| Internet-Draft | SRv6 SIDs | February 2024 |
| Krishnan | Expires 18 August 2024 | [Page] |
The data plane for Segment Routing over IPv6 (SRv6) is built using IPv6 as the underlying forwarding plane. Due to this underlying use of IPv6, Segment Identifiers (SIDs) used by SRv6 can resemble IPv6 addresses and behave like them while exhibiting slightly different behaviors in some situations. This document explores the characteristics of SRv6 SIDs and focuses on the relationship of SRv6 SIDs to the IPv6 Addressing Architecture. This document allocates and makes a dedicated prefix available for SRv6 SIDs.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 18 August 2024.¶
Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Segment Routing over IPv6 (SRv6) [RFC8754] uses IPv6 as the underlying data plane. In SRv6, SR source nodes initiate packets with a segment identifier in the Destination Address of the IPv6 header, and SR segment endpoint nodes process a local segment present in the Destination Address of an IPv6 header. Thus Segment Identifiers (SIDs) in SRv6 can and do appear in the Destination Address of IPv6 datagrams by design. This document explores the characteristics of SRv6 SIDs and focuses on the relationship of SRv6 SIDs to the IPv6 Addressing Architecture [RFC4291]. This document allocates and makes a dedicated prefix available for SRv6 SIDs.¶
The following terms are used as defined in [RFC8402].¶
The following terms are used as defined in [RFC8754].¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
[RFC8754] defines the Segment List of the SRH as a contiguous array of 128-bit IPv6 addresses, and that each of the elements in this list are SIDs. But all of these elements are not necessarily made equal. Some of these elements may represent a local interface as described in Section 4.3 of [RFC8754] as "A FIB entry that represents a local interface, not locally instantiated as an SRv6 SID". From this it follows that not all the SIDs that appear in the SRH are SRv6 SIDs as defined by [RFC8402].¶
As stated above, the non-SRv6-SID elements that appear in the SRH SID list are simply IPv6 addresses assigned to local interfaces and they need to conform to [RFC4291]. So, the following discussions are applicable solely to SRv6 SIDs that are not assigned to local interfaces.¶
One of the key questions to address is how these SRv6 SIDs appearing as IPv6 Destination Addresses are perceived and treated by "transit nodes" (that are not required to be capable of processing a Segment or the Segment Routing Header).¶
Section 3.1. of [RFC8986] describes the format of an SRv6 SID as composed of three parts LOC:FUNCT:ARG, where a locator (LOC) is encoded in the L most significant bits of the SID, followed by F bits of function (FUNCT) and A bits of arguments (ARG). If L+F+A < 128, the ARG is followed by enough zero bits to fill the 128 bit SID. Such an SRv6 SID is assigned to a node within a prefix defined as a Locator of length L. When an SRv6 SID occurs in the IPv6 Destination Address of an IPv6 header, only the longest match prefix corresponding to the Locator [BCP198] is used by the transit node to forward the packet to the node identified by the Locator.¶
It is clear that this format for SRv6 SIDs is not compliant with the requirements set forth in [RFC4291] for IPv6 addresses but it is also clear that SRv6 SIDs are not intended for assignment onto interfaces on end hosts. They look and act similarly to other mechanisms that use IPv6 addresses with different formats such as [RFC6052] that defines the IPv6 Addressing of IPv4/IPv6 Translators and [RFC7343] that describes ORCHIDv2 (a cryptographic hash identifier format).¶
While looking at the transit nodes it becomes apparent that these addresses are used purely for forwarding and not for packet delivery to end hosts. Hence the relevant specification to apply here is [BCP198] that requires implementations to support the use of variable length prefixes in forwarding while explicitly decoupling IPv6 routing and forwarding from the IPv6 address/prefix semantics described in [RFC4291]. Please note that [BCP198] does not override the rules in [RFC4291], but merely limits where their impact is observed.¶
Furthermore, in the SRv6 specifications, all SIDs assigned within a given Locator prefix are located inside the node identified by Locator. Therefore there does not appear to be a conflict with section 2.6.1 of [RFC4291] since subnet-router anycast addresses are neither required nor useful within a node.¶
[CSID] introduces an encoding for compressed segment lists (C-SIDs), and describes how to use a single entry in the Segment list as a container for multiple SIDs. A node taking part in this mechanism accomplishes this by using the ARG part [RFC8986] of the Destination Address of the IPv6 header to derive a new Destination Address. i.e., the Destination Address field of the packet changes at a segment endpoint in a way similar to how the address changes as the result of processing a segment in the SRH.¶
One key thing to note here is that the Locator Block at the beginning of the address does not get modified by the operations needed for supporting compressed SIDs. As we have established that the SRv6 SIDs are being treated simply as routing prefixes on transit nodes within the SR domain this does not constitute a modification to the IPv6 data plane on such transit nodes and any changes are restricted to SR aware nodes.¶
All of the SRv6 related specifications discussed above are intended to be applicable to a contained SR Domain or between collaborating SR Domains. Nodes either inside or outside the SR Domains that are not SR-aware will not perform any special behavior for SRv6 SIDs and will treat them solely as IPv6 routing prefixes.¶
As an added factor of security, it is desirable to allocate some address space that explicitly signals that the addresses within that space cannot be expected to comply with [RFC4291]. As described in Section 3 above, there is precedent for mechanisms that use IPv6 addresses in a manner different from that specified in [RFC4291]. This would be useful in identifying and potentially filtering packets at the edges of the SR Domains to make it simpler for the SR domain to fail closed.¶
At the present time, global DNS [RFC8499] SHOULD NOT reference addresses assigned from this block. Further specifications are needed to describe the conventions and guidelines for the use of this newly allocated address block. The SRv6 operational community, which is the first intended user of this block, is requested to come up with such conventions and guidelines in line with their requirements.¶
IANA is requested to assign the following /16 address block from the IPv6 Unicast Address Registry [UNICAST] for the purposes described in Section 5 and record the allocation in the IPv6 Special-Purpose Address Registry [SPECIAL].¶
Address Block: 5f00::/16
Name: Segment Routing (SRv6) SIDs
RFC: This document
Allocation Date: Allocation Date
Termination Date: N/A
Source: True
Destination: True
Forwardable: True
Globally Reachable: False
Reserved-by-Protocol: False¶
The security considerations for the use of Segment Routing [RFC8402], SRv6 [RFC8754], and SRv6 network programming [RFC8986] apply to the use of these addresses. The use of IPv6 tunneling mechanisms (including SRv6) also brings up additional concerns such as those described in [RFC6169]. The usage of the prefix allocated by this document improves security by making it simpler to filter traffic at the edge of the SR domains.¶
In case the deployments do not use this allocated prefix, additional care needs to be exercised at network ingress and egress points so that SRv6 packets do not leak out of SR domains and they do not accidentally enter SR unaware domains. Similarly, as stated in Section 5.1 of [RFC8754], the SR domain needs to be configured to filter out packets entering that use the selected prefix.¶
The author would like to extend a special note of thanks to Brian Carpenter and Erik Kline for their precisely summarized thoughts on this topic that provided the seed of this draft. The author would also like to thank Andrew Alston, Fred Baker, Ron Bonica, Nick Buraglio, Bruno Decraene, Dhruv Dhody, Darren Dukes, Linda Dunbar, Reese Enghardt, Adrian Farrel, Clarence Filsfils, Jim Guichard, Joel Halpern, Ted Hardie, Bob Hinden, Murray Kucherawy, Cheng Li, Acee Lindem, Jen Linkova, Gyan Mishra, Yingzhen Qu, Robert Raszuk, Alvaro Retana, Michael Richardson, John Scudder, Petr Spacek, Mark Smith, Dirk Steinberg, Ole Troan, Eduard Vasilenko, Eric Vyncke, Rob Wilton, Jingrong Xie, Chongfeng Xie and Juan Carlos Zuniga for their ideas and comments to improve this document.¶