The document seems to lack separate sections for Informative/Normative References. All references will be assumed normative when checking for downward references. ** There are 20 instances of too long lines in the document, the longest one being 1 character in excess of 72. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (May 10, 2003) is 7655 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) ** Obsolete normative reference: RFC 793 (ref. '3') (Obsoleted by RFC 9293) ** Obsolete normative reference: RFC 2401 (ref. '5') (Obsoleted by RFC 4301) ** Obsolete normative reference: RFC 2406 (ref. '6') (Obsoleted by RFC 4303, RFC 4305) ** Obsolete normative reference: RFC 2960 (ref. '8') (Obsoleted by RFC 4960) -- Possible downref: Non-RFC (?) normative reference: ref. '10' -- Possible downref: Non-RFC (?) normative reference: ref. '11' -- Possible downref: Non-RFC (?) normative reference: ref. '12' -- Possible downref: Non-RFC (?) normative reference: ref. '13' Summary: 8 errors (**), 0 flaws (~~), 3 warnings (==), 6 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 1 Internet Architecture Board M. St Johns, Ed. 2 Internet-Draft G. Huston, Ed. 3 Expires: November 8, 2003 IAB 4 May 10, 2003 6 Considerations on the use of a Service Identifier in Packet Headers 7 draft-iab-service-id-considerations-01.txt 9 Status of this Memo 11 This document is an Internet-Draft and is in full conformance with 12 all provisions of Section 10 of RFC2026. 14 Internet-Drafts are working documents of the Internet Engineering 15 Task Force (IETF), its areas, and its working groups. Note that other 16 groups may also distribute working documents as Internet-Drafts. 18 Internet-Drafts are draft documents valid for a maximum of six months 19 and may be updated, replaced, or obsoleted by other documents at any 20 time. It is inappropriate to use Internet-Drafts as reference 21 material or to cite them other than as "work in progress." 23 The list of current Internet-Drafts can be accessed at http:// 24 www.ietf.org/ietf/1id-abstracts.txt. 26 The list of Internet-Draft Shadow Directories can be accessed at 27 http://www.ietf.org/shadow.html. 29 This Internet-Draft will expire on November 8, 2003. 31 Copyright Notice 33 Copyright (C) The Internet Society (2003). All Rights Reserved. 35 Abstract 37 This memo describes some considerations relating to the use of IP 38 protocol number fields and payload protocol (e.g. TCP) port fields 39 to identify particular services that may be associated with that port 40 number or protocol number. 42 1. Introduction 44 This memo describes some considerations relating to the use of IP 45 protocol number fields and payload protocol (e.g. TCP) port or 46 service fields to identify particular services that may be associated 47 with that port number or protocol number. It is a general statement 48 regarding appropriate processing and use of service identifiers by 49 intermediate systems. 51 This memo points out that various measures by intermediate systems 52 that are intended to filter or prevent the transmission of traffic 53 based on the service identification within the traffic flow have 54 limited effect, with a major side-effect of forcing the affected 55 services to be redesigned using various forms of encapsulation or 56 dynamic port negotiation in order to remove the fixed service 57 identification from the IP packet headers. The IAB does not believe 58 this serves the general interests of the Internet community related 59 to the design of simple and reliable Internet applications. This memo 60 suggests some thought be given to control mechanisms that do not rely 61 on intermediary systems taking actions based on an assumed 62 relationship between the service identifier in the packet and the 63 actual service of which the packet is a part. 65 2. Service Identifiers 67 Although not necessarily by design, certain conventions have evolved 68 with respect to the IP protocol suite relative to the identification 69 of services within an IP traffic flow: 71 o Within the IP protocol suite, end point identifiers (e.g. TCP/ 72 UDP/SCTP port numbers, IP protocol numbers) are designed to 73 identify services to end points. In particular, TCP, UDP or SCTP 74 (Stream Control Transmission Protocol) port numbers are intended 75 to identify the source service location and the destination 76 service entity to the destination end point. 78 o The IP [2] datagram header contains the source and destination 79 address of the datagram as well as an indication of the upper- 80 level protocol (ULP) carried within the datagram. If the ULP is 81 either TCP [3], UDP [1], or SCTP [8] the payload will contain both 82 source and destination port numbers which allows differentiation 83 between services (e.g. TELNET, HTTP) and between multiple 84 instances of the same service between the pair of hosts described 85 by the source and destination address. 87 o By convention, for at least TCP and UDP, certain port numbers are 88 used as rendezvous points and are considered "well known" on the 89 source or destination side of the communication. Such rendezvous 90 points are maintained in an IANA registry currently located at 91 [11]. Specific registries for protocol and port numbers are at 92 [12] and [13]. 94 o Notwithstanding the "well-knownness" of any given port, port 95 numbers are only guaranteed to be meaningful to the end systems. 96 An intermediate system should generally not impute specific 97 meaning to any given port number, unless specifically indicated by 98 an end system (e.g. via the Resource Reservation Protocol 99 (RSVP)[4] ) or agreed to by convention among the end systems and 100 one or more specific intermediate systems (e.g. firewall 101 traversal for the IP Security Protocol (IPSEC)[5]). 103 o Some services make use of protocol interactions to dynamically 104 allocate service identifiers (i.e. port numbers) to specific 105 communications. One specific example of this is the Session 106 Initiation Protocol (SIP)[9]. The implication of this is that 107 intermediate systems cannot relate the service identifiers to the 108 actual service unless they participate in the protocols which 109 allocate the service identifiers, or are explicitly notified of 110 the outcome of the allocation. 112 o Various products and service-related mechanisms deployed today 113 take advantage of the fact that some service identifiers are 114 relatively stable (and well known) to do various things (e.g. 115 firewall filtering, QOS marking). 117 o Certain network operations, such as various forms of packet 118 encapsulation (e.g. tunnelling) and encryption, can occlude this 119 port number (or service identifier) while an IP packet is in 120 transit within the network. For example, both the IPSEC 121 Encapsulating Security Payload (ESP) [6] and Generic Routing 122 Encapsulation (GRE) [7] both provide means for tunneling an IP 123 datagram within another IP datagram. The service information 124 becomes obscured and, in some instances, encrypted. 126 o Cooperating end systems may elect to use arbitrarily selected port 127 numbers for any service. The port numbers used in such cases may 128 be statically defined, through coordinated configuration of the 129 cooperating end systems through use of a common application or 130 operating system, or by dynamic selection as an outcome of a 131 rendezvous protocol. 133 Intermediate system imposed service-based controls may block 134 legitimate uses by subscribers. For example, some service providers 135 are blocking port 25 (i.e. notionally SMTP) traffic for the stated 136 purpose of trying to prevent SPAM, but which can also block 137 legitimate email to the end user. 139 Attempts by intermediate systems to impose service-based controls on 140 communications against the perceived interests of the end parties to 141 the communication are often circumvented[10]. Services may be 142 tunneled within other services, proxied by a collaborating external 143 host (e.g. an anonymous redirector), or simply run over an alternate 144 port (e.g. port 8080 vs port 80 for HTTP). Another means of 145 circumvention is alteration of the service behaviour to use a dynamic 146 port negotiation phase, in order to avoid use of a constant port 147 address. 149 For the purposes of this memo a "party to a communication" is either 150 the sender, receiver or an agent of the sender or receiver in the 151 path. 153 If intermediate systems take actions on behalf of one or more parties 154 to the communication or affecting the communication, a good rule of 155 thumb is they should only take actions that are beneficial to or 156 approved by one or more of the parties, within the operational 157 parameters of the service-specific protocol, or otherwise unlikely to 158 lead to widespread evasion by the user community. 160 3. Ramifications 162 The IAB observes that having stable and globally meaningful service 163 identifiers visible at points other than the end systems can be 164 useful for the purposes of determining network behavior and network 165 loading on a macro level. The IAB also observes that application 166 protocols that include dynamic port negotiation for both ends of a 167 connection tend to add to the complexity of the applications. 169 Dynamic port negotiation for a protocol may also limit or prohibit 170 its use in situations where the service provider (e.g. ISP or 171 employer) has instituted some form of service filtering through port 172 blocking mechanisms. 174 From this perspective of network and application utility, it is 175 preferable that no action or activity be undertaken by any agency, 176 carrier, service provider or organization which would tend to cause 177 end-users and protocol designers to generally obscure service 178 identification information from the IP packet header. 180 Nothing in this statement should be construed as opposing 181 encapsulation or other processes beneficial or specifically desired 182 by the end-users. 184 4. Security Considerations 186 This document is a general statement regarding appropriate processing 187 and use of service identifiers by intermediate systems. If enough 188 agencies, carriers, service providers and organizations ignore the 189 concerns voiced here, the utility of port and protocol numbers, 190 general network analysis, end-user beneficial filtering (e.g. 191 preventing DDOS attacks), and other common uses of these service 192 identifiers might be adversely affected. 194 References 196 [1] Postel, J., "User Datagram Protocol", STD 6, RFC 768, August 197 1980. 199 [2] Postel, J., "Internet Protocol", STD 5, RFC 791, September 200 1981. 202 [3] Postel, J., "Transmission Control Protocol", STD 7, RFC 793, 203 September 1981. 205 [4] Braden, B., Zhang, L., Berson, S., Herzog, S. and S. Jamin, 206 "Resource ReSerVation Protocol (RSVP) -- Version 1 Functional 207 Specification", RFC 2205, September 1997. 209 [5] Kent, S. and R. Atkinson, "Security Architecture for the 210 Internet Protocol", RFC 2401, November 1998. 212 [6] Kent, S. and R. Atkinson, "IP Encapsulating Security Payload 213 (ESP)", RFC 2406, November 1998. 215 [7] Farinacci, D., Li, T., Hanks, S., Meyer, D. and P. Traina, 216 "Generic Routing Encapsulation (GRE)", RFC 2784, March 2000. 218 [8] Stewart, R., Xie, Q., Morneault, K., Sharp, C., Schwarzbauer, 219 H., Taylor, T., Rytina, I., Kalla, M., Zhang, L. and V. Paxson, 220 "Stream Control Transmission Protocol", RFC 2960, October 2000. 222 [9] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., 223 Peterson, J., Sparks, R., Handley, M. and E. Schooler, "SIP: 224 Session Initiation Protocol", RFC 3261, June 2002. 226 [10] New York Times, "STUDENTS EVADE UNIVERSITY TACTICS TO PROTECT 227 MEDIA FILES", 27th November 2002. 229 [11] IANA, "IANA Protocol Numbers and Assignment Services", May 230 2003, . 232 [12] IANA, "IANA Protocol Number Registry", May 2003, . 235 [13] IANA, "IANA Port Number Registry", May 2003, . 238 Authors' Addresses 240 Mike St Johns 241 Internet Architecture Board 243 Geoff Huston 244 Internet Architecture Board 246 Appendix A. IAB Members 248 Internet Architecture Board Members at the time this document was 249 completed were: 251 Bernard Aboba 252 Harald Alvestrand 253 Rob Austein 254 Leslie Daigle, Chair 255 Patrik Faltstrom 256 Sally Floyd 257 Jun-ichiro Itojun Hagino 258 Mark Handley 259 Geoff Huston 260 Charlie Kaufman 261 James Kempf 262 Eric Rescorla 263 Michael StJohns 265 Intellectual Property Statement 267 The IETF takes no position regarding the validity or scope of any 268 intellectual property or other rights that might be claimed to 269 pertain to the implementation or use of the technology described in 270 this document or the extent to which any license under such rights 271 might or might not be available; neither does it represent that it 272 has made any effort to identify any such rights. Information on the 273 IETF's procedures with respect to rights in standards-track and 274 standards-related documentation can be found in BCP-11. Copies of 275 claims of rights made available for publication and any assurances of 276 licenses to be made available, or the result of an attempt made to 277 obtain a general license or permission for the use of such 278 proprietary rights by implementors or users of this specification can 279 be obtained from the IETF Secretariat. 281 The IETF invites any interested party to bring to its attention any 282 copyrights, patents or patent applications, or other proprietary 283 rights which may cover technology that may be required to practice 284 this standard. Please address the information to the IETF Executive 285 Director. 287 Full Copyright Statement 289 Copyright (C) The Internet Society (2003). All Rights Reserved. 291 This document and translations of it may be copied and furnished to 292 others, and derivative works that comment on or otherwise explain it 293 or assist in its implementation may be prepared, copied, published 294 and distributed, in whole or in part, without restriction of any 295 kind, provided that the above copyright notice and this paragraph are 296 included on all such copies and derivative works. However, this 297 document itself may not be modified in any way, such as by removing 298 the copyright notice or references to the Internet Society or other 299 Internet organizations, except as needed for the purpose of 300 developing Internet standards in which case the procedures for 301 copyrights defined in the Internet Standards process must be 302 followed, or as required to translate it into languages other than 303 English. 305 The limited permissions granted above are perpetual and will not be 306 revoked by the Internet Society or its successors or assignees. 308 This document and the information contained herein is provided on an 309 "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING 310 TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 311 BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION 312 HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF 313 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 315 Acknowledgement 317 Funding for the RFC Editor function is currently provided by the 318 Internet Society.