idnits 2.17.1 draft-ietf-roll-useofrplinfo-31.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** There are 4 instances of too long lines in the document, the longest one being 2 characters in excess of 72. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (July 4, 2019) is 1757 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- Looks like a reference, but probably isn't: '1' on line 1740 -- Looks like a reference, but probably isn't: '2' on line 1077 == Outdated reference: A later version (-23) exists of draft-ietf-6lo-ap-nd-12 == Outdated reference: A later version (-20) exists of draft-ietf-6lo-backbone-router-11 == Outdated reference: A later version (-30) exists of draft-ietf-anima-autonomic-control-plane-19 == Outdated reference: A later version (-45) exists of draft-ietf-anima-bootstrapping-keyinfra-22 == Outdated reference: A later version (-13) exists of draft-ietf-intarea-tunnels-09 -- Obsolete informational reference (is this intentional?): RFC 2460 (Obsoleted by RFC 8200) Summary: 1 error (**), 0 flaws (~~), 6 warnings (==), 4 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 ROLL Working Group M. Robles 3 Internet-Draft Aalto 4 Updates: 6553, 6550, 8138 (if approved) M. Richardson 5 Intended status: Standards Track SSW 6 Expires: January 5, 2020 P. Thubert 7 Cisco 8 July 4, 2019 10 Using RPL Option Type, Routing Header for Source Routes and IPv6-in-IPv6 11 encapsulation in the RPL Data Plane 12 draft-ietf-roll-useofrplinfo-31 14 Abstract 16 This document looks at different data flows through LLN (Low-Power 17 and Lossy Networks) where RPL (IPv6 Routing Protocol for Low-Power 18 and Lossy Networks) is used to establish routing. The document 19 enumerates the cases where RFC6553 (RPL Option Type), RFC6554 20 (Routing Header for Source Routes) and IPv6-in-IPv6 encapsulation is 21 required in data plane. This analysis provides the basis on which to 22 design efficient compression of these headers. This document updates 23 RFC6553 adding a change to the RPL Option Type. Additionally, this 24 document updates RFC6550 defining a flag in the DIO Configuration 25 Option to indicate about this change and updates RFC8138 as well to 26 consider the new Option Type when the RPL Option is decompressed. 28 Status of This Memo 30 This Internet-Draft is submitted in full conformance with the 31 provisions of BCP 78 and BCP 79. 33 Internet-Drafts are working documents of the Internet Engineering 34 Task Force (IETF). Note that other groups may also distribute 35 working documents as Internet-Drafts. The list of current Internet- 36 Drafts is at https://datatracker.ietf.org/drafts/current/. 38 Internet-Drafts are draft documents valid for a maximum of six months 39 and may be updated, replaced, or obsoleted by other documents at any 40 time. It is inappropriate to use Internet-Drafts as reference 41 material or to cite them other than as "work in progress." 43 This Internet-Draft will expire on January 5, 2020. 45 Copyright Notice 47 Copyright (c) 2019 IETF Trust and the persons identified as the 48 document authors. All rights reserved. 50 This document is subject to BCP 78 and the IETF Trust's Legal 51 Provisions Relating to IETF Documents 52 (https://trustee.ietf.org/license-info) in effect on the date of 53 publication of this document. Please review these documents 54 carefully, as they describe your rights and restrictions with respect 55 to this document. Code Components extracted from this document must 56 include Simplified BSD License text as described in Section 4.e of 57 the Trust Legal Provisions and are provided without warranty as 58 described in the Simplified BSD License. 60 Table of Contents 62 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 63 1.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 4 64 2. Terminology and Requirements Language . . . . . . . . . . . . 4 65 3. RPL Overview . . . . . . . . . . . . . . . . . . . . . . . . 6 66 4. Updates to RFC6553, RFC6550 and RFC8138 . . . . . . . . . . . 7 67 4.1. Updates to RFC6553: Indicating the new RPI value. . . . . 7 68 4.2. Updates to RFC6550: Indicating the new RPI in the 69 DODAG Configuration Option Flag. . . . . . . . . . . . . 10 70 4.3. Updates to RFC8138: Indicating the way to decompress with 71 the new RPI value. . . . . . . . . . . . . . . . . . . . 11 72 5. Sample/reference topology . . . . . . . . . . . . . . . . . . 12 73 6. Use cases . . . . . . . . . . . . . . . . . . . . . . . . . . 14 74 7. Storing mode . . . . . . . . . . . . . . . . . . . . . . . . 16 75 7.1. Storing Mode: Interaction between Leaf and Root . . . . . 18 76 7.1.1. SM: Example of Flow from RAL to root . . . . . . . . 18 77 7.1.2. SM: Example of Flow from root to RAL . . . . . . . . 19 78 7.1.3. SM: Example of Flow from root to RUL . . . . . . . . 20 79 7.1.4. SM: Example of Flow from RUL to root . . . . . . . . 20 80 7.2. SM: Interaction between Leaf and Internet. . . . . . . . 21 81 7.2.1. SM: Example of Flow from RAL to Internet . . . . . . 22 82 7.2.2. SM: Example of Flow from Internet to RAL . . . . . . 22 83 7.2.3. SM: Example of Flow from RUL to Internet . . . . . . 23 84 7.2.4. SM: Example of Flow from Internet to RUL. . . . . . . 24 85 7.3. SM: Interaction between Leaf and Leaf . . . . . . . . . . 25 86 7.3.1. SM: Example of Flow from RAL to RAL . . . . . . . . . 25 87 7.3.2. SM: Example of Flow from RAL to RUL . . . . . . . . . 27 88 7.3.3. SM: Example of Flow from RUL to RAL . . . . . . . . . 27 89 7.3.4. SM: Example of Flow from RUL to RUL . . . . . . . . . 29 90 8. Non Storing mode . . . . . . . . . . . . . . . . . . . . . . 30 91 8.1. Non-Storing Mode: Interaction between Leaf and Root . . . 31 92 8.1.1. Non-SM: Example of Flow from RAL to root . . . . . . 32 93 8.1.2. Non-SM: Example of Flow from root to RAL . . . . . . 32 94 8.1.3. Non-SM: Example of Flow from root to RUL . . . . . . 33 95 8.1.4. Non-SM: Example of Flow from RUL to root . . . . . . 34 96 8.2. Non-Storing Mode: Interaction between Leaf and Internet . 35 97 8.2.1. Non-SM: Example of Flow from RAL to Internet . . . . 35 98 8.2.2. Non-SM: Example of Flow from Internet to RAL . . . . 36 99 8.2.3. Non-SM: Example of Flow from RUL to Internet . . . . 37 100 8.2.4. Non-SM: Example of Flow from Internet to RUL . . . . 38 101 8.3. Non-SM: Interaction between Leafs . . . . . . . . . . . . 39 102 8.3.1. Non-SM: Example of Flow from RAL to RAL . . . . . . . 39 103 8.3.2. Non-SM: Example of Flow from RAL to RUL . . . . . . . 41 104 8.3.3. Non-SM: Example of Flow from RUL to RAL . . . . . . . 42 105 8.3.4. Non-SM: Example of Flow from RUL to RUL . . . . . . . 43 106 9. Operational Considerations of supporting 107 not-RPL-aware-leaves . . . . . . . . . . . . . . . . . . . . 44 108 10. Operational considerations of introducing 0x23 . . . . . . . 45 109 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 46 110 12. Security Considerations . . . . . . . . . . . . . . . . . . . 47 111 13. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 50 112 14. References . . . . . . . . . . . . . . . . . . . . . . . . . 50 113 14.1. Normative References . . . . . . . . . . . . . . . . . . 50 114 14.2. Informative References . . . . . . . . . . . . . . . . . 51 115 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 54 117 1. Introduction 119 RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks) 120 [RFC6550] is a routing protocol for constrained networks. RFC6553 121 [RFC6553] defines the "RPL option" (RPL Packet Information or RPI), 122 carried within the IPv6 Hop-by-Hop header to quickly identify 123 inconsistencies (loops) in the routing topology. RFC6554 [RFC6554] 124 defines the "RPL Source Route Header" (RH3), an IPv6 Extension Header 125 to deliver datagrams within a RPL routing domain, particularly in 126 non-storing mode. 128 These various items are referred to as RPL artifacts, and they are 129 seen on all of the data-plane traffic that occurs in RPL routed 130 networks; they do not in general appear on the RPL control plane 131 traffic at all which is mostly hop-by-hop traffic (one exception 132 being DAO messages in non-storing mode). 134 It has become clear from attempts to do multi-vendor 135 interoperability, and from a desire to compress as many of the above 136 artifacts as possible that not all implementers agree when artifacts 137 are necessary, or when they can be safely omitted, or removed. 139 The ROLL WG analysized how [RFC2460] rules apply to storing and non- 140 storing use of RPL. The result was 24 data plane use cases. They 141 are exhaustively outlined here in order to be completely unambiguous. 142 During the processing of this document, new rules were published as 143 [RFC8200], and this document was updated to reflect the normative 144 changes in that document. 146 This document updates RFC6553, changing the RPI option value to make 147 RFC8200 routers ignore this option by default. 149 A Routing Header Dispatch for 6LoWPAN (6LoRH)([RFC8138]) defines a 150 mechanism for compressing RPL Option information and Routing Header 151 type 3 (RH3) [RFC6554], as well as an efficient IPv6-in-IPv6 152 technique. 154 Since some of the uses cases here described, use IPv6-in-IPv6 155 encapsulation. It MUST take in consideration, when encapsulation is 156 applied, the RFC6040 [RFC6040], which defines how the explicit 157 congestion notification (ECN) field of the IP header should be 158 constructed on entry to and exit from any IPV6-in-IPV6 tunnel. 159 Additionally, it is recommended the reading of 160 [I-D.ietf-intarea-tunnels] that explains the relationship of IP 161 tunnels to existing protocol layers and the challenges in supporting 162 IP tunneling. 164 Non-constrained uses of RPL are not in scope of this document, and 165 applicability statements for those uses may provide different advice, 166 E.g. [I-D.ietf-anima-autonomic-control-plane]. 168 1.1. Overview 170 The rest of the document is organized as follows: Section 2 describes 171 the used terminology. Section 3 describes the updates to RFC6553, 172 RFC6550 and RFC 8138. Section 4 provides the reference topology used 173 for the uses cases. Section 5 describes the uses cases included. 174 Section 6 describes the storing mode cases and section 7 the non- 175 storing mode cases. Section 8 describes the operational 176 considerations of supporting not-RPL-aware-leaves. Section 9 depicts 177 operational considerations for the proposed change on RPL Option 178 type, section 10 the IANA considerations and then section 11 179 describes the security aspects. 181 2. Terminology and Requirements Language 183 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 184 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 185 "OPTIONAL" in this document are to be interpreted as described in BCP 186 14 [RFC2119] [RFC8174] when, and only when, they appear in all 187 capitals, as shown here. 189 Terminology defined in [RFC7102] applies to this document: LLN, RPL, 190 RPL Domain and ROLL. 192 RPL-aware-node: A device which implements RPL. Please note that the 193 device can be found inside the LLN or outside LLN. 195 RPL-Aware-Leaf(RAL): A RPL-aware-node which is a leaf of a 196 (Destination Oriented Directed Acyclic Graph) DODAG. 198 RPL-unaware-node: A device which does not implement RPL, thus the 199 device is not-RPL-aware. Please note that the device can be found 200 inside the LLN. 202 RPL-Unaware-Leaf(RUL): A RPL-unaware-node which is a leaf of a 203 (Destination Oriented Directed Acyclic Graph) DODAG. 205 6LoWPAN Node (6LN): [RFC6775] defines it as: "A 6LoWPAN node is any 206 host or router participating in a LoWPAN. This term is used when 207 referring to situations in which either a host or router can play the 208 role described.". In this document, a 6LN acts as a leaf. 210 6LoWPAN Router (6LR): [RFC6775] defines it as:" An intermediate 211 router in the LoWPAN that is able to send and receive Router 212 Advertisements (RAs) and Router Solicitations (RSs) as well as 213 forward and route IPv6 packets. 6LoWPAN routers are present only in 214 route-over topologies." 216 6LoWPAN Border Router (6LBR): [RFC6775] defines it as:"A border 217 router located at the junction of separate 6LoWPAN networks or 218 between a 6LoWPAN network and another IP network. There may be one 219 or more 6LBRs at the 6LoWPAN network boundary. A 6LBR is the 220 responsible authority for IPv6 prefix propagation for the 6LoWPAN 221 network it is serving. An isolated LoWPAN also contains a 6LBR in 222 the network, which provides the prefix(es) for the isolated network." 224 Flag Day: A transition that involves having a network with different 225 values of RPL Option Type. Thus the network does not work correctly 226 (Lack of interoperation). 228 Hop-by-hop re-encapsulation: The term "hop-by-hop re-encapsulation" 229 header refers to adding a header that originates from a node to an 230 adjacent node, using the addresses (usually the GUA or ULA, but could 231 use the link-local addresses) of each node. If the packet must 232 traverse multiple hops, then it must be decapsulated at each hop, and 233 then re-encapsulated again in a similar fashion. 235 Non-storing Mode (Non-SM): RPL mode of operation in which the RPL- 236 aware-nodes send information to the root about its parents. Thus, 237 the root know the topology, then the intermediate 6LRs do not 238 maintain routing state so that source routing is needed. 240 Storing Mode (SM): RPL mode of operation in which RPL-aware-nodes 241 (6LRs) maintain routing state (of the children) so that source 242 routing is not needed. 244 Due to lack of space in some figures (tables) we refers IPv6-in-IPv6 245 as IP6-IP6. 247 3. RPL Overview 249 RPL defines the RPL Control messages (control plane), a new ICMPv6 250 [RFC4443] message with Type 155. DIS (DODAG Information 251 Solicitation), DIO (DODAG Information Object) and DAO (Destination 252 Advertisement Object) messages are all RPL Control messages but with 253 different Code values. A RPL Stack is shown in Figure 1. 255 +--------------+ 256 | Upper Layers | 257 | | 258 +--------------+ 259 | RPL | 260 | | 261 +--------------+ 262 | ICMPv6 | 263 | | 264 +--------------+ 265 | IPv6 | 266 | | 267 +--------------+ 268 | 6LoWPAN | 269 | | 270 +--------------+ 271 | PHY-MAC | 272 | | 273 +--------------+ 275 Figure 1: RPL Stack. 277 RPL supports two modes of Downward traffic: in storing mode (SM), it 278 is fully stateful; in non-storing mode (Non-SM), it is fully source 279 routed. A RPL Instance is either fully storing or fully non-storing, 280 i.e. a RPL Instance with a combination of storing and non-storing 281 nodes is not supported with the current specifications at the time of 282 writing this document. 284 4. Updates to RFC6553, RFC6550 and RFC8138 286 4.1. Updates to RFC6553: Indicating the new RPI value. 288 This modification is required to be able to send, for example, IPv6 289 packets from a RPL-Aware-Leaf to a not-RPL-aware node through 290 Internet (see Section 7.2.1), without requiring IPv6-in-IPv6 291 encapsulation. 293 [RFC6553] (Section 6, Page 7) states as shown in Figure 2, that in 294 the Option Type field of the RPL Option header, the two high order 295 bits must be set to '01' and the third bit is equal to '1'. The 296 first two bits indicate that the IPv6 node must discard the packet if 297 it doesn't recognize the option type, and the third bit indicates 298 that the Option Data may change in route. The remaining bits serve 299 as the option type. 301 +-------+-------------------+----------------+-----------+ 302 | Hex | Binary Value | Description | Reference | 303 + Value +-------------------+ + + 304 | | act | chg | rest | | | 305 +-------+-----+-----+-------+----------------+-----------+ 306 | 0x63 | 01 | 1 | 00011 | RPL Option | [RFC6553] | 307 +-------+-----+-----+-------+----------------+-----------+ 309 Figure 2: Option Type in RPL Option. 311 This document illustrates that is is not always possible to know for 312 sure at the source that a packet will only travel within the RPL 313 domain or may leave it. 315 At the time [RFC6553] was published, leaking a Hop-by-Hop header in 316 the outer IPv6 header chain could potentially impact core routers in 317 the internet. So at that time, it was decided to encapsulate any 318 packet with a RPL option using IPv6-in-IPv6 in all cases where it was 319 unclear whether the packet would remain within the RPL domain. In 320 the exception case where a packet would still leak, the Option Type 321 would ensure that the first router in the Internet that does not 322 recognize the option would drop the packet and protect the rest of 323 the network. 325 Even with [RFC8138] that compresses the IPv6-in-IPv6 header, this 326 approach yields extra bytes in a packet which means consuming more 327 energy, more bandwidth, incurring higher chances of loss and possibly 328 causing a fragmentation at the 6LoWPAN level. This impacts the daily 329 operation of constrained devices for a case that generally does not 330 happen and would not heavily impact the core anyway. 332 While intention was and remains that the Hop-by-Hop header with a RPL 333 option should be confined within the RPL domain, this specification 334 modifies this behavior in order to reduce the dependency on IPv6-in- 335 IPv6 and protect the constrained devices. Section 4 of [RFC8200] 336 clarifies the behaviour of routers in the Internet as follows: "it is 337 now expected that nodes along a packet's delivery path only examine 338 and process the Hop-by-Hop Options header if explicitly configured to 339 do so". 341 When unclear about the travel of a packet, it becomes preferable for 342 a source not to encapsulate, accepting the fact that the packet may 343 leave the RPL domain on its way to its destination. In that event, 344 the packet should reach its destination and should not be discarded 345 by the first node that does not recognize the RPL option. But with 346 the current value of the Option Type, if a node in the Internet is 347 configured to process the Hop-by-Hop header, and if such node 348 encounters an option with the first two bits set to 01 and conforms 349 to [RFC8200], it will drop the packet. Host systems should do the 350 same, irrespective of the configuration. 352 Thus, this document updates the Option Type field to (Figure 3): the 353 two high order bits MUST be set to '00' and the third bit is equal to 354 '1'. The first two bits indicate that the IPv6 node MUST skip over 355 this option and continue processing the header ([RFC8200] 356 Section 4.2) if it doesn't recognize the option type, and the third 357 bit continues to be set to indicate that the Option Data may change 358 en route. The remaining bits serve as the option type and remain as 359 0x3. This ensures that a packet that leaves the RPL domain of an LLN 360 (or that leaves the LLN entirely) will not be discarded when it 361 contains the [RFC6553] RPL Hop-by-Hop option known as RPI. 363 With the new Option Type, if an IPv6 (intermediate) node (RPL-not- 364 capable) receives a packet with an RPL Option, it should ignore the 365 Hop-by-Hop RPL option (skip over this option and continue processing 366 the header). This is relevant, as it was mentioned previously, in 367 the case that there is a flow from RAL to Internet (see 368 Section 7.2.1). 370 This is a significant update to [RFC6553]. 372 +-------+-------------------+-------------+------------+ 373 | Hex | Binary Value | Description | Reference | 374 + Value +-------------------+ + + 375 | | act | chg | rest | | | 376 +-------+-----+-----+-------+-------------+------------+ 377 | 0x23 | 00 | 1 | 00011 | RPL Option |[RFCXXXX](*)| 378 +-------+-----+-----+-------+-------------+------------+ 380 Figure 3: Revised Option Type in RPL Option. (*)represents this 381 document 383 Without the signaling described below, this change would otherwise 384 create a lack of interoperation (flag day) for existing networks 385 which are currently using 0x63 as the RPI value. A move to 0x23 will 386 not be understood by those networks. It is suggested that RPL 387 implementations accept both 0x63 and 0x23 when processing the header. 389 When forwarding packets, implementations SHOULD use the same value as 390 it was received (This is required because, RPI type code can not be 391 changed by [RFC8200] - Section 4.2). It allows to the network to be 392 incrementally upgraded, and for the DODAG root to know which parts of 393 the network are upgraded. 395 When originating new packets, implementations SHOULD have an option 396 to determine which value to originate with, this option is controlled 397 by the DIO option described below. 399 A network which is switching from straight 6LoWPAN compression 400 mechanism to those described in [RFC8138] will experience a flag day 401 in the data compression anyway, and if possible this change can be 402 deployed at the same time. 404 The change of RPI option type from 0x63 to 0x23, makes all [RFC8200] 405 Section 4.2 compliant nodes tolerant of the RPL artifacts. There is 406 therefore no longer a necessity to remove the artifacts when sending 407 traffic to the Internet. This change clarifies when to use an IPv6- 408 in-IPv6 header, and how to address them: The Hop-by-Hop Options 409 Header containing the RPI option MUST always be added when 6LRs 410 originate packets (without IPv6-in-IPv6 headers), and IPv6-in-IPv6 411 headers MUST always be added when a 6LR find that it needs to insert 412 a Hop-by-Hop Options Header containing the RPI option. The IPv6-in- 413 IPv6 header is to be addressed to the RPL root when on the way up, 414 and to the end-host when on the way down. 416 In the non-storing case, dealing with not-RPL aware leaf nodes is 417 much easier as the 6LBR (DODAG root) has complete knowledge about the 418 connectivity of all DODAG nodes, and all traffic flows through the 419 root node. 421 The 6LBR can recognize not-RPL aware leaf nodes because it will 422 receive a DAO about that node from the 6LR immediately above that 423 not-RPL aware node. This means that the non-storing mode case can 424 avoid ever using hop-by-hop re-encapsulation headers for traffic 425 originating from the root to the leafs. 427 The non-storing mode case does not require the type change from 0x63 428 to 0x23, as the root can always create the right packet. The type 429 change does not adversely affect the non-storing case. 431 4.2. Updates to RFC6550: Indicating the new RPI in the DODAG 432 Configuration Option Flag. 434 In order to avoid a Flag Day caused by lack of interoperation between 435 new RPI (0x23) and old RPI (0x63) nodes, this section defines a flag 436 in the DIO Configuration Option, to indicate when then new RPI value 437 can be safely used. This means, the flag is going to indicate the 438 type of RPI that the network is using. Thus, when a node join to a 439 network will know which value to use. With this, RPL-capable nodes 440 know if it is safe to use 0x23 when creating a new RPI. A node that 441 forwards a packet with an RPI MUST NOT modify the option type of the 442 RPI. 444 This is done via a DODAG Configuration Option flag which will 445 propagate through the network. If the flag is received with a value 446 zero (which is the default), then new nodes will remain in RFC6553 447 Compatible Mode; originating traffic with the old-RPI (0x63) value. 449 As stated in [RFC6550] the DODAG Configuration option is present in 450 DIO messages. The DODAG Configuration option distributes 451 configuration information. It is generally static, and does not 452 change within the DODAG. This information is configured at the DODAG 453 root and distributed throughout the DODAG with the DODAG 454 Configuration option. Nodes other than the DODAG root do not modify 455 this information when propagating the DODAG Configuration option. 457 The DODAG Configuration Option has a Flag field which is modified by 458 this document. Currently, the DODAG Configuration Option in 459 [RFC6550] states: "the unused bits MUST be initialize to zero by the 460 sender and MUST be ignored by the receiver". 462 Bit number three of the flag field in the DODAG Configuration option 463 is to be used as shown in Figure 4 : 465 +------------+-----------------+---------------+ 466 | Bit number | Description | Reference | 467 +------------+-----------------+---------------+ 468 | 3 | RPI 0x23 enable | This document | 469 +------------+-----------------+---------------+ 471 Figure 4: DODAG Configuration Option Flag to indicate the RPI-flag- 472 day. 474 In case of rebooting, the node (6LN or 6LR) does not remember the RPL 475 Option Type, that is if the flag is set, so DIO messages sent by the 476 node would be set with the flag unset until a DIO message is received 477 with the flag set indicating the new RPI value. The node sets to 478 0x23 if the node supports this feature. 480 4.3. Updates to RFC8138: Indicating the way to decompress with the new 481 RPI value. 483 This modification is required to be able to decompress the RPL RPI 484 option with the new value (0x23). 486 RPI-6LoRH header provides a compressed form for the RPL RPI [RFC8138] 487 in section 6. A node that is decompressing this header MUST 488 decompress using the RPL RPI option type that is currently active: 489 that is, a choice between 0x23 (new) and 0x63 (old). The node will 490 know which to use based upon the presence of the flag in the DODAG 491 Configuration Option defined in Section 4.2. E.g. If the network is 492 in 0x23 mode (by DIO option), then it should be decompressed to 0x23. 494 [RFC8138] section 7 documents how to compress the IPv6-in-IPv6 495 header. 497 There are potential significant advantages to having a single code 498 path that always processes IPv6-in-IPv6 headers with no conditional 499 branches. 501 In Storing Mode, for the examples of Flow from RAL to RUL and RUL to 502 RUL comprise an IPv6-in-IPv6 and RPI compression headers. The use of 503 the IPv6-in-IPv6 header is MANDATORY in this case, and it SHOULD be 504 compressed with [RFC8138] section 7. Figure 5 illustrates the case 505 in Storing mode where the packet is received from the Internet, then 506 the root encapsulates the packet to insert the RPI. In that example, 507 the leaf is not known to support RFC 8138, and the packet is 508 encapsulated to the 6LR that is the parent and last hop to the final 509 destination. 511 +-+ ... -+-+ ... +-+- ... -+-+- .... +-+-+-+ ... +-+-+ ... -+ ... +-... 512 |11110001|SRH-6LoRH| RPI- |IPv6-in-IPv6| NH=1 |11110CPP| UDP | UDP 513 |Page 1 |Type1 S=0| 6LoRH | 6LoRH |LOWPAN_IPHC| UDP | hdr |Payld 514 +-+ ... -+-+ ... +-+- ... -+-+-- ...+-+-+-+-+ ... +-+-+ ... -+ ... +-... 515 <-4bytes-> <- RFC 6282 -> 516 No RPL artifact 518 Figure 5: RPI Inserted by the Root in Storing Mode 520 In Figure 5, the source of the IPv6-in-IPv6 encapsulation is the 521 Root, so it is elided in the IPv6-in-IPv6 6LoRH. The destination is 522 the parent 6LR of the destination of the inner packet so it cannot be 523 elided. It is placed as the single entry in an SRH-6LoRH as the 524 first 6LoRH. There is a single entry so the SRH-6LoRH Size is 0. In 525 that example, the type is 1 so the 6LR address is compressed to 2 526 bytes. It results that the total length of the SRH-6LoRH is 4 bytes. 527 Follows the RPI-6LoRH and then the IPv6-in-IPv6 6LoRH. When the 528 IPv6-in-IPv6 6LoRH is removed, all the router headers that precede it 529 are also removed. The Paging Dispatch [RFC8025] may also be removed 530 if there was no previous Page change to a Page other than 0 or 1, 531 since the LOWPAN_IPHC is encoded in the same fashion in the default 532 Page 0 and in Page 1. The resulting packet to the destination is the 533 inner packet compressed with [RFC6282]. 535 5. Sample/reference topology 537 A RPL network in general is composed of a 6LBR, Backbone Router 538 (6BBR), 6LR and 6LN as leaf logically organized in a DODAG structure. 540 Figure 6 shows the reference RPL Topology for this document. The 541 letters above the nodes are there so that they may be referenced in 542 subsequent sections. In the figure, 6LR represents a full router 543 node. The 6LN is a RPL aware router, or host (as a leaf). 544 Additionally, for simplification purposes, it is supposed that the 545 6LBR has direct access to Internet, thus the 6BBR is not present in 546 the figure. 548 The 6LN leaves (RAL) marked as (F, H and I) are RPL nodes with no 549 children hosts. 551 The leafs marked as RUL (G and J) are devices which do not speak RPL 552 at all (not-RPL-aware), but uses Router-Advertisements, 6LowPAN DAR/ 553 DAC and efficient-ND only to participate in the network [RFC6775]. 554 In the document these leafs (G and J) are also referred to as an IPv6 555 node. 557 The 6LBR ("A") in the figure is the root of the Global DODAG. 559 +------------+ 560 | INTERNET ----------+ 561 | | | 562 +------------+ | 563 | 564 | 565 | 566 A | 567 +-------+ 568 |6LBR | 569 +-----------|(root) |-------+ 570 | +-------+ | 571 | | 572 | | 573 | | 574 | | 575 | B |C 576 +---|---+ +---|---+ 577 | 6LR | | 6LR | 578 +---------| |--+ +--- ---+ 579 | +-------+ | | +-------+ | 580 | | | | 581 | | | | 582 | | | | 583 | | | | 584 | D | E | | 585 +-|-----+ +---|---+ | | 586 | 6LR | | 6LR | | | 587 | | +------ | | | 588 +---|---+ | +---|---+ | | 589 | | | | | 590 | | +--+ | | 591 | | | | | 592 | | | | | 593 | | | I | J | 594 F | | G | H | | 595 +-----+-+ +-|-----+ +---|--+ +---|---+ +---|---+ 596 | RAL | | RUL | | RAL | | RAL | | RUL | 597 | 6LN | | 6LN | | 6LN | | 6LN | | 6LN | 598 +-------+ +-------+ +------+ +-------+ +-------+ 600 Figure 6: A reference RPL Topology. 602 6. Use cases 604 In the data plane a combination of RFC6553, RFC6554 and IPv6-in-IPv6 605 encapsulation are going to be analyzed for a number of representative 606 traffic flows. 608 This document assumes that the LLN is using the no-drop RPI option 609 (0x23). 611 The use cases describe the communication in the following cases: - 612 Between RPL-aware-nodes with the root (6LBR) - Between RPL-aware- 613 nodes with the Internet - Between RUL nodes within the LLN (e.g. see 614 Section 7.1.4) - Inside of the LLN when the final destination address 615 resides outside of the LLN (e.g. see Section 7.2.3). 617 The uses cases are as follows: 619 Interaction between Leaf and Root: 621 RAL to root 623 root to RAL 625 RUL to root 627 root to RUL 629 Interaction between Leaf and Internet: 631 RAL to Internet 633 Internet to RAL 635 RUL to Internet 637 Internet to RUL 639 Interaction between Leafs: 641 RAL to RAL (storing and non-storing) 643 RAL to RUL (non-storing) 645 RUL to RAL (storing and non-storing) 647 RUL to RUL (non-storing) 649 This document is consistent with the rule that a Header cannot be 650 inserted or removed on the fly inside an IPv6 packet that is being 651 routed. This is a fundamental precept of the IPv6 architecture as 652 outlined in [RFC8200]. 654 As the rank information in the RPI artifact is changed at each hop, 655 it will typically be zero when it arrives at the DODAG root. The 656 DODAG root MUST force it to zero when passing the packet out to the 657 Internet. The Internet will therefore not see any SenderRank 658 information. 660 Despite being legal to leave the RPI artifact in place, an 661 intermediate router that needs to add an extension header (e.g. RH3 662 or RPI Option) MUST still encapsulate the packet in an (additional) 663 outer IP header. The new header is placed after this new outer IP 664 header. 666 A corollary is that an RH3 or RPI Option can only be removed by an 667 intermediate router if it is placed in an encapsulating IPv6 Header, 668 which is addressed TO the intermediate router. When it does so, the 669 whole encapsulating header must be removed. (A replacement may be 670 added). This sometimes can result in outer IP headers being 671 addressed to the next hop router using link-local address. 673 Both RPI and RH3 headers may be modified in very specific ways by 674 routers on the path of the packet without the need to add and remove 675 an encapsulating header. Both headers were designed with this 676 modification in mind, and both the RPL RH3 and the RPL option are 677 marked mutable but recoverable: so an IPsec AH security header can be 678 applied across these headers, but it can not secure the values which 679 mutate. 681 RPI MUST be present in every single RPL data packet. 683 Prior to [RFC8138], there was significant interest in removing the 684 RPI for downward flows in non-storing mode. The exception covered a 685 very small number of cases, and causes significant interoperability 686 challenges, yet costed significant code and testing complexity. The 687 ability to compress the RPI down to three bytes or less removes much 688 of the pressure to optimize this any further 689 [I-D.ietf-anima-autonomic-control-plane]. 691 The earlier examples are more extensive to make sure that the process 692 is clear, while later examples are more concise. 694 The uses cases are delineated based on the following requirements: 696 The RPI option has to be in every packet that traverses the LLN. 698 - Because of (1), packets from the Internet have to be 699 encapsulated. 701 - A Header cannot be inserted or removed on the fly inside an IPv6 702 packet that is being routed. 704 - Extension headers may not be added or removed except by the 705 sender or the receiver. 707 - RPI and RH3 headers may be modified by routers on the path of 708 the packet without the need to add and remove an encapsulating 709 header. 711 - An RH3 or RPI Option can only be removed by an intermediate 712 router if it is placed in an encapsulating IPv6 Header, which is 713 addressed to the intermediate router. 715 - Non-storing mode requires downstream encapsulation by root for 716 RH3. 718 The uses cases are delineated based on the following assumptions: 720 This document assumes that the LLN is using the no-drop RPI option 721 (0x23). 723 - Each IPv6 node (including Internet routers) obeys [RFC8200] 724 8200, so that 0x23 RPI can be safely inserted. 726 - All 6LRs obey [RFC8200]. 728 - The RPI is ignored at the IPv6 dst node (RPL-unaware-leaf). 730 - The leaf can be a router 6LR or a host, both indicated as 6LN. 732 - Non-constrained uses of RPL are not in scope of this document. 734 - Compression is based on [RFC8138]. 736 - The flow label [RFC6437] is not needed in RPL. 738 7. Storing mode 740 In storing mode (SM) (fully stateful), the sender can determine if 741 the destination is inside the LLN by looking if the destination 742 address is matched by the DIO's Prefix Information Option (PIO) 743 option. 745 The following table (Figure 7) itemizes which headers are needed in 746 each of the following scenarios. It indicates if the IPv6-in-IPv6 747 header that is added, must be addressed to the final destination (the 748 RAL node that is the target(tgt)), to the "root" or if a hop-by-hop 749 header must be added (indicated by "hop"). In the hop-by-hop basis, 750 the destination address for the next hop is the link-layer address of 751 the next hop. 753 In cases where no IPv6-in-IPv6 header is needed, the column states as 754 "No". If the IPv6-in-IPv6 header is needed is a "must". 756 In all cases the RPI headers are needed, since it identifies 757 inconsistencies (loops) in the routing topology. In all cases the 758 RH3 is not needed because it is not used in storing mode. 760 In each case, 6LR_i are the intermediate routers from source to 761 destination. "1 <= i <= n", n is the number of routers (6LR) that 762 the packet goes through from source (6LN) to destination. 764 The leaf can be a router 6LR or a host, both indicated as 6LN. The 765 root refers to the 6LBR (see Figure 6). 767 +---------------------+--------------+------------+------------------+ 768 | Interaction between | Use Case |IPv6-in-IPv6| IPv6-in-IPv6 dst | 769 +---------------------+--------------+------------+------------------+ 770 | | RAL to root | No | No | 771 + +--------------+------------+------------------+ 772 | Leaf - Root | root to RAL | No | No | 773 + +--------------+------------+------------------+ 774 | | root to RUL | No | No | 775 + +--------------+------------+------------------+ 776 | | RUL to root | must | root | 777 +---------------------+--------------+------------+------------------+ 778 | | RAL to Int | No | No | 779 + +--------------+------------+------------------+ 780 | Leaf - Internet | Int to RAL | must | RAL (tgt) | 781 + +--------------+------------+------------------+ 782 | | RUL to Int | must | root | 783 + +--------------+------------+------------------+ 784 | | Int to RUL | must | hop | 785 +---------------------+--------------+------------+------------------+ 786 | | RAL to RAL | No | No | 787 + +--------------+------------+------------------+ 788 | | RAL to RUL | No | No | 789 + Leaf - Leaf +--------------+------------+------------------+ 790 | | RUL to RAL | must | RAL (tgt) | 791 + +--------------+------------+------------------+ 792 | | RUL to RUL | must | hop | 793 +---------------------+--------------+------------+------------------+ 795 Figure 7: Table of IPv6-in-IPv6 encapsulation in Storing mode. 797 7.1. Storing Mode: Interaction between Leaf and Root 799 In this section is described the communication flow in storing mode 800 (SM) between, 802 RAL to root 804 root to RAL 806 RUL to root 808 root to RUL 810 7.1.1. SM: Example of Flow from RAL to root 812 In storing mode, RFC 6553 (RPI) is used to send RPL Information 813 instanceID and rank information. 815 In this case the flow comprises: 817 RAL (6LN) --> 6LR_i --> root(6LBR) 819 For example, a communication flow could be: Node F --> Node D --> 820 Node B --> Node A root(6LBR) 822 The 6LN (Node F) inserts the RPI header, and sends the packet to 6LR 823 (Node E) which decrements the rank in RPI and sends the packet up. 824 When the packet arrives at 6LBR (Node A), the RPI is removed and the 825 packet is processed. 827 No IPv6-in-IPv6 header is required. 829 The RPI header can be removed by the 6LBR because the packet is 830 addressed to the 6LBR. The 6LN must know that it is communicating 831 with the 6LBR to make use of this scenario. The 6LN can know the 832 address of the 6LBR because it knows the address of the root via the 833 DODAGID in the DIO messages. 835 The Table 1 summarizes what headers are needed for this use case. 837 +-------------------+---------+-------+----------+ 838 | Header | 6LN src | 6LR_i | 6LBR dst | 839 +-------------------+---------+-------+----------+ 840 | Inserted headers | RPI | -- | -- | 841 | Removed headers | -- | -- | RPI | 842 | Re-added headers | -- | -- | -- | 843 | Modified headers | -- | RPI | -- | 844 | Untouched headers | -- | -- | -- | 845 +-------------------+---------+-------+----------+ 847 Table 1: SM: Summary of the use of headers from RAL to root 849 7.1.2. SM: Example of Flow from root to RAL 851 In this case the flow comprises: 853 root (6LBR) --> 6LR_i --> RAL (6LN) 855 For example, a communication flow could be: Node A root(6LBR) --> 856 Node B --> Node D --> Node F 858 In this case the 6LBR inserts RPI header and sends the packet down, 859 the 6LR is going to increment the rank in RPI (it examines the 860 instanceID to identify the right forwarding table), the packet is 861 processed in the 6LN and the RPI removed. 863 No IPv6-in-IPv6 header is required. 865 The Table 2 summarizes what headers are needed for this use case. 867 +-------------------+------+-------+------+ 868 | Header | 6LBR | 6LR_i | 6LN | 869 +-------------------+------+-------+------+ 870 | Inserted headers | RPI | -- | -- | 871 | Removed headers | -- | -- | RPI | 872 | Re-added headers | -- | -- | -- | 873 | Modified headers | -- | RPI | -- | 874 | Untouched headers | -- | -- | -- | 875 +-------------------+------+-------+------+ 877 Table 2: SM: Summary of the use of headers from root to RAL 879 7.1.3. SM: Example of Flow from root to RUL 881 In this case the flow comprises: 883 root (6LBR) --> 6LR_i --> RUL (IPv6) 885 For example, a communication flow could be: Node A root(6LBR) --> 886 Node B --> Node E --> Node G 888 As the RPI extension can be ignored by the not-RPL-aware leaf, this 889 situation is identical to the previous scenario. 891 The Table 3 summarizes what headers are needed for this use case. 893 +-------------------+----------+-------+----------------+ 894 | Header | 6LBR src | 6LR_i | IPv6 dst node | 895 +-------------------+----------+-------+----------------+ 896 | Inserted headers | RPI | -- | -- | 897 | Removed headers | -- | -- | -- | 898 | Re-added headers | -- | -- | -- | 899 | Modified headers | -- | RPI | -- | 900 | Untouched headers | -- | -- | RPI (Ignored) | 901 +-------------------+----------+-------+----------------+ 903 Table 3: SM: Summary of the use of headers from root to RUL 905 7.1.4. SM: Example of Flow from RUL to root 907 In this case the flow comprises: 909 RUL (IPv6) --> 6LR_1 --> 6LR_i --> root (6LBR) 910 For example, a communication flow could be: Node G --> Node E --> 911 Node B --> Node A root(6LBR) 913 When the packet arrives from IPv6 node (Node G) to 6LR_1 (Node E), 914 the 6LR_1 will insert a RPI header, encapsulated in a IPv6-in-IPv6 915 header. The IPv6-in-IPv6 header can be addressed to the next hop 916 (Node B), or to the root (Node A). The root removes the header and 917 processes the packet. 919 The Figure 8 shows the table that summarizes what headers are needed 920 for this use case. [1] refers the case where the IPv6-in-IPv6 header 921 is addressed to the next hop (Node B). [2] refers the case where the 922 IPv6-in-IPv6 header is addressed to the root (Node A). 924 +-----------+------+--------------+-----------------+------------------+ 925 | Header | IPv6 | 6LR_1 | 6LR_i | 6LBR dst | 926 | | src | | | | 927 | | node | | | | 928 +-----------+------+--------------+-----------------+------------------+ 929 | Inserted | -- | IP6-IP6(RPI) | IP6-IP6(RPI)[1] | -- | 930 | headers | | | | | 931 +-----------+------+--------------+-----------------+------------------+ 932 | Removed | -- | -- | -- |IP6-IP6(RPI)[1][2]| 933 | headers | | | | | 934 +-----------+------+--------------+-----------------+------------------+ 935 | Re-added | -- | -- | IP6-IP6(RPI)[1] | -- | 936 | headers | | | | | 937 +-----------+------+--------------+-----------------+------------------+ 938 | Modified | -- | -- | IP6-IP6(RPI)[2] | -- | 939 | headers | | | | | 940 +-----------+------+--------------+-----------------+------------------+ 941 | Untouched | -- | -- | -- | -- | 942 | headers | | | | | 943 +-----------+------+--------------+-----------------+------------------+ 945 Figure 8: SM: Summary of the use of headers from RUL to root. 947 7.2. SM: Interaction between Leaf and Internet. 949 In this section is described the communication flow in storing mode 950 (SM) between, 952 RAL to Internet 954 Internet to RAL 956 RUL to Internet 957 Internet to RUL 959 7.2.1. SM: Example of Flow from RAL to Internet 961 RPL information from RFC 6553 may go out to Internet as it will be 962 ignored by nodes which have not been configured to be RPI aware. 964 In this case the flow comprises: 966 RAL (6LN) --> 6LR_i --> root (6LBR) --> Internet 968 For example, the communication flow could be: Node F --> Node D --> 969 Node B --> Node A root(6LBR) --> Internet 971 No IPv6-in-IPv6 header is required. 973 Note: In this use case it is used a node as leaf, but this use case 974 can be also applicable to any RPL-aware-node type (e.g. 6LR) 976 The Table 4 summarizes what headers are needed for this use case. 978 +-------------------+---------+-------+------+----------------+ 979 | Header | 6LN src | 6LR_i | 6LBR | Internet dst | 980 +-------------------+---------+-------+------+----------------+ 981 | Inserted headers | RPI | -- | -- | -- | 982 | Removed headers | -- | -- | -- | -- | 983 | Re-added headers | -- | -- | -- | -- | 984 | Modified headers | -- | RPI | -- | -- | 985 | Untouched headers | -- | -- | RPI | RPI (Ignored) | 986 +-------------------+---------+-------+------+----------------+ 988 Table 4: SM: Summary of the use of headers from RAL to Internet 990 7.2.2. SM: Example of Flow from Internet to RAL 992 In this case the flow comprises: 994 Internet --> root (6LBR) --> 6LR_i --> RAL (6LN) 996 For example, a communication flow could be: Internet --> Node A 997 root(6LBR) --> Node B --> Node D --> Node F 999 When the packet arrives from Internet to 6LBR the RPI header is added 1000 in a outer IPv6-in-IPv6 header (with the IPv6-in-IPv6 destination 1001 address set to the 6LR) and sent to 6LR, which modifies the rank in 1002 the RPI. When the packet arrives at 6LN the RPI header is removed 1003 and the packet processed. 1005 The Figure 9 shows the table that summarizes what headers are needed 1006 for this use case. 1008 +-----------+----------+--------------+--------------+--------------+ 1009 | Header | Internet | 6LBR | 6LR_i | 6LN dst | 1010 | | src | | | | 1011 +-----------+----------+--------------+--------------+--------------+ 1012 | Inserted | -- | IP6-IP6(RPI) | -- | -- | 1013 | headers | | | | | 1014 +-----------+----------+--------------+--------------+--------------+ 1015 | Removed | -- | -- | -- | IP6-IP6(RPI) | 1016 | headers | | | | | 1017 +-----------+----------+--------------+--------------+--------------+ 1018 | Re-added | -- | -- | -- | -- | 1019 | headers | | | | | 1020 +-----------+----------+--------------+--------------+--------------+ 1021 | Modified | -- | -- | IP6-IP6(RPI) | -- | 1022 | headers | | | | | 1023 +-----------+----------+--------------+--------------+--------------+ 1024 | Untouched | -- | -- | -- | -- | 1025 | headers | | | | | 1026 +-----------+----------+--------------+--------------+--------------+ 1028 Figure 9: SM: Summary of the use of headers from Internet to RAL. 1030 7.2.3. SM: Example of Flow from RUL to Internet 1032 In this case the flow comprises: 1034 RUL (IPv6) --> 6LR_1 --> 6LR_i -->root (6LBR) --> Internet 1036 For example, a communication flow could be: Node G --> Node E --> 1037 Node B --> Node A root(6LBR) --> Internet 1039 The 6LR_1 (i=1) node will add an IPv6-in-IPv6(RPI) header addressed 1040 either to the root, or hop-by-hop such that the root can remove the 1041 RPI header before passing upwards. The IPv6-in-IPv6 addressed to the 1042 root cause less processing overhead. On the other hand, with hop-by- 1043 hop the intermediate routers can check the routing tables for a 1044 better routing path, thus it could be more efficient and faster. 1045 Implementation should decide which approach to take. 1047 The originating node will ideally leave the IPv6 flow label as zero 1048 so that the packet can be better compressed through the LLN. The 1049 6LBR will set the flow label of the packet to a non-zero value when 1050 sending to the Internet, for details check [RFC6437]. 1052 The Figure 10 shows the table that summarizes what headers are needed 1053 for this use case. 1055 +---------+-------+------------+--------------+-------------+--------+ 1056 | Header | IPv6 | 6LR_1 | 6LR_i | 6LBR |Internet| 1057 | | src | | [i=2,...,n] | | dst | 1058 | | node | | | | | 1059 +---------+-------+------------+--------------+-------------+--------+ 1060 | Inserted| -- |IP6-IP6(RPI)| IP6-IP6(RPI) | -- | -- | 1061 | headers | | | [2] | | | 1062 +---------+-------+------------+--------------+-------------+--------+ 1063 | Removed | -- | -- | IP6-IP6(RPI) | IP6-IP6(RPI)| -- | 1064 | headers | | | [2] | [1][2] | | 1065 +---------+-------+------------+--------------+-------------+--------+ 1066 | Re-added| -- | -- | -- | -- | -- | 1067 | headers | | | | | | 1068 +---------+-------+------------+--------------+-------------+--------+ 1069 | Modified| -- | -- | IP6-IP6(RPI) | -- | -- | 1070 | headers | | | [1] | | | 1071 +---------+-------+------------+--------------+-------------+--------+ 1072 |Untouched| -- | -- | -- | -- | -- | 1073 | headers | | | | | | 1074 +---------+-------+------------+--------------+-------------+--------+ 1076 Figure 10: SM: Summary of the use of headers from RUL to Internet. 1077 [1] Case when packet is addressed to the root. [2] Case when the 1078 packet is addressed hop-by-hop. 1080 7.2.4. SM: Example of Flow from Internet to RUL. 1082 In this case the flow comprises: 1084 Internet --> root (6LBR) --> 6LR_i --> RUL (IPv6) 1086 For example, a communication flow could be: Internet --> Node A 1087 root(6LBR) --> Node B --> Node E --> Node G 1089 The 6LBR will have to add an RPI header within an IPv6-in-IPv6 1090 header. The IPv6-in-IPv6 is addressed hop-by-hop. 1092 The final node should be able to remove one or more IPv6-in-IPv6 1093 headers which are all addressed to it. The final node does not 1094 process the RPI, the node ignores the RPI. Furhter details about 1095 this are mentioned in [I-D.thubert-roll-unaware-leaves], which 1096 specifies RPL routing for a 6LN acting as a plain host and not aware 1097 of RPL. 1099 The 6LBR may set the flow label on the inner IPv6-in-IPv6 header to 1100 zero in order to aid in compression [RFC8138][RFC6437]. 1102 The Figure 11 shows the table that summarizes what headers are needed 1103 for this use case. 1105 +-----------+----------+--------------+--------------+--------------+ 1106 | Header | Internet | 6LBR | 6LR_i |IPv6 dst node | 1107 | | src | | | | 1108 +-----------+----------+--------------+--------------+--------------+ 1109 | Inserted | -- | IP6-IP6(RPI) | -- | -- | 1110 | headers | | | | | 1111 +-----------+----------+--------------+--------------+--------------+ 1112 | Removed | -- | -- | | IP6-IP6(RPI)| 1113 | headers | | | | RPI Ignored | 1114 +-----------+----------+--------------+--------------+--------------+ 1115 | Re-added | -- | -- | -- | -- | 1116 | headers | | | | | 1117 +-----------+----------+--------------+--------------+--------------+ 1118 | Modified | -- | -- | IP6-IP6(RPI) | -- | 1119 | headers | | | | | 1120 +-----------+----------+--------------+--------------+--------------+ 1121 | Untouched | -- | -- | -- | -- | 1122 | headers | | | | | 1123 +-----------+----------+--------------+--------------+--------------+ 1125 Figure 11: SM: Summary of the use of headers from Internet to RUL. 1127 7.3. SM: Interaction between Leaf and Leaf 1129 In this section is described the communication flow in storing mode 1130 (SM) between, 1132 RAL to RAL 1134 RAL to RUL 1136 RUL to RAL 1138 RUL to RUL 1140 7.3.1. SM: Example of Flow from RAL to RAL 1142 In [RFC6550] RPL allows a simple one-hop optimization for both 1143 storing and non-storing networks. A node may send a packet destined 1144 to a one-hop neighbor directly to that node. See section 9 in 1145 [RFC6550]. 1147 When the nodes are not directly connected, then in storing mode, the 1148 flow comprises: 1150 6LN --> 6LR_ia --> common parent (6LR_x) --> 6LR_id --> 6LN 1152 For example, a communication flow could be: Node F --> Node D --> 1153 Node B --> Node E --> Node H 1155 6LR_ia (Node D) are the intermediate routers from source to the 1156 common parent (6LR_x) (Node B) In this case, 1 <= ia <= n, n is the 1157 number of routers (6LR) that the packet goes through from 6LN (Node 1158 F) to the common parent (6LR_x). 1160 6LR_id (Node E) are the intermediate routers from the common parent 1161 (6LR_x) (Node B) to destination 6LN (Node H). In this case, 1 <= id 1162 <= m, m is the number of routers (6LR) that the packet goes through 1163 from the common parent (6LR_x) to destination 6LN. 1165 It is assumed that the two nodes are in the same RPL Domain (that 1166 they share the same DODAG root). At the common parent (Node B), the 1167 direction of RPI is changed (from increasing to decreasing the rank). 1169 While the 6LR nodes will update the RPI, no node needs to add or 1170 remove the RPI, so no IPv6-in-IPv6 headers are necessary. 1172 The Table 5 summarizes what headers are needed for this use case. 1174 +---------------+--------+--------+---------------+--------+--------+ 1175 | Header | 6LN | 6LR_ia | 6LR_x (common | 6LR_id | 6LN | 1176 | | src | | parent) | | dst | 1177 +---------------+--------+--------+---------------+--------+--------+ 1178 | Inserted | RPI | -- | -- | -- | -- | 1179 | headers | | | | | | 1180 | Removed | -- | -- | -- | -- | RPI | 1181 | headers | | | | | | 1182 | Re-added | -- | -- | -- | -- | -- | 1183 | headers | | | | | | 1184 | Modified | -- | RPI | RPI | RPI | -- | 1185 | headers | | | | | | 1186 | Untouched | -- | -- | -- | -- | -- | 1187 | headers | | | | | | 1188 +---------------+--------+--------+---------------+--------+--------+ 1190 Table 5: SM: Summary of the use of headers for RAL to RAL 1192 7.3.2. SM: Example of Flow from RAL to RUL 1194 In this case the flow comprises: 1196 6LN --> 6LR_ia --> common parent (6LR_x) --> 6LR_id --> not-RPL-aware 1197 6LN (IPv6) 1199 For example, a communication flow could be: Node F --> Node D --> 1200 Node B --> Node E --> Node G 1202 6LR_ia are the intermediate routers from source (6LN) to the common 1203 parent (6LR_x) In this case, 1 <= ia <= n, n is the number of routers 1204 (6LR) that the packet goes through from 6LN to the common parent 1205 (6LR_x). 1207 6LR_id (Node E) are the intermediate routers from the common parent 1208 (6LR_x) (Node B) to destination not-RPL-aware 6LN (IPv6) (Node G). 1209 In this case, 1 <= id <= m, m is the number of routers (6LR) that the 1210 packet goes through from the common parent (6LR_x) to destination 1211 6LN. 1213 This situation is identical to the previous situation Section 7.3.1 1215 The Table 6 summarizes what headers are needed for this use case. 1217 +-----------+------+--------+---------------+--------+--------------+ 1218 | Header | 6LN | 6LR_ia | 6LR_x(common | 6LR_id | IPv6 dst | 1219 | | src | | parent) | | node | 1220 +-----------+------+--------+---------------+--------+--------------+ 1221 | Inserted | RPI | -- | -- | -- | -- | 1222 | headers | | | | | | 1223 | Removed | -- | -- | -- | -- | -- | 1224 | headers | | | | | | 1225 | Re-added | -- | -- | -- | -- | -- | 1226 | headers | | | | | | 1227 | Modified | -- | RPI | RPI | RPI | -- | 1228 | headers | | | | | | 1229 | Untouched | -- | -- | -- | -- | RPI(Ignored) | 1230 | headers | | | | | | 1231 +-----------+------+--------+---------------+--------+--------------+ 1233 Table 6: SM: Summary of the use of headers for RAL to RUL 1235 7.3.3. SM: Example of Flow from RUL to RAL 1237 In this case the flow comprises: 1239 not-RPL-aware 6LN (IPv6) --> 6LR_ia --> common parent (6LR_x) --> 1240 6LR_id --> 6LN 1242 For example, a communication flow could be: Node G --> Node E --> 1243 Node B --> Node D --> Node F 1245 6LR_ia (Node E) are the intermediate routers from source (not-RPL- 1246 aware 6LN (IPv6)) (Node G) to the common parent (6LR_x) (Node B). In 1247 this case, 1 <= ia <= n, n is the number of routers (6LR) that the 1248 packet ges through from source to the common parent. 1250 6LR_id (Node D) are the intermediate routers from the common parent 1251 (6LR_x) (Node B) to destination 6LN (Node F). In this case, 1 <= id 1252 <= m, m is the number of routers (6LR) that the packet goes through 1253 from the common parent (6LR_x) to destination 6LN. 1255 The 6LR_ia (ia=1) (Node E) receives the packet from the the IPv6 node 1256 (Node G) and inserts and the RPI header encapsulated in IPv6-in-IPv6 1257 header. The IPv6-in-IPv6 header is addressed to the destination 6LN 1258 (Node F). 1260 The Figure 12 shows the table that summarizes what headers are needed 1261 for this use case. 1263 +---------+-----+------------+-------------+-------------+------------+ 1264 | Header |IPv6 | 6LR_ia | Common | 6LR_id | 6LN | 1265 | |src | | Parent | | dst | 1266 | |node | | (6LRx) | | | 1267 +---------+-----+------------+-------------+-------------+------------+ 1268 | Inserted| -- |IP6-IP6(RPI)| -- | -- | -- | 1269 | headers | | | | | | 1270 +---------+-----+------------+-------------+-------------+------------+ 1271 | Removed | -- | -- | -- | -- |IP6-IP6(RPI)| 1272 | headers | | | | | | 1273 +---------+-----+------------+-------------+-------------+------------+ 1274 | Re-added| -- | -- | -- | -- | -- | 1275 | headers | | | | | | 1276 +---------+-----+------------+-------------+-------------+------------+ 1277 | Modified| -- | -- |IP6-IP6(RPI) |IP6-IP6(RPI) | -- | 1278 | headers | | | | | | 1279 +---------+-----+------------+-------------+-------------+------------+ 1280 |Untouched| -- | -- | -- | -- | -- | 1281 | headers | | | | | | 1282 +---------+-----+------------+-------------+-------------+------------+ 1284 Figure 12: SM: Summary of the use of headers from RUL to RAL. 1286 7.3.4. SM: Example of Flow from RUL to RUL 1288 In this case the flow comprises: 1290 not-RPL-aware 6LN (IPv6 src)--> 6LR_1--> 6LR_ia --> 6LBR --> 6LR_id 1291 --> not-RPL-aware 6LN (IPv6 dst) 1293 For example, a communication flow could be: Node G --> Node E --> 1294 Node B --> Node A (root) --> Node C --> Node J 1296 Internal nodes 6LR_ia (e.g: Node E or Node B) is the intermediate 1297 router from the not-RPL-aware source (Node G) to the root (6LBR) 1298 (Node A). In this case, "1 < ia <= n", n is the number of routers 1299 (6LR) that the packet goes through from IPv6 src to the root. 1301 6LR_id (Node C) are the intermediate routers from the root (Node A) 1302 to the destination Node J. In this case, 1 <= id <= m, m is the 1303 number of routers (6LR) that the packet goes through from the root to 1304 destination (IPv6 dst). 1306 The RPI is ignored at the IPv6 dst node. 1308 The 6LR_1 (Node E) receives the packet from the the IPv6 node (Node 1309 G) and inserts the RPI header (RPI), encapsulated in an IPv6-in-IPv6 1310 header. The IPv6-in-IPv6 header is addressed hop-by-hop. 1312 The Figure 13 shows the table that summarizes what headers are needed 1313 for this use case. 1315 +---------+------+-------+-------+---------+-------+-------+ 1316 | Header | IPv6 | 6LR_1 | 6LR_ia| 6LBR |6LR_id | IPv6 | 1317 | | src | | | | | dst | 1318 | | node | | | | | node | 1319 +---------+------+-------+-------+---------+-------+-------+ 1320 | Inserted| -- |IP6-IP6| -- | | -- | -- | 1321 | headers | | (RPI )| | | | | 1322 | | | | | | | | 1323 +---------+------+-------+-------+---------+-------+-------+ 1324 | Removed | -- | -- | -- | | -- |IP6-IP6| 1325 | headers | | | | | |(RPI) | 1326 | | | | | | | RPI | 1327 | | | | | | |Ignored| 1328 +---------+------+-------+-------+---------+-------+-------+ 1329 | Re-added| -- | -- | -- | -- | -- | -- | 1330 | headers | | | | | | | 1331 +---------+------+-------+-------+---------+-------+-------+ 1332 | Modified| -- | -- |IP6-IP6| IP6-IP6 |IP6-IP6| -- | 1333 | headers | | | (RPI) | (RPI) | (RPI) | | 1334 | | | | | | | | 1335 +---------+------+-------+-------+---------+-------+-------+ 1336 |Untouched| -- | -- | -- | -- | -- | -- | 1337 | headers | | | | | | | 1338 +---------+------+-------+-------+---------+-------+-------+ 1340 Figure 13: SM: Summary of the use of headers from RUL to RUL 1342 8. Non Storing mode 1344 In Non Storing Mode (Non-SM) (fully source routed), the 6LBR (DODAG 1345 root) has complete knowledge about the connectivity of all DODAG 1346 nodes, and all traffic flows through the root node. Thus, there is 1347 no need for all nodes to know about the existence of not-RPL aware 1348 nodes. Only the 6LBR needs to act if compensation is necessary for 1349 not-RPL aware receivers. 1351 The following table (Figure 14) summarizes what headers are needed in 1352 the following scenarios, and indicates when the RPI, RH3 and IPv6-in- 1353 IPv6 header are to be inserted. It depicts the target destination 1354 address possible (indicated by "RAL"), to a 6LR (parent of a 6LN) or 1355 to the root. In cases where no IPv6-in-IPv6 header is needed, the 1356 column states as "No". There is no expectation on RPL that RPI can 1357 be omitted, because it is needed for routing, quality of service and 1358 compression. This specification expects that is always a RPI 1359 Present. 1361 The leaf can be a router 6LR or a host, both indicated as 6LN 1362 (Figure 3). In the Figure the (1) indicates a 6tisch case [RFC8180], 1363 where the RPI header may still be needed for the instanceID to be 1364 available for priority/channel selection at each hop. 1366 +-----------------+--------------+-----+-----+------------+------------+ 1367 | Interaction | Use Case | RPI | RH3 |IPv6-in-IPv6|IPv6-in-IPv6| 1368 | between | | | | | dst | 1369 +-----------------+--------------+-----+-----+------------+------------+ 1370 | | RAL to root | Yes | No | No | No | 1371 + +--------------+-----+-----+------------+------------+ 1372 | Leaf - Root | root to RAL | Yes | Yes | No | No | 1373 + +--------------+-----+-----+------------+------------+ 1374 | | root to RUL | Yes | Yes | must | 6LR | 1375 | | | (1) | | | | 1376 + +--------------+-----+-----+------------+------------+ 1377 | | RUL to root | Yes | No | must | root | 1378 +-----------------+--------------+-----+-----+------------+------------+ 1379 | | RAL to Int | Yes | No | No | No | 1380 + +--------------+-----+-----+------------+------------+ 1381 | Leaf - Internet | Int to RAL | Yes | Yes | must | RAL | 1382 + +--------------+-----+-----+------------+------------+ 1383 | | RUL to Int | Yes | No | must | root | 1384 + +--------------+-----+-----+------------+------------+ 1385 | | Int to RUL | Yes | Yes | must | 6LR | 1386 +-----------------+--------------+-----+-----+------------+------------+ 1387 | | RAL to RAL | Yes | Yes | must | root/RAL | 1388 + +--------------+-----+-----+------------+------------+ 1389 | | RAL to RUL | Yes | Yes | must | root/6LR | 1390 + Leaf - Leaf +--------------+-----+-----+------------+------------+ 1391 | | RUL to RAL | Yes | Yes | must | root/RAL | 1392 + +--------------+-----+-----+------------+------------+ 1393 | | RUL to RUL | Yes | Yes | must | root/6LR | 1394 +-----------------+--------------+-----+-----+------------+------------+ 1396 Figure 14: Table that shows headers needed in Non-Storing mode: RPI, 1397 RH3, IPv6-in-IPv6 encapsulation. 1399 8.1. Non-Storing Mode: Interaction between Leaf and Root 1401 In this section is described the communication flow in Non Storing 1402 Mode (Non-SM) between, 1404 RAL to root 1406 root to RAL 1408 RUL to root 1410 root to RUL 1412 8.1.1. Non-SM: Example of Flow from RAL to root 1414 In non-storing mode the leaf node uses default routing to send 1415 traffic to the root. The RPI header must be included since it 1416 contains the rank information, which is used to avoid/detect loops. 1418 RAL (6LN) --> 6LR_i --> root(6LBR) 1420 For example, a communication flow could be: Node F --> Node D --> 1421 Node B --> Node A (root) 1423 6LR_i are the intermediate routers from source to destination. In 1424 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1425 packet goes through from source (6LN) to destination (6LBR). 1427 This situation is the same case as storing mode. 1429 The Table 7 summarizes what headers are needed for this use case. 1431 +-------------------+---------+-------+----------+ 1432 | Header | 6LN src | 6LR_i | 6LBR dst | 1433 +-------------------+---------+-------+----------+ 1434 | Inserted headers | RPI | -- | -- | 1435 | Removed headers | -- | -- | RPI | 1436 | Re-added headers | -- | -- | -- | 1437 | Modified headers | -- | RPI | -- | 1438 | Untouched headers | -- | -- | -- | 1439 +-------------------+---------+-------+----------+ 1441 Table 7: Non-SM: Summary of the use of headers from RAL to root 1443 8.1.2. Non-SM: Example of Flow from root to RAL 1445 In this case the flow comprises: 1447 root (6LBR) --> 6LR_i --> RAL (6LN) 1449 For example, a communication flow could be: Node A (root) --> Node B 1450 --> Node D --> Node F 1452 6LR_i are the intermediate routers from source to destination. In 1453 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1454 packet goes through from source (6LBR) to destination (6LN). 1456 The 6LBR inserts an RH3, and a RPI header. No IPv6-in-IPv6 header is 1457 necessary as the traffic originates with an RPL aware node, the 6LBR. 1458 The destination is known to be RPL-aware because the root knows the 1459 whole topology in non-storing mode. 1461 The Table 8 summarizes what headers are needed for this use case. 1463 +-------------------+----------+-----------+-----------+ 1464 | Header | 6LBR src | 6LR_i | 6LN dst | 1465 +-------------------+----------+-----------+-----------+ 1466 | Inserted headers | RPI, RH3 | -- | -- | 1467 | Removed headers | -- | -- | RH3, RPI | 1468 | Re-added headers | -- | -- | -- | 1469 | Modified headers | -- | RPI, RH3 | -- | 1470 | Untouched headers | -- | -- | -- | 1471 +-------------------+----------+-----------+-----------+ 1473 Table 8: Non-SM: Summary of the use of headers from root to RAL 1475 8.1.3. Non-SM: Example of Flow from root to RUL 1477 In this case the flow comprises: 1479 root (6LBR) --> 6LR_i --> RUL (IPv6) 1481 For example, a communication flow could be: Node A (root) --> Node B 1482 --> Node E --> Node G 1484 6LR_i are the intermediate routers from source to destination. In 1485 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1486 packet goes through from source (6LBR) to destination (IPv6). 1488 In 6LBR the RH3 is added, it is modified at each intermediate 6LR 1489 (6LR_1 and so on) and it is fully consumed in the last 6LR (6LR_n), 1490 but left there. As the RPI is added, then the IPv6 node which does 1491 not understand the RPI, will ignore it (following RFC8200), thus 1492 encapsulation is not necessary. 1494 The Figure 15 depicts the table that summarizes what headers are 1495 needed for this use case. 1497 +-----------+----------+--------------+----------------+----------+ 1498 | Header | 6LBR | 6LR_i | 6LR_n | IPv6 | 1499 | | | i=(1,..,n-1) | | dst | 1500 | | | | | node | 1501 +-----------+----------+--------------+----------------+----------+ 1502 | Inserted | RPI, RH3 | -- | -- | -- | 1503 | headers | | | | | 1504 +-----------+----------+--------------+----------------+----------+ 1505 | Removed | -- | -- | | -- | 1506 | headers | | | | | 1507 +-----------+----------+--------------+----------------+----------+ 1508 | Re-added | -- | -- | -- | -- | 1509 | headers | | | | | 1510 +-----------+----------+--------------+----------------+----------+ 1511 | Modified | -- | RPI, RH3 | RPI, | -- | 1512 | headers | | | RH3(consumed) | | 1513 +-----------+----------+--------------+----------------+----------+ 1514 | Untouched | -- | -- | -- | RPI, RH3 | 1515 | headers | | | | (both | 1516 | | | | | ignored) | 1517 +-----------+----------+--------------+----------------+----------+ 1519 Figure 15: Non-SM: Summary of the use of headers from root to RUL 1521 8.1.4. Non-SM: Example of Flow from RUL to root 1523 In this case the flow comprises: 1525 RUL (IPv6) --> 6LR_1 --> 6LR_i --> root (6LBR) 1527 For example, a communication flow could be: Node G --> Node E --> 1528 Node B --> Node A (root) 1530 6LR_i are the intermediate routers from source to destination. In 1531 this case, "1 < i <= n", n is the number of routers (6LR) that the 1532 packet goes through from source (IPv6) to destination (6LBR). For 1533 example, 6LR_1 (i=1) is the router that receives the packets from the 1534 IPv6 node. 1536 In this case the RPI is added by the first 6LR (6LR1) (Node E), 1537 encapsulated in an IPv6-in-IPv6 header, and is modified in the 1538 following 6LRs. The RPI and entire packet is consumed by the root. 1540 The Figure 16 shows the table that summarizes what headers are needed 1541 for this use case. 1543 +---------+----+-----------------+-----------------+-----------------+ 1544 | Header |IPv6| 6LR_1 | 6LR_i | 6LBR dst | 1545 | |src | | | | 1546 | |node| | | | 1547 +---------+----+-----------------+-----------------+-----------------+ 1548 | Inserted| -- |IPv6-in-IPv6(RPI)| -- | -- | 1549 | headers | | | | | 1550 +---------+----+-----------------+-----------------+-----------------+ 1551 | Removed | -- | -- | -- |IPv6-in-IPv6(RPI)| 1552 | headers | | | | | 1553 +---------+----+-----------------+-----------------+-----------------+ 1554 | Re-added| -- | -- | -- | -- | 1555 | headers | | | | | 1556 +---------+----+-----------------+-----------------+-----------------+ 1557 | Modified| -- | -- |IPv6-in-IPv6(RPI)| -- | 1558 | headers | | | | | 1559 +---------+----+-----------------+-----------------+-----------------+ 1560 |Untouched| -- | -- | -- | -- | 1561 | headers | | | | | 1562 +---------+----+-----------------+-----------------+-----------------+ 1564 Figure 16: Non-SM: Summary of the use of headers from RUL to root 1566 8.2. Non-Storing Mode: Interaction between Leaf and Internet 1568 This section will describe the communication flow in Non Storing Mode 1569 (Non-SM) between: 1571 RAL to Internet 1573 Internet to RAL 1575 RUL to Internet 1577 Internet to RUL 1579 8.2.1. Non-SM: Example of Flow from RAL to Internet 1581 In this case the flow comprises: 1583 RAL (6LN) --> 6LR_i --> root (6LBR) --> Internet 1585 For example, a communication flow could be: Node F --> Node D --> 1586 Node B --> Node A --> Internet 1588 6LR_i are the intermediate routers from source to destination. In 1589 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1590 packet goes through from source (6LN) to 6LBR. 1592 This case is identical to storing-mode case. 1594 The IPv6 flow label should be set to zero to aid in compression 1595 [RFC8138], and the 6LBR will set it to a non-zero value when sending 1596 towards the Internet [RFC6437]. 1598 The Table 9 summarizes what headers are needed for this use case. 1600 +-------------------+---------+-------+------+----------------+ 1601 | Header | 6LN src | 6LR_i | 6LBR | Internet dst | 1602 +-------------------+---------+-------+------+----------------+ 1603 | Inserted headers | RPI | -- | -- | -- | 1604 | Removed headers | -- | -- | -- | -- | 1605 | Re-added headers | -- | -- | -- | -- | 1606 | Modified headers | -- | RPI | -- | -- | 1607 | Untouched headers | -- | -- | RPI | RPI (Ignored) | 1608 +-------------------+---------+-------+------+----------------+ 1610 Table 9: Non-SM: Summary of the use of headers from RAL to Internet 1612 8.2.2. Non-SM: Example of Flow from Internet to RAL 1614 In this case the flow comprises: 1616 Internet --> root (6LBR) --> 6LR_i --> RAL (6LN) 1618 For example, a communication flow could be: Internet --> Node A 1619 (root) --> Node B --> Node D --> Node F 1621 6LR_i are the intermediate routers from source to destination. In 1622 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1623 packet goes through from 6LBR to destination(6LN). 1625 The 6LBR must add an RH3 header. As the 6LBR will know the path and 1626 address of the target node, it can address the IPv6-in-IPv6 header to 1627 that node. The 6LBR will zero the flow label upon entry in order to 1628 aid compression [RFC8138]. 1630 The Table 10 summarizes what headers are needed for this use case. 1632 +-----------+----------+--------------+--------------+--------------+ 1633 | Header | Internet | 6LBR | 6LR_i | 6LN src | 1634 | | dst | | | | 1635 +-----------+----------+--------------+--------------+--------------+ 1636 | Inserted | -- | IPv6-in-IPv6 | -- | -- | 1637 | headers | | (RH3,RPI) | | | 1638 | Removed | -- | -- | -- | IPv6-in-IPv6 | 1639 | headers | | | | (RH3,RPI) | 1640 | Re-added | -- | -- | -- | -- | 1641 | headers | | | | | 1642 | Modified | -- | -- | IPv6-in-IPv6 | -- | 1643 | headers | | | (RH3,RPI) | | 1644 | Untouched | -- | -- | -- | -- | 1645 | headers | | | | | 1646 +-----------+----------+--------------+--------------+--------------+ 1648 Table 10: Non-SM: Summary of the use of headers from Internet to RAL 1650 8.2.3. Non-SM: Example of Flow from RUL to Internet 1652 In this case the flow comprises: 1654 RUL (IPv6) --> 6LR_1 --> 6LR_i -->root (6LBR) --> Internet 1656 For example, a communication flow could be: Node G --> Node E --> 1657 Node B --> Node A --> Internet 1659 6LR_i are the intermediate routers from source to destination. In 1660 this case, "1 < i <= n", n is the number of routers (6LR) that the 1661 packet goes through from source(IPv6) to 6LBR. e.g 6LR_1 (i=1). 1663 In this case the flow label is recommended to be zero in the IPv6 1664 node. As RPL headers are added in the IPv6 node packet, the first 1665 6LR (6LR_1) will add a RPI header inside a new IPv6-in-IPv6 header. 1666 The IPv6-in-IPv6 header will be addressed to the root. This case is 1667 identical to the storing-mode case (see Section 7.2.3). 1669 The Figure 17 shows the table that summarizes what headers are needed 1670 for this use case. 1672 +---------+----+-------------+--------------+--------------+--------+ 1673 | Header |IPv6| 6LR_1 | 6LR_i | 6LBR |Internet| 1674 | |src | | [i=2,..,n] | | dst | 1675 | |node| | | | | 1676 +---------+----+-------------+--------------+--------------+--------+ 1677 | Inserted| -- |IP6-IP6(RPI) | -- | -- | -- | 1678 | headers | | | | | | 1679 +---------+----+-------------+--------------+--------------+--------+ 1680 | Removed | -- | -- | -- | IP6-IP6(RPI) | -- | 1681 | headers | | | | | | 1682 +---------+----+-------------+--------------+--------------+--------+ 1683 | Re-added| -- | -- | -- | -- | -- | 1684 | headers | | | | | | 1685 +---------+----+-------------+--------------+--------------+--------+ 1686 | Modified| -- | -- | IP6-IP6(RPI) | -- | -- | 1687 | headers | | | | | | 1688 +---------+----+-------------+--------------+--------------+--------+ 1689 |Untouched| -- | -- | -- | -- | -- | 1690 | headers | | | | | | 1691 +---------+----+-------------+--------------+--------------+--------+ 1693 Figure 17: Non-SM: Summary of the use of headers from RUL to Internet 1695 8.2.4. Non-SM: Example of Flow from Internet to RUL 1697 In this case the flow comprises: 1699 Internet --> root (6LBR) --> 6LR_i --> RUL (IPv6) 1701 For example, a communication flow could be: Internet --> Node A 1702 (root) --> Node B --> Node E --> Node G 1704 6LR_i are the intermediate routers from source to destination. In 1705 this case, "1 < i <= n", n is the number of routers (6LR) that the 1706 packet goes through from 6LBR to RUL (IPv6). 1708 The 6LBR must add an RH3 header inside an IPv6-in-IPv6 header. The 1709 6LBR will know the path, and will recognize that the final node is 1710 not an RPL capable node as it will have received the connectivity DAO 1711 from the nearest 6LR. The 6LBR can therefore make the IPv6-in-IPv6 1712 header destination be the last 6LR. The 6LBR will set to zero the 1713 flow label upon entry in order to aid compression [RFC8138]. 1715 The Figure 18 shows the table that summarizes what headers are needed 1716 for this use case. 1718 +---------+--------+-------------+--------------+--------------+-----+ 1719 | Header |Internet| 6LBR | 6LR_1 | 6lR_i |IPv6 | 1720 | | src | | | (i=2,...,n) |dst | 1721 | | | | | |node | 1722 +---------+--------+-------------+--------------+--------------+-----+ 1723 | Inserted| -- | IPv6-in-IPv6| -- | -- | -- | 1724 | headers | | (RH3,RPI) | | | | 1725 +---------+--------+-------------+--------------+--------------+-----+ 1726 | Removed | -- | -- | -- | IPv6-in-IPv6 | -- | 1727 | headers | | | | (RH3,RPI)[1] | | 1728 +---------+--------+-------------+--------------+--------------+-----+ 1729 | Re-added| -- | -- | -- | -- | -- | 1730 | headers | | | | | | 1731 +---------+--------+-------------+--------------+--------------+-----+ 1732 | Modified| -- | -- | IPv6-in-IPv6 | IPv6-in-IPv6 | -- | 1733 | headers | | | (RH3,RPI) | (RH3,RPI) | | 1734 +---------+--------+-------------+--------------+--------------+-----+ 1735 |Untouched| -- | -- | -- | -- | -- | 1736 | headers | | | | | | 1737 +---------+--------+-------------+--------------+--------------+-----+ 1739 Figure 18: Non-SM: Summary of the use of headers from Internet to RUL 1740 [1] The last 6LR before the IPv6 node. 1742 8.3. Non-SM: Interaction between Leafs 1744 In this section is described the communication flow in Non Storing 1745 Mode (Non-SM) between, 1747 RAL to RAL 1749 RAL to RUL 1751 RUL to RAL 1753 RUL to RUL 1755 8.3.1. Non-SM: Example of Flow from RAL to RAL 1757 In this case the flow comprises: 1759 6LN src --> 6LR_ia --> root (6LBR) --> 6LR_id --> 6LN dst 1761 For example, a communication flow could be: Node F --> Node D --> 1762 Node B --> Node A (root) --> Node B --> Node E --> Node H 1763 6LR_ia are the intermediate routers from source to the root In this 1764 case, 1 <= ia <= n, n is the number of routers (6LR) that the packet 1765 goes through from 6LN to the root. 1767 6LR_id are the intermediate routers from the root to the destination. 1768 In this case, "1 <= ia <= m", m is the number of the intermediate 1769 routers (6LR). 1771 This case involves only nodes in same RPL Domain. The originating 1772 node will add a RPI header to the original packet, and send the 1773 packet upwards. 1775 The originating node must put the RPI into an IPv6-in-IPv6 header 1776 addressed to the root, so that the 6LBR can remove that header. If 1777 it does not, then additional resources are wasted on the way down to 1778 carry the useless RPI option. 1780 The 6LBR will need to insert an RH3 header, which requires that it 1781 add an IPv6-in-IPv6 header. It should be able to remove the RPI, as 1782 it was contained in an IPv6-in-IPv6 header addressed to it. 1783 Otherwise, there may be a RPI header buried inside the inner IP 1784 header, which should get ignored. 1786 Networks that use the RPL P2P extension [RFC6997] are essentially 1787 non-storing DODAGs and fall into this scenario or scenario 1788 Section 8.1.2, with the originating node acting as 6LBR. 1790 The Figure 19 shows the table that summarizes what headers are needed 1791 for this use case. 1793 +---------+------------+----------+------------+----------+------------+ 1794 | Header | 6LN | 6LR_ia | 6LBR | 6LR_id | 6LN | 1795 | | src | | | | dst | 1796 +---------+------------+----------+------------+----------+------------+ 1797 | Inserted|IPv6-in-IPv6| |IPv6-in-IPv6| -- | -- | 1798 | headers | (RPI1) | |(RH3-> 6LN, | | | 1799 | | | | RPI2) | | | 1800 +---------+------------+----------+------------+----------+------------+ 1801 | Removed | -- | -- |IPv6-in-IPv6| -- |IPv6-in-IPv6| 1802 | headers | | | (RPI1) | | (RH3, | 1803 | | | | | | RPI2) | 1804 +---------+------------+----------+------------+----------+------------+ 1805 | Re-added| -- | -- | -- | -- | -- | 1806 | headers | | | | | | 1807 +---------+------------+----------+------------+----------+------------+ 1808 | Modified| -- |IP6-in-IP6| -- |IP6-in-IP6| -- | 1809 | headers | | (RPI1) | | (RPI2) | | 1810 +---------+------------+----------+------------+----------+------------+ 1811 |Untouched| -- | -- | -- | -- | -- | 1812 | headers | | | | | | 1813 +---------+------------+----------+------------+----------+------------+ 1815 Figure 19: Non-SM: Summary of the use of headers for RAL to RAL. 1816 IP6-in-IP6 refers to IPv6-in-IPv6. 1818 8.3.2. Non-SM: Example of Flow from RAL to RUL 1820 In this case the flow comprises: 1822 6LN --> 6LR_ia --> root (6LBR) --> 6LR_id --> not-RPL-aware (IPv6) 1824 For example, a communication flow could be: Node F --> Node D --> 1825 Node B --> Node A (root) --> Node B --> Node E --> Node G 1827 6LR_ia are the intermediate routers from source to the root In this 1828 case, 1 <= ia <= n, n is the number of intermediate routers (6LR) 1830 6LR_id are the intermediate routers from the root to the destination. 1831 In this case, "1 <= ia <= m", m is the number of the intermediate 1832 routers (6LRs). 1834 As in the previous case, the 6LN will insert a RPI (RPI_1) header 1835 which must be in an IPv6-in-IPv6 header addressed to the root so that 1836 the 6LBR can remove this RPI. The 6LBR will then insert an RH3 1837 inside a new IPv6-in-IPv6 header addressed to the 6LR_id. 1839 The Figure 20 shows the table that summarizes what headers are needed 1840 for this use case. 1842 +-----------+---------+---------+---------+---------+---------+------+ 1843 | Header | 6LN | 6LR_ia | 6LBR | 6LR_id | 6LR_m | IPv6 | 1844 | | src | | | | | dst | 1845 | | | | | | | node | 1846 +-----------+---------+---------+---------+---------+---------+------+ 1847 | Inserted | IP6-IP6 | | IP6-IP6 | -- | -- | -- | 1848 | headers | (RPI1) | | (RH3, | | | | 1849 | | | | RPI2) | | | | 1850 +-----------+---------+---------+---------+---------+---------+------+ 1851 | Removed | -- | -- | IP6-IP6 | -- | IP6-IP6 | -- | 1852 | headers | | | (RPI1) | | (RH3, | | 1853 | | | | | | RPI2) | | 1854 +-----------+---------+---------+---------+---------+---------+------+ 1855 | Re-added | -- | -- | -- | -- | -- | -- | 1856 | headers | | | | | | | 1857 +-----------+---------+---------+---------+---------+---------+------+ 1858 | Modified | -- | IP6-IP6 | -- | IP6-IP6 | | -- | 1859 | headers | | (RPI1) | | (RH3, | | | 1860 | | | | | RPI2) | | | 1861 +-----------+---------+---------+---------+---------+---------+------+ 1862 | Untouched | -- | -- | -- | -- | -- | -- | 1863 | headers | | | | | | | 1864 +-----------+---------+---------+---------+---------+---------+------+ 1866 Figure 20: Non-SM: Summary of the use of headers from RAL to RUL. 1868 8.3.3. Non-SM: Example of Flow from RUL to RAL 1870 In this case the flow comprises: 1872 not-RPL-aware 6LN (IPv6) --> 6LR_1 --> 6LR_ia --> root (6LBR) --> 1873 6LR_id --> 6LN 1875 For example, a communication flow could be: Node G --> Node E --> 1876 Node B --> Node A (root) --> Node B --> Node E --> Node H 1878 6LR_ia are the intermediate routers from source to the root. In this 1879 case, 1 <= ia <= n, n is the number of intermediate routers (6LR) 1881 6LR_id are the intermediate routers from the root to the destination. 1882 In this case, "1 <= ia <= m", m is the number of the intermediate 1883 routers (6LR). 1885 This scenario is mostly identical to the previous one. The RPI is 1886 added by the first 6LR (6LR_1) inside an IPv6-in-IPv6 header 1887 addressed to the root. The 6LBR will remove this RPI, and add it's 1888 own IPv6-in-IPv6 header containing an RH3 header and an RPI (RPI_2). 1890 The Figure 21 shows the table that summarizes what headers are needed 1891 for this use case. 1893 +-----------+------+---------+---------+---------+---------+---------+ 1894 | Header | IPv6 | 6LR_1 | 6LR_ia | 6LBR | 6LR_id | 6LN | 1895 | | src | | | | | dst | 1896 | | node | | | | | | 1897 +-----------+------+---------+---------+---------+---------+---------+ 1898 | Inserted | -- | IP6-IP6 | -- | IP6-IP6 | -- | -- | 1899 | headers | | (RPI1) | | (RH3, | | | 1900 | | | | | RPI2) | | | 1901 +-----------+------+---------+---------+---------+---------+---------+ 1902 | Removed | -- | | -- | IP6-IP6 | -- | IP6-IP6 | 1903 | headers | | | | (RPI1) | | (RH3, | 1904 | | | | | | | RPI2) | 1905 +-----------+------+---------+---------+---------+---------+---------+ 1906 | Re-added | -- | | -- | -- | -- | -- | 1907 | headers | | | | | | | 1908 +-----------+------+---------+---------+---------+---------+---------+ 1909 | Modified | -- | | IP6-IP6 | -- | IP6-IP6 | -- | 1910 | headers | | | (RPI1) | | (RH3, | | 1911 | | | | | | RPI2) | | 1912 +-----------+------+---------+---------+---------+---------+---------+ 1913 | Untouched | -- | | -- | -- | -- | -- | 1914 | headers | | | | | | | 1915 +-----------+------+---------+---------+---------+---------+---------+ 1917 Figure 21: Non-SM: Summary of the use of headers from RUL to RAL. 1919 8.3.4. Non-SM: Example of Flow from RUL to RUL 1921 In this case the flow comprises: 1923 not-RPL-aware 6LN (IPv6 src) --> 6LR_1 --> 6LR_ia --> root (6LBR) --> 1924 6LR_id --> not-RPL-aware (IPv6 dst) 1926 For example, a communication flow could be: Node G --> Node E --> 1927 Node B --> Node A (root) --> Node C --> Node J 1929 6LR_ia are the intermediate routers from source to the root. In this 1930 case, 1 <= ia <= n, n is the number of intermediate routers (6LR) 1932 6LR_id are the intermediate routers from the root to the destination. 1933 In this case, "1 <= ia <= m", m is the number of the intermediate 1934 routers (6LR). 1936 This scenario is the combination of the previous two cases. 1938 The Figure 22 shows the table that summarizes what headers are needed 1939 for this use case. 1941 +---------+------+-------+-------+---------+-------+---------+------+ 1942 | Header | IPv6 | 6LR_1 | 6LR_ia| 6LBR |6LR_id | 6LR_m | IPv6 | 1943 | | src | | | | | | dst | 1944 | | node | | | | | | node | 1945 +---------+------+-------+-------+---------+-------+---------+------+ 1946 | Inserted| -- |IP6-IP6| -- | IP6-IP6 | -- | -- | -- | 1947 | headers | | (RPI1)| | (RH3, | | | | 1948 | | | | | RPI2) | | | | 1949 +---------+------+-------+-------+---------+-------+---------+------+ 1950 | Removed | -- | -- | -- | IP6-IP6 | -- | IP6-IP6 | -- | 1951 | headers | | | | (RPI1) | | (RH3, | | 1952 | | | | | | | RPI2) | | 1953 +---------+------+-------+-------+---------+-------+---------+------+ 1954 | Re-added| -- | -- | -- | -- | -- | -- | -- | 1955 | headers | | | | | | | | 1956 +---------+------+-------+-------+---------+-------+---------+------+ 1957 | Modified| -- | -- |IP6-IP6| -- |IP6-IP6| -- | -- | 1958 | headers | | | (RPI1)| | (RH3, | | | 1959 | | | | | | RPI2)| | | 1960 +---------+------+-------+-------+---------+-------+---------+------+ 1961 |Untouched| -- | -- | -- | -- | -- | -- | -- | 1962 | headers | | | | | | | | 1963 +---------+------+-------+-------+---------+-------+---------+------+ 1965 Figure 22: Non-SM: Summary of the use of headers from RUL to RUL 1967 9. Operational Considerations of supporting not-RPL-aware-leaves 1969 Roughly half of the situations described in this document involve 1970 leaf ("host") nodes that do not speak RPL. These nodes fall into two 1971 further categories: ones that drop a packet that have RPI or RH3 1972 headers, and ones that continue to process a packet that has RPI and/ 1973 or RH3 headers. 1975 [RFC8200] provides for new rules that suggest that nodes that have 1976 not been configured (explicitly) to examine Hop-by-Hop headers, 1977 should ignore those headers, and continue processing the packet. 1978 Despite this, and despite the switch from 0x63 to 0x23, there may be 1979 hosts that are pre-RFC8200, or simply intolerant. Those hosts will 1980 drop packets that continue to have RPL artifacts in them. In 1981 general, such hosts can not be easily supported in RPL LLNs. 1983 There are some specific cases where it is possible to remove the RPL 1984 artifacts prior to forwarding the packet to the leaf host. The 1985 critical thing is that the artifacts have been inserted by the RPL 1986 root inside an IPv6-in-IPv6 header, and that the header has been 1987 addressed to the 6LR immediately prior to the leaf node. In that 1988 case, in the process of removing the IPv6-in-IPv6 header, the 1989 artifacts can also be removed. 1991 The above case occurs whenever traffic originates from the outside 1992 the LLN (the "Internet" cases above), and non-storing mode is used. 1993 In non-storing mode, the RPL root knows the exact topology (as it 1994 must be create the RH3 header), and therefore knows what the 6LR 1995 prior to the leaf. For example, in Figure 5, node E is the 6LR prior 1996 to the leaf node G, or node C is the 6LR prior to the leaf node J. 1998 traffic originating from the RPL root (such as when the data 1999 collection system is co-located on the RPL root), does not require an 2000 IPv6-in-IPv6 header (in either mode), as the packet is originating at 2001 the root, and the root can insert the RPI and RH3 headers directly 2002 into the packet, as it is formed. Such a packet is slightly smaller, 2003 but only can be sent to nodes (whether RPL aware or not), that will 2004 tolerate the RPL artifacts. 2006 An operator that finds itself with a lot of traffic from the RPL root 2007 to RPL-not-aware-leaves, will have to do IPv6-in-IPv6 encapsulation 2008 if the leaf is not tolerant of the RPL artifacts. Such an operator 2009 could otherwise omit this unnecessary header if it was certain of the 2010 properties of the leaf. 2012 As storing mode can not know the final path of the traffic, 2013 intolerant (that drop packets with RPL artifacts) leaf nodes can not 2014 be supported. 2016 10. Operational considerations of introducing 0x23 2018 This section describes the operational considerations of introducing 2019 the new RPI value of 0x23. 2021 During bootstrapping the node gets the DIO with the information of 2022 RPL Option Type, indicating the new RPI in the DODAG Configuration 2023 Option Flag. The DODAG root is in charge to configure the current 2024 network to the new value, through DIO messages and when all the nodes 2025 are set with the new value. The DODAG should change to a new DODAG 2026 version. In case of rebooting, the node does not remember the RPL 2027 Option Type. Thus, the DIO is sent with a flag indicating the new 2028 RPI value. 2030 The DODAG Configuration option is contained in a RPL DIO message, 2031 which contains a unique DTSN counter. The leaf nodes respond to this 2032 message with DAO messages containing the same DTSN. This is a normal 2033 part of RPL routing; the RPL root therefore knows when the updated 2034 DODAG Configuration Option has been seen by all nodes. 2036 Before the migration happens, all the RPL-aware nodes should support 2037 both values . The migration procedure it is triggered when the DIO 2038 is sent with the flag indicating the new RPI value. Namely, it 2039 remains at 0x63 until it is sure that the network is capable of 0x23, 2040 then it abruptly change to 0x23. This options allows to send packets 2041 to not-RPL nodes, which should ignore the option and continue 2042 processing the packets. 2044 In case that a node join to a network that only process 0x63, it 2045 would produce a flag day as was mentioned previously. Indicating the 2046 new RPI in the DODAG Configuration Option Flag is a way to avoid the 2047 flag day in a network. It is recommended that a network process both 2048 options to enable interoperability. 2050 11. IANA Considerations 2052 This document updates the registration made in [RFC6553] Destination 2053 Options and Hop-by-Hop Options registry from 0x63 to 0x23 as shown in 2054 Figure 23. 2056 +-------+-------------------+------------------------+---------- -+ 2057 | Hex | Binary Value | Description | Reference | 2058 + Value +-------------------+ + + 2059 | | act | chg | rest | | | 2060 +-------+-----+-----+-------+------------------------+------------+ 2061 | 0x23 | 00 | 1 | 00011 | RPL Option |[RFCXXXX](*)| 2062 +-------+-----+-----+-------+------------------------+------------+ 2063 | 0x63 | 01 | 1 | 00011 | RPL Option(DEPRECATED) | [RFC6553] | 2064 | | | | | |[RFCXXXX](*)| 2065 +-------+-----+-----+-------+------------------------+------------+ 2067 Figure 23: Option Type in RPL Option.(*)represents this document 2069 DODAG Configuration option is updated as follows (Figure 24): 2071 +------------+-----------------+---------------+ 2072 | Bit number | Description | Reference | 2073 +------------+-----------------+---------------+ 2074 | 3 | RPI 0x23 enable | This document | 2075 +------------+-----------------+---------------+ 2077 Figure 24: DODAG Configuration Option Flag to indicate the RPI-flag- 2078 day. 2080 12. Security Considerations 2082 The security considerations covered in [RFC6553] and [RFC6554] apply 2083 when the packets are in the RPL Domain. 2085 The IPv6-in-IPv6 mechanism described in this document is much more 2086 limited than the general mechanism described in [RFC2473]. The 2087 willingness of each node in the LLN to decapsulate packets and 2088 forward them could be exploited by nodes to disguise the origin of an 2089 attack. 2091 While a typical LLN may be a very poor origin for attack traffic (as 2092 the networks tend to be very slow, and the nodes often have very low 2093 duty cycles) given enough nodes, they could still have a significant 2094 impact, particularly if attack is targeting another LLN. 2095 Additionally, some uses of RPL involve large backbone ISP scale 2096 equipment [I-D.ietf-anima-autonomic-control-plane], which may be 2097 equipped with multiple 100Gb/s interfaces. 2099 Blocking or careful filtering of IPv6-in-IPv6 traffic entering the 2100 LLN as described above will make sure that any attack that is mounted 2101 must originate from compromised nodes within the LLN. The use of 2102 BCP38 [BCP38] filtering at the RPL root on egress traffic will both 2103 alert the operator to the existence of the attack, as well as drop 2104 the attack traffic. As the RPL network is typically numbered from a 2105 single prefix, which is itself assigned by RPL, BCP38 filtering 2106 involves a single prefix comparison and should be trivial to 2107 automatically configure. 2109 There are some scenarios where IPv6-in-IPv6 traffic should be allowed 2110 to pass through the RPL root, such as the IPv6-in-IPv6 mediated 2111 communications between a new Pledge and the Join Registrar/ 2112 Coordinator (JRC) when using [I-D.ietf-anima-bootstrapping-keyinfra] 2113 and [I-D.ietf-6tisch-dtsecurity-secure-join]. This is the case for 2114 the RPL root to do careful filtering: it occurs only when the Join 2115 Coordinator is not co-located inside the RPL root. 2117 With the above precautions, an attack using IPv6-in-IPv6 tunnels can 2118 only be by a node within the LLN on another node within the LLN. 2119 Such an attack could, of course, be done directly. An attack of this 2120 kind is meaningful only if the source addresses are either fake or if 2121 the point is to amplify return traffic. Such an attack, could also 2122 be done without the use of IPv6-in-IPv6 headers using forged source 2123 addresses. If the attack requires bi-directional communication, then 2124 IPv6-in-IPv6 provides no advantages. 2126 Whenever IPv6-in-IPv6 headers are being proposed, there is a concern 2127 about creating security issues. In the security section of 2129 [RFC2473], it was suggested that tunnel entry and exit points can be 2130 secured, via "Use IPsec". This recommendation is not practical for 2131 RPL networks. [RFC5406] goes into some detail on what additional 2132 details would be needed in order to "Use IPsec". Use of ESP would 2133 prevent RFC8183 compression (compression must occur before 2134 encryption), and RFC8183 compression is lossy in a way that prevents 2135 use of AH. These are minor issues. The major issue is how to 2136 establish trust enough such that IKEv2 could be used. This would 2137 require a system of certificates to be present in every single node, 2138 including any Internet nodes that might need to communicate with the 2139 LLN. Thus, "Use IPsec" requires a global PKI in the general case. 2141 More significantly, the use of IPsec tunnels to protect the IPv6-in- 2142 IPv6 headers would in the general case scale with the square of the 2143 number of nodes. This is a lot of resource for a constrained nodes 2144 on a constrained network. In the end, the IPsec tunnels would be 2145 providing only BCP38-like origin authentication! That is, IPsec 2146 provides a transitive guarantee to the tunnel exit point that the 2147 tunnel entry point did BCP38 on traffic going in. Just doing BCP38 2148 origin filtering at the entry and exit of the LLN provides a similar 2149 level amount of security without all the scaling and trust problems 2150 of using IPsec as RFC2473 suggested. IPsec is not recommended. 2152 An LLN with hostile nodes within it would not be protected against 2153 impersonation with the LLN by entry/exit filtering. 2155 The RH3 header usage described here can be abused in equivalent ways 2156 (to disguise the origin of traffic and attack other nodes) with an 2157 IPv6-in-IPv6 header to add the needed RH3 header. As such, the 2158 attacker's RH3 header will not be seen by the network until it 2159 reaches the end host, which will decapsulate it. An end-host should 2160 be suspicious about a RH3 header which has additional hops which have 2161 not yet been processed, and SHOULD ignore such a second RH3 header. 2163 In addition, the LLN will likely use [RFC8138] to compress the IPv6- 2164 in-IPv6 and RH3 headers. As such, the compressor at the RPL-root 2165 will see the second RH3 header and MAY choose to discard the packet 2166 if the RH3 header has not been completely consumed. A consumed 2167 (inert) RH3 header could be present in a packet that flows from one 2168 LLN, crosses the Internet, and enters another LLN. As per the 2169 discussion in this document, such headers do not need to be removed. 2170 However, there is no case described in this document where an RH3 is 2171 inserted in a non-storing network on traffic that is leaving the LLN, 2172 but this document should not preclude such a future innovation. It 2173 should just be noted that an incoming RH3 must be fully consumed, or 2174 very carefully inspected. 2176 The RPI header, if permitted to enter the LLN, could be used by an 2177 attacker to change the priority of a packet by selecting a different 2178 RPLInstanceID, perhaps one with a higher energy cost, for instance. 2179 It could also be that not all nodes are reachable in an LLN using the 2180 default instanceID, but a change of instanceID would permit an 2181 attacker to bypass such filtering. Like the RH3, a RPI header is to 2182 be inserted by the RPL root on traffic entering the LLN by first 2183 inserting an IPv6-in-IPv6 header. The attacker's RPI header 2184 therefore will not be seen by the network. Upon reaching the 2185 destination node the RPI header has no further meaning and is just 2186 skipped; the presence of a second RPI header will have no meaning to 2187 the end node as the packet has already been identified as being at 2188 it's final destination. 2190 The RH3 and RPI headers could be abused by an attacker inside of the 2191 network to route packets on non-obvious ways, perhaps eluding 2192 observation. This usage is in fact part of [RFC6997] and can not be 2193 restricted at all. This is a feature, not a bug. 2195 [RFC7416] deals with many other threats to LLNs not directly related 2196 to the use of IPv6-in-IPv6 headers, and this document does not change 2197 that analysis. 2199 Nodes within the LLN can use the IPv6-in-IPv6 mechanism to mount an 2200 attack on another part of the LLN, while disguising the origin of the 2201 attack. The mechanism can even be abused to make it appear that the 2202 attack is coming from outside the LLN, and unless countered, this 2203 could be used to mount a Distributed Denial Of Service attack upon 2204 nodes elsewhere in the Internet. See [DDOS-KREBS] for an example of 2205 such attacks already seen in the real world. 2207 If an attack comes from inside of LLN, it can be alleviated with SAVI 2208 (Source Address Validation Improvement) using [RFC8505] with 2209 [I-D.ietf-6lo-ap-nd]. The attacker will not be able to source 2210 traffic with an address that is not registered, and the registration 2211 process checks for topological correctness. Notice that there is an 2212 L2 authentication in most of the cases. If an attack comes from 2213 outside LLN IPv6-in- IPv6 can be used to hide inner routing headers, 2214 but by construction, the RH3 can typically only address nodes within 2215 the LLN. That is, a RH3 with a CmprI less than 8 , should be 2216 considered an attack (see RFC6554, section 3). 2218 Nodes outside of the LLN will need to pass IPv6-in-IPv6 traffic 2219 through the RPL root to perform this attack. To counter, the RPL 2220 root SHOULD either restrict ingress of IPv6-in-IPv6 packets (the 2221 simpler solution), or it SHOULD walk the IP header extension chain 2222 until it can inspect the upper-layer-payload as described in 2223 [RFC7045]. In particular, the RPL root SHOULD do [BCP38] processing 2224 on the source addresses of all IP headers that it examines in both 2225 directions. 2227 Note: there are some situations where a prefix will spread across 2228 multiple LLNs via mechanisms such as the one described in 2229 [I-D.ietf-6lo-backbone-router]. In this case the BCP38 filtering 2230 needs to take this into account, either by exchanging detailed 2231 routing information on each LLN, or by moving the BCP38 filtering 2232 further towards the Internet, so that the details of the multiple 2233 LLNs do not matter. 2235 13. Acknowledgments 2237 This work is done thanks to the grant by the Stand.ICT project. 2239 A special BIG thanks to C. M. Heard for the help with the 2240 Section 4. Much of the redaction in that section is based on his 2241 comments. 2243 Additionally, the authors would like to acknowledge the review, 2244 feedback, and comments of (alphabetical order): Robert Cragie, Simon 2245 Duquennoy, Ralph Droms, Cenk Guendogan, Rahul Jadhav, Matthias 2246 Kovatsch, Peter van der Stok, Xavier Vilajosana and Thomas Watteyne. 2248 14. References 2250 14.1. Normative References 2252 [BCP38] Ferguson, P. and D. Senie, "Network Ingress Filtering: 2253 Defeating Denial of Service Attacks which employ IP Source 2254 Address Spoofing", BCP 38, RFC 2827, DOI 10.17487/RFC2827, 2255 May 2000, . 2257 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2258 Requirement Levels", BCP 14, RFC 2119, 2259 DOI 10.17487/RFC2119, March 1997, 2260 . 2262 [RFC6040] Briscoe, B., "Tunnelling of Explicit Congestion 2263 Notification", RFC 6040, DOI 10.17487/RFC6040, November 2264 2010, . 2266 [RFC6282] Hui, J., Ed. and P. Thubert, "Compression Format for IPv6 2267 Datagrams over IEEE 802.15.4-Based Networks", RFC 6282, 2268 DOI 10.17487/RFC6282, September 2011, 2269 . 2271 [RFC6550] Winter, T., Ed., Thubert, P., Ed., Brandt, A., Hui, J., 2272 Kelsey, R., Levis, P., Pister, K., Struik, R., Vasseur, 2273 JP., and R. Alexander, "RPL: IPv6 Routing Protocol for 2274 Low-Power and Lossy Networks", RFC 6550, 2275 DOI 10.17487/RFC6550, March 2012, 2276 . 2278 [RFC6553] Hui, J. and JP. Vasseur, "The Routing Protocol for Low- 2279 Power and Lossy Networks (RPL) Option for Carrying RPL 2280 Information in Data-Plane Datagrams", RFC 6553, 2281 DOI 10.17487/RFC6553, March 2012, 2282 . 2284 [RFC6554] Hui, J., Vasseur, JP., Culler, D., and V. Manral, "An IPv6 2285 Routing Header for Source Routes with the Routing Protocol 2286 for Low-Power and Lossy Networks (RPL)", RFC 6554, 2287 DOI 10.17487/RFC6554, March 2012, 2288 . 2290 [RFC7045] Carpenter, B. and S. Jiang, "Transmission and Processing 2291 of IPv6 Extension Headers", RFC 7045, 2292 DOI 10.17487/RFC7045, December 2013, 2293 . 2295 [RFC8025] Thubert, P., Ed. and R. Cragie, "IPv6 over Low-Power 2296 Wireless Personal Area Network (6LoWPAN) Paging Dispatch", 2297 RFC 8025, DOI 10.17487/RFC8025, November 2016, 2298 . 2300 [RFC8138] Thubert, P., Ed., Bormann, C., Toutain, L., and R. Cragie, 2301 "IPv6 over Low-Power Wireless Personal Area Network 2302 (6LoWPAN) Routing Header", RFC 8138, DOI 10.17487/RFC8138, 2303 April 2017, . 2305 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2306 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 2307 May 2017, . 2309 [RFC8200] Deering, S. and R. Hinden, "Internet Protocol, Version 6 2310 (IPv6) Specification", STD 86, RFC 8200, 2311 DOI 10.17487/RFC8200, July 2017, 2312 . 2314 14.2. Informative References 2316 [DDOS-KREBS] 2317 Goodin, D., "Record-breaking DDoS reportedly delivered by 2318 >145k hacked cameras", September 2016, 2319 . 2322 [I-D.ietf-6lo-ap-nd] 2323 Thubert, P., Sarikaya, B., Sethi, M., and R. Struik, 2324 "Address Protected Neighbor Discovery for Low-power and 2325 Lossy Networks", draft-ietf-6lo-ap-nd-12 (work in 2326 progress), April 2019. 2328 [I-D.ietf-6lo-backbone-router] 2329 Thubert, P., Perkins, C., and E. Levy-Abegnoli, "IPv6 2330 Backbone Router", draft-ietf-6lo-backbone-router-11 (work 2331 in progress), February 2019. 2333 [I-D.ietf-6tisch-dtsecurity-secure-join] 2334 Richardson, M., "6tisch Secure Join protocol", draft-ietf- 2335 6tisch-dtsecurity-secure-join-01 (work in progress), 2336 February 2017. 2338 [I-D.ietf-anima-autonomic-control-plane] 2339 Eckert, T., Behringer, M., and S. Bjarnason, "An Autonomic 2340 Control Plane (ACP)", draft-ietf-anima-autonomic-control- 2341 plane-19 (work in progress), March 2019. 2343 [I-D.ietf-anima-bootstrapping-keyinfra] 2344 Pritikin, M., Richardson, M., Behringer, M., Bjarnason, 2345 S., and K. Watsen, "Bootstrapping Remote Secure Key 2346 Infrastructures (BRSKI)", draft-ietf-anima-bootstrapping- 2347 keyinfra-22 (work in progress), June 2019. 2349 [I-D.ietf-intarea-tunnels] 2350 Touch, J. and M. Townsley, "IP Tunnels in the Internet 2351 Architecture", draft-ietf-intarea-tunnels-09 (work in 2352 progress), July 2018. 2354 [I-D.thubert-roll-unaware-leaves] 2355 Thubert, P., "Routing for RPL Leaves", draft-thubert-roll- 2356 unaware-leaves-07 (work in progress), April 2019. 2358 [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 2359 (IPv6) Specification", RFC 2460, DOI 10.17487/RFC2460, 2360 December 1998, . 2362 [RFC2473] Conta, A. and S. Deering, "Generic Packet Tunneling in 2363 IPv6 Specification", RFC 2473, DOI 10.17487/RFC2473, 2364 December 1998, . 2366 [RFC4443] Conta, A., Deering, S., and M. Gupta, Ed., "Internet 2367 Control Message Protocol (ICMPv6) for the Internet 2368 Protocol Version 6 (IPv6) Specification", STD 89, 2369 RFC 4443, DOI 10.17487/RFC4443, March 2006, 2370 . 2372 [RFC5406] Bellovin, S., "Guidelines for Specifying the Use of IPsec 2373 Version 2", BCP 146, RFC 5406, DOI 10.17487/RFC5406, 2374 February 2009, . 2376 [RFC6437] Amante, S., Carpenter, B., Jiang, S., and J. Rajahalme, 2377 "IPv6 Flow Label Specification", RFC 6437, 2378 DOI 10.17487/RFC6437, November 2011, 2379 . 2381 [RFC6775] Shelby, Z., Ed., Chakrabarti, S., Nordmark, E., and C. 2382 Bormann, "Neighbor Discovery Optimization for IPv6 over 2383 Low-Power Wireless Personal Area Networks (6LoWPANs)", 2384 RFC 6775, DOI 10.17487/RFC6775, November 2012, 2385 . 2387 [RFC6997] Goyal, M., Ed., Baccelli, E., Philipp, M., Brandt, A., and 2388 J. Martocci, "Reactive Discovery of Point-to-Point Routes 2389 in Low-Power and Lossy Networks", RFC 6997, 2390 DOI 10.17487/RFC6997, August 2013, 2391 . 2393 [RFC7102] Vasseur, JP., "Terms Used in Routing for Low-Power and 2394 Lossy Networks", RFC 7102, DOI 10.17487/RFC7102, January 2395 2014, . 2397 [RFC7416] Tsao, T., Alexander, R., Dohler, M., Daza, V., Lozano, A., 2398 and M. Richardson, Ed., "A Security Threat Analysis for 2399 the Routing Protocol for Low-Power and Lossy Networks 2400 (RPLs)", RFC 7416, DOI 10.17487/RFC7416, January 2015, 2401 . 2403 [RFC8180] Vilajosana, X., Ed., Pister, K., and T. Watteyne, "Minimal 2404 IPv6 over the TSCH Mode of IEEE 802.15.4e (6TiSCH) 2405 Configuration", BCP 210, RFC 8180, DOI 10.17487/RFC8180, 2406 May 2017, . 2408 [RFC8505] Thubert, P., Ed., Nordmark, E., Chakrabarti, S., and C. 2409 Perkins, "Registration Extensions for IPv6 over Low-Power 2410 Wireless Personal Area Network (6LoWPAN) Neighbor 2411 Discovery", RFC 8505, DOI 10.17487/RFC8505, November 2018, 2412 . 2414 Authors' Addresses 2416 Maria Ines Robles 2417 Aalto University 2418 Otaniemi 2419 Espoo 02150 2420 Finland 2422 Email: mariainesrobles@gmail.com 2424 Michael C. Richardson 2425 Sandelman Software Works 2426 470 Dawson Avenue 2427 Ottawa, ON K1Z 5V7 2428 CA 2430 Email: mcr+ietf@sandelman.ca 2431 URI: http://www.sandelman.ca/mcr/ 2433 Pascal Thubert 2434 Cisco Systems, Inc 2435 Village d'Entreprises Green Side 400, Avenue de Roumanille 2436 Batiment T3, Biot - Sophia Antipolis 06410 2437 France 2439 Email: pthubert@cisco.com