Point-to-Point Protocol (PPP) initial configuration options
obsoleted by
Extracted elements (31)
Authentication is not required to be full-duplex, and different authentication protocols may be used in each direction, depending on what is negotiated. This allows asymmetric trust relationships between peers.
Link Quality Monitoring deliberately separates 'mechanism' (the LQR packet format and transmission procedure, fully specified) from 'policy' (how to judge quality and what to do about it, left to each implementation). This allows interoperation between peers with different link quality policies.
Magic-Numbers should be chosen with maximum randomness (machine serial numbers, hardware addresses, time-of-day, inter-arrival times of physical events) to ensure uniqueness. If no good source of uniqueness is available, the option should not be enabled because loop-back detection will be unreliable.
If an implementation transmits a Configure-Request with a Magic-Number option, it MUST NOT respond with a Configure-Reject if its peer also sends a Magic-Number option — i.e., if an implementation wants Magic Numbers, it MUST allow its peer to use them too.
If smaller frames are requested via the MRU option, an implementation MUST still be able to receive 1500-octet frames in case link synchronization is lost.
LQM counters (one 8-bit Out-Identifier-Ctr and four 32-bit counters for packets/octets sent/received) may be initialized to any value before the first LQR but MUST NOT be reset again while LCP remains in the Open state. Counters wrap at their maximum value.
Once a Magic-Number has been successfully negotiated, an LCP implementation MUST transmit Echo-Request, Echo-Reply, Discard-Request, and Link-Quality-Report packets with the Magic-Number field set to its negotiated value. Reception of the local Magic-Number in these packets indicates a looped-back link.
Out-Tx-Octets-Ctr and In-Rx-Octets-Ctr MUST count all octets included in FCS calculations (including the FCS octets themselves) and MUST NOT count any other octets such as transparency or framing bits.
PPP implementations MUST accept both single-octet and double-octet Protocol fields and MUST NOT distinguish between them, even after PFC negotiation. Compressed Protocol fields MAY NOT be transmitted unless the peer has sent a Configure-Ack with this option.
Synchronous PPP implementations MUST always accept an Async-Control-Character-Map Configuration Option (MUST respond with Configure-Ack) to enable sync-to-async converters; the sync implementation itself does no character mapping since it uses bit-stuffing.
The LQR Identifier sequence number space MUST be separate from that of all other LCP packets; transmitting an LCP Echo-Request must not increment Out-Identifier-Ctr. LQRs MUST be consistently transmitted with the same amount of padding so that In-Tx-Octets and In-Rx-Octets calculations remain correct.
The LQR Magic-Number field MUST always be transmitted as zero and MUST always be ignored on reception unless Magic-Numbers have been negotiated. If negotiated, incoming LQR Magic-Numbers should be checked for loop-back detection.
Upon reception of a PAP Authenticate packet, the authenticating implementation MUST transmit some type of Authenticate reply (Ack or Nak). The Identifier field in Authenticate-Ack and Authenticate-Nak MUST be copied from the Identifier field of the triggering Authenticate.
Address-and-Control-Field-Compression option (Type=8, Length=2) allows omission of the constant Address (0xff) and Control (0x03) fields. Compression is prohibited when the result would be ambiguous (Protocol value 0xff followed by 0x03) and MUST never be applied to LCP packets.
IPCP Configuration Option type assignments: 1=IP-Addresses (negotiates both source and destination IP addresses in a single 10-octet option), 2=Compression-Type (negotiates IP header compression; initial value 0x0037 = Van Jacobson Compressed TCP/IP).
LCP Configuration Option type assignments: 1=Maximum-Receive-Unit, 2=Async-Control-Character-Map, 3=Authentication-Type, 5=Magic-Number, 6=Link-Quality-Monitoring, 7=Protocol-Field-Compression, 8=Address-and-Control-Field-Compression. Type 4 is not assigned.
LQM uses five logical processes per link direction: Link-Manager (sends/receives LQRs, implements policy), Mux (prioritizes outbound packets), Tx (maintains Out-Tx-Packets-Ctr and Out-Tx-Octets-Ctr), Rx (maintains In-Rx-Packets-Ctr and In-Rx-Octets-Ctr), and Demux. LQR packets MUST be given the highest possible priority in the Mux.
PAP uses three packet codes: 1=Authenticate (carries Peer-ID-Length, Peer-ID, Passwd-Length, Password), 2=Authenticate-Ack (carries Msg-Length and optional ASCII Message), 3=Authenticate-Nak (same format as Ack). Protocol type is 0xc023. The Authentication phase ends upon sending or receiving an Authenticate-Ack.
Protocol-Field-Compression (PFC) option (Type=7, Length=2) enables ISO 3309 extension mechanism to compress two-octet Protocol fields to one octet for protocol values less than 256. The FCS is calculated on the compressed frame. LCP packets MUST never use a compressed Protocol field.
Successful negotiation of the Authentication-Type option inserts an Authentication phase into LCP: after the Link Quality Determination phase and before Network Layer Protocol Configuration Negotiation. Advancement to the next phase MUST NOT occur until the peer is successfully authenticated.
Authentication configuration parameters MUST be maintained at least per-interface to prevent an attacker from negotiating a weaker authentication protocol or no authentication at all. Downgrade attacks are an explicit threat model for this option.
PAP is explicitly not a strong authentication method: passwords are transmitted in the clear and there is no protection against repeated trial-and-error (brute force) attacks. Implementors are strongly recommended to switch to stronger methods when they become available.
Async-Control-Character-Map Configuration Option: Type=2, Length=6, followed by a four-octet big-endian bitmap. Each bit position corresponds to an ASCII control character; bit set to 1 means that character must remain mapped, 0 means it need not be mapped. Default is all ones (0xffffffff).
Authentication-Type Configuration Option: Type=3, Length>=4, followed by a two-octet Authentication-Type field (values match PPP Data Link Layer Protocol field values, e.g., 0xc023 for PAP) and zero or more Data octets. Default is no authentication.
IPCP Compression-Type Configuration Option: Type=2, Length>=4, 2-octet Compression-Type field (values match PPP Data Link Layer Protocol field values; 0x0037=Van Jacobson Compressed TCP/IP), followed by zero or more Data octets. Default is no compression.
IPCP IP-Addresses Configuration Option: Type=1, Length=10, 4-octet Source-IP-Address (desired local address of sender), 4-octet Destination-IP-Address (desired remote address). An address value of zero requests the remote end to specify the address. Default is no addresses assigned.
Link-Quality-Monitoring Configuration Option: Type=6, Length=6, followed by a four-octet Reporting-Period field indicating the maximum time in microseconds between LQR transmissions. A value of zero is illegal and must be Nak'd or rejected.
Link-Quality-Report packet: Code=12, 1-octet Identifier, 2-octet Length, 4-octet Magic-Number, 1-octet In-Tx-LQRs, 1-octet Last-In-Id, 15-bit Reserved, 1-bit V (validity), then four 4-octet measurement fields (In-Tx-Packets, In-Tx-Octets, In-Rx-Packets, In-Rx-Octets) and two 4-octet counter fields (Out-Tx-Packets-Ctr, Out-Tx-Octets-Ctr) transmitted over the wire; In-Rx-Packets-Ctr and In-Rx-Octets-Ctr are appended by the Rx process after reception.
Magic-Number Configuration Option: Type=5, Length=6, followed by a four-octet Magic-Number field chosen to be unique to one end of the link. A Magic-Number of zero is illegal and MUST NOT be sent.
Maximum-Receive-Unit Configuration Option: Type=1, Length=4, followed by a two-octet Maximum-Receive-Unit field indicating the maximum Information field size. Default is 1500 octets.
PAP Authenticate packet: Code=1, 1-octet Identifier, 2-octet Length, 1-octet Peer-ID-Length, variable Peer-ID, 1-octet Passwd-Length, variable Password. Both Peer-ID and Password fields are zero or more octets.