IPv6 Hop-by-Hop Options Processing Procedures

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 24 April 2023.¶

Copyright Notice

Copyright (c) 2022 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

This document specifies procedures for how IPv6 Hop-by-Hop options are processed. It modifies the procedures specified in the IPv6 Protocol Specification (RFC8200) to make processing of IPv6 Hop-by-Hop options practical with the goal of making IPv6 Hop-by-Hop options useful to deploy and use in the Internet.¶

The editors focus for this document is to set a lower bound for the minimum number of hop-by-hop options that a node should process. This document does not discuss an upper bound. That topic is discussed in [I-D.ietf-6man-eh-limits].¶

When published this document updates [RFC8200] and updates section 2.2 of [RFC7045].¶

The current list of defined Hop-by-Hop options can be found at [IANA-HBH].¶

3. Terminology

This document uses the following loosely defined terms:¶

• Forwarding Plane: IPv6 hosts exchange user data through the forwarding plane. User data is processed by its recipient (i.e., an IPv6 host). User data can traverse routers between its source and its destination. These routers process fields contained in packet headers. However, they do not process information contained in packet payloads.¶
• Control Plane: IPv6 routers exchange management and routing information with controllers. They also exchange routing information with one another. Management and routing information is processed by its recipient (i.e., an IPv6 router or controller). Management and control information can traverse router that process fields contained in packet headers. However, they do not process information contained in packet payloads.¶
• Fast Path: A path through a router that is optimized for forwarding packets without processing their payloads. The Fast Path might be supported by Application Specific Integrated Circuits (ASICS), Network Processor (NP), or other special purpose hardware. This is the usual processing path within a router taken by the forwarding plane.¶
• Slow Path: A path through a router that is capable of general purpose processing and is not optimized for any particular function. This processing path is used for packets that require special processing or differ from assumptions made in Fast Path heuristics or to process router control protocols used by the control plane.¶

NOTE: [RFC6192] is an example of how designs can separate control plane (Slow Path) and forwarding plane (Fast Path) functions. The separation between hardware and software processing described in [RFC6398] does not apply to all router architectures. However, a router that performs all or most processing in software might still incur more processing cost when providing special processing (aka Slow Path).¶

4. Background

In the first versions of the IPv6 specification [RFC1883] and [RFC2460], Hop-by-Hop options were required to be processed by all nodes: routers and hosts. This proved to not be practical in current high speed routers due to several factors, including:¶

• Inability to process the hop-by-hop options at the full forwarding rate (e.g., routers with no support on the Fast Path).¶
• Hop-by-Hop options would be sent to the Slow Path. This could degrade a router's performance and its ability to process important control traffic.¶
• It was recognised that a mechanism that forces packets from any source to the routers "Slow Path" could be exploited as a Denial of Service attack against the router.¶
• Packets could contain multiple Hop-by-Hop options making the previous issues worse by increasing the complexity required to process them, or requiring access to more bytes of protocol header.¶

When the IPv6 Specification was updated and published in July 2017 as [RFC8200], the procedures relating to hop-by-hop options were as follows:¶

• Extension headers (except for the Hop-by-Hop Options header) are not processed, inserted, or deleted by any node along a packet's delivery path, until the packet reaches the node (or each of the set of nodes, in the case of multicast) identified in the Destination Address field of the IPv6 header.¶
• The Hop-by-Hop Options header is not inserted or deleted, but may be examined or processed by any node along a packet's delivery path, until the packet reaches the node (or each of the set of nodes, in the case of multicast) identified in the Destination Address field of the IPv6 header. The Hop-by-Hop Options header, when present, must immediately follow the IPv6 header. Its presence is indicated by the value zero in the Next Header field of the IPv6 header.¶
• NOTE: While [RFC2460] required that all nodes must examine and process the Hop-by-Hop Options header, it is now expected that nodes along a packet's delivery path only examine and process the Hop-by-Hop Options header if explicitly configured to do so.¶

The changes meant that an implementation complied with the IPv6 specification even if it did not process hop-by-hop options, and that it was expected that routers would add configuration information to control which hop-by-hop options they would process.¶

The text regarding processing Hop-by Hop Options in [RFC8200] was not intended to change the processing of Hop-by-Hop options. It only documented how they were being used in the Internet at the time RFC8200 was published. This was a constraint on publishing the IPv6 specification as an IETF Standard.¶

The main issues remain:¶

• Routers are commonly configured to drop transit packets containing hop-by-hop options that would have required processing in the Slow Path. This could be to protect against a denial of service attack on the router.¶
• A survey in 2015 reported a high loss rate in transit ASs for packets with HBH options [RFC7872]. The operational implications of IPv6 Packets that set extension headers are discussed in [RFC9098].¶
• Allowing multiple hop-by-hop options in a single packet in some cases consumes more router resources to process these packets. It also adds complexity to the number of permutations that might need to be processed/configured.¶
• Any mechanism that can be used to force packets into the router's Slow Path can be exploited as a denial of service attack on a transit router by saturating the resources needed for router management protocols (e.g., routing protocols, network management protocols, etc.) that could cause the router to fail. This is an issue for the Router Alert option, which intentionally places packets on the Slow Path, is discussed in [RFC6398]. Section 3 of that RFC includes a good summary:¶

• "In a nutshell, the IP Router Alert Option does not provide a convenient universal mechanism to accurately and reliably distinguish between IP Router Alert packets of interest and unwanted IP Router Alert packets. This, in turn, creates a security concern when the IP Router Alert Option is used, because, short of appropriate router-implementation-specific mechanisms, the router Slow Path is at risk of being flooded by unwanted traffic."¶

There has been research that discussed the general problem with dropping packets containing IPv6 extension headers, including the Hop-by-Hop Options header. For example [Hendriks] states that "dropping all packets with Extension Headers, is a bad practice", and that "The share of traffic containing more than one EH however, is very small. For the design of hardware able to handle the dynamic nature of Extension Headers we therefore recommend to support at least one EH".¶

The topic discussed in this section is also discussed in [I-D.ietf-v6ops-hbh].¶

"Transmission and Processing of IPv6 Extension Headers" [RFC7045] clarified how intermediate nodes should process extension headers. This document is generally consistent with [RFC7045], and was considered when [RFC2460] was updated and was itself replaced by [RFC8200]. This document updates [RFC8200] as described in the next section and consequently updates the description in Section 2.2 of [RFC7045].¶

This document defines a set of procedures for the Hop-by-Hop Option header that are intended to make the processing of hop-by-hop options practical in modern transit routers. The authors expectations are that some hop-by-hop options will be processed across the Internet while others will only be processed in a limited domain (e.g., where there is a specific service made available in that network segment that relies on one or more hop-by-hop options).¶

5. Hop-by-Hop Header Processing Procedures

This section describes several changes to [RFC8200].¶

   00 - skip over this option and continue processing the header.

   01 - discard the packet.

   10 - discard the packet and, regardless of whether or not the
        packet's Destination Address was a multicast address, send an
        ICMPv6 Parameter Problem, Code 2, message to the packet's
        Source Address, pointing to the unrecognized Option Type.

   11 - discard the packet and, only if the packet's Destination
        Address was not a multicast address, send an ICMPv6 Parameter
        Problem, Code 2, message to the packet's Source Address,
        pointing to the unrecognized Option Type.

   10 - discard the packet and, regardless of whether or not the
        packet's Destination Address was a multicast address, MAY
        send an ICMP Parameter Problem, Code 2, message to the
        packet's Source Address, pointing to the unrecognized Option
        Type.

   11 - discard the packet and, only if the packet's Destination
        Address was not a multicast address, MAY send an ICMP
        Parameter Problem, Code 2, message to the packet's Source
        Address, pointing to the unrecognized Option Type.

6. New Hop-by-Hop Options

Any new IPv6 Hop-by-Hop option designed in the future should be designed to be processed at full forwarding rate (e.g., on a router's Fast Path, or at least without slowing processing of other packets). New options SHOULD NOT be defined that are not expected to be executed at full forwarding rate. New Hop-by-Hop options should have the following characteristics:¶

• Straight forward to process. That is, Hop-by-Hop options SHOULD be designed to keep the time to process low.¶
• New options SHOULD be defined with the Action type (highest-order 2 bits of the Option Type) set to 00 to skip over this option and continue processing the header if a node does not recognize the option.¶
• New Hop-by-Hop options SHOULD be designed to be the first option in a Hop-by-Hop options header.¶
• The size of an option SHOULD NOT extend beyond what can be reasonably expected to be executed at full forwarding rate (e.g., forwarded on a router's fast path).¶

Any new Hop-by-Hop option that is standardized that does not meet these criteria needs to explain in detail in its specification why this can not be accomplished and that there is a reasonable expectation that it can be proceed at full forwarding rate.¶

7. IANA Considerations

There are no actions required for IANA defined in this document.¶

8. Security Considerations

Security issues with IPv6 Hop-by-Hop options are well known and have been documented in several places, including [RFC6398], [RFC6192], [RFC7045] and [RFC9098]. The main issue, as noted in Section 4, is that any mechanism that can be used to force packets into the router's Slow Path can be exploited as a denial of service attack on a transit router by saturating the resources needed for router management protocols (e.g., routing protocols, network management protocols, etc.) that may cause the router to fail or perform sub-optimally. Due to this it's common for transit routers to drop packets with a Hop-by-Hop options header.¶

While Hop-by-Hop options are not required to be processed in the Slow Path, the Router Alert option is designed to do just that.¶

Some IPv6 nodes implement features that access more of the protocol information than a typical IPv6 router (e.g. [RFC9098]). Examples are nodes that provide virus-scanning, DDOS mitigation, Firewall/access control, traffic engineering, or traffic normalization. These nodes could be configured to drop packets when they are unable to access and process all extension headers, or are unable to locate and process the higher-layer packet information. This document provides guidance on the requirements concerning Hop-by-Hop Options.¶

Finally, the document notes that Internet protocol processing needs to be robust to malformed/malicious protocol fields. This requirement is not specific to Hop-by-Hop Options. It is important that implementations fail gracefully when a malformed or malicious Hop-by-Hop Option is encountered.¶

This document changes the way Hop-by-Hop options are processed in several ways that significantly reduce the attack surface. These changes include:¶

• All Hop-by-Hop options (with one exception) must be processed at full forwarding rate. Only one HBH Option MUST be processed and additional HBH Options MAY be processed based on local configuration.¶
• Only the Router Alert option can be processed in the Slow Path, and the router MUST be configured to do so.¶
• The document added criteria to allow control over how Router Alert options are processed and that a node configured to support these options must protect itself from attacks using the Router Alert.¶
• The document limited the default number of Hop-by-Hop options that can be included in a packet to a single Hop-by-Hop option.¶
• Additional Hop-by-Hop options MAY be included, based on local configuration. Although nodes only process these additional Hop-by-Hop Options if configured to do so.¶
• The document added restrictions to any future new Hop-by-Hop options that limit their size and computational requirements.¶

The authors intent is that these changes significantly reduce the security issues relating to IPv6 Hop-by-Hop options and will enable them to be used safely in the Internet.¶

9. Acknowledgments

Helpful comments were received from Brian Carpenter, Ron Bonica, Ole Troan, Mark Heard, Tom Herbert, Cheng Li, Eric Vyncke, Greg Mirksy, Xiao Min, Fernando Gont, Darren Dukes, Peng Shuping, [your name here], and other members of the 6MAN working group.¶

10. Change log [RFC Editor: Please remove]

draft-ietf-6man-hbh-processing-04, 2022-October-21:¶

• Add a paragraph to Section 4 that describes the relationship to [RFC7045] "Transmission and Processing of IPv6 Extension Headers".¶
• Change that this draft updates section 2.2 of [RFC7045].¶

draft-ietf-6man-hbh-processing-03, 2022-October-12:¶

• Changed in Section 5.2 to have router skip over options if can't process at full forwarding rate.¶
• Added to Section 6 that new options should be defined with action type set to 00.¶

draft-ietf-6man-hbh-processing-02, 2022-August-23:¶

• Several clarification and editorial changes suggested by a review by Peng Shuping.¶
• Editorial changes.¶
• Revised text relating to fast/slow path and processing rates.¶
• Revised the third paragraph in Section 5.4 to be clearer.¶
• Revised text in Security section based on comments from Fernando Gont.¶

draft-ietf-6man-hbh-processing-01, 2022-June-15:¶

• Fixed typo in last paragraph of Section 5.2¶
• Revised text in Section 4 to reflect constraints on publishing RFC8200.¶
• Changed text in Section 6 that new options SHOULD NOT (from MUST NOT) be defined that require that are not expected to be excepted at full forwarding rates.¶
• Added reference to RFC7872 in Section 4.¶
• Added text to Section 1 that the focus of this document is to set a minium bound on the number of Hop-by-Hop Options a node should process.¶
• Added text to Section 4 that the authors some Hop-by-Hop options will be supported Internet wide, and others only in limited domains.¶
• Editorial changes.¶

draft-ietf-6man-hbh-processing-00, 2022-January-29:¶

• 6MAN Working Group Draft¶
• Reworked text to talk about processing HBH options at full forwarding rates, instead of "fast path"¶
• Revised Section 6 "New Hop-by-Hop Options" to allow variable sized HBH options, remove specific length requirements, and other clarifications.¶
• Editorial changes.¶

draft-hinden-6man-hbh-processing-01, 2021-June-2:¶

• Expanded terminology section to include Forwarding Plane and Control Plane.¶
• Changed draft that only one HBH Option MUST be processed and additional HBH Options MAY be processed based on local configuration.¶
• Clarified that all HBH options (with one exception) must be processed on the Fast Path.¶
• Kept the Router Alert options as the single exception for Slow Path processing.¶
• Rewrote and expanded section on New Hop-by-Hop Options.¶
• Removed requirement for HBH Option size and alignment.¶
• Removed sections evaluating currently defined HBH Options.¶
• Added content to the Security Considerations section.¶
• Added people to the acknowledgements section.¶
• Numerous editorial changes¶

draft-hinden-6man-hbh-processing-00, 2020-Nov-29:¶

• Initial draft.¶

Authors' Addresses