| Internet-Draft | In-situ OAM IPv6 encapsulation | May 2023 |
| Bhandari & Brockners | Expires 8 November 2023 | [Page] |
In-situ Operations, Administration, and Maintenance (IOAM) records operational and telemetry information in the packet while the packet traverses a path between two points in the network. This document outlines how IOAM data fields are encapsulated in IPv6.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 8 November 2023.¶
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
In-situ Operations, Administration, and Maintenance (IOAM) records operational and telemetry information in the packet while the packet traverses a path between two points in the network. IOAM concepts and associated nomenclature, as well as IOAM data fields are defined in [RFC9197]. This document outlines how IOAM data fields are encapsulated in IPv6 [RFC8200] and discusses deployment requirements for networks that use IPv6-encapsulated IOAM data fields.¶
The terms "encapsulation" and "decapsulation" are used in this document in the same way as in [RFC9197]: An IOAM encapsulating node incorporates one or more IOAM-Option-Types into packets. An IOAM decapsulating node removes IOAM-Option-Type(s) from packets.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
Abbreviations used in this document:¶
IOAM in IPv6 is used to enhance diagnostics of IPv6 networks. It complements other mechanisms designed to enhance diagnostics of IPv6 networks, such as the IPv6 Performance and Diagnostic Metrics Destination Option described in [RFC8250].¶
At the time this document was written, several implementations of IOAM for IPv6 exist, e.g., IOAM for IPv6 in the Linux Kernel (supported from Kernel version 5.15 onwards IPv6 IOAM in Linux Kernel), IOAM for IPv6 in VPP .¶
IOAM data fields can be encapsulated with two types of extension headers in IPv6 packets - either the hop-by-hop options header or the destination options header. Multiple options with the same option type MAY appear in the same hop-by-hop options or destination options header, with distinct content.¶
An IPv6 packet carrying IOAM data in an extension header can have other extension headers, compliant with [RFC8200].¶
IPv6 hop-by-hop and destination option format for carrying IOAM data fields:¶
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Option Type | Opt Data Len | Reserved | IOAM-Opt-Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<-+ | | | . . I . . O . . A . . M . . . . Option Data . O . . P . . T . . I . . O . . N | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+<-+¶
IOAM Option data is inserted as follows:¶
Pre-allocated Trace Option: The IOAM Preallocated Trace Option-Type defined in Section 4.4 of [RFC9197] is represented as an IPv6 option in the hop-by-hop extension header:¶
Proof of Transit Option: The IOAM POT Option-Type defined in Section 4.5 of [RFC9197] is represented as an IPv6 option in the hop-by-hop extension header:¶
Edge to Edge Option: The IOAM E2E option defined in Section 4.6 [RFC9197] is represented as an IPv6 option in destination extension header:¶
Direct Export (DEX) Option: The IOAM Direct Export Option-Type defined in Section 3.2 of [RFC9326] is represented as an IPv6 option in the hop-by-hop extension header:¶
All the IOAM IPv6 options defined here have alignment requirements. Specifically, they all require 4n alignment. This ensures that fields specified in [RFC9197] are aligned at a multiple-of-4 offset from the start of the hop-by-hop and destination options header.¶
IPv6 options can have a maximum length of 255 octets. Consequently, the total length of IOAM Option-Types including all data fields is also limited to 255 octets when encapsulated into IPv6.¶
IOAM deployments in IPv6 networks MUST take the following considerations and requirements into account:¶
For deployments where the IOAM domain is bounded by hosts, hosts will perform the operation of IOAM data field encapsulation and decapsulation, i.e., hosts will place the IOAM data fields directly in the IPv6 header or remove the IOAM data fields directly from the IPv6 header. IOAM data is carried in IPv6 packets as hop-by-hop or destination options as specified in this document.¶
For deployments where the IOAM domain is bounded by network devices, network devices such as routers form the edge of an IOAM domain. Network devices will perform the operation of IOAM data field encapsulation and decapsulation. Network devices will encapsulate IOAM data fields in an additional, outer, IPv6 header which carries the IOAM data fields.¶
This document describes the encapsulation of IOAM data fields in IPv6. For general IOAM security considerations, see [RFC9197]. Security considerations of the specific IOAM data fields for each case (i.e., Trace, Proof of Transit, and E2E) are also described and defined in [RFC9197].¶
As this document describes new options for IPv6, the security considerations of [RFC8200] and [RFC8250] apply.¶
From a network-protection perspective, there is an assumed trust model such that any node that adds IOAM to a packet, removes IOAM from a packet, or modifies IOAM data fields of a packet is assumed to be allowed to do so. By default, packets that include IPv6 extension headers with IOAM information MUST NOT be leaked through the boundaries of the IOAM-Domain.¶
IOAM-Domain boundary routers MUST filter any incoming traffic from outside the IOAM-Domain that contains IPv6 extension headers with IOAM information. IOAM-Domain boundary routers MUST also filter any outgoing traffic leaving the IOAM-Domain that contains IPv6 extension headers with IOAM information.¶
In the general case, an IOAM node only adds, removes, or modifies an IPv6 extension header with IOAM information, if the directive to do so comes from a trusted source and the directive is validated.¶
Problems may occur if the above behaviors are not implemented or if the assumed trust model is violated (e.g., through a security breach). In addition to the security considerations discussed in [RFC9197], the security considerations associated with IPv6 extension headers listed in [RFC9098] apply.¶
The network devices in an IOAM-Domain are trusted to add, update and remove IOAM options according to the constraints specified in [RFC8200]. IOAM domain does not rely on the Authentication Header (AH) as defined in [RFC4302] to secure IOAM options. The use of IOAM options with AH and its processing is not defined in this document. Future documents may define the use of IOAM with AH and its processing.¶
This draft requests the following IPv6 Option Type assignments from the destination options and hop-by-hop options sub-registry of Internet Protocol Version 6 (IPv6) Parameters.¶
http://www.iana.org/assignments/ipv6-parameters/ipv6- parameters.xhtml#ipv6-parameters-2¶
Hex Value Binary Value Description Reference
act chg rest
------------------------------------------------------------------
TBD_1_0 00 0 TBD_1 IOAM [This draft]
destination option
and
IOAM hop-by-hop option
TBD_1_1 00 1 TBD_1 IOAM [This draft]
destination option
and
IOAM hop-by-hop option
¶
The authors would like to thank Tom Herbert, Eric Vyncke, Nalini Elkins, Srihari Raghavan, Ranganathan T S, Karthik Babu Harichandra Babu, Akshaya Nadahalli, Stefano Previdi, Hemant Singh, Erik Nordmark, LJ Wobker, Mark Smith, Andrew Yourtchenko and Justin Iurman for the comments and advice. For the IPv6 encapsulation, this document leverages concepts described in [I-D.kitamura-ipv6-record-route]. The authors would like to acknowledge the work done by the author Hiroshi Kitamura and people involved in writing it.¶
This document was the collective effort of several authors. The text and content were contributed by the editors and the co-authors listed below. The contact information of the co-authors appears at the end of this document.¶
Carlos Pignataro Cisco Systems, Inc. 7200-11 Kit Creek Road Research Triangle Park, NC 27709 United States Email: cpignata@cisco.com Hannes Gredler RtBrick Inc. Email: hannes@rtbrick.com John Leddy Email: john@leddy.net Stephen Youell JP Morgan Chase 25 Bank Street London E14 5JP United Kingdom Email: stephen.youell@jpmorgan.com Tal Mizrahi Huawei Network.IO Innovation Lab Israel Email: tal.mizrahi.phd@gmail.com Aviv Kfir Mellanox Technologies, Inc. 350 Oakmead Parkway, Suite 100 Sunnyvale, CA 94085 U.S.A. Email: avivk@mellanox.com Barak Gafni Mellanox Technologies, Inc. 350 Oakmead Parkway, Suite 100 Sunnyvale, CA 94085 U.S.A. Email: gbarak@mellanox.com Petr Lapukhov Facebook 1 Hacker Way Menlo Park, CA 94025 US Email: petr@fb.com Mickey Spiegel Barefoot Networks, an Intel company 4750 Patrick Henry Drive Santa Clara, CA 95054 US Email: mickey.spiegel@intel.com Suresh Krishnan Kaloom Email: suresh@kaloom.com Rajiv Asati Cisco Systems, Inc. 7200 Kit Creek Road Research Triangle Park, NC 27709 US Email: rajiva@cisco.com Mark Smith PO BOX 521 HEIDELBERG, VIC 3084 AU Email: markzzzsmith+id@gmail.com¶