TSGWG J. Touch
Internet Draft USC/ISI
Intended status: Experimental January 19, 2016
Expires: July 2016
Transport Options for UDP
draft-touch-tsvwg-udp-options-02.txt
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. This document may not be modified,
and derivative works of it may not be created, and it may not be
published except as an Internet-Draft.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other documents
at any time. It is inappropriate to use Internet-Drafts as
reference material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html
This Internet-Draft will expire on July 19, 2016.
Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with
respect to this document.
Touch Expires July 19, 2016 [Page 1]
Internet-Draft Transport Options for UDP January 2016
Abstract
Transport protocols are extended through the use of transport header
options. This document experimentally extends UDP to provide a
location, syntax, and semantics for transport layer options.
Table of Contents
1. Introduction...................................................2
2. Conventions used in this document..............................2
3. Background.....................................................3
4. The UDP Option Area............................................3
5. Whose options are these?.......................................7
6. UDP options vs. UDP-Lite.......................................7
7. Interactions with Legacy Devices...............................8
8. Options in a Stateless, Unreliable Transport Protocol..........9
9. Security Considerations........................................9
10. IANA Considerations...........................................9
11. References...................................................10
11.1. Normative References....................................10
11.2. Informative References..................................10
12. Acknowledgments..............................................11
1. Introduction
Transport protocols use options as a way to extend their
capabilities. TCP [RFC793], SCTP [RFC4960], and DCCP [RFC4340]
include space for these options but UDP [RFC768] currently does not.
This document defines an experimental extension to UDP that provides
space for transport options including their generic syntax and
semantics for their use in UDP's stateless, unreliable message
protocol.
2. Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [RFC2119].
In this document, these words will appear with that interpretation
only when in ALL CAPS. Lowercase uses of these words are not to be
interpreted as carrying significance described in RFC 2119.
In this document, the characters ">>" preceding an indented line(s)
indicates a statement using the key words listed above. This
Touch Expires July 19, 2016 [Page 2]
Internet-Draft Transport Options for UDP January 2016
convention aids reviewers in quickly identifying or finding the
portions of this RFC covered by these key words.
3. Background
Many protocols include a default header and an area for header
options. These options enable the protocol to be extended for use in
particular environments or in ways unforeseen by the original
designers. Examples include TCP's Maximum Segment Size, Window
Scale, Timestamp, and Authentication Options
[RFC793][RFC5925][RFC7323].
These options are used both in stateful (connection-oriented, e.g.,
TCP [RFC793], SCTP [RFC4960], DCCP [RFC4340]) and stateless
(connectionless, e.g., IPv4 [RFC791], IPv6 [RFC2460] protocols. In
stateful protocols they can help extend the way in which state is
managed. In stateless protocols their effect is often limited to
individual packets, but they can have an aggregate effect on a
sequence as well. One example of such uses is Substrate Protocol for
User Datagrams (SPUD) [Tr15], and this document is intended to
provide an out-of-band option area as an alternative to the in-band
mechanism currently proposed [Hi15].
UDP is one of the most popular protocols that lacks space for
options [RFC768]. The UDP header was intended to be a minimal
addition to IP, providing only ports and a data checksum for
protection. This document experimentally extends UDP to provide a
trailer area for options located after the UDP data payload.
4. The UDP Option Area
The UDP transport header includes demultiplexing and service
identification (port numbers), a checksum, and a field that
indicates the payload length. This length field is typically
redundant with total IP datagram length and header length.
For IPv4, the total datagram length (including IP header) is the IP
"Total Length" field and the header and its options are 4*IHL
("Internet Header Length"), as shown in Figure 1 [RFC791]. For IPv6,
the last IP option with "Next Header" = UDP (i.e., 17) indicates the
size of the transport payload as its "Payload Length" directly, as
shown in Figure 2 [RFC2460]. In both cases, the space available for
the UDP transport protocol data unit is indicated by IP, either
indirectly for IPv4 (Total Length - 4*IHL) or directly (Payload
Length). In either case, this document will refer to the length of
the IP payload by the IPv6 term of "Payload Length".
Touch Expires July 19, 2016 [Page 3]
Internet-Draft Transport Options for UDP January 2016
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| IHL |Type of Service| Total Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Identification |Flags| Fragment Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Time to Live | Proto=17 (UDP)| Header Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Source Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Destination Address |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
... Options (padded as necessary, indicated by Frag. Offset)
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| UDP Source Port | UDP Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| UDP Length | UDP Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1 IPv4 datagram with UDP transport payload
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Version| Traffic Class | Flow Label |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Payload Length | Next Hdr=17 | Hop Limit |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
...
| Source Address (128 bits) |
...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
...
| Destination Address (128 bits) |
...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| UDP Source Port | UDP Destination Port |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| UDP Length | UDP Checksum |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2 IPv6 datagram with UDP transport payload
As a result of this redundancy, there is an opportunity to use the
UDP Length field as a way to break up the IP payload into two areas
- that intended as UDP user data and an additional "surplus area"
(as shown in Figure 3).
Touch Expires July 19, 2016 [Page 4]
Internet-Draft Transport Options for UDP January 2016
+--------+---------+----------------------+------------------+
| IP Hdr | UDP Hdr | UDP user data | surplus area |
+--------+---------+----------------------+------------------+
| | ^ ^
| +-------- UDP Length -------+ |
| |
+------------------ IP Total Length --------------------+
Figure 3 IP Payload Length vs. UDP Length
In most cases, the IP Payload Length and UDP Length are the same,
i.e., they point to the same location, indicating that there is no
surplus area. UDP-Lite used the difference in these pointers to
indicate the partial coverage of the UDP Checksum, such that the UDP
user data, UDP header, and UDP pseudoheader (a subset of the IP
header) are covered by the UDP checksum but additional user data in
the surplus area is not covered [RFC3828]. This document uses the
surplus area for UDP transport options.
The UDP option area is thus defined as the location between the end
of the UDP payload and the end of the IP datagram as a trailing
options area. This area can occur at any valid byte offset, i.e., it
need not be 16-bit or 32-bit aligned. In effect, this document
redefines the UDP "Length" field as a "trailer offset".
UDP options are defined using a syntax similar to that of TCP
[RFC793]. They are typically a minimum of two bytes in length as
shown in Figure 4, excepting only the one byte options "No
Operation" (NOP) and "End of Options List" (EOL) described below.
+--------+--------+
| Kind | Length |
+--------+--------+
Figure 4 UDP option default format
>> UDP options MAY occur at any UDP length offset.
>> The UDP length MUST be at least as large as the UDP header (8)
and no larger than the payload of the IP datagram. Values outside
this range MUST be silently discarded as invalid and logged where
rate-limiting permits.
Others have considered using values of the UDP Length that is larger
than the IP Payload Length as an additional type of signal. Using a
value smaller than the IP Payload Length is expected to be backward
compatible with existing UDP implementations, i.e., to deliver the
Touch Expires July 19, 2016 [Page 5]
Internet-Draft Transport Options for UDP January 2016
UDP Length of user data to the application and silently ignore the
additional surplus area data. Using a value larger than the IP
Payload Length would either be considered malformed (and be silently
dropped) or could cause buffer overruns, and so is not considered
silently and safely backward compatible. Its use is thus out of
scope for the extension described in this document.
>> UDP options MUST be interpreted in the order in which they occur
in the UDP option area.
The following UDP options are currently defined:
Kind Length Meaning
----------------------------------------------
0 - End of Options List (EOL)
1 - No operation (NOP)
2 2 Option checksum (OCS)
128-253 RESERVED
254 N(>=4) RFC 3692-style experiments
255 RESERVED
>> If options longer than one byte are used, NOP options SHOULD be
used at the beginning of the UDP options area to achieve alignment
as would be more efficient for for active (i.e., non-NOP) options.
The option checksum (OCS, Kind = 2) is an 8-bit ones-complement sum
that covers only the options, from the first option as indicated by
the UDP Length to the last option as indicated by EOL (where
present) or the IP Payload Length. OCS can be calculated by
computing the 16-bit ones-complement sum and "folding over" the
result (using carry wraparound). Note that OCS is direct, i.e., it
is not negated or adjusted if zero. OCS protects the option area
from errors in a similar way that the UDP checksum protects the UDP
user data.
>> When present, the option checksum SHOULD occur as early as
possible, preferably preceded by only NOP options for alignment.
>> If the option checksum fails, all options MUST be ignored and any
trailing surplus data silently discarded.
>> UDP data that is validated by a correct UDP checksum MUST be
delivered to the application layer, even if the UDP option checksum
fails, unless the endpoints have negotiated otherwise for this
segment's socket pair.
Touch Expires July 19, 2016 [Page 6]
Internet-Draft Transport Options for UDP January 2016
>> When the UDP options do not consume the entire option area, the
last non-NOP option SHOULD be EOL (vs. filling the entire option
area with NOP values).
>> All bytes after EOL MUST be ignored by UDP option processing.
Those bytes MAY be passed to the application layer and this can be
used as a way to include user data that is not protected by a
checksum. If this unprotected data is provided to the user, it MUST
be provided distinct from the UDP user data.
Kind=254 is reserved for experiments [RFC3692]. Only one such value
is reserved because it experiments are expected to already apply the
shared use approach developed for TCP experimental options
[RFC6994].
>> The length of the experimental option MUST be at least 4 to
account for the Kind, Length, and the minimum 16-bit UDP ExID
identifier (similar to TCP ExIDs [RFC6994]).
5. Whose options are these?
UDP options are indicated in an area of the IP payload that is not
used by UDP. That area is really part of the IP payload, not the UDP
payload, and as such, it might be tempting to consider whether this
is a generally useful approach to extending IP.
Unfortunately, the surplus area exists only for transports that
include their own transport layer payload length indicator. TCP and
SCTP include header length fields that already provide space for
transport options by indicating the total length of the header area,
such that the entire remaining area indicated in the network layer
(IP) is transport payload. UDP-Lite already uses the UDP Length
field to indicate the boundary between data covered by the transport
checksum and data not covered, and so there is no remaining area
where the length of the UDP payload as a whole can be indicated
[RFC3828].
6. UDP options vs. UDP-Lite
UDP-Lite provides partial checksum coverage, so that packets with
errors in some locations can be delivered to the user [RFC3828]. It
uses a different transport protocol number (136) than UDP (17) to
interpret the UDP Length field as the prefix covered by the UDP
checksum.
UDP (protocol 17) already defines the UDP Length field as the limit
of the UDP checksum, but by default also limits the data provided to
Touch Expires July 19, 2016 [Page 7]
Internet-Draft Transport Options for UDP January 2016
the application as that which precedes the UDP Length. A goal of
UDP-Lite is to deliver data beyond UDP Length as a default, which is
why a separate transport protocol number was required.
UDP options do not need a separate transport protocol number because
the data beyond the UDP Length offset (surplus data) is not provided
to the application by default. That data is interpreted exclusively
within the UDP transport layer.
UDP options support a similar service to UDP-Lite by terminating the
UDP options with an EOL option. The additional data not covered by
the UDP checksum follows that EOL option, and is passed to the user
separately. The difference is that UDP-Lite provides the un-
checksummed user data to the application by default, whereas UDP
options can provide the same capability only for endpoints that are
negotiated in advance (i.e., by default, UDP options would silently
discard this non-checksummed data). Additionally, in UDP-Lite the
checksummed and non-checksummed payload components are adjacent,
whereas in UDP options they are separated by the option area -
which, minimally, must consist of at least one EOL option.
UDP-Lite cannot support UDP options, either as proposed here or in
any other form, because the entire payload of the UDP packet is
already defined as user data and there is no additional field in
which to indicate a separate area for options. The UDP Length field
in UDP-Lite is already used to indicate the boundary between user
data covered by the checksum and user data not covered.
7. Interactions with Legacy Devices
UDP options have been tested as interoperable with Linux, Max OS-X,
and Windows Cygwin, and worked through NAT devices. These systems
successfully delivered only the user data indicated by the UDP
Length field and silently discarded additional IP payload.
There was one embedded device reported that passed the entire IP
payload to the user for UDP sockets. This is already inconsistent
with UDP and host requirements [RFC768] [RFC1122], as it presents an
IP payload to the user (including the transport header) instead of
the transport payload corresponding to the transport protocol.
It has been reported that Alcatel-Lucent's "Brick" Intrusion
Detection System has a default configuration that interprets
inconsistencies between UDP Length and IP Length as an attack to be
reported. Note that other firewall systems, e.g., CheckPoint, use a
default "relaxed UDP length verification" because it avoids falsely
interpreting this inconsistency as an attack.
Touch Expires July 19, 2016 [Page 8]
Internet-Draft Transport Options for UDP January 2016
(TBD: test with UDP checksum offload and UDP fragmentation offload)
8. Options in a Stateless, Unreliable Transport Protocol
There are two ways to interpret options for a stateless, unreliable
protocol -- an option is either local to the message or intended to
affect a stream of messages in a soft-state manner. Either
interpretation is valid for defined UDP options.
It is impossible to know in advance whether an endpoint supports a
UDP option.
>> UDP options MUST allow for silent failure on first receipt.
>> UDP options that rely on soft-state exchange MUST allow for
message reordering and loss.
>> A UDP option MUST be silently optional until confirmed by
exchange with an endpoint.
It is useful that these requirements are inconsistent with using UDP
options to implement transport-layer fragmentation and reassembly
unless that capability has been negotiated with an endpoint in
advance for a socket pair. Legacy systems would need to be able to
interpret the payload fragments independently.
(I'm sure there will be more here)
9. Security Considerations
The use of UDP packets with inconsistent IP and UDP Length fields
has the potential to trigger a buffer overflow error if not properly
handled, e.g., if space is allocated based on the smaller field and
copying is based on the larger. However, there have been no reports
of such a vulnerability and it would rely on inconsistent use of the
two fields for memory allocation and copying.
10. IANA Considerations
Upon publication, IANA is hereby requested to create a new registry
for UDP Option Kind numbers, similar to that for TCP Option Kinds.
Initial values of this registry are as indicated herein. Additional
values in this registry are to be assigned by IESG Approval or
Standards Action [RFC5226].
Upon publication, IANA is hereby requested to create a new registry
for UDP Experimental Option Experiment Identifiers (UDP ExIDs) for
Touch Expires July 19, 2016 [Page 9]
Internet-Draft Transport Options for UDP January 2016
use in the same manner as TCP ExIDs [RFC6994]. Values in this
registry are to be assigned by IANA using first-come, first-served
(FCFS) rules [RFC5226].
11. References
11.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
11.2. Informative References
[Hi15] Hildebrand, J., B. Trammel, "Substrate Protocol for User
Datagrams (SPUD) Prototype," draft-hildebrand-spud-
prototype-03, Mar. 2015.
[RFC768] Postel, J., "User Datagram Protocol", RFC 768, August
1980.
[RFC791] Postel, J., "Internet Protocol," RFC 791, Sept. 1981.
[RFC793] Postel, J., "Transmission Control Protocol" RFC 793,
September 1981.
[RFC1122] Braden, R., Ed., "Requirements for Internet Hosts --
Communication Layers," RFC 1122, Oct. 1989.
[RFC2460] Deering, S., R. Hinden, "Internet Protocol Version 6
(IPv6) Specification," RFC 2460, Dec. 1998.
[RFC4340] Kohler, E., M. Handley, and S. Floyd, "Datagram Congestion
Control Protocol (DCCP)", RFC 4340, March 2006.
[RFC4960] Stewart, R. (Ed.), "Stream Control Transmission Protocol",
RFC 4960, September 2007.
[RFC3692] Narten, T., "Assigning Experimental and Testing Numbers
Considered Useful," RFC 3692, Jan. 2004.
[RFC3828] Larzon, L-A., M. Degermark, S. Pink, L-E. Jonsson (Ed.),
G. Fairhurst (Ed.), "The Lightweight User Datagram
Protocol (UDP-Lite)," RFC 3828, July 2004.
[RFC5226] Narten, T., H. Alvestrand, "Guidelines for Writing an IANA
Considerations Section in RFCs," RFC 5226, May 2008.
Touch Expires July 19, 2016 [Page 10]
Internet-Draft Transport Options for UDP January 2016
[RFC5925] Touch, J., A. Mankin, R. Bonica, "The TCP Authentication
Option," RFC 5925, June 2010.
[RFC6994] Touch, J., "Shared Use of Experimental TCP Options," RFC
6994, Aug. 2013.
[RFC7323] Borman, D., R. Braden, V. Jacobson, R. Scheffenegger
(Ed.), "TCP Extensions for High Performance," RFC 7323,
Sep. 2014.
[Tr15] Trammel, B. (Ed.), M. Kuelewind (Ed.), "Requirements for
the design of a Substrate Protocol for User Datagrams
(SPUD)," draft-trammell-spud-req-01, Oct. 2015.
12. Acknowledgments
This work benefitted from feedback from Bob Briscoe, Ken Calvert,
Ted Faber, Gorry Fairhurst, C. M. Heard, Tom Herbert, as well as
discussions on the IETF SPUD email list.
This document was prepared using 2-Word-v2.0.template.dot.
Touch Expires July 19, 2016 [Page 11]
Internet-Draft Transport Options for UDP January 2016
Authors' Addresses
Joe Touch
USC/ISI
4676 Admiralty Way
Marina del Rey, CA 90292 USA
Phone: +1 (310) 448-9151
Email: touch@isi.edu
Touch Expires July 19, 2016 [Page 12]