Point-to-Point Protocol (PPP) Vendor Protocol
Extracted elements (24)
Using LCP Vendor-Specific Option to enable proprietary protocols was rejected because: (1) negotiation would occur before peer authentication, complicating security analysis; (2) compulsory tunneling creates deployment problems; (3) unassigned protocol numbers complicate diagnostic tools. A fixed set of vendor-specific protocol numbers solves all three problems.
An OUI-aware implementation that selectively disables on Protocol-Reject is compatible with a simple single-OUI implementation: the latter responds with Protocol-Reject for unrecognized OUIs and leaves negotiation state unmodified.
An implementation supporting multiple vendor-specific protocols distinguished by OUI MUST treat LCP Protocol-Reject specially by examining the OUI field and disabling only the protocol to which it refers, rather than all use of the vendor-specific protocol number.
If a VSNCP packet with an unrecognized OUI is received, an LCP Protocol-Reject SHOULD be sent in response.
If the LCP Magic-Number Option was not negotiated, the Magic-Number field in VSP packets MUST be set to 0. Implementation of the LCP Magic-Number Option is RECOMMENDED.
It is RECOMMENDED that vendor-specific authentication protocols use Code 3 for 'Success' and Code 4 for 'Failure' to simplify the design of network monitoring equipment.
The network layer data carried in VSNP packets MUST NOT be sent unless VSNCP is in Opened state.
VSNCP packets MUST NOT be exchanged until PPP has reached the Network-Layer Protocol phase; any VSNCP packets received when not in that phase MUST be silently ignored.
VSNP is defined to operate at the bundle level when Multilink PPP is in use, above any Compression and Encryption Protocols. VSP operates at the per-link level, MUST NOT be subjected to data compression, and MUST be encrypted if per-link encryption is in use.
VSP packets MUST NOT be sent until PPP has reached either Network-Layer Protocol or Authentication phase; VSP packets received before those phases MUST be silently ignored.
Four vendor-specific PPP protocol numbers are defined: VSNP (005b), VSP (405b), VSNCP (805b), and VSAP (c05b), one in each of the four PPP protocol number ranges.
The 3-octet OUI in all vendor-specific protocol messages is based on IEEE 802 vendor assignments and identifies the organization defining the message meaning; vendors SHOULD register their OUI with IANA.
VSAP is used in two ways: in the LCP Authentication Option to negotiate a vendor-specific authentication protocol, and as a PPP Protocol field value (c05b) to carry proprietary authentication messages during the PPP Authentication phase.
VSNCP uses the same packet exchange and option negotiation mechanism as LCP but with a different set of options; only LCP Code values 1-7 (Configure-Request through Code-Reject) are used.
IANA has assigned four PPP Protocol field values—005b (VSNP), 405b (VSP), 805b (VSNCP), and c05b (VSAP)—as described in this document.
IANA maintains a CF0000 series block of non-IEEE OUIs assignable to vendors that do not otherwise need an IEEE-assigned OUI for PPP vendor protocols.
The security of vendor-specific networking protocols is subject to the security mechanisms defined by those protocols; independent security analysis of any such protocol is RECOMMENDED.
The security of VSAP is subject to the provisions of the proprietary mechanism used. Implementations wishing to avoid security problems SHOULD send LCP Configure-Nak in response to Configure-Request specifying VSAP, or MAY terminate operation.
When using PPP encryption without Multilink PPP, VSP packets are sent in the clear. Implementations that require encryption as part of a security mechanism should consider per-link encryption or forgoing VSP in favor of VSNP.
The VSAP Authentication Option has Type=3, Length>=7, Authentication-Protocol=c05b (2 octets, Network Byte Order), a 3-octet OUI, and optional vendor-specific Data.
VSAP Authentication Data contains a 1-octet Code, 1-octet Identifier, 2-octet Length, and variable Data; the Code and Data semantics are defined by the vendor-specific protocol.
VSNCP packets contain a 1-octet Code field (LCP codes 1-7 only), 1-octet Identifier, 2-octet Length, a 3-octet OUI, and variable Data. All other Code values SHOULD result in a Code-Reject reply.
VSNP packets carry vendor-specific data in the PPP Information field with PPP Protocol set to 005b; no restrictions are placed on the data format.
VSP packets contain a 4-octet Magic-Number field (0 if Magic-Number Option not negotiated), a 3-octet OUI, a 1-octet Reserved field (must be zero on transmit, ignored on reception), and variable vendor-specific Data.