3.1. Convergence-Layer Services

This version of the TCPCL protocol provides the following services to support the overlaying BPA. In all cases, this is not an API definition but a logical description of how the CL can interact with the BPA. Each of these interactions can be associated with any number of additional metadata items as necessary to support the operation of the CL or BPA.¶

Attempt Session:

The TCPCL allows a BPA to preemptively attempt to establish a TCPCL session with a peer entity. Each session attempt can send a different set of session negotiation parameters as directed by the BPA.¶

Terminate Session:

The TCPCL allows a BPA to preemptively terminate an established TCPCL session with a peer entity. The terminate request is done on a per-session basis.¶

Session State Changed:

The TCPCL entity indicates to the BPA when the session state changes. The top-level session states indicated are as follows:¶

Connecting:

A TCP connection is being established. This state only applies to the active entity.¶

Contact Negotiating:

A TCP connection has been made (as either the active or passive entity), and contact negotiation has begun.¶

Session Negotiating:

Contact negotiation has been completed (including possible TLS use), and session negotiation has begun.¶

Established:

The session has been fully established and is ready for its first transfer. When the session is established, the peer node ID (along with an indication of whether or not it was authenticated) and the negotiated session parameters (see Section 4.7) are also communicated to the BPA.¶

Ending:

The entity sent a SESS_TERM message and is in the Ending state.¶

Terminated:

The session has finished normal termination sequencing.¶

Failed:

The session ended without normal termination sequencing.¶

Session Idle Changed:

The TCPCL entity indicates to the BPA when the Live/Idle substate of the session changes. This occurs only when the top-level session state is "Established". The session transitions from Idle to Live at the start of a transfer in either transfer stream; the session transitions from Live to Idle at the end of a transfer when the other transfer stream does not have an ongoing transfer. Because the TCPCL transmits serially over a TCP connection, it suffers from "head-of-queue blocking", so a transfer in either direction can block an immediate start of a new transfer in the session.¶

Begin Transmission:

The principal purpose of the TCPCL is to allow a BPA to transmit bundle data over an established TCPCL session. Transmission requests are done on a per-session basis, and the CL does not necessarily perform any per-session or inter-session queueing. Any queueing of transmissions is the obligation of the BPA.¶

Transmission Success:

The TCPCL entity indicates to the BPA when a bundle has been fully transferred to a peer entity.¶

Transmission Intermediate Progress:

The TCPCL entity indicates to the BPA the intermediate progress of a transfer to a peer entity. This intermediate progress is at the granularity of each transferred segment.¶

Transmission Failure:

The TCPCL entity indicates to the BPA certain reasons for bundle transmission failure, notably when the peer entity rejects the bundle or when a TCPCL session ends before transfer success. The TCPCL itself does not have a notion of transfer timeout.¶

Reception Initialized:

The TCPCL entity indicates this status to the receiving BPA just before any transmission data is sent. This corresponds to reception of the XFER_SEGMENT message with the START flag set to 1.¶

Interrupt Reception:

The TCPCL entity allows a BPA to interrupt an individual transfer before it has fully completed (successfully or not). Interruption can occur any time after the reception is initialized.¶

Reception Success:

The TCPCL entity indicates to the BPA when a bundle has been fully transferred from a peer entity.¶

Reception Intermediate Progress:

The TCPCL entity indicates to the BPA the intermediate progress of a transfer from the peer entity. This intermediate progress is at the granularity of each transferred segment. An indication of intermediate reception gives a BPA the chance to inspect bundle header contents before the entire bundle is available and thus supports the "Interrupt Reception" capability.¶

Reception Failure:

The TCPCL entity indicates to the BPA certain reasons for reception failure, notably when the local entity rejects an attempted transfer for some local policy reason or when a TCPCL session ends before transfer success. The TCPCL itself does not have a notion of transfer timeout.¶

3.2. TCPCL Session Overview

First, one entity establishes a TCPCL session to the other by initiating a TCP connection in accordance with [RFC0793]. After setup of the TCP connection is complete, an initial Contact Header is exchanged in both directions to establish a shared TCPCL version and negotiate the use of TLS security (as described in Section 4). Once contact negotiation is complete, TCPCL messaging is available and the session negotiation is used to set parameters of the TCPCL session. One of these parameters is a node ID; each TCPCL entity is acting on behalf of a BPA having a node ID. This is used to assist in routing and forwarding messages by the BPA and is part of the authentication capability provided by TLS.¶

Once negotiated, the parameters of a TCPCL session cannot change; if there is a desire by either peer to transfer data under different parameters, then a new session must be established. This makes CL logic simpler but relies on the assumption that establishing a TCP connection is lightweight enough that TCP connection overhead is negligible compared to TCPCL data sizes.¶

Once the TCPCL session is established and configured in this way, bundles can be transferred in either direction. Each transfer is performed by segmenting the transfer data into one or more XFER_SEGMENT messages. Multiple bundles can be transmitted consecutively in a single direction on a single TCPCL connection. Segments from different bundles are never interleaved. Bundle interleaving can be accomplished by fragmentation at the BP layer or by establishing multiple TCPCL sessions between the same peers. There is no fundamental limit on the number of TCPCL sessions that a single entity can establish, beyond the limit imposed by the number of available (ephemeral) TCP ports of the active entity.¶

One feature of this protocol is that the receiving entity can send acknowledgment (XFER_ACK) messages as bundle data segments arrive. The rationale behind these acknowledgments is to enable the transmitting entity to determine how much of the bundle has been received, so that if the session is interrupted, it can perform reactive fragmentation to avoid resending the already-transmitted part of the bundle. In addition, there is no explicit flow control on the TCPCL.¶

A TCPCL receiver can interrupt the transmission of a bundle at any point in time by replying with a XFER_REFUSE message, which causes the sender to stop transmission of the associated bundle (if it hasn't already finished transmission).¶

For sessions that are idle, a KEEPALIVE message is sent at a negotiated interval. This is used to convey entity liveness information during otherwise messageless time intervals.¶

A SESS_TERM message is used to initiate the ending of a TCPCL session (see Section 6.1). During termination sequencing, in-progress transfers can be completed but no new transfers can be initiated. A SESS_TERM message can also be used to refuse a session setup by a peer (see Section 4.3). Regardless of the reason, session termination is initiated by one of the entities and the other entity responds to it, as illustrated by Figures 13 and 14 in the next subsection. Even when there are no transfers queued or in progress, the session termination procedure allows each entity to distinguish between a clean end to a session and the TCP connection being closed because of some underlying network issue.¶

Once a session is established, the TCPCL is a symmetric protocol between the peers. Both sides can start sending data segments in a session, and one side's bundle transfer does not have to complete before the other side can start sending data segments on its own. Hence, the protocol allows for a bidirectional mode of communication. Note that in the case of concurrent bidirectional transmission, acknowledgment segments MAY be interleaved with data segments.¶

3.3. TCPCL States and Transitions

The states of a normal TCPCL session (i.e., without session failures) are indicated in Figure 4.¶

  +-------+
  | START |
  +-------+
      |
  TCP Establishment
      |
      V
+-----------+            +---------------------+
|    TCP    |----------->|  Contact / Session  |
| Connected |            |     Negotiation     |
+-----------+            +---------------------+
                                    |
       +-----Session Parameters-----+
       |         Negotiated
       V
+-------------+                     +-------------+
| Established |----New Transfer---->| Established |
|   Session   |                     |   Session   |
|    Idle     |<---Transfers Done---|     Live    |
+-------------+                     +-------------+
      |                                    |
      +------------------------------------+
      |
      V
+-------------+
| Established |                    +-------------+
|   Session   |----Transfers------>|     TCP     |
|   Ending    |      Done          | Terminating |
+-------------+                    +-------------+
                                           |
     +----------TCP Close Message----------+
     |
     V
 +-------+
 |  END  |
 +-------+

Notes on established session states:¶

• Session "Live" means transmitting or receiving over a transfer stream.¶
• Session "Idle" means no transmission/reception over a transfer stream.¶
• Session "Ending" means no new transfers will be allowed.¶

Contact negotiation involves exchanging a Contact Header ("CH" in Figures 5, 6, and 7) in both directions and deriving a negotiated state from the two headers. The contact negotiation sequencing is performed as either the active or passive entity and is illustrated in Figures 5 and 6, respectively, which both share the data validation and negotiation of the Processing of Contact Header ("[PCH]") activity (Figure 7) and the "[TCPCLOSE]" activity, which indicates TCP connection close. Successful negotiation results in one of the Session Initiation ("[SI]") activities being performed, as shown further below. To avoid data loss, a Session Termination ("[ST]") exchange allows cleanly finishing transfers before a session is ended.¶

+-------+
| START |
+-------+
    |
TCP Connecting
    V
+-----------+
|    TCP    |            +---------+
| Connected |--Send CH-->| Waiting |--Timeout-->[TCPCLOSE]
+-----------+            +---------+
                              |
                          Received CH
                              V
                            [PCH]

+-----------+             +---------+
|   TCP     |--Wait for-->| Waiting |--Timeout-->[TCPCLOSE]
| Connected |     CH      +---------+
+-----------+                  |
                          Received CH
                               V
                       +-----------------+
                       | Preparing reply |--Send CH-->[PCH]
                       +-----------------+

+-----------+
|  Peer CH  |
| available |
+-----------+
      |
 Validate and
  Negotiate
      V
 +------------+
 | Negotiated |--Failure-->[TCPCLOSE]
 +------------+
    |       |
  No TLS    +----Negotiate---+      [ST]
    |               TLS      |       ^
    V                        |    Failure
  +-----------+              V       |
  |   TCPCL   |            +---------------+
  | Messaging |<--Success--| TLS Handshake |
  | Available |            +---------------+
  +-----------+

Session negotiation involves exchanging a session initialization (SESS_INIT) message in both directions and deriving a negotiated state from the two messages. The session negotiation sequencing is performed as either the active or passive entity and is illustrated in Figures 8 and 9, respectively (where "[PSI]" means "Processing of Session Initiation"), which both share the data validation and negotiation shown in Figure 10. The validation here includes certificate validation and authentication when TLS is used for the session.¶

+-----------+
|   TCPCL   |                   +---------+
| Messaging |--Send SESS_INIT-->| Waiting |--Timeout-->[ST]
| Available |                   +---------+
+-----------+                       |
                            Received SESS_INIT
                                    |
                                    V
                                  [PSI]

+-----------+
|   TCPCL   |                  +---------+
| Messaging |----Wait for ---->| Waiting |--Timeout-->[ST]
| Available |    SESS_INIT     +---------+
+-----------+                       |
                            Received SESS_INIT
                                    |
                            +-----------------+
                            | Preparing reply |--Send SESS_INIT-->[PSI]
                            +-----------------+

+----------------+
| Peer SESS_INIT |
|   available    |
+----------------+
        |
   Validate and
    Negotiate
        V
   +------------+
   | Negotiated |---Failure--->[ST]
   +------------+
        |
     Success
        V
  +--------------+
  | Established  |
  | Session Idle |
  +--------------+

Transfers can occur after a session is established and it's not in the Ending state. Each transfer occurs within a single logical transfer stream between a sender and a receiver, as illustrated in Figures 11 and 12, respectively.¶

                                       +--Send XFER_SEGMENT--+
+--------+                             |                     |
| Stream |                       +-------------+             |
|  Idle  |---Send XFER_SEGMENT-->| In Progress |<------------+
+--------+                       +-------------+
                                       |
     +---------All segments sent-------+
     |
     V
+---------+                       +--------+
| Waiting |---- Receive Final---->| Stream |
| for Ack |       XFER_ACK        |  Idle  |
+---------+                       +--------+

                                         +-Receive XFER_SEGMENT-+
+--------+                               |    Send XFER_ACK     |
| Stream |                         +-------------+              |
|  Idle  |--Receive XFER_SEGMENT-->| In Progress |<-------------+
+--------+                         +-------------+
                                         |
     +--------Sent Final XFER_ACK--------+
     |
     V
+--------+
| Stream |
|  Idle  |
+--------+

Session termination involves one entity initiating the termination of the session and the other entity acknowledging the termination. For either entity, it is the sending of the SESS_TERM message, which transitions the session to the Ending substate. While a session is in the Ending state, only in-progress transfers can be completed and no new transfers can be started.¶

+-----------+                   +---------+
|  Session  |--Send SESS_TERM-->| Session |
| Live/Idle |                   | Ending  |
+-----------+                   +---------+

+-----------+                   +---------+
|  Session  |--Send SESS_TERM-->| Session |
| Live/Idle |                   | Ending  |
+-----------+<------+           +---------+
      |             |
 Receive SESS_TERM  |
      |             |
      +-------------+

3.4. PKIX Environments and CA Policy

This specification defines requirements regarding how to use PKIX certificates issued by a Certificate Authority (CA) but does not define any mechanisms for how those certificates come to be. The requirements regarding TCPCL certificate use are broad, to support two quite different PKIX environments:¶

DTN-Aware CAs:

In the ideal case, the CA or CAs issuing certificates for TCPCL entities are aware of the end use of the certificate, have a mechanism for verifying ownership of a node ID, and are issuing certificates directly for that node ID. In this environment, the ability to authenticate a peer entity node ID directly avoids the need to authenticate a network name or address and then implicitly trust the node ID of the peer. The TCPCL authenticates the node ID whenever possible; this is preferred over lower-level PKIX identities.¶

DTN-Ignorant CAs:

It is expected that Internet-scale "public" CAs will continue to focus on DNS names as the preferred PKIX identifier. There are large infrastructures already in place for managing network-level authentication and protocols to manage identity verification in those environments [RFC8555]. The TCPCL allows for this type of environment by authenticating a lower-level identifier for a peer and requiring the entity to trust that the node ID given by the peer (during session initialization) is valid. This situation is not ideal, as it allows the vulnerabilities described in Section 7.9, but it still provides some amount of mutual authentication to take place for a TCPCL session.¶

Even within a single TCPCL session, each entity may operate within different PKI environments and with different identifier limitations. The requirements related to identifiers in a PKIX certificate are provided in Section 4.4.1.¶

It is important for interoperability that a TCPCL entity have its own security policy tailored to accommodate the peers with which it is expected to operate. Some security policy recommendations are given in Section 4.4.5, but these are meant as a starting point for tailoring. A strict TLS security policy is appropriate for a private network with a single shared CA. Operation on the Internet (such as inter-site BP gateways) could trade more lax TCPCL security with the use of encrypted bundle encapsulation [DTN-BIBECT] to ensure strong bundle security.¶

By using the Server Name Indication (SNI) DNS name (see Section 4.4.3), a single passive entity can act as a convergence layer for multiple BPAs with distinct node IDs. When this "virtual host" behavior is used, the DNS name is used as the indication of which BP node the active entity is attempting to communicate with. A virtual host CL entity can be authenticated by a certificate containing all of the DNS names and/or node IDs being hosted or by several certificates each authenticating a single DNS name and/or node ID, using the SNI value from the peer to select which certificate to use. The logic for mapping an SNI DNS name to an end-entity certificate is an implementation matter and can involve correlating a DNS name with a node ID or other certificate attributes.¶

3.5. Session-Keeping Policies

This specification defines requirements regarding how to initiate, sustain, and terminate a TCPCL session but does not impose any requirements on how sessions need to be managed by a BPA. It is a network administration matter to determine an appropriate session-keeping policy, but guidance given here can be used to steer policy toward performance goals.¶

Persistent Session:

This policy preemptively establishes a single session to known entities in the network and keeps the session active using KEEPALIVEs. Benefits of this policy include reducing the total amount of TCP data that needs to be exchanged for a set of transfers (assuming that the KEEPALIVE size is significantly smaller than the transfer size) and allowing the session state to indicate peer connectivity. Drawbacks include wasted network resources when a session is mostly idle or when network connectivity is inconsistent (which requires that failed sessions be reestablished), and potential queueing issues when multiple transfers are requested simultaneously. This policy assumes that there is agreement between pairs of entities as to which of the peers will initiate sessions; if there is no such agreement, there is potential for duplicate sessions to be established between peers.¶

Ephemeral Sessions:

This policy only establishes a session when an outgoing transfer needs to be sent. Benefits of this policy include not wasting network resources on sessions that are idle for long periods of time and avoiding potential queueing issues as can be seen when using a single persistent session. Drawbacks include the TCP and TLS overhead of establishing a new session for each transfer. This policy assumes that each entity can function in a passive role to listen for session requests from any peer that needs to send a transfer; when that is not the case, the polling behavior discussed below needs to happen. This policy can be augmented to keep the session established as long as any transfers are queued.¶

Active-Only Polling Sessions:

When naming and/or addressing of one entity is variable (i.e., a dynamically assigned IP address or domain name) or when firewall or routing rules prevent incoming TCP connections, that entity can only function in the active role. In these cases, sessions also need to be established when an incoming transfer is expected from a peer or based on a periodic schedule. This polling behavior causes inefficiencies compared to as-needed ephemeral sessions.¶

Many other policies can be established in a TCPCL network between the two extremes of single persistent sessions and only ephemeral sessions. Different policies can be applied to each peer entity and to each bundle as it needs to be transferred (e.g., for quality of service). Additionally, future session extension types can apply further nuance to session policies and policy negotiation.¶

3.6. Transfer Segmentation Policies

Each TCPCL session allows a negotiated transfer segmentation policy to be applied in each transfer direction. A receiving entity can set the Segment Maximum Receive Unit (MRU) in its SESS_INIT message to determine the largest acceptable segment size, and a transmitting entity can segment a transfer into any sizes smaller than the receiver's Segment MRU. It is a network administration matter to determine an appropriate segmentation policy for entities using the TCPCL protocol, but guidance given here can be used to steer policy toward performance goals. Administrators are also advised to consider the Segment MRU in relation to chunking/packetization performed by TLS, TCP, and any intermediate network-layer nodes.¶

Minimum Overhead:

For a simple network expected to exchange relatively small bundles, the Segment MRU can be set to be identical to the Transfer MRU, which indicates that all transfers can be sent with a single data segment (i.e., no actual segmentation). If the network is closed and all transmitters are known to follow a single-segment transfer policy, then receivers can avoid the necessity of segment reassembly. Because this CL operates over a TCP stream, which suffers from a form of head-of-queue blocking between messages, while one entity is transmitting a single XFER_SEGMENT message it is not able to transmit any XFER_ACK or XFER_REFUSE messages for any associated received transfers.¶

Predictable Message Sizing:

In situations where the maximum message size is desired to be well controlled, the Segment MRU can be set to the largest acceptable size (the message size less the XFER_SEGMENT header size) and transmitters can always segment a transfer into maximum-size chunks no larger than the Segment MRU. This guarantees that any single XFER_SEGMENT will not monopolize the TCP stream for too long, which would prevent outgoing XFER_ACK and XFER_REFUSE messages associated with received transfers.¶

Dynamic Segmentation:

Even after negotiation of a Segment MRU for each receiving entity, the actual transfer segmentation only needs to guarantee that any individual segment is no larger than that MRU. In a situation where TCP throughput is dynamic, the transfer segmentation size can also be dynamic in order to control message transmission duration.¶

Many other policies can be established in a TCPCL network between the two extremes of minimum overhead (large MRU, single segment) and predictable message sizing (small MRU, highly segmented). Different policies can be applied to each transfer stream to and from any particular entity. Additionally, future session extension and transfer extension types can apply further nuance to transfer policies and policy negotiation.¶

3.7. Example Message Exchange

Figure 15 depicts the protocol exchange for a simple session, showing the session establishment and the transmission of a single bundle split into three data segments (of lengths "L1", "L2", and "L3") from Entity A to Entity B.¶

Note that the sending entity can transmit multiple XFER_SEGMENT messages without waiting for the corresponding XFER_ACK responses. This enables pipelining of messages on a transfer stream. Although this example only demonstrates a single bundle transmission, it is also possible to pipeline multiple XFER_SEGMENT messages for different bundles without necessarily waiting for XFER_ACK messages to be returned for each one. However, interleaving data segments from different bundles is not allowed.¶

No errors or rejections are shown in this example.¶

             Entity A                             Entity B
             ========                             ========
    +-------------------------+
    |  Open TCP Connection    | ->      +-------------------------+
    +-------------------------+      <- |    Accept Connection    |
                                        +-------------------------+
    +-------------------------+
    |     Contact Header      | ->      +-------------------------+
    +-------------------------+      <- |     Contact Header      |
                                        +-------------------------+
    +-------------------------+
    |        SESS_INIT        | ->      +-------------------------+
    +-------------------------+      <- |        SESS_INIT        |
                                        +-------------------------+

    +-------------------------+
    |   XFER_SEGMENT (start)  | ->
    |     Transfer ID [I1]    |
    |       Length [L1]       |
    |  Bundle Data 0..(L1-1)  |
    +-------------------------+
    +-------------------------+         +-------------------------+
    |     XFER_SEGMENT        | ->   <- |     XFER_ACK (start)    |
    |     Transfer ID [I1]    |         |     Transfer ID [I1]    |
    |       Length   [L2]     |         |        Length   [L1]    |
    |Bundle Data L1..(L1+L2-1)|         +-------------------------+
    +-------------------------+
    +-------------------------+         +-------------------------+
    |    XFER_SEGMENT (end)   | ->   <- |         XFER_ACK        |
    |     Transfer ID [I1]    |         |     Transfer ID [I1]    |
    |        Length   [L3]    |         |      Length   [L1+L2]   |
    |Bundle Data              |         +-------------------------+
    |    (L1+L2)..(L1+L2+L3-1)|
    +-------------------------+
                                        +-------------------------+
                                     <- |      XFER_ACK (end)     |
                                        |     Transfer ID [I1]    |
                                        |     Length   [L1+L2+L3] |
                                        +-------------------------+

    +-------------------------+
    |       SESS_TERM         | ->      +-------------------------+
    +-------------------------+      <- |        SESS_TERM        |
                                        +-------------------------+
    +-------------------------+         +-------------------------+
    |        TCP Close        | ->   <- |        TCP Close        |
    +-------------------------+         +-------------------------+

4.1. TCP Connection

To establish a TCPCL session, an entity MUST first establish a TCP connection with the intended peer entity, typically by using the services provided by the operating system. Destination port number 4556 has been assigned by IANA as the registered port number for the TCPCL; see Section 8.1. Other destination port numbers MAY be used per local configuration. Determining a peer's destination port number (if different from the registered TCPCL port number) is left up to the implementation. Any source port number MAY be used for TCPCL sessions. Typically, an operating system assigned number in the TCP Ephemeral range (49152-65535) is used.¶

If the entity is unable to establish a TCP connection for any reason, then it is an implementation matter to determine how to handle the connection failure. An entity MAY decide to reattempt to establish the connection. If it does so, it MUST NOT overwhelm its target with repeated connection attempts. Therefore, the entity MUST NOT retry the connection setup earlier than some delay time from the last attempt, and it SHOULD use a (binary) exponential backoff mechanism to increase this delay in the case of repeated failures. The upper limit on a reattempt backoff is implementation defined but SHOULD be no longer than one minute (60 seconds) before signaling to the BPA that a connection cannot be made.¶

Once a TCP connection is established, the active entity SHALL immediately transmit its Contact Header. The passive entity SHALL wait for the active entity's Contact Header. Upon reception of a Contact Header, the passive entity SHALL transmit its Contact Header. If either entity does not receive a Contact Header after some implementation-defined time duration after the TCP connection is established, the waiting entity SHALL close the TCP connection. Entities SHOULD choose a Contact Header reception timeout interval no longer than one minute (60 seconds). The ordering of the Contact Header exchange allows the passive entity to avoid allocating resources to a potential TCPCL session until after a valid Contact Header has been received from the active entity. This ordering also allows the passive peer to adapt to alternate TCPCL protocol versions.¶

The format of the Contact Header is described in Section 4.2. Because the TCPCL protocol version in use is part of the initial Contact Header, entities using TCPCL version 4 can coexist on a network with entities using earlier TCPCL versions (with some negotiation needed for interoperation, as described in Section 4.3).¶

Within this specification, when an entity is said to "close" a TCP connection the entity SHALL use the TCP FIN mechanism and not the RST mechanism. However, either mechanism, when received, will cause a TCP connection to become closed.¶

4.2. Contact Header

This section describes the format of the Contact Header and the meaning of its fields.¶

If the entity is configured to enable the exchange of messages according to TLS 1.3 [RFC8446] or any successors that are compatible with that TLS ClientHello, the CAN_TLS flag within its Contact Header SHALL be set to 1. The RECOMMENDED policy is to enable TLS for all sessions, even if security policy does not allow or require authentication. This follows the "opportunistic security" model specified in [RFC7435], though an active attacker could interfere with the exchange in such cases (see Section 7.4).¶

Upon receipt of the Contact Header, both entities perform the validation and negotiation procedures defined in Section 4.3. After receiving the Contact Header from the other entity, either entity MAY refuse the session by sending a SESS_TERM message with an appropriate reason code.¶

The format for the Contact Header is as follows:¶

                     1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+---------------+---------------+
|                          magic='dtn!'                         |
+---------------+---------------+---------------+---------------+
|     Version   |   Flags       |
+---------------+---------------+

See Section 4.3 for details on the use of each of these Contact Header fields.¶

The fields of the Contact Header are as follows:¶

magic:

A four-octet field that always contains the octet sequence 0x64 0x74 0x6E 0x21, i.e., the text string "dtn!" in US-ASCII (and UTF-8).¶

Version:

A one-octet field value containing the value 4 (current version of the TCPCL protocol).¶

Flags:

A one-octet field of single-bit flags, interpreted according to the descriptions in Table 1. All reserved header flag bits SHALL be set to 0 by the sender. All reserved header flag bits SHALL be ignored by the receiver.¶

4.3. Contact Validation and Negotiation

Upon reception of the Contact Header, each entity follows the following procedures to ensure the validity of the TCPCL session and to negotiate values for the session parameters.¶

If the "magic string" is not present or is not valid, the connection MUST be terminated. The intent of the magic string is to provide some protection against an inadvertent TCP connection by a different protocol than the one described in this document. To prevent a flood of repeated connections from a misconfigured application, a passive entity MAY deny new TCP connections from a specific peer address for a period of time after one or more connections fail to provide a decodable Contact Header.¶

The first negotiation attempts to determine which TCPCL protocol version to use. The active entity always sends its Contact Header first and waits for a response from the passive entity. During contact initiation, the active TCPCL entity SHALL send the highest TCPCL protocol version on a first session attempt for a TCPCL peer. If the active entity receives a Contact Header with a lower protocol version than the one sent earlier on the TCP connection, the TCP connection SHALL be closed. If the active entity receives a SESS_TERM message with a reason code of "Version mismatch", that entity MAY attempt further TCPCL sessions with the peer using earlier protocol version numbers in decreasing order. Managing multi-TCPCL-session state such as this is an implementation matter.¶

If the passive entity receives a Contact Header containing a version that is not a version of the TCPCL protocol that the entity implements, then the entity SHALL send its Contact Header and immediately terminate the session with a reason code of "Version mismatch". If the passive entity receives a Contact Header with a version that is lower than the latest version of the protocol that the entity implements, the entity MAY either terminate the session (with a reason code of "Version mismatch") or adapt its operation to conform to the older version of the protocol. The decision of version fallback is an implementation matter.¶

The negotiated contact parameters defined by this specification are described in the following paragraphs.¶

TCPCL Version:

Both Contact Headers of a successful contact negotiation have identical TCPCL version numbers as described above. Only upon response of a Contact Header from the passive entity is the TCPCL protocol version established and session negotiation begun.¶

Enable TLS:

Negotiation of the Enable TLS parameter is performed by taking the logical AND of the two Contact Headers' CAN_TLS flags. A local security policy is then applied to determine whether the negotiated value of Enable TLS is acceptable. A reasonable security policy would require or disallow the use of TLS, depending upon the desired network flows. The RECOMMENDED policy is to require TLS for all sessions, even if security policy does not allow or require authentication. Because this state is negotiated over an unsecured medium, there is a risk of TLS Stripping as described in Section 7.4.¶

If the Enable TLS state is unacceptable, the entity SHALL terminate the session with a reason code of "Contact Failure". Note that this "Contact Failure" reason is different than a failure of a TLS handshake or TLS authentication after an agreed-upon and acceptable Enable TLS state. If the negotiated Enable TLS value is "true" and acceptable, then the TLS negotiation feature described in Section 4.4 begins immediately following the Contact Header exchange.¶

4.4. Session Security

This version of the TCPCL protocol supports establishing a TLS session within an existing TCP connection. When TLS is used within the TCPCL, it affects the entire session. Once TLS is established, there is no mechanism available to downgrade the TCPCL session to non-TLS operation.¶

Once established, the lifetime of a TLS connection SHALL be bound to the lifetime of the underlying TCP connection. Immediately prior to actively ending a TLS connection after TCPCL session termination, the peer that sent the original (non-reply) SESS_TERM message SHOULD follow the closure alert procedure provided in [RFC8446] to cleanly terminate the TLS connection. Because each TCPCL message is either fixed length or self-indicates its length, the lack of a TLS closure alert will not cause data truncation or corruption.¶

Subsequent TCPCL session attempts to the same passive entity MAY attempt to use the TLS session resumption feature. There is no guarantee that the passive entity will accept the request to resume a TLS session, and the active entity cannot assume any resumption outcome.¶

         Entity A                             Entity B
        active peer                         passive peer

+-------------------------+
|  Open TCP Connection    | ->      +-------------------------+
+-------------------------+      <- |    Accept Connection    |
                                    +-------------------------+
+-------------------------+
|     Contact Header      | ->      +-------------------------+
+-------------------------+      <- |     Contact Header      |
                                    +-------------------------+

+-------------------------+         +-------------------------+
|     TLS Negotiation     | ->   <- |     TLS Negotiation     |
|       (as client)       |         |       (as server)       |
+-------------------------+         +-------------------------+

           DNS-ID and IPADDR-ID authentication occurs.
               Secured TCPCL messaging can begin.

+-------------------------+
|        SESS_INIT        | ->      +-------------------------+
+-------------------------+      <- |        SESS_INIT        |
                                    +-------------------------+

                  NODE-ID authentication occurs.
           Session is established, transfers can begin.

+-------------------------+
|       SESS_TERM         | ->      +-------------------------+
+-------------------------+      <- |        SESS_TERM        |
                                    +-------------------------+
+-------------------------+
|    TLS Closure Alert    | ->      +-------------------------+
+-------------------------+      <- |    TLS Closure Alert    |
                                    +-------------------------+
+-------------------------+         +-------------------------+
|        TCP Close        | ->   <- |        TCP Close        |
+-------------------------+         +-------------------------+

4.5. Message Header

After the initial exchange of a Contact Header and (if TLS is negotiated to be used) the TLS handshake, all messages transmitted over the session are identified by a one-octet header with the following structure:¶

 0 1 2 3 4 5 6 7
+---------------+
| Message Type  |
+---------------+

The Message Header contains the following field:¶

Message Type:

Indicates the type of the message as per Table 2 below. Encoded values are listed in Section 8.5.¶

4.6. Session Initialization Message (SESS_INIT)

Before a session is established and ready to transfer bundles, the session parameters are negotiated between the connected entities. The SESS_INIT message is used to convey the per-entity parameters, which are used together to negotiate the per-session parameters as described in Section 4.7.¶

The format of a SESS_INIT message is shown in Figure 19.¶

+-----------------------------+
|       Message Header        |
+-----------------------------+
|   Keepalive Interval (U16)  |
+-----------------------------+
|       Segment MRU (U64)     |
+-----------------------------+
|      Transfer MRU (U64)     |
+-----------------------------+
|     Node ID Length (U16)    |
+-----------------------------+
|    Node ID Data (variable)  |
+-----------------------------+
|      Session Extension      |
|      Items Length (U32)     |
+-----------------------------+
|      Session Extension      |
|         Items (var.)        |
+-----------------------------+

The fields of the SESS_INIT message are as follows:¶

Keepalive Interval:

A 16-bit unsigned integer indicating the minimum interval, in seconds, to negotiate as the Session Keepalive using the method described in Section 4.7.¶

Segment MRU:

A 64-bit unsigned integer indicating the largest allowable single-segment data payload size to be received in this session. Any XFER_SEGMENT sent to this peer SHALL have a data payload no longer than the peer's Segment MRU. The two entities of a single session MAY have different Segment MRUs, and no relationship between the two is required.¶

Transfer MRU:

A 64-bit unsigned integer indicating the largest allowable total-bundle data size to be received in this session. Any bundle transfer sent to this peer SHALL have a Total Bundle Length payload no longer than the peer's Transfer MRU. This value can be used to perform proactive bundle fragmentation. The two entities of a single session MAY have different Transfer MRUs, and no relationship between the two is required.¶

Node ID Length and Node ID Data:

Together, these fields represent a variable-length text string. The Node ID Length is a 16-bit unsigned integer indicating the number of octets of Node ID Data to follow. A zero-length node ID SHALL be used to indicate the lack of a node ID rather than a truly empty node ID. This case allows an entity to avoid exposing node ID information on an untrusted network. A non-zero-length Node ID Data SHALL contain the UTF-8 encoded node ID of the entity that sent the SESS_INIT message. Every node ID SHALL be a URI consistent with the requirements in [RFC3986] and the URI schemes of the IANA "Bundle Protocol URI Scheme Types" registry [IANA-BUNDLE]. The node ID itself can be authenticated as described in Section 4.4.4.¶

Session Extension Items Length and Session Extension Items list:  

​ Together, these fields represent protocol extension data not defined by this specification. The Session Extension Items Length is the total number of octets to follow that are used to encode the Session Extension Items list. The encoding of each Session Extension Item is within a consistent data container as described in Section 4.8. The full set of Session Extension Items apply for the duration of the TCPCL session to follow. The order and multiplicity of these Session Extension Items are significant, as defined in the associated type specification(s). If the content of the Session Extension Items list disagrees with the Session Extension Items Length (e.g., the last item claims to use more or fewer octets than are indicated in the Session Extension Items Length), the reception of the SESS_INIT is considered to have failed.¶

If an entity receives a peer node ID that is not authenticated (by the procedure described in Section 4.4.4.3), that node ID SHOULD NOT be used by a BPA for any discovery or routing functions. Trusting an unauthenticated node ID can lead to the threat described in Section 7.9.¶

When the active entity initiates a TCPCL session, it is likely based on routing information that binds a node ID to CL parameters used to initiate the session. If the active entity receives a SESS_INIT with a different node ID than was intended for the TCPCL session, the session MAY be allowed to be established. If allowed, such a session SHALL be associated with the node ID provided in the SESS_INIT message rather than any intended value.¶

4.7. Session Parameter Negotiation

An entity calculates the parameters for a TCPCL session by negotiating the values from its own preferences (conveyed by the SESS_INIT it sent to the peer) with the preferences of the peer entity (expressed in the SESS_INIT that it received from the peer). The negotiated parameters defined by this specification are described in the following paragraphs.¶

Transfer MTU and Segment MTU:

The Maximum Transmission Unit (MTU) for whole transfers and individual segments is identical to the Transfer MRU and Segment MRU, respectively, of the received SESS_INIT message. A transmitting peer can send individual segments with any size smaller than the Segment MTU, depending on local policy, dynamic network conditions, etc. Determining the size of each transmitted segment is an implementation matter. If either the Transfer MRU or Segment MRU is unacceptable, the entity SHALL terminate the session with a reason code of "Contact Failure".¶

Session Keepalive:

Negotiation of the Session Keepalive parameter is performed by taking the minimum of the two Keepalive Interval values from the two SESS_INIT messages. The Session Keepalive Interval is a parameter for the behavior described in Section 5.1.1. If the Session Keepalive Interval is unacceptable, the entity SHALL terminate the session with a reason code of "Contact Failure".¶

Once this process of parameter negotiation is completed, this protocol defines no additional mechanism to change the parameters of an established session; to effect such a change, the TCPCL session MUST be terminated and a new session established.¶

4.8. Session Extension Items

Each of the Session Extension Items SHALL be encoded in an identical Type-Length-Value (TLV) container form as indicated in Figure 20.¶

The fields of the Session Extension Item are as follows:¶

Item Flags:

A one-octet field containing generic bit flags related to the Item, which are listed in Table 3. All reserved header flag bits SHALL be set to 0 by the sender. All reserved header flag bits SHALL be ignored by the receiver. If a TCPCL entity receives a Session Extension Item with an unknown Item Type and the CRITICAL flag set to 1, the entity SHALL terminate the TCPCL session with a SESS_TERM reason code of "Contact Failure". If the CRITICAL flag is 0, an entity SHALL skip over and ignore any item with an unknown Item Type.¶

Item Type:

A 16-bit unsigned integer field containing the type of the extension item. This specification does not define any extension types directly but does create an IANA registry for such codes (see Section 8.3).¶

Item Length:

A 16-bit unsigned integer field containing the number of Item Value octets to follow.¶

Item Value:

A variable-length data field that is interpreted according to the associated Item Type. This specification places no restrictions on an extension's use of available Item Value data. Extension specifications SHOULD avoid the use of large data lengths, as no bundle transfers can begin until the full extension data is sent.¶

                     1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+---------------+---------------+
|  Item Flags   |           Item Type           | Item Length...|
+---------------+---------------+---------------+---------------+
| length contd. | Item Value...                                 |
+---------------+---------------+---------------+---------------+

5.1. Upkeep and Status Messages

+-----------------------------+
|       Message Header        |
+-----------------------------+
|      Reason Code (U8)       |
+-----------------------------+
|   Rejected Message Header   |
+-----------------------------+

5.2. Bundle Transfer

All of the messages discussed in this section are directly associated with transferring a bundle between TCPCL entities.¶

A single TCPCL transfer results in the exchange of a bundle (handled by the convergence layer as opaque data) between two entities. In the TCPCL, a transfer is accomplished by dividing a single bundle up into "segments" based on the receiving-side Segment MRU, which is defined in Section 4.6. The choice of the length to use for segments is an implementation matter, but each segment MUST NOT be larger than the receiving entity's Segment MRU. The first segment for a bundle is indicated by the START flag, and the last segment is indicated by the END flag.¶

A single transfer (and, by extension, a single segment) SHALL NOT contain data of more than a single bundle. This requirement is imposed on the agent using the TCPCL, rather than on the TCPCL itself.¶

If multiple bundles are transmitted on a single TCPCL connection, they MUST be transmitted consecutively, without the interleaving of segments from multiple bundles.¶

+------------------------------+
|       Message Header         |
+------------------------------+
|     Message Flags (U8)       |
+------------------------------+
|      Transfer ID (U64)       |
+------------------------------+
|     Transfer Extension       |
|      Items Length (U32)      |
|   (only for START segment)   |
+------------------------------+
|     Transfer Extension       |
|         Items (var.)         |
|   (only for START segment)   |
+------------------------------+
|      Data length (U64)       |
+------------------------------+
| Data contents (octet string) |
+------------------------------+

+-----------------------------+
|       Message Header        |
+-----------------------------+
|     Message Flags (U8)      |
+-----------------------------+
|      Transfer ID (U64)      |
+-----------------------------+
| Acknowledged length (U64)   |
+-----------------------------+

+-----------------------------+
|       Message Header        |
+-----------------------------+
|      Reason Code (U8)       |
+-----------------------------+
|      Transfer ID (U64)      |
+-----------------------------+

                     1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+---------------+---------------+---------------+---------------+
|  Item Flags   |           Item Type           | Item Length...|
+---------------+---------------+---------------+---------------+
| length contd. | Item Value...                                 |
+---------------+---------------+---------------+---------------+

+----------------------+
|  Total Length (U64)  |
+----------------------+

6.1. Session Termination Message (SESS_TERM)

To cleanly terminate a session, a SESS_TERM message SHALL be transmitted by either entity at any point following complete transmission of any other message. When sent to initiate a termination, the REPLY flag of a SESS_TERM message SHALL be 0. Upon receiving a SESS_TERM message after not sending a SESS_TERM message in the same session, an entity SHALL send an acknowledging SESS_TERM message. When sent to acknowledge a termination, a SESS_TERM message SHALL have identical data content from the message being acknowledged except for the REPLY flag, which is set to 1 to indicate acknowledgment.¶

Once a SESS_TERM message is sent, the state of that TCPCL session changes to Ending. While the session is in the Ending state,¶

• an entity MAY finish an in-progress transfer in either direction.¶
• an entity SHALL NOT begin any new outgoing transfer for the remainder of the session.¶
• an entity SHALL NOT accept any new incoming transfer for the remainder of the session.¶

If a new incoming transfer is attempted while in the Ending state, the receiving entity SHALL send a XFER_REFUSE with a reason code of "Session Terminating".¶

There are circumstances where an entity has an urgent need to close a TCP connection associated with a TCPCL session, without waiting for transfers to complete but also in a way that doesn't force timeouts to occur -- for example, due to impending shutdown of the underlying data-link layer. Instead of following a clean termination sequence, after transmitting a SESS_TERM message, an entity MAY perform an unclean termination by immediately closing the associated TCP connection. When performing an unclean termination, an entity SHOULD acknowledge all received XFER_SEGMENTs with a XFER_ACK before closing the TCP connection. Not acknowledging received segments can result in unnecessary bundle or bundle fragment retransmissions. Any delay between a request to close the TCP connection and the actual closing of the connection (a "half-closed" state) MAY be ignored by the TCPCL entity. If the underlying TCP connection is closed during a transmission (in either transfer stream), the transfer SHALL be indicated to the BPA as failed (see the transmission failure and reception failure indications defined in Section 3.1).¶

The TCPCL itself does not have any required behavior related to responding to a SESS_TERM based on its reason code; the termination is passed up as an indication to the BPA that the session state has changed. If a termination has a reason code that is not decodable to the BPA, the agent SHOULD treat the termination as having a reason code of "Unknown".¶

The format of the SESS_TERM message is shown in Figure 27.¶

+-----------------------------+
|       Message Header        |
+-----------------------------+
|     Message Flags (U8)      |
+-----------------------------+
|      Reason Code (U8)       |
+-----------------------------+

The fields of the SESS_TERM message are as follows:¶

Message Flags:

A one-octet field of single-bit flags, interpreted according to the descriptions in Table 8. All reserved header flag bits SHALL be set to 0 by the sender. All reserved header flag bits SHALL be ignored by the receiver.¶

Reason Code:

A one-octet refusal reason code interpreted according to the descriptions in Table 9.¶

The earliest a TCPCL session termination MAY occur is immediately after transmission of a Contact Header (and prior to any further message transmissions). This can, for example, be used as a notification that the entity is currently not able or willing to communicate. However, an entity MUST always send the Contact Header to its peer before sending a SESS_TERM message.¶

Termination of the TCP connection MAY occur prior to receiving the Contact Header as discussed in Section 4.1. If reception of the Contact Header itself somehow fails (e.g., an invalid magic string is received), an entity SHALL close the TCP connection without sending a SESS_TERM message.¶

If a session is to be terminated before the sending of a protocol message has completed, then the entity MUST NOT transmit the SESS_TERM message but still SHALL close the TCP connection. Each TCPCL message is contiguous in the octet stream and has no ability to be cut short and/or preempted by another message. This is particularly important when large segment sizes are being transmitted; either the entire XFER_SEGMENT is sent before a SESS_TERM message or the connection is simply terminated mid-XFER_SEGMENT.¶

6.2. Idle Session Termination

The protocol includes a provision for clean termination of idle sessions. Determining the length of time to wait before terminating idle sessions, if they are to be terminated at all, is an implementation and configuration matter.¶

If there is a configured time to terminate idle sessions and if no TCPCL messages (other than KEEPALIVE messages) have been received for at least that amount of time, then either entity MAY terminate the session by transmitting a SESS_TERM message with a reason code of "Idle timeout" (as described in Table 9).¶

7.4. Threat: Transport Security Stripping

When security policy allows non-TLS sessions, the TCPCL does not protect against active network attackers. It is possible for an on-path attacker to set the CAN_TLS flag to 0 on either side of the Contact Header exchange, which will cause the negotiation discussed in Section 4.3 to disable TLS. This leads to the "SSL Stripping" attack described in [RFC7457].¶

The purpose of the CAN_TLS flag is to allow the use of the TCPCL on entities that simply do not have a TLS implementation available. When TLS is available on an entity, it is strongly encouraged that the security policy disallow non-TLS sessions. This requires that the TLS handshake occur, regardless of the policy-driven parameters of the handshake and policy-driven handling of the handshake outcome.¶

One mechanism to mitigate the possibility of TLS Stripping is the use of DNS-based Authentication of Named Entities (DANE) [RFC6698] toward the passive peer. This mechanism relies on DNS and is unidirectional, so it doesn't help with applying policy toward the active peer, but it can be useful in an environment using opportunistic security. The configuration and use of DANE are outside of the scope of this document.¶

The negotiated use of TLS is identical in behavior to the use of STARTTLS as described in [RFC2595], [RFC4511], and others.¶

7.6. Threat: Untrusted End-Entity Certificate

The authentication method discussed in Section 4.4.4 uses end-entity certificates chained to a trusted root CA. During a TLS handshake, either entity can send a certificate set that does not contain the full chain, possibly excluding intermediate or root CAs. In an environment where peers are known to already contain needed root and intermediate CAs, there is no need to include those CAs, but this carries the risk of an entity not actually having one of the needed CAs.¶

7.9. Threat: BP Node Impersonation

The certificates exchanged by TLS enable authentication of the peer DNS name and node ID, but it is possible that either a peer does not provide a valid certificate or the certificate does not validate either the DNS-ID/IPADDR-ID or NODE-ID of the peer (see Section 3.4). Having a CA-validated certificate does not alone guarantee the identity of the network host or BP node from which the certificate is provided; additional validation procedures as provided in Section 4.4.4 bind the DNS-ID/IPADDR-ID or NODE-ID based on the contents of the certificate.¶

The DNS-ID/IPADDR-ID validation is a weaker form of authentication, because even if a peer is operating on an authenticated network DNS name or IP address it can provide an invalid node ID and cause bundles to be "leaked" to an invalid node. Especially in DTN environments, network names and addresses of nodes can be time-variable, so binding a certificate to a node ID results in a more stable identity.¶

NODE-ID validation ensures that the peer to which a bundle is transferred is in fact the node that the BPA expects it to be. In circumstances where certificates can only be issued to DNS names, node ID validation is not possible, but it could be reasonable to assume that a trusted host is not going to present an invalid node ID. Determining when a DNS-ID/IPADDR-ID authentication can be trusted to validate a node ID is also a policy matter outside of the scope of this document.¶

One mitigation regarding arbitrary entities with valid PKIX certificates impersonating arbitrary node IDs is the use of the PKIX EKU key purpose id-kp-bundleSecurity (Section 4.4.2.1). When this EKU is present in the certificate, it represents a stronger assertion that the private key holder should in fact be trusted to operate as a bundle node.¶

7.11. Mandatory-to-Implement TLS

Following IETF best current practice, TLS is mandatory to implement for all TCPCL implementations but TLS is optional to use for a given TCPCL session. The policy recommendations in Sections 4.2 and 4.3 both enable TLS and require TLS, but entities are permitted to disable and not require TLS based on local configuration. The configuration to enable or require TLS for an entity or a session is outside of the scope of this document. The configuration to disable TLS is different from the threat of TLS Stripping as described in Section 7.4.¶

7.12. Alternate Uses of TLS

This specification makes use of PKIX certificate validation and authentication within TLS. There are alternate uses of TLS that are not necessarily incompatible with the security goals of this specification but that are outside of the scope of this document. The following subsections give examples of alternate TLS uses.¶

7.13. Predictability of Transfer IDs

The only requirement on Transfer IDs is that they be unique within each session from the sending peer only. The trivial algorithm of the first transfer starting at zero and later transfers incrementing by one causes absolutely predictable Transfer IDs. Even when a TCPCL session is not TLS secured and there is an on-path attacker causing denial of service with XFER_REFUSE messages, it is not possible to preemptively refuse a transfer, so there is no benefit in having unpredictable Transfer IDs within a session.¶

8.1. Port Number

Within the "Service Name and Transport Protocol Port Number Registry" [IANA-PORTS], TCP port number 4556 had previously been assigned as the default port for the TCPCL; see [RFC7242]. This assignment is unchanged by TCPCL version 4, but the assignment reference has been updated to point to this specification. Each TCPCL entity identifies its TCPCL protocol version in its initial contact (see Sections 3.2 and 8.2), so there is no ambiguity regarding what protocol is being used. The related assignments for UDP and DCCP port 4556 (both registered by [RFC7122]) are unchanged.¶

8.2. Protocol Versions

IANA has registered the following value in the "Bundle Protocol TCP Convergence-Layer Version Numbers" registry [RFC7242].¶

8.3. Session Extension Types

Under the "Bundle Protocol" registry [IANA-BUNDLE], IANA has created the "Bundle Protocol TCP Convergence-Layer Version 4 Session Extension Types" registry and populated it with the contents of Table 12. The registration procedure is Expert Review within the lower range 0x0001-0x7FFF. Values in the range 0x8000-0xFFFF are reserved for Private or Experimental Use, which are not recorded by IANA.¶

Specifications of new session extension types need to define the encoding of the Item Value data as well as any meaning or restriction on the number of or order of instances of the type within an extension item list. Specifications need to define how the extension functions when no instance of the new extension type is received during session negotiation.¶

Experts are encouraged to be biased towards approving registrations unless they are abusive, frivolous, or actively harmful (not merely esthetically displeasing or architecturally dubious).¶

8.4. Transfer Extension Types

Under the "Bundle Protocol" registry [IANA-BUNDLE], IANA has created the "Bundle Protocol TCP Convergence-Layer Version 4 Transfer Extension Types" registry and populated it with the contents of Table 13. The registration procedure is Expert Review within the lower range 0x0001-0x7FFF. Values in the range 0x8000-0xFFFF are reserved for Private or Experimental Use, which are not recorded by IANA.¶

Specifications of new transfer extension types need to define the encoding of the Item Value data as well as any meaning or restriction on the number of or order of instances of the type within an extension item list. Specifications need to define how the extension functions when no instance of the new extension type is received in a transfer.¶

Experts are encouraged to be biased towards approving registrations unless they are abusive, frivolous, or actively harmful (not merely esthetically displeasing or architecturally dubious).¶

8.5. Message Types

Under the "Bundle Protocol" registry [IANA-BUNDLE], IANA has created the "Bundle Protocol TCP Convergence-Layer Version 4 Message Types" registry and populated it with the contents of Table 14. The registration procedure is RFC Required within the lower range 0x01-0xEF. Values in the range 0xF0-0xFF are reserved for Private or Experimental Use, which are not recorded by IANA.¶

Specifications of new message types need to define the encoding of the message data as well as the purpose and relationship of the new message to existing session/transfer state within the baseline message sequencing. The use of new message types needs to be negotiated between TCPCL entities within a session (using the session extension mechanism) so that the receiving entity can properly decode all message types used in the session.¶

Experts are encouraged to favor new session/transfer extension types over new message types. TCPCL messages are not self-delimiting, so care must be taken in introducing new message types. If an entity receives an unknown message type, the only thing that can be done is to send a MSG_REJECT and close the TCP connection; not even a clean termination can be done at that point.¶

8.6. XFER_REFUSE Reason Codes

Under the "Bundle Protocol" registry [IANA-BUNDLE], IANA has created the "Bundle Protocol TCP Convergence-Layer Version 4 XFER_REFUSE Reason Codes" registry and populated it with the contents of Table 15. The registration procedure is Specification Required within the lower range 0x00-0xEF. Values in the range 0xF0-0xFF are reserved for Private or Experimental Use, which are not recorded by IANA.¶

Specifications of new XFER_REFUSE reason codes need to define the meaning of the reason and disambiguate it from preexisting reasons. Each refusal reason needs to be usable by the receiving BPA to make retransmission or rerouting decisions.¶

Experts are encouraged to be biased towards approving registrations unless they are abusive, frivolous, or actively harmful (not merely esthetically displeasing or architecturally dubious).¶

8.7. SESS_TERM Reason Codes

Under the "Bundle Protocol" registry [IANA-BUNDLE], IANA has created the "Bundle Protocol TCP Convergence-Layer Version 4 SESS_TERM Reason Codes" registry and populated it with the contents of Table 16. The registration procedure is Specification Required within the lower range 0x00-0xEF. Values in the range 0xF0-0xFF are reserved for Private or Experimental Use, which are not recorded by IANA.¶

Specifications of new SESS_TERM reason codes need to define the meaning of the reason and disambiguate it from preexisting reasons. Each termination reason needs to be usable by the receiving BPA to make reconnection decisions.¶

Experts are encouraged to be biased towards approving registrations unless they are abusive, frivolous, or actively harmful (not merely esthetically displeasing or architecturally dubious).¶

8.8. MSG_REJECT Reason Codes

Under the "Bundle Protocol" registry [IANA-BUNDLE], IANA has created the "Bundle Protocol TCP Convergence-Layer Version 4 MSG_REJECT Reason Codes" registry and populated it with the contents of Table 17. The registration procedure is Specification Required within the lower range 0x01-0xEF. Values in the range 0xF0-0xFF are reserved for Private or Experimental Use, which are not recorded by IANA.¶

Specifications of new MSG_REJECT reason codes need to define the meaning of the reason and disambiguate it from preexisting reasons. Each rejection reason needs to be usable by the receiving TCPCL entity to make message sequencing and/or session termination decisions.¶

Experts are encouraged to be biased towards approving registrations unless they are abusive, frivolous, or actively harmful (not merely esthetically displeasing or architecturally dubious).¶

8.9. Object Identifier for PKIX Module Identifier

IANA has registered the following in the "SMI Security for PKIX Module Identifier" registry [IANA-SMI] for identifying the module described in Appendix B.¶

8.10. Object Identifier for PKIX Other Name Forms

IANA has registered the following in the "SMI Security for PKIX Other Name Forms" registry [IANA-SMI] for identifying bundle endpoint IDs:¶

The formal structure of the associated Other Name Form is provided in Appendix B. The use of this OID is defined in Sections 4.4.1 and 4.4.2.¶

8.11. Object Identifier for PKIX Extended Key Usage

IANA has registered the following in the "SMI Security for PKIX Extended Key Purpose" registry [IANA-SMI] for securing BP bundles.¶

The formal definition of this EKU is provided in Appendix B. The use of this OID is defined in Section 4.4.2.¶