idnits 2.17.1 draft-ietf-roll-useofrplinfo-32.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** There is 1 instance of too long lines in the document, the longest one being 31 characters in excess of 72. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (November 4, 2019) is 1636 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) -- Looks like a reference, but probably isn't: '1' on line 1801 -- Looks like a reference, but probably isn't: '2' on line 1128 == Outdated reference: A later version (-23) exists of draft-ietf-6lo-ap-nd-12 == Outdated reference: A later version (-20) exists of draft-ietf-6lo-backbone-router-13 == Outdated reference: A later version (-30) exists of draft-ietf-anima-autonomic-control-plane-20 == Outdated reference: A later version (-45) exists of draft-ietf-anima-bootstrapping-keyinfra-29 == Outdated reference: A later version (-13) exists of draft-ietf-intarea-tunnels-10 == Outdated reference: A later version (-30) exists of draft-ietf-roll-unaware-leaves-06 -- Obsolete informational reference (is this intentional?): RFC 2460 (Obsoleted by RFC 8200) Summary: 1 error (**), 0 flaws (~~), 7 warnings (==), 4 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 ROLL Working Group M. Robles 3 Internet-Draft Aalto/UTN-FRM 4 Updates: 6553, 6550, 8138 (if approved) M. Richardson 5 Intended status: Standards Track SSW 6 Expires: May 7, 2020 P. Thubert 7 Cisco 8 November 4, 2019 10 Using RPL Option Type, Routing Header for Source Routes and IPv6-in-IPv6 11 encapsulation in the RPL Data Plane 12 draft-ietf-roll-useofrplinfo-32 14 Abstract 16 This document looks at different data flows through LLN (Low-Power 17 and Lossy Networks) where RPL (IPv6 Routing Protocol for Low-Power 18 and Lossy Networks) is used to establish routing. The document 19 enumerates the cases where RFC6553 (RPL Option Type), RFC6554 20 (Routing Header for Source Routes) and IPv6-in-IPv6 encapsulation is 21 required in data plane. This analysis provides the basis on which to 22 design efficient compression of these headers. This document updates 23 RFC6553 adding a change to the RPL Option Type. Additionally, this 24 document updates RFC6550 defining a flag in the DIO Configuration 25 Option to indicate about this change and updates RFC8138 as well to 26 consider the new Option Type when the RPL Option is decompressed. 28 Status of This Memo 30 This Internet-Draft is submitted in full conformance with the 31 provisions of BCP 78 and BCP 79. 33 Internet-Drafts are working documents of the Internet Engineering 34 Task Force (IETF). Note that other groups may also distribute 35 working documents as Internet-Drafts. The list of current Internet- 36 Drafts is at https://datatracker.ietf.org/drafts/current/. 38 Internet-Drafts are draft documents valid for a maximum of six months 39 and may be updated, replaced, or obsoleted by other documents at any 40 time. It is inappropriate to use Internet-Drafts as reference 41 material or to cite them other than as "work in progress." 43 This Internet-Draft will expire on May 7, 2020. 45 Copyright Notice 47 Copyright (c) 2019 IETF Trust and the persons identified as the 48 document authors. All rights reserved. 50 This document is subject to BCP 78 and the IETF Trust's Legal 51 Provisions Relating to IETF Documents 52 (https://trustee.ietf.org/license-info) in effect on the date of 53 publication of this document. Please review these documents 54 carefully, as they describe your rights and restrictions with respect 55 to this document. Code Components extracted from this document must 56 include Simplified BSD License text as described in Section 4.e of 57 the Trust Legal Provisions and are provided without warranty as 58 described in the Simplified BSD License. 60 Table of Contents 62 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 63 1.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 4 64 2. Terminology and Requirements Language . . . . . . . . . . . . 4 65 3. RPL Overview . . . . . . . . . . . . . . . . . . . . . . . . 6 66 4. Updates to RFC6553, RFC6550 and RFC8138 . . . . . . . . . . . 7 67 4.1. Updates to RFC6550: Advertise External Routes with Non- 68 Storing Mode Signaling. . . . . . . . . . . . . . . . . . 7 69 4.2. Updates to RFC6553: Indicating the new RPI value. . . . . 8 70 4.3. Updates to RFC6550: Indicating the new RPI in the 71 DODAG Configuration Option Flag. . . . . . . . . . . . . 11 72 4.4. Updates to RFC8138: Indicating the way to decompress with 73 the new RPI value. . . . . . . . . . . . . . . . . . . . 12 74 5. Sample/reference topology . . . . . . . . . . . . . . . . . . 14 75 6. Use cases . . . . . . . . . . . . . . . . . . . . . . . . . . 16 76 7. Storing mode . . . . . . . . . . . . . . . . . . . . . . . . 19 77 7.1. Storing Mode: Interaction between Leaf and Root . . . . . 20 78 7.1.1. SM: Example of Flow from RAL to root . . . . . . . . 21 79 7.1.2. SM: Example of Flow from root to RAL . . . . . . . . 21 80 7.1.3. SM: Example of Flow from root to RUL . . . . . . . . 22 81 7.1.4. SM: Example of Flow from RUL to root . . . . . . . . 23 82 7.2. SM: Interaction between Leaf and Internet. . . . . . . . 23 83 7.2.1. SM: Example of Flow from RAL to Internet . . . . . . 24 84 7.2.2. SM: Example of Flow from Internet to RAL . . . . . . 24 85 7.2.3. SM: Example of Flow from RUL to Internet . . . . . . 25 86 7.2.4. SM: Example of Flow from Internet to RUL. . . . . . . 26 87 7.3. SM: Interaction between Leaf and Leaf . . . . . . . . . . 27 88 7.3.1. SM: Example of Flow from RAL to RAL . . . . . . . . . 28 89 7.3.2. SM: Example of Flow from RAL to RUL . . . . . . . . . 29 90 7.3.3. SM: Example of Flow from RUL to RAL . . . . . . . . . 30 91 7.3.4. SM: Example of Flow from RUL to RUL . . . . . . . . . 31 92 8. Non Storing mode . . . . . . . . . . . . . . . . . . . . . . 32 93 8.1. Non-Storing Mode: Interaction between Leaf and Root . . . 33 94 8.1.1. Non-SM: Example of Flow from RAL to root . . . . . . 34 95 8.1.2. Non-SM: Example of Flow from root to RAL . . . . . . 34 96 8.1.3. Non-SM: Example of Flow from root to RUL . . . . . . 35 97 8.1.4. Non-SM: Example of Flow from RUL to root . . . . . . 36 98 8.2. Non-Storing Mode: Interaction between Leaf and Internet . 37 99 8.2.1. Non-SM: Example of Flow from RAL to Internet . . . . 37 100 8.2.2. Non-SM: Example of Flow from Internet to RAL . . . . 38 101 8.2.3. Non-SM: Example of Flow from RUL to Internet . . . . 39 102 8.2.4. Non-SM: Example of Flow from Internet to RUL . . . . 40 103 8.3. Non-SM: Interaction between Leafs . . . . . . . . . . . . 41 104 8.3.1. Non-SM: Example of Flow from RAL to RAL . . . . . . . 41 105 8.3.2. Non-SM: Example of Flow from RAL to RUL . . . . . . . 43 106 8.3.3. Non-SM: Example of Flow from RUL to RAL . . . . . . . 44 107 8.3.4. Non-SM: Example of Flow from RUL to RUL . . . . . . . 45 108 9. Operational Considerations of supporting 109 RUL-leaves . . . . . . . . . . . . . . . . . . . . . . . . . 46 110 10. Operational considerations of introducing 0x23 . . . . . . . 47 111 11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 48 112 12. Security Considerations . . . . . . . . . . . . . . . . . . . 49 113 13. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 52 114 14. References . . . . . . . . . . . . . . . . . . . . . . . . . 52 115 14.1. Normative References . . . . . . . . . . . . . . . . . . 52 116 14.2. Informative References . . . . . . . . . . . . . . . . . 54 117 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 56 119 1. Introduction 121 RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks) 122 [RFC6550] is a routing protocol for constrained networks. RFC6553 123 [RFC6553] defines the "RPL option" (RPL Packet Information or RPI), 124 carried within the IPv6 Hop-by-Hop header to quickly identify 125 inconsistencies (loops) in the routing topology. RFC6554 [RFC6554] 126 defines the "RPL Source Route Header" (RH3), an IPv6 Extension Header 127 to deliver datagrams within a RPL routing domain, particularly in 128 non-storing mode. 130 These various items are referred to as RPL artifacts, and they are 131 seen on all of the data-plane traffic that occurs in RPL routed 132 networks; they do not in general appear on the RPL control plane 133 traffic at all which is mostly hop-by-hop traffic (one exception 134 being DAO messages in non-storing mode). 136 It has become clear from attempts to do multi-vendor 137 interoperability, and from a desire to compress as many of the above 138 artifacts as possible that not all implementers agree when artifacts 139 are necessary, or when they can be safely omitted, or removed. 141 The ROLL WG analysized how [RFC2460] rules apply to storing and non- 142 storing use of RPL. The result was 24 data plane use cases. They 143 are exhaustively outlined here in order to be completely unambiguous. 144 During the processing of this document, new rules were published as 145 [RFC8200], and this document was updated to reflect the normative 146 changes in that document. 148 This document updates RFC6553, changing the RPI option value to make 149 RFC8200 routers ignore this option by default. 151 A Routing Header Dispatch for 6LoWPAN (6LoRH)([RFC8138]) defines a 152 mechanism for compressing RPL Option information and Routing Header 153 type 3 (RH3) [RFC6554], as well as an efficient IPv6-in-IPv6 154 technique. 156 Since some of the uses cases here described, use IPv6-in-IPv6 157 encapsulation. It MUST take in consideration, when encapsulation is 158 applied, the RFC6040 [RFC6040], which defines how the explicit 159 congestion notification (ECN) field of the IP header should be 160 constructed on entry to and exit from any IPV6-in-IPV6 tunnel. 161 Additionally, it is recommended the reading of 162 [I-D.ietf-intarea-tunnels] that explains the relationship of IP 163 tunnels to existing protocol layers and the challenges in supporting 164 IP tunneling. 166 Non-constrained uses of RPL are not in scope of this document, and 167 applicability statements for those uses may provide different advice, 168 E.g. [I-D.ietf-anima-autonomic-control-plane]. 170 1.1. Overview 172 The rest of the document is organized as follows: Section 2 describes 173 the used terminology. Section 3 provides a RPL Overview. Section 4 174 describes the updates to RFC6553, RFC6550 and RFC 8138. Section 5 175 provides the reference topology used for the uses cases. Section 6 176 describes the uses cases included. Section 7 describes the storing 177 mode cases and section 8 the non-storing mode cases. Section 9 178 describes the operational considerations of supporting RPL-unaware- 179 leaves. Section 10 depicts operational considerations for the 180 proposed change on RPL Option type, section 11 the IANA 181 considerations and then section 12 describes the security aspects. 183 2. Terminology and Requirements Language 185 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 186 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 187 "OPTIONAL" in this document are to be interpreted as described in BCP 188 14 [RFC2119] [RFC8174] when, and only when, they appear in all 189 capitals, as shown here. 191 Terminology defined in [RFC7102] applies to this document: LLN, RPL, 192 RPL Domain and ROLL. 194 RPL Leaf: An IPv6 host that is attached to a RPL router and obtains 195 connectivity through a RPL Destination Oriented Directed Acyclic 196 Graph (DODAG). As an IPv6 node, a RPL Leaf is expected to ignore a 197 consumed Routing Header and as an IPv6 host, it is expected to ignore 198 a Hop-by-Hop header. It results that a RPL Leaf can correctly 199 receive a packet with RPL artifacts. On the other hand, a RPL Leaf 200 is not expected to generate RPL artifacts or to support IP-in-IP 201 encapsulation. For simplification, this document uses the standalone 202 term leaf to mean a RPL leaf. 204 RPL-aware-node (RAN): A device which implements RPL. Please note 205 that the device can be found inside the LLN or outside LLN. 207 RPL-Aware-Leaf(RAL): A RPL-aware-node that is also a RPL Leaf. 209 RPL-unaware-node: A device which does not implement RPL, thus the 210 device is not-RPL-aware. Please note that the device can be found 211 inside the LLN. 213 RPL-Unaware-Leaf(RUL): A RPL-unaware-node that is also a RPL Leaf. 215 6LoWPAN Node (6LN): [RFC6775] defines it as: "A 6LoWPAN node is any 216 host or router participating in a LoWPAN. This term is used when 217 referring to situations in which either a host or router can play the 218 role described.". In this document, a 6LN acts as a leaf. 220 6LoWPAN Router (6LR): [RFC6775] defines it as:" An intermediate 221 router in the LoWPAN that is able to send and receive Router 222 Advertisements (RAs) and Router Solicitations (RSs) as well as 223 forward and route IPv6 packets. 6LoWPAN routers are present only in 224 route-over topologies." 226 6LoWPAN Border Router (6LBR): [RFC6775] defines it as:"A border 227 router located at the junction of separate 6LoWPAN networks or 228 between a 6LoWPAN network and another IP network. There may be one 229 or more 6LBRs at the 6LoWPAN network boundary. A 6LBR is the 230 responsible authority for IPv6 prefix propagation for the 6LoWPAN 231 network it is serving. An isolated LoWPAN also contains a 6LBR in 232 the network, which provides the prefix(es) for the isolated network." 233 Flag Day: A transition that involves having a network with different 234 values of RPL Option Type. Thus the network does not work correctly 235 (Lack of interoperation). 237 Hop-by-hop re-encapsulation: The term "hop-by-hop re-encapsulation" 238 header refers to adding a header that originates from a node to an 239 adjacent node, using the addresses (usually the GUA or ULA, but could 240 use the link-local addresses) of each node. If the packet must 241 traverse multiple hops, then it must be decapsulated at each hop, and 242 then re-encapsulated again in a similar fashion. 244 Non-Storing Mode (Non-SM): RPL mode of operation in which the RPL- 245 aware-nodes send information to the root about its parents. Thus, 246 the root know the topology, then the intermediate 6LRs do not 247 maintain routing state so that source routing is needed. 249 Storing Mode (SM): RPL mode of operation in which RPL-aware-nodes 250 (6LRs) maintain routing state (of the children) so that source 251 routing is not needed. 253 Note: Due to lack of space in some figures (tables) we refers IPv6- 254 in-IPv6 as IP6-IP6. 256 3. RPL Overview 258 RPL defines the RPL Control messages (control plane), a new ICMPv6 259 [RFC4443] message with Type 155. DIS (DODAG Information 260 Solicitation), DIO (DODAG Information Object) and DAO (Destination 261 Advertisement Object) messages are all RPL Control messages but with 262 different Code values. A RPL Stack is shown in Figure 1. 264 +--------------+ 265 | Upper Layers | 266 | | 267 +--------------+ 268 | RPL | 269 | | 270 +--------------+ 271 | ICMPv6 | 272 | | 273 +--------------+ 274 | IPv6 | 275 | | 276 +--------------+ 277 | 6LoWPAN | 278 | | 279 +--------------+ 280 | PHY-MAC | 281 | | 282 +--------------+ 284 Figure 1: RPL Stack. 286 RPL supports two modes of Downward traffic: in storing mode (SM), it 287 is fully stateful; in non-storing mode (Non-SM), it is fully source 288 routed. A RPL Instance is either fully storing or fully non-storing, 289 i.e. a RPL Instance with a combination of storing and non-storing 290 nodes is not supported with the current specifications at the time of 291 writing this document. 293 4. Updates to RFC6553, RFC6550 and RFC8138 295 4.1. Updates to RFC6550: Advertise External Routes with Non-Storing 296 Mode Signaling. 298 Section 6.7.8. of [RFC6550] introduces the 'E' flag that is set to 299 indicate that the 6LR that generates the DAO redistributes external 300 targets into the RPL network. An external Target is a Target that 301 has been learned through an alternate protocol, for instance a route 302 to a prefix that is outside the RPL domain but reachable via a 6LR. 303 Being outside of the RPL domain, a node that is reached via an 304 external target cannot be guaranteed to ignore the RPL artifacts and 305 cannot be expected to process the [RFC8138] compression correctly. 306 This means that the RPL artifacts should be contained in an IP-in-IP 307 encapsulation that is removed by the 6LR, and that any remaining 308 compression should be expanded by the 6LR before it forwards a packet 309 outside the RPL domain. 311 This specification updates [RFC6550] to RECOMMEND that external 312 targets are advertised using Non-Storing Mode DAO messaging even in a 313 Storing-Mode network. This way, external routes are not advertised 314 within the DODAG and all packets to an external target reach the Root 315 like normal Non-Storing Mode traffic. The Non-Storing Mode DAO 316 informs the Root of the address of the 6LR that injects the external 317 route, and the root uses IP-in-IP encapsulation to that 6LR, which 318 terminates the IP-in-IP tunnel and forwards the original packet 319 outside the RPL domain free of RPL artifacts. This whole operation 320 is transparent to intermediate routers that only see traffic between 321 the 6LR and the Root, and only the Root and the 6LRs that inject 322 external routes in the network need to be upgraded to add this 323 function to the network. 325 A RUL is a special case of external target when the target is 326 actually a host and it is known to support a consumed Routing Header 327 and to ignore a HbH header as prescribed by [RFC8200]. The target 328 may have been learned through as a host route or may have been 329 registered to the 6LR using [RFC8505]. IP-in-IP encapsulation MAY be 330 avoided for Root to RUL communication if the RUL is known to process 331 the packets as forwarded by the parent 6LR without decapsulation. 333 In order to enable IP-in-IP all the way to a 6LN, it is beneficial 334 that the 6LN supports decapsulating IP-in-IP, but that is not assumed 335 by [RFC8504]. If the 6LN is a RUL, the Root that encapsulates a 336 packet SHOULD terminate the tunnel at a parent 6LR unless it is aware 337 that the RUL supports IP-in-IP decapsulation. 339 A node that is reachable over an external route is not expected to 340 support [RFC8138]. Whether a decapsulation took place or not and 341 even when the 6LR is delivering the packet to a RUL, the 6LR that 342 injected an external route MUST uncompress the packet before 343 forwarding over that external route. 345 4.2. Updates to RFC6553: Indicating the new RPI value. 347 This modification is required to be able to send, for example, IPv6 348 packets from a RPL-Aware-Leaf to a RPL-unaware node through Internet 349 (see Section 7.2.1), without requiring IPv6-in-IPv6 encapsulation. 351 [RFC6553] (Section 6, Page 7) states as shown in Figure 2, that in 352 the Option Type field of the RPL Option header, the two high order 353 bits must be set to '01' and the third bit is equal to '1'. The 354 first two bits indicate that the IPv6 node must discard the packet if 355 it doesn't recognize the option type, and the third bit indicates 356 that the Option Data may change in route. The remaining bits serve 357 as the option type. 359 +-------+-------------------+----------------+-----------+ 360 | Hex | Binary Value | Description | Reference | 361 + Value +-------------------+ + + 362 | | act | chg | rest | | | 363 +-------+-----+-----+-------+----------------+-----------+ 364 | 0x63 | 01 | 1 | 00011 | RPL Option | [RFC6553] | 365 +-------+-----+-----+-------+----------------+-----------+ 367 Figure 2: Option Type in RPL Option. 369 This document illustrates that is is not always possible to know for 370 sure at the source that a packet will only travel within the RPL 371 domain or may leave it. 373 At the time [RFC6553] was published, leaking a Hop-by-Hop header in 374 the outer IPv6 header chain could potentially impact core routers in 375 the internet. So at that time, it was decided to encapsulate any 376 packet with a RPL option using IPv6-in-IPv6 in all cases where it was 377 unclear whether the packet would remain within the RPL domain. In 378 the exception case where a packet would still leak, the Option Type 379 would ensure that the first router in the Internet that does not 380 recognize the option would drop the packet and protect the rest of 381 the network. 383 Even with [RFC8138] that compresses the IPv6-in-IPv6 header, this 384 approach yields extra bytes in a packet which means consuming more 385 energy, more bandwidth, incurring higher chances of loss and possibly 386 causing a fragmentation at the 6LoWPAN level. This impacts the daily 387 operation of constrained devices for a case that generally does not 388 happen and would not heavily impact the core anyway. 390 While intention was and remains that the Hop-by-Hop header with a RPL 391 option should be confined within the RPL domain, this specification 392 modifies this behavior in order to reduce the dependency on IPv6-in- 393 IPv6 and protect the constrained devices. Section 4 of [RFC8200] 394 clarifies the behaviour of routers in the Internet as follows: "it is 395 now expected that nodes along a packet's delivery path only examine 396 and process the Hop-by-Hop Options header if explicitly configured to 397 do so". 399 When unclear about the travel of a packet, it becomes preferable for 400 a source not to encapsulate, accepting the fact that the packet may 401 leave the RPL domain on its way to its destination. In that event, 402 the packet should reach its destination and should not be discarded 403 by the first node that does not recognize the RPL option. But with 404 the current value of the Option Type, if a node in the Internet is 405 configured to process the Hop-by-Hop header, and if such node 406 encounters an option with the first two bits set to 01 and conforms 407 to [RFC8200], it will drop the packet. Host systems should do the 408 same, irrespective of the configuration. 410 Thus, this document updates the Option Type field to (Figure 3): the 411 two high order bits MUST be set to '00' and the third bit is equal to 412 '1'. The first two bits indicate that the IPv6 node MUST skip over 413 this option and continue processing the header ([RFC8200] 414 Section 4.2) if it doesn't recognize the option type, and the third 415 bit continues to be set to indicate that the Option Data may change 416 en route. The remaining bits serve as the option type and remain as 417 0x3. This ensures that a packet that leaves the RPL domain of an LLN 418 (or that leaves the LLN entirely) will not be discarded when it 419 contains the [RFC6553] RPL Hop-by-Hop option known as RPI. 421 With the new Option Type, if an IPv6 (intermediate) node (RPL-not- 422 capable) receives a packet with an RPL Option, it should ignore the 423 Hop-by-Hop RPL option (skip over this option and continue processing 424 the header). This is relevant, as it was mentioned previously, in 425 the case that there is a flow from RAL to Internet (see 426 Section 7.2.1). 428 This is a significant update to [RFC6553]. 430 +-------+-------------------+-------------+------------+ 431 | Hex | Binary Value | Description | Reference | 432 + Value +-------------------+ + + 433 | | act | chg | rest | | | 434 +-------+-----+-----+-------+-------------+------------+ 435 | 0x23 | 00 | 1 | 00011 | RPL Option |[RFCXXXX](*)| 436 +-------+-----+-----+-------+-------------+------------+ 438 Figure 3: Revised Option Type in RPL Option. (*)represents this 439 document 441 Without the signaling described below, this change would otherwise 442 create a lack of interoperation (flag day) for existing networks 443 which are currently using 0x63 as the RPI value. A move to 0x23 will 444 not be understood by those networks. It is suggested that RPL 445 implementations accept both 0x63 and 0x23 when processing the header. 447 When forwarding packets, implementations SHOULD use the same value as 448 it was received (This is required because, RPI type code can not be 449 changed by [RFC8200] - Section 4.2). It allows to the network to be 450 incrementally upgraded, and for the DODAG root to know which parts of 451 the network are upgraded. 453 When originating new packets, implementations SHOULD have an option 454 to determine which value to originate with, this option is controlled 455 by the DIO option described below. 457 A network which is switching from straight 6LoWPAN compression 458 mechanism to those described in [RFC8138] will experience a flag day 459 in the data compression anyway, and if possible this change can be 460 deployed at the same time. 462 The change of RPI option type from 0x63 to 0x23, makes all [RFC8200] 463 Section 4.2 compliant nodes tolerant of the RPL artifacts. There is 464 therefore no longer a necessity to remove the artifacts when sending 465 traffic to the Internet. This change clarifies when to use an IPv6- 466 in-IPv6 header, and how to address them: The Hop-by-Hop Options 467 Header containing the RPI option MUST always be added when 6LRs 468 originate packets (without IPv6-in-IPv6 headers), and IPv6-in-IPv6 469 headers MUST always be added when a 6LR find that it needs to insert 470 a Hop-by-Hop Options Header containing the RPI option. The IPv6-in- 471 IPv6 header is to be addressed to the RPL root when on the way up, 472 and to the end-host when on the way down. 474 In the non-storing case, dealing with not-RPL aware leaf nodes is 475 much easier as the 6LBR (DODAG root) has complete knowledge about the 476 connectivity of all DODAG nodes, and all traffic flows through the 477 root node. 479 The 6LBR can recognize not-RPL aware leaf nodes because it will 480 receive a DAO about that node from the 6LR immediately above that 481 not-RPL aware node. This means that the non-storing mode case can 482 avoid ever using hop-by-hop re-encapsulation headers for traffic 483 originating from the root to the leafs. 485 The non-storing mode case does not require the type change from 0x63 486 to 0x23, as the root can always create the right packet. The type 487 change does not adversely affect the non-storing case. 489 4.3. Updates to RFC6550: Indicating the new RPI in the DODAG 490 Configuration Option Flag. 492 In order to avoid a Flag Day caused by lack of interoperation between 493 new RPI (0x23) and old RPI (0x63) nodes, this section defines a flag 494 in the DIO Configuration Option, to indicate when then new RPI value 495 can be safely used. This means, the flag is going to indicate the 496 type of RPI that the network is using. Thus, when a node join to a 497 network will know which value to use. With this, RPL-capable nodes 498 know if it is safe to use 0x23 when creating a new RPI. A node that 499 forwards a packet with an RPI MUST NOT modify the option type of the 500 RPI. 502 This is done via a DODAG Configuration Option flag which will 503 propagate through the network. If the flag is received with a value 504 zero (which is the default), then new nodes will remain in RFC6553 505 Compatible Mode; originating traffic with the old-RPI (0x63) value. 507 As stated in [RFC6550] the DODAG Configuration option is present in 508 DIO messages. The DODAG Configuration option distributes 509 configuration information. It is generally static, and does not 510 change within the DODAG. This information is configured at the DODAG 511 root and distributed throughout the DODAG with the DODAG 512 Configuration option. Nodes other than the DODAG root do not modify 513 this information when propagating the DODAG Configuration option. 515 The DODAG Configuration Option has a Flag field which is modified by 516 this document. Currently, the DODAG Configuration Option in 517 [RFC6550] states: "the unused bits MUST be initialize to zero by the 518 sender and MUST be ignored by the receiver". 520 Bit number three of the flag field in the DODAG Configuration option 521 is to be used as shown in Figure 4 : 523 +------------+-----------------+---------------+ 524 | Bit number | Description | Reference | 525 +------------+-----------------+---------------+ 526 | 3 | RPI 0x23 enable | This document | 527 +------------+-----------------+---------------+ 529 Figure 4: DODAG Configuration Option Flag to indicate the RPI-flag- 530 day. 532 In case of rebooting, the node (6LN or 6LR) does not remember the RPL 533 Option Type, that is if the flag is set, so DIO messages sent by the 534 node would be set with the flag unset until a DIO message is received 535 with the flag set indicating the new RPI value. The node sets to 536 0x23 if the node supports this feature. 538 4.4. Updates to RFC8138: Indicating the way to decompress with the new 539 RPI value. 541 This modification is required to be able to decompress the RPL RPI 542 option with the new value (0x23). 544 RPI-6LoRH header provides a compressed form for the RPL RPI [RFC8138] 545 in section 6. A node that is decompressing this header MUST 546 decompress using the RPL RPI option type that is currently active: 547 that is, a choice between 0x23 (new) and 0x63 (old). The node will 548 know which to use based upon the presence of the flag in the DODAG 549 Configuration Option defined in Section 4.3. E.g. If the network is 550 in 0x23 mode (by DIO option), then it should be decompressed to 0x23. 552 [RFC8138] section 7 documents how to compress the IPv6-in-IPv6 553 header. 555 There are potential significant advantages to having a single code 556 path that always processes IPv6-in-IPv6 headers with no conditional 557 branches. 559 In Storing Mode, for the examples of Flow from RAL to RUL and RUL to 560 RUL comprise an IPv6-in-IPv6 and RPI compression headers. The use of 561 the IPv6-in-IPv6 header is MANDATORY in this case, and it SHOULD be 562 compressed with [RFC8138] section 7. Figure 5 illustrates the case 563 in Storing mode where the packet is received from the Internet, then 564 the root encapsulates the packet to insert the RPI. In that example, 565 the leaf is not known to support RFC 8138, and the packet is 566 encapsulated to the 6LR that is the parent and last hop to the final 567 destination. 569 +-+ ... -+-+ ... +-+- ... -+-+- +-+-+-+ ... +-+-+ ... -+++ ... +-... 570 |11110001|SRH-6LoRH| RPI- |IP-in-IP| NH=1 |11110CPP| UDP | UDP 571 |Page 1 |Type1 S=0| 6LoRH |6LoRH |LOWPAN_IPHC| UDP | hdr |Payld 572 +-+ ... -+-+ ... +-+- ... -+-+-.+-+-+-+-+ ... +-+-+ ... -+ ... +-... 573 <-4bytes-> <- RFC 6282 -> 574 No RPL artifact 576 Figure 5: RPI Inserted by the Root in Storing Mode 578 In Figure 5, the source of the IPv6-in-IPv6 encapsulation is the 579 Root, so it is elided in the IP-in-IP 6LoRH. The destination is the 580 parent 6LR of the destination of the inner packet so it cannot be 581 elided. It is placed as the single entry in an SRH-6LoRH as the 582 first 6LoRH. There is a single entry so the SRH-6LoRH Size is 0. In 583 that example, the type is 1 so the 6LR address is compressed to 2 584 bytes. It results that the total length of the SRH-6LoRH is 4 bytes. 585 Follows the RPI-6LoRH and then the IP-in-IP 6LoRH. When the IP-in-IP 586 6LoRH is removed, all the router headers that precede it are also 587 removed. The Paging Dispatch [RFC8025] may also be removed if there 588 was no previous Page change to a Page other than 0 or 1, since the 589 LOWPAN_IPHC is encoded in the same fashion in the default Page 0 and 590 in Page 1. The resulting packet to the destination is the inner 591 packet compressed with [RFC6282]. 593 5. Sample/reference topology 595 A RPL network in general is composed of a 6LBR, Backbone Router 596 (6BBR), 6LR and 6LN as leaf logically organized in a DODAG structure. 598 Figure 6 shows the reference RPL Topology for this document. The 599 letters above the nodes are there so that they may be referenced in 600 subsequent sections. In the figure, 6LR represents a full router 601 node. The 6LN is a RPL aware router, or host (as a leaf). 602 Additionally, for simplification purposes, it is supposed that the 603 6LBR has direct access to Internet and is the root of the DODAG, thus 604 the 6BBR is not present in the figure. 606 The 6LN leaves (RAL) marked as (F, H and I) are RPL nodes with no 607 children hosts. 609 The leafs marked as RUL (G and J) are devices which do not speak RPL 610 at all (not-RPL-aware), but uses Router-Advertisements, 6LowPAN DAR/ 611 DAC and efficient-ND only to participate in the network [RFC6775]. 612 In the document these leafs (G and J) are also referred to as an IPv6 613 node. 615 The 6LBR ("A") in the figure is the root of the Global DODAG. 617 +------------+ 618 | INTERNET ----------+ 619 | | | 620 +------------+ | 621 | 622 | 623 | 624 A | 625 +-------+ 626 |6LBR | 627 +-----------|(root) |-------+ 628 | +-------+ | 629 | | 630 | | 631 | | 632 | | 633 | B |C 634 +---|---+ +---|---+ 635 | 6LR | | 6LR | 636 +---------| |--+ +--- ---+ 637 | +-------+ | | +-------+ | 638 | | | | 639 | | | | 640 | | | | 641 | | | | 642 | D | E | | 643 +-|-----+ +---|---+ | | 644 | 6LR | | 6LR | | | 645 | | +------ | | | 646 +---|---+ | +---|---+ | | 647 | | | | | 648 | | +--+ | | 649 | | | | | 650 | | | | | 651 | | | I | J | 652 F | | G | H | | 653 +-----+-+ +-|-----+ +---|--+ +---|---+ +---|---+ 654 | RAL | | RUL | | RAL | | RAL | | RUL | 655 | 6LN | | 6LN | | 6LN | | 6LN | | 6LN | 656 +-------+ +-------+ +------+ +-------+ +-------+ 658 Figure 6: A reference RPL Topology. 660 6. Use cases 662 In the data plane a combination of RFC6553, RFC6554 and IPv6-in-IPv6 663 encapsulation are going to be analyzed for a number of representative 664 traffic flows. 666 This document assumes that the LLN is using the no-drop RPI option 667 (0x23). 669 The use cases describe the communication in the following cases: - 670 Between RPL-aware-nodes with the root (6LBR) - Between RPL-aware- 671 nodes with the Internet - Between RUL nodes within the LLN (e.g. see 672 Section 7.1.4) - Inside of the LLN when the final destination address 673 resides outside of the LLN (e.g. see Section 7.2.3). 675 The uses cases are as follows: 677 Interaction between Leaf and Root: 679 RAL to root 681 root to RAL 683 RUL to root 685 root to RUL 687 Interaction between Leaf and Internet: 689 RAL to Internet 691 Internet to RAL 693 RUL to Internet 695 Internet to RUL 697 Interaction between Leafs: 699 RAL to RAL 701 RAL to RUL 703 RUL to RAL 705 RUL to RUL 707 This document is consistent with the rule that a Header cannot be 708 inserted or removed on the fly inside an IPv6 packet that is being 709 routed. This is a fundamental precept of the IPv6 architecture as 710 outlined in [RFC8200]. 712 As the rank information in the RPI artifact is changed at each hop, 713 it will typically be zero when it arrives at the DODAG root. The 714 DODAG root MUST force it to zero when passing the packet out to the 715 Internet. The Internet will therefore not see any SenderRank 716 information. 718 Despite being legal to leave the RPI artifact in place, an 719 intermediate router that needs to add an extension header (e.g. RH3 720 or RPI Option) MUST still encapsulate the packet in an (additional) 721 outer IP header. The new header is placed after this new outer IP 722 header. 724 A corollary is that an RH3 or RPI Option can only be removed by an 725 intermediate router if it is placed in an encapsulating IPv6 Header, 726 which is addressed TO the intermediate router. When it does so, the 727 whole encapsulating header must be removed. (A replacement may be 728 added). This sometimes can result in outer IP headers being 729 addressed to the next hop router using link-local address. 731 Both RPI and RH3 headers may be modified in very specific ways by 732 routers on the path of the packet without the need to add and remove 733 an encapsulating header. Both headers were designed with this 734 modification in mind, and both the RPL RH3 and the RPL option are 735 marked mutable but recoverable: so an IPsec AH security header can be 736 applied across these headers, but it can not secure the values which 737 mutate. 739 RPI MUST be present in every single RPL data packet. 741 Prior to [RFC8138], there was significant interest in removing the 742 RPI for downward flows in non-storing mode. The exception covered a 743 very small number of cases, and causes significant interoperability 744 challenges, yet costed significant code and testing complexity. The 745 ability to compress the RPI down to three bytes or less removes much 746 of the pressure to optimize this any further 747 [I-D.ietf-anima-autonomic-control-plane]. 749 The earlier examples are more extensive to make sure that the process 750 is clear, while later examples are more concise. 752 The uses cases are delineated based on the following requirements: 754 The RPI option has to be in every packet that traverses the LLN. 756 - Because of the previous requirement, packets from the Internet 757 have to be encapsulated. 759 - A Header cannot be inserted or removed on the fly inside an IPv6 760 packet that is being routed. 762 - Extension headers may not be added or removed except by the 763 sender or the receiver. 765 - RPI and RH3 headers may be modified by routers on the path of 766 the packet without the need to add and remove an encapsulating 767 header. 769 - An RH3 or RPI Option can only be removed by an intermediate 770 router if it is placed in an encapsulating IPv6 Header, which is 771 addressed to the intermediate router. 773 - Non-storing mode requires downstream encapsulation by root for 774 RH3. 776 The uses cases are delineated based on the following assumptions: 778 This document assumes that the LLN is using the no-drop RPI option 779 (0x23). 781 - Each IPv6 node (including Internet routers) obeys [RFC8200] RFC 782 8200, so that 0x23 RPI can be safely inserted. 784 - All 6LRs obey RFC 8200 [RFC8200]. 786 - The RPI is ignored at the IPv6 dst node (RUL). 788 - In the uses cases, we assume that the RAL supports IP-in-IP 789 encapsulation. 791 - In the uses cases, we dont assume that the RUL supports IP-in-IP 792 encapsulation. 794 - Non-constrained uses of RPL are not in scope of this document. 796 - Compression is based on [RFC8138]. 798 - The flow label [RFC6437] is not needed in RPL. 800 7. Storing mode 802 In storing mode (SM) (fully stateful), the sender can determine if 803 the destination is inside the LLN by looking if the destination 804 address is matched by the DIO's Prefix Information Option (PIO) 805 option. 807 The following table (Figure 7) itemizes which headers are needed in 808 each of the following scenarios. It indicates if the IPv6-in-IPv6 809 header that is added, must be addressed to the final destination (the 810 RAL node that is the target(tgt)), to the "root" or if a hop-by-hop 811 header must be added (indicated by "hop"). In the hop-by-hop basis, 812 the destination address for the next hop is the link-layer address of 813 the next hop. 815 In cases where no IPv6-in-IPv6 header is needed, the column states as 816 "No". If the IPv6-in-IPv6 header is needed is a "must". 818 In all cases the RPI headers are needed, since it identifies 819 inconsistencies (loops) in the routing topology. In all cases the 820 RH3 is not needed because it is not used in storing mode. 822 In each case, 6LR_i are the intermediate routers from source to 823 destination. "1 <= i <= n", n is the number of routers (6LR) that 824 the packet goes through from source (6LN) to destination. 826 The leaf can be a router 6LR or a host, both indicated as 6LN. The 827 root refers to the 6LBR (see Figure 6). 829 +---------------------+--------------+------------+------------------+ 830 | Interaction between | Use Case |IPv6-in-IPv6| IPv6-in-IPv6 dst | 831 +---------------------+--------------+------------+------------------+ 832 | | RAL to root | No | No | 833 + +--------------+------------+------------------+ 834 | Leaf - Root | root to RAL | No | No | 835 + +--------------+------------+------------------+ 836 | | root to RUL | No | No | 837 + +--------------+------------+------------------+ 838 | | RUL to root | must | hop or root | 839 +---------------------+--------------+------------+------------------+ 840 | | RAL to Int | No | No | 841 + +--------------+------------+------------------+ 842 | Leaf - Internet | Int to RAL | must | RAL (tgt) | 843 + +--------------+------------+------------------+ 844 | | RUL to Int | must | hop or root | 845 + +--------------+------------+------------------+ 846 | | Int to RUL | must | 6LR | 847 +---------------------+--------------+------------+------------------+ 848 | | RAL to RAL | No | No | 849 + +--------------+------------+------------------+ 850 | | RAL to RUL | No | No | 851 + Leaf - Leaf +--------------+------------+------------------+ 852 | | RUL to RAL | must | RAL (tgt) | 853 + +--------------+------------+------------------+ 854 | | RUL to RUL | must | 6LR | 855 +---------------------+--------------+------------+------------------+ 857 Figure 7: Table of IPv6-in-IPv6 encapsulation in Storing mode. 859 7.1. Storing Mode: Interaction between Leaf and Root 861 In this section is described the communication flow in storing mode 862 (SM) between, 864 RAL to root 866 root to RAL 868 RUL to root 870 root to RUL 872 7.1.1. SM: Example of Flow from RAL to root 874 In storing mode, RFC 6553 (RPI) is used to send RPL Information 875 instanceID and rank information. 877 In this case the flow comprises: 879 RAL (6LN) --> 6LR_i --> root(6LBR) 881 For example, a communication flow could be: Node F --> Node D --> 882 Node B --> Node A root(6LBR) 884 The RAL (Node F) inserts the RPI header, and sends the packet to 6LR 885 (Node D) which decrements the rank in RPI and sends the packet up. 886 When the packet arrives at 6LBR (Node A), the RPI is removed and the 887 packet is processed. 889 No IPv6-in-IPv6 header is required. 891 The RPI header can be removed by the 6LBR because the packet is 892 addressed to the 6LBR. The RAL must know that it is communicating 893 with the 6LBR to make use of this scenario. The RAL can know the 894 address of the 6LBR because it knows the address of the root via the 895 DODAGID in the DIO messages. 897 The Table 1 summarizes what headers are needed for this use case. 899 +-------------------+---------+-------+----------+ 900 | Header | RAL src | 6LR_i | 6LBR dst | 901 +-------------------+---------+-------+----------+ 902 | Inserted headers | RPI | -- | -- | 903 | Removed headers | -- | -- | RPI | 904 | Re-added headers | -- | -- | -- | 905 | Modified headers | -- | RPI | -- | 906 | Untouched headers | -- | -- | -- | 907 +-------------------+---------+-------+----------+ 909 Table 1: SM: Summary of the use of headers from RAL to root 911 7.1.2. SM: Example of Flow from root to RAL 913 In this case the flow comprises: 915 root (6LBR) --> 6LR_i --> RAL (6LN) 917 For example, a communication flow could be: Node A root(6LBR) --> 918 Node B --> Node D --> Node F 919 In this case the 6LBR inserts RPI header and sends the packet down, 920 the 6LR is going to increment the rank in RPI (it examines the 921 instanceID to identify the right forwarding table), the packet is 922 processed in the RAL and the RPI removed. 924 No IPv6-in-IPv6 header is required. 926 The Table 2 summarizes what headers are needed for this use case. 928 +-------------------+----------+-------+---------+ 929 | Header | 6LBR src | 6LR_i | RAL dst | 930 +-------------------+----------+-------+---------+ 931 | Inserted headers | RPI | -- | -- | 932 | Removed headers | -- | -- | RPI | 933 | Re-added headers | -- | -- | -- | 934 | Modified headers | -- | RPI | -- | 935 | Untouched headers | -- | -- | -- | 936 +-------------------+----------+-------+---------+ 938 Table 2: SM: Summary of the use of headers from root to RAL 940 7.1.3. SM: Example of Flow from root to RUL 942 In this case the flow comprises: 944 root (6LBR) --> 6LR_i --> RUL (IPv6 dst node) 946 For example, a communication flow could be: Node A root(6LBR) --> 947 Node B --> Node E --> Node G 949 As the RPI extension can be ignored by the RUL, this situation is 950 identical to the previous scenario. 952 The Table 3 summarizes what headers are needed for this use case. 954 +-------------------+----------+-------+----------------------+ 955 | Header | 6LBR src | 6LR_i | RUL (IPv6 dst node) | 956 +-------------------+----------+-------+----------------------+ 957 | Inserted headers | RPI | -- | -- | 958 | Removed headers | -- | -- | -- | 959 | Re-added headers | -- | -- | -- | 960 | Modified headers | -- | RPI | -- | 961 | Untouched headers | -- | -- | RPI (Ignored) | 962 +-------------------+----------+-------+----------------------+ 964 Table 3: SM: Summary of the use of headers from root to RUL 966 7.1.4. SM: Example of Flow from RUL to root 968 In this case the flow comprises: 970 RUL (IPv6 src node) --> 6LR_1 --> 6LR_i --> root (6LBR) 972 For example, a communication flow could be: Node G --> Node E --> 973 Node B --> Node A root(6LBR) 975 When the packet arrives from IPv6 node (Node G) to 6LR_1 (Node E), 976 the 6LR_1 will insert a RPI header, encapsulated in a IPv6-in-IPv6 977 header. The IPv6-in-IPv6 header can be addressed to the next hop 978 (Node B), or to the root (Node A). The root removes the header and 979 processes the packet. 981 The Figure 8 shows the table that summarizes what headers are needed 982 for this use case. [1] refers the case where the IPv6-in-IPv6 header 983 is addressed to the next hop (Node B). [2] refers the case where the 984 IPv6-in-IPv6 header is addressed to the root (Node A). 986 +-----------+------+--------------+-----------------+------------------+ 987 | Header | RUL | 6LR_1 | 6LR_i | 6LBR dst | 988 | | src | | | | 989 | | node | | | | 990 +-----------+------+--------------+-----------------+------------------+ 991 | Inserted | -- | IP6-IP6(RPI) | IP6-IP6(RPI)[1] | -- | 992 | headers | | | | | 993 +-----------+------+--------------+-----------------+------------------+ 994 | Removed | -- | -- | IP6-IP6(RPI)[1] |IP6-IP6(RPI)[1][2]| 995 | headers | | | | | 996 +-----------+------+--------------+-----------------+------------------+ 997 | Re-added | -- | -- | -- | -- | 998 | headers | | | | | 999 +-----------+------+--------------+-----------------+------------------+ 1000 | Modified | -- | -- | IP6-IP6(RPI)[2] | -- | 1001 | headers | | | | | 1002 +-----------+------+--------------+-----------------+------------------+ 1003 | Untouched | -- | -- | -- | -- | 1004 | headers | | | | | 1005 +-----------+------+--------------+-----------------+------------------+ 1007 Figure 8: SM: Summary of the use of headers from RUL to root. 1009 7.2. SM: Interaction between Leaf and Internet. 1011 In this section is described the communication flow in storing mode 1012 (SM) between, 1013 RAL to Internet 1015 Internet to RAL 1017 RUL to Internet 1019 Internet to RUL 1021 7.2.1. SM: Example of Flow from RAL to Internet 1023 RPL information from RFC 6553 may go out to Internet as it will be 1024 ignored by nodes which have not been configured to be RPI aware. 1026 In this case the flow comprises: 1028 RAL (6LN) --> 6LR_i --> root (6LBR) --> Internet 1030 For example, the communication flow could be: Node F --> Node D --> 1031 Node B --> Node A root(6LBR) --> Internet 1033 No IPv6-in-IPv6 header is required. 1035 Note: In this use case it is used a node as leaf, but this use case 1036 can be also applicable to any RPL-aware-node type (e.g. 6LR) 1038 The Table 4 summarizes what headers are needed for this use case. 1040 +-------------------+---------+-------+------+----------------+ 1041 | Header | RAL src | 6LR_i | 6LBR | Internet dst | 1042 +-------------------+---------+-------+------+----------------+ 1043 | Inserted headers | RPI | -- | -- | -- | 1044 | Removed headers | -- | -- | -- | -- | 1045 | Re-added headers | -- | -- | -- | -- | 1046 | Modified headers | -- | RPI | -- | -- | 1047 | Untouched headers | -- | -- | RPI | RPI (Ignored) | 1048 +-------------------+---------+-------+------+----------------+ 1050 Table 4: SM: Summary of the use of headers from RAL to Internet 1052 7.2.2. SM: Example of Flow from Internet to RAL 1054 In this case the flow comprises: 1056 Internet --> root (6LBR) --> 6LR_i --> RAL (6LN) 1058 For example, a communication flow could be: Internet --> Node A 1059 root(6LBR) --> Node B --> Node D --> Node F 1060 When the packet arrives from Internet to 6LBR the RPI header is added 1061 in a outer IPv6-in-IPv6 header (with the IPv6-in-IPv6 destination 1062 address set to the RAL) and sent to 6LR, which modifies the rank in 1063 the RPI. When the packet arrives at the RAL the RPI header is 1064 removed and the packet processed. 1066 The Figure 9 shows the table that summarizes what headers are needed 1067 for this use case. 1069 +-----------+----------+--------------+--------------+--------------+ 1070 | Header | Internet | 6LBR | 6LR_i | RAL dst | 1071 | | src | | | | 1072 +-----------+----------+--------------+--------------+--------------+ 1073 | Inserted | -- | IP6-IP6(RPI) | -- | -- | 1074 | headers | | | | | 1075 +-----------+----------+--------------+--------------+--------------+ 1076 | Removed | -- | -- | -- | IP6-IP6(RPI) | 1077 | headers | | | | | 1078 +-----------+----------+--------------+--------------+--------------+ 1079 | Re-added | -- | -- | -- | -- | 1080 | headers | | | | | 1081 +-----------+----------+--------------+--------------+--------------+ 1082 | Modified | -- | -- | IP6-IP6(RPI) | -- | 1083 | headers | | | | | 1084 +-----------+----------+--------------+--------------+--------------+ 1085 | Untouched | -- | -- | -- | -- | 1086 | headers | | | | | 1087 +-----------+----------+--------------+--------------+--------------+ 1089 Figure 9: SM: Summary of the use of headers from Internet to RAL. 1091 7.2.3. SM: Example of Flow from RUL to Internet 1093 In this case the flow comprises: 1095 RUL (IPv6 src node) --> 6LR_1 --> 6LR_i -->root (6LBR) --> Internet 1097 For example, a communication flow could be: Node G --> Node E --> 1098 Node B --> Node A root(6LBR) --> Internet 1100 The 6LR_1 (i=1) node will add an IPv6-in-IPv6(RPI) header addressed 1101 either to the root, or hop-by-hop such that the root can remove the 1102 RPI header before passing upwards. The IPv6-in-IPv6 addressed to the 1103 root cause less processing overhead. On the other hand, with hop-by- 1104 hop the intermediate routers can check the routing tables for a 1105 better routing path, thus it could be more efficient and faster. 1106 Implementation should decide which approach to take. 1108 The originating node will ideally leave the IPv6 flow label as zero 1109 so that the packet can be better compressed through the LLN. The 1110 6LBR will set the flow label of the packet to a non-zero value when 1111 sending to the Internet, for details check [RFC6437]. 1113 The Figure 10 shows the table that summarizes what headers are needed 1114 for this use case. In the table, [1] shows the case when packet is 1115 addressed to the root. [2] shows the case when the packet is 1116 addressed hop-by-hop. 1118 +---------+-------+------------+--------------+-------------+--------+ 1119 | Header | IPv6 | 6LR_1 | 6LR_i | 6LBR |Internet| 1120 | | src | | [i=2,...,n] | | dst | 1121 | | node | | | | | 1122 | | (RUL) | | | | | 1123 +---------+-------+------------+--------------+-------------+--------+ 1124 | Inserted| -- |IP6-IP6(RPI)| IP6-IP6(RPI) | -- | -- | 1125 | headers | | | [2] | | | 1126 +---------+-------+------------+--------------+-------------+--------+ 1127 | Removed | -- | -- | IP6-IP6(RPI) | IP6-IP6(RPI)| -- | 1128 | headers | | | [2] | [1][2] | | 1129 +---------+-------+------------+--------------+-------------+--------+ 1130 | Re-added| -- | -- | -- | -- | -- | 1131 | headers | | | | | | 1132 +---------+-------+------------+--------------+-------------+--------+ 1133 | Modified| -- | -- | IP6-IP6(RPI) | -- | -- | 1134 | headers | | | [1] | | | 1135 +---------+-------+------------+--------------+-------------+--------+ 1136 |Untouched| -- | -- | -- | -- | -- | 1137 | headers | | | | | | 1138 +---------+-------+------------+--------------+-------------+--------+ 1140 Figure 10: SM: Summary of the use of headers from RUL to Internet. 1142 7.2.4. SM: Example of Flow from Internet to RUL. 1144 In this case the flow comprises: 1146 Internet --> root (6LBR) --> 6LR_i --> RUL (IPv6 dst node) 1148 For example, a communication flow could be: Internet --> Node A 1149 root(6LBR) --> Node B --> Node E --> Node G 1151 The 6LBR will have to add an RPI header within an IPv6-in-IPv6 1152 header. The IPv6-in-IPv6 is addressed to the 6LR parent of the 1153 6lR_i. 1155 Further details about this are mentioned in 1156 [I-D.ietf-roll-unaware-leaves], which specifies RPL routing for a 6LN 1157 acting as a plain host and not being aware of RPL. 1159 The 6LBR may set the flow label on the inner IPv6-in-IPv6 header to 1160 zero in order to aid in compression [RFC8138][RFC6437]. 1162 The Figure 11 shows the table that summarizes what headers are needed 1163 for this use case. 1165 +-----------+----------+--------------+--------------+--------------+ 1166 | Header | Internet | 6LBR | 6LR_i |IPv6 dst node | 1167 | | src | | | | 1168 +-----------+----------+--------------+--------------+--------------+ 1169 | Inserted | -- | IP6-IP6(RPI) | IP6-IP6(RPI) | -- | 1170 | headers | | | | | 1171 +-----------+----------+--------------+--------------+--------------+ 1172 | Removed | -- | -- | IP6-IP6(RPI) | -- | 1173 | headers | | | | | 1174 +-----------+----------+--------------+--------------+--------------+ 1175 | Re-added | -- | -- | -- | -- | 1176 | headers | | | | | 1177 +-----------+----------+--------------+--------------+--------------+ 1178 | Modified | -- | -- | -- | -- | 1179 | headers | | | | | 1180 +-----------+----------+--------------+--------------+--------------+ 1181 | Untouched | -- | -- | -- | -- | 1182 | headers | | | | | 1183 +-----------+----------+--------------+--------------+--------------+ 1185 Figure 11: SM: Summary of the use of headers from Internet to RUL. 1187 7.3. SM: Interaction between Leaf and Leaf 1189 In this section is described the communication flow in storing mode 1190 (SM) between, 1192 RAL to RAL 1194 RAL to RUL 1196 RUL to RAL 1198 RUL to RUL 1200 7.3.1. SM: Example of Flow from RAL to RAL 1202 In [RFC6550] RPL allows a simple one-hop optimization for both 1203 storing and non-storing networks. A node may send a packet destined 1204 to a one-hop neighbor directly to that node. See section 9 in 1205 [RFC6550]. 1207 When the nodes are not directly connected, then in storing mode, the 1208 flow comprises: 1210 RAL src (6LN) --> 6LR_ia --> common parent (6LR_x) --> 6LR_id --> RAL 1211 dst (6LN) 1213 For example, a communication flow could be: Node F --> Node D --> 1214 Node B --> Node E --> Node H 1216 6LR_ia (Node D) are the intermediate routers from source to the 1217 common parent (6LR_x) (Node B). In this case, 1 <= ia <= n, n is the 1218 number of routers (6LR) that the packet goes through from RAL (Node 1219 F) to the common parent 6LR_x (Node B). 1221 6LR_id (Node E) are the intermediate routers from the common parent 1222 (6LR_x) (Node B) to destination RAL (Node H). In this case, 1 <= id 1223 <= m, m is the number of routers (6LR) that the packet goes through 1224 from the common parent (6LR_x) to destination RAL (Node H). 1226 It is assumed that the two nodes are in the same RPL Domain (that 1227 they share the same DODAG root). At the common parent (Node B), the 1228 direction of RPI is changed (from decreasing to increasing the rank). 1230 While the 6LR nodes will update the RPI, no node needs to add or 1231 remove the RPI, so no IPv6-in-IPv6 headers are necessary. 1233 The Table 5 summarizes what headers are needed for this use case. 1235 +---------------+--------+--------+---------------+--------+--------+ 1236 | Header | RAL | 6LR_ia | 6LR_x (common | 6LR_id | RAL | 1237 | | src | | parent) | | dst | 1238 +---------------+--------+--------+---------------+--------+--------+ 1239 | Inserted | RPI | -- | -- | -- | -- | 1240 | headers | | | | | | 1241 | Removed | -- | -- | -- | -- | RPI | 1242 | headers | | | | | | 1243 | Re-added | -- | -- | -- | -- | -- | 1244 | headers | | | | | | 1245 | Modified | -- | RPI | RPI | RPI | -- | 1246 | headers | | | | | | 1247 | Untouched | -- | -- | -- | -- | -- | 1248 | headers | | | | | | 1249 +---------------+--------+--------+---------------+--------+--------+ 1251 Table 5: SM: Summary of the use of headers for RAL to RAL 1253 7.3.2. SM: Example of Flow from RAL to RUL 1255 In this case the flow comprises: 1257 RAL src (6LN) --> 6LR_ia --> common parent (6LR_x) --> 6LR_id --> RUL 1258 (IPv6 dst node) 1260 For example, a communication flow could be: Node F --> Node D --> 1261 Node B --> Node E --> Node G 1263 6LR_ia are the intermediate routers from source (RAL) to the common 1264 parent (6LR_x) In this case, 1 <= ia <= n, n is the number of routers 1265 (6LR) that the packet goes through from RAL to the common parent 1266 (6LR_x). 1268 6LR_id (Node E) are the intermediate routers from the common parent 1269 (6LR_x) (Node B) to destination RUL (Node G). In this case, 1 <= id 1270 <= m, m is the number of routers (6LR) that the packet goes through 1271 from the common parent (6LR_x) to destination RUL. 1273 This situation is identical to the previous situation Section 7.3.1 1275 The Table 6 summarizes what headers are needed for this use case. 1277 +-----------+------+--------+---------------+--------+--------------+ 1278 | Header | RAL | 6LR_ia | 6LR_x(common | 6LR_id | RUL dst | 1279 | | src | | parent) | | | 1280 +-----------+------+--------+---------------+--------+--------------+ 1281 | Inserted | RPI | -- | -- | -- | -- | 1282 | headers | | | | | | 1283 | Removed | -- | -- | -- | -- | -- | 1284 | headers | | | | | | 1285 | Re-added | -- | -- | -- | -- | -- | 1286 | headers | | | | | | 1287 | Modified | -- | RPI | RPI | RPI | -- | 1288 | headers | | | | | | 1289 | Untouched | -- | -- | -- | -- | RPI(Ignored) | 1290 | headers | | | | | | 1291 +-----------+------+--------+---------------+--------+--------------+ 1293 Table 6: SM: Summary of the use of headers for RAL to RUL 1295 7.3.3. SM: Example of Flow from RUL to RAL 1297 In this case the flow comprises: 1299 RUL (IPv6 src node) --> 6LR_ia --> common parent (6LR_x) --> 6LR_id 1300 --> RAL dst (6LN) 1302 For example, a communication flow could be: Node G --> Node E --> 1303 Node B --> Node D --> Node F 1305 6LR_ia (Node E) are the intermediate routers from source (RUL) (Node 1306 G) to the common parent (6LR_x) (Node B). In this case, 1 <= ia <= 1307 n, n is the number of routers (6LR) that the packet goes through from 1308 source to the common parent. 1310 6LR_id (Node D) are the intermediate routers from the common parent 1311 (6LR_x) (Node B) to destination RAL (Node F). In this case, 1 <= id 1312 <= m, m is the number of routers (6LR) that the packet goes through 1313 from the common parent (6LR_x) to the destination RAL. 1315 The 6LR_ia (ia=1) (Node E) receives the packet from the RUL (Node G) 1316 and inserts the RPI header encapsulated in a IPv6-in-IPv6 header. 1317 The IPv6-in-IPv6 header is addressed to the destination RAL (Node F). 1319 The Figure 12 shows the table that summarizes what headers are needed 1320 for this use case. 1322 +---------+-----+------------+-------------+-------------+------------+ 1323 | Header |RUL | 6LR_ia | Common | 6LR_id | RAL | 1324 | |src | | Parent | | dst | 1325 | |node | | (6LRx) | | | 1326 +---------+-----+------------+-------------+-------------+------------+ 1327 | Inserted| -- |IP6-IP6(RPI)| -- | -- | -- | 1328 | headers | | | | | | 1329 +---------+-----+------------+-------------+-------------+------------+ 1330 | Removed | -- | -- | -- | -- |IP6-IP6(RPI)| 1331 | headers | | | | | | 1332 +---------+-----+------------+-------------+-------------+------------+ 1333 | Re-added| -- | -- | -- | -- | -- | 1334 | headers | | | | | | 1335 +---------+-----+------------+-------------+-------------+------------+ 1336 | Modified| -- | -- |IP6-IP6(RPI) |IP6-IP6(RPI) | -- | 1337 | headers | | | | | | 1338 +---------+-----+------------+-------------+-------------+------------+ 1339 |Untouched| -- | -- | -- | -- | -- | 1340 | headers | | | | | | 1341 +---------+-----+------------+-------------+-------------+------------+ 1343 Figure 12: SM: Summary of the use of headers from RUL to RAL. 1345 7.3.4. SM: Example of Flow from RUL to RUL 1347 In this case the flow comprises: 1349 RUL (IPv6 src node)--> 6LR_1--> 6LR_ia --> 6LBR --> 6LR_id --> RUL 1350 (IPv6 dst node) 1352 For example, a communication flow could be: Node G --> Node E --> 1353 Node B --> Node A (root) --> Node C --> Node J 1355 Internal nodes 6LR_ia (e.g: Node E or Node B) is the intermediate 1356 router from the RUL source (Node G) to the root (6LBR) (Node A). In 1357 this case, "1 < ia <= n", n is the number of routers (6LR) that the 1358 packet goes through from the RUL to the root. 1360 6LR_id (Node C) are the intermediate routers from the root (Node A) 1361 to the destination RUL dst node (Node J). In this case, 1 <= id <= 1362 m, m is the number of routers (6LR) that the packet goes through from 1363 the root to destination RUL. 1365 The RPI is ignored at the RUL dst node. 1367 The 6LR_1 (Node E) receives the packet from the RUL (Node G) and 1368 inserts the RPI header (RPI), encapsulated in an IPv6-in-IPv6 header 1369 directed to the root. The root removes the RPI and inserts a new RPI 1370 header addressed to the 6LR father of the RUL. 1372 The Figure 13 shows the table that summarizes what headers are needed 1373 for this use case. 1375 +---------+------+-------+-------+---------+-------+-------+ 1376 | Header | RUL | 6LR_1 | 6LR_ia| 6LBR |6LR_id | RUL | 1377 | | src | | | | | dst | 1378 | | node | | | | | node | 1379 +---------+------+-------+-------+---------+-------+-------+ 1380 | Inserted| -- |IP6-IP6|IP6-IP6| IP6-IP6 |IP6-IP6| -- | 1381 | headers | | (RPI )| (RPI) | (RPI2) | (RPI2)| | 1382 | | | | | | | | 1383 +---------+------+-------+-------+---------+-------+-------+ 1384 | Removed | -- | -- |IP6-IP6| IP6-IP6 |IP6-IP6| | 1385 | headers | | | (RPI) | (RPI1) | (RPI2)| | 1386 | | | | | | | | 1387 | | | | | | | | 1388 +---------+------+-------+-------+---------+-------+-------+ 1389 | Re-added| -- | -- | -- | -- | -- | -- | 1390 | headers | | | | | | | 1391 +---------+------+-------+-------+---------+-------+-------+ 1392 | Modified| -- | -- | | | | -- | 1393 | headers | | | | | | | 1394 | | | | | | | | 1395 +---------+------+-------+-------+---------+-------+-------+ 1396 |Untouched| -- | -- | -- | -- | -- | -- | 1397 | headers | | | | | | | 1398 +---------+------+-------+-------+---------+-------+-------+ 1400 Figure 13: SM: Summary of the use of headers from RUL to RUL 1402 8. Non Storing mode 1404 In Non Storing Mode (Non-SM) (fully source routed), the 6LBR (DODAG 1405 root) has complete knowledge about the connectivity of all DODAG 1406 nodes, and all traffic flows through the root node. Thus, there is 1407 no need for all nodes to know about the existence of RPL-unaware 1408 nodes. Only the 6LBR needs to act if compensation is necessary for 1409 not-RPL aware receivers. 1411 The table (Figure 14) summarizes what headers are needed in the 1412 following scenarios, and indicates when the RPI, RH3 and IPv6-in-IPv6 1413 header are to be inserted. It depicts the target destination address 1414 possible to a 6LN (indicated by "RAL"), to a 6LR (parent of a 6LN) or 1415 to the root. In cases where no IPv6-in-IPv6 header is needed, the 1416 column states as "No". There is no expectation on RPL that RPI can 1417 be omitted, because it is needed for routing, quality of service and 1418 compression. This specification expects that is always a RPI 1419 Present. 1421 The leaf can be a router 6LR or a host, both indicated as 6LN 1422 (Figure 6). In the table (Figure 14) the (1) indicates a 6tisch case 1423 [RFC8180], where the RPI header may still be needed for the 1424 instanceID to be available for priority/channel selection at each 1425 hop. 1427 +-----------------+--------------+-----+-----+------------+------------+ 1428 | Interaction | Use Case | RPI | RH3 |IPv6-in-IPv6|IPv6-in-IPv6| 1429 | between | | | | | dst | 1430 +-----------------+--------------+-----+-----+------------+------------+ 1431 | | RAL to root | Yes | No | No | No | 1432 + +--------------+-----+-----+------------+------------+ 1433 | Leaf - Root | root to RAL | Yes | Yes | No | No | 1434 + +--------------+-----+-----+------------+------------+ 1435 | | root to RUL | Yes | Yes | must | 6LR | 1436 | | | (1) | | | | 1437 + +--------------+-----+-----+------------+------------+ 1438 | | RUL to root | Yes | No | must | root | 1439 +-----------------+--------------+-----+-----+------------+------------+ 1440 | | RAL to Int | Yes | No | No | No | 1441 + +--------------+-----+-----+------------+------------+ 1442 | Leaf - Internet | Int to RAL | Yes | Yes | must | RAL | 1443 + +--------------+-----+-----+------------+------------+ 1444 | | RUL to Int | Yes | No | must | root | 1445 + +--------------+-----+-----+------------+------------+ 1446 | | Int to RUL | Yes | Yes | must | 6LR | 1447 +-----------------+--------------+-----+-----+------------+------------+ 1448 | | RAL to RAL | Yes | Yes | must | root/RAL | 1449 + +--------------+-----+-----+------------+------------+ 1450 | | RAL to RUL | Yes | Yes | must | root/6LR | 1451 + Leaf - Leaf +--------------+-----+-----+------------+------------+ 1452 | | RUL to RAL | Yes | Yes | must | root/RAL | 1453 + +--------------+-----+-----+------------+------------+ 1454 | | RUL to RUL | Yes | Yes | must | root/6LR | 1455 +-----------------+--------------+-----+-----+------------+------------+ 1457 Figure 14: Table that shows headers needed in Non-Storing mode: RPI, 1458 RH3, IPv6-in-IPv6 encapsulation. 1460 8.1. Non-Storing Mode: Interaction between Leaf and Root 1462 In this section is described the communication flow in Non Storing 1463 Mode (Non-SM) between, 1464 RAL to root 1466 root to RAL 1468 RUL to root 1470 root to RUL 1472 8.1.1. Non-SM: Example of Flow from RAL to root 1474 In non-storing mode the leaf node uses default routing to send 1475 traffic to the root. The RPI header must be included since it 1476 contains the rank information, which is used to avoid/detect loops. 1478 RAL (6LN) --> 6LR_i --> root(6LBR) 1480 For example, a communication flow could be: Node F --> Node D --> 1481 Node B --> Node A (root) 1483 6LR_i are the intermediate routers from source to destination. In 1484 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1485 packet goes through from source (RAL) to destination (6LBR). 1487 This situation is the same case as storing mode. 1489 The Table 7 summarizes what headers are needed for this use case. 1491 +-------------------+---------+-------+----------+ 1492 | Header | RAL src | 6LR_i | 6LBR dst | 1493 +-------------------+---------+-------+----------+ 1494 | Inserted headers | RPI | -- | -- | 1495 | Removed headers | -- | -- | RPI | 1496 | Re-added headers | -- | -- | -- | 1497 | Modified headers | -- | RPI | -- | 1498 | Untouched headers | -- | -- | -- | 1499 +-------------------+---------+-------+----------+ 1501 Table 7: Non-SM: Summary of the use of headers from RAL to root 1503 8.1.2. Non-SM: Example of Flow from root to RAL 1505 In this case the flow comprises: 1507 root (6LBR) --> 6LR_i --> RAL (6LN) 1509 For example, a communication flow could be: Node A (root) --> Node B 1510 --> Node D --> Node F 1511 6LR_i are the intermediate routers from source to destination. In 1512 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1513 packet goes through from source (6LBR) to destination (RAL). 1515 The 6LBR inserts an RH3, and a RPI header. No IPv6-in-IPv6 header is 1516 necessary as the traffic originates with an RPL aware node, the 6LBR. 1517 The destination is known to be RPL-aware because the root knows the 1518 whole topology in non-storing mode. 1520 The Table 8 summarizes what headers are needed for this use case. 1522 +-------------------+----------+-----------+-----------+ 1523 | Header | 6LBR src | 6LR_i | RAL dst | 1524 +-------------------+----------+-----------+-----------+ 1525 | Inserted headers | RPI, RH3 | -- | -- | 1526 | Removed headers | -- | -- | RH3, RPI | 1527 | Re-added headers | -- | -- | -- | 1528 | Modified headers | -- | RPI, RH3 | -- | 1529 | Untouched headers | -- | -- | -- | 1530 +-------------------+----------+-----------+-----------+ 1532 Table 8: Non-SM: Summary of the use of headers from root to RAL 1534 8.1.3. Non-SM: Example of Flow from root to RUL 1536 In this case the flow comprises: 1538 root (6LBR) --> 6LR_i --> RUL (IPv6 dst node) 1540 For example, a communication flow could be: Node A (root) --> Node B 1541 --> Node E --> Node G 1543 6LR_i are the intermediate routers from source to destination. In 1544 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1545 packet goes through from source (6LBR) to destination (RUL). 1547 In 6LBR the RH3 is added, it is modified at each intermediate 6LR 1548 (6LR_1 and so on) and it is fully consumed in the last 6LR (6LR_n), 1549 but left there. As the RPI is added, then the IPv6 node which does 1550 not understand the RPI, will ignore it (following RFC8200), thus 1551 encapsulation is not necessary. 1553 The Figure 15 depicts the table that summarizes what headers are 1554 needed for this use case. 1556 +-----------+----------+--------------+----------------+----------+ 1557 | Header | 6LBR | 6LR_i | 6LR_n | IPv6 | 1558 | | | i=(1,..,n-1) | |dst node | 1559 | | | | | (RUL) | 1560 +-----------+----------+--------------+----------------+----------+ 1561 | Inserted | RPI, RH3 | -- | -- | -- | 1562 | headers | | | | | 1563 +-----------+----------+--------------+----------------+----------+ 1564 | Removed | -- | -- | | -- | 1565 | headers | | | | | 1566 +-----------+----------+--------------+----------------+----------+ 1567 | Re-added | -- | -- | -- | -- | 1568 | headers | | | | | 1569 +-----------+----------+--------------+----------------+----------+ 1570 | Modified | -- | RPI, RH3 | RPI, | -- | 1571 | headers | | | RH3(consumed) | | 1572 +-----------+----------+--------------+----------------+----------+ 1573 | Untouched | -- | -- | -- | RPI, RH3 | 1574 | headers | | | | (both | 1575 | | | | | ignored) | 1576 +-----------+----------+--------------+----------------+----------+ 1578 Figure 15: Non-SM: Summary of the use of headers from root to RUL 1580 8.1.4. Non-SM: Example of Flow from RUL to root 1582 In this case the flow comprises: 1584 RUL (IPv6 src node) --> 6LR_1 --> 6LR_i --> root (6LBR) dst 1586 For example, a communication flow could be: Node G --> Node E --> 1587 Node B --> Node A (root) 1589 6LR_i are the intermediate routers from source to destination. In 1590 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1591 packet goes through from source (RUL) to destination (6LBR). For 1592 example, 6LR_1 (i=1) is the router that receives the packets from the 1593 IPv6 node. 1595 In this case the RPI is added by the first 6LR (6LR1) (Node E), 1596 encapsulated in an IPv6-in-IPv6 header, and is modified in the 1597 following 6LRs. The RPI and the entire packet is consumed by the 1598 root. 1600 The Figure 16 shows the table that summarizes what headers are needed 1601 for this use case. 1603 +---------+----+-----------------+-----------------+-----------------+ 1604 | |RUL | | | | 1605 | Header |src | 6LR_1 | 6LR_i | 6LBR dst | 1606 | |node| | | | 1607 +---------+----+-----------------+-----------------+-----------------+ 1608 | Inserted| -- |IPv6-in-IPv6(RPI)| -- | -- | 1609 | headers | | | | | 1610 +---------+----+-----------------+-----------------+-----------------+ 1611 | Removed | -- | -- | -- |IPv6-in-IPv6(RPI)| 1612 | headers | | | | | 1613 +---------+----+-----------------+-----------------+-----------------+ 1614 | Re-added| -- | -- | -- | -- | 1615 | headers | | | | | 1616 +---------+----+-----------------+-----------------+-----------------+ 1617 | Modified| -- | -- |IPv6-in-IPv6(RPI)| -- | 1618 | headers | | | | | 1619 +---------+----+-----------------+-----------------+-----------------+ 1620 |Untouched| -- | -- | -- | -- | 1621 | headers | | | | | 1622 +---------+----+-----------------+-----------------+-----------------+ 1624 Figure 16: Non-SM: Summary of the use of headers from RUL to root 1626 8.2. Non-Storing Mode: Interaction between Leaf and Internet 1628 This section will describe the communication flow in Non Storing Mode 1629 (Non-SM) between: 1631 RAL to Internet 1633 Internet to RAL 1635 RUL to Internet 1637 Internet to RUL 1639 8.2.1. Non-SM: Example of Flow from RAL to Internet 1641 In this case the flow comprises: 1643 RAL (6LN) src --> 6LR_i --> root (6LBR) --> Internet dst 1645 For example, a communication flow could be: Node F --> Node D --> 1646 Node B --> Node A --> Internet 1648 6LR_i are the intermediate routers from source to destination. In 1649 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1650 packet goes through from source (RAL) to 6LBR. 1652 This case is identical to storing-mode case. 1654 The IPv6 flow label should be set to zero to aid in compression 1655 [RFC8138], and the 6LBR will set it to a non-zero value when sending 1656 towards the Internet [RFC6437]. 1658 The Table 9 summarizes what headers are needed for this use case. 1660 +-------------------+---------+-------+------+----------------+ 1661 | Header | RAL src | 6LR_i | 6LBR | Internet dst | 1662 +-------------------+---------+-------+------+----------------+ 1663 | Inserted headers | RPI | -- | -- | -- | 1664 | Removed headers | -- | -- | -- | -- | 1665 | Re-added headers | -- | -- | -- | -- | 1666 | Modified headers | -- | RPI | -- | -- | 1667 | Untouched headers | -- | -- | RPI | RPI (Ignored) | 1668 +-------------------+---------+-------+------+----------------+ 1670 Table 9: Non-SM: Summary of the use of headers from RAL to Internet 1672 8.2.2. Non-SM: Example of Flow from Internet to RAL 1674 In this case the flow comprises: 1676 Internet --> root (6LBR) --> 6LR_i --> RAL dst (6LN) 1678 For example, a communication flow could be: Internet --> Node A 1679 (root) --> Node B --> Node D --> Node F 1681 6LR_i are the intermediate routers from source to destination. In 1682 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1683 packet goes through from 6LBR to destination (RAL). 1685 The 6LBR must add an RH3 header. As the 6LBR will know the path and 1686 address of the target node, it can address the IPv6-in-IPv6 header to 1687 that node. The 6LBR will zero the flow label upon entry in order to 1688 aid compression [RFC8138]. 1690 The Table 10 summarizes what headers are needed for this use case. 1692 +-----------+----------+--------------+--------------+--------------+ 1693 | Header | Internet | 6LBR | 6LR_i | RAL dst | 1694 | | src | | | | 1695 +-----------+----------+--------------+--------------+--------------+ 1696 | Inserted | -- | IPv6-in-IPv6 | -- | -- | 1697 | headers | | (RH3,RPI) | | | 1698 | Removed | -- | -- | -- | IPv6-in-IPv6 | 1699 | headers | | | | (RH3,RPI) | 1700 | Re-added | -- | -- | -- | -- | 1701 | headers | | | | | 1702 | Modified | -- | -- | IPv6-in-IPv6 | -- | 1703 | headers | | | (RH3,RPI) | | 1704 | Untouched | -- | -- | -- | -- | 1705 | headers | | | | | 1706 +-----------+----------+--------------+--------------+--------------+ 1708 Table 10: Non-SM: Summary of the use of headers from Internet to RAL 1710 8.2.3. Non-SM: Example of Flow from RUL to Internet 1712 In this case the flow comprises: 1714 RUL (IPv6 src node) --> 6LR_1 --> 6LR_i -->root (6LBR) --> Internet 1715 dst 1717 For example, a communication flow could be: Node G --> Node E --> 1718 Node B --> Node A --> Internet 1720 6LR_i are the intermediate routers from source to destination. In 1721 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1722 packet goes through from source (RUL) to 6LBR, e.g. 6LR_1 (i=1). 1724 In this case the flow label is recommended to be zero in the IPv6 1725 node. As RPL headers are added in the IPv6 node packet, the first 1726 6LR (6LR_1) will add a RPI header inside a new IPv6-in-IPv6 header. 1727 The IPv6-in-IPv6 header will be addressed to the root. This case is 1728 identical to the storing-mode case (see Section 7.2.3). 1730 The Figure 17 shows the table that summarizes what headers are needed 1731 for this use case. 1733 +---------+----+-------------+--------------+--------------+--------+ 1734 | Header |RUL | 6LR_1 | 6LR_i | 6LBR |Internet| 1735 | |src | | [i=2,..,n] | | dst | 1736 | |node| | | | | 1737 +---------+----+-------------+--------------+--------------+--------+ 1738 | Inserted| -- |IP6-IP6(RPI) | -- | -- | -- | 1739 | headers | | | | | | 1740 +---------+----+-------------+--------------+--------------+--------+ 1741 | Removed | -- | -- | -- | IP6-IP6(RPI) | -- | 1742 | headers | | | | | | 1743 +---------+----+-------------+--------------+--------------+--------+ 1744 | Re-added| -- | -- | -- | -- | -- | 1745 | headers | | | | | | 1746 +---------+----+-------------+--------------+--------------+--------+ 1747 | Modified| -- | -- | IP6-IP6(RPI) | -- | -- | 1748 | headers | | | | | | 1749 +---------+----+-------------+--------------+--------------+--------+ 1750 |Untouched| -- | -- | -- | -- | -- | 1751 | headers | | | | | | 1752 +---------+----+-------------+--------------+--------------+--------+ 1754 Figure 17: Non-SM: Summary of the use of headers from RUL to Internet 1756 8.2.4. Non-SM: Example of Flow from Internet to RUL 1758 In this case the flow comprises: 1760 Internet src --> root (6LBR) --> 6LR_i --> RUL (IPv6 dst node) 1762 For example, a communication flow could be: Internet --> Node A 1763 (root) --> Node B --> Node E --> Node G 1765 6LR_i are the intermediate routers from source to destination. In 1766 this case, "1 <= i <= n", n is the number of routers (6LR) that the 1767 packet goes through from 6LBR to RUL. 1769 The 6LBR must add an RH3 header inside an IPv6-in-IPv6 header. The 1770 6LBR will know the path, and will recognize that the final node is 1771 not an RPL capable node as it will have received the connectivity DAO 1772 from the nearest 6LR. The 6LBR can therefore make the IPv6-in-IPv6 1773 header destination be the last 6LR. The 6LBR will set to zero the 1774 flow label upon entry in order to aid compression [RFC8138]. 1776 The Figure 18 shows the table that summarizes what headers are needed 1777 for this use case. 1779 +---------+--------+-------------+--------------+--------------+-----+ 1780 | Header |Internet| 6LBR | 6LR_1 | 6lR_i |RUL | 1781 | | src | | | (i=2,...,n) |dst | 1782 | | | | | |node | 1783 +---------+--------+-------------+--------------+--------------+-----+ 1784 | Inserted| -- | IPv6-in-IPv6| -- | -- | -- | 1785 | headers | | (RH3,RPI) | | | | 1786 +---------+--------+-------------+--------------+--------------+-----+ 1787 | Removed | -- | -- | -- | IPv6-in-IPv6 | -- | 1788 | headers | | | | (RH3,RPI)[1] | | 1789 +---------+--------+-------------+--------------+--------------+-----+ 1790 | Re-added| -- | -- | -- | -- | -- | 1791 | headers | | | | | | 1792 +---------+--------+-------------+--------------+--------------+-----+ 1793 | Modified| -- | -- | IPv6-in-IPv6 | IPv6-in-IPv6 | -- | 1794 | headers | | | (RH3,RPI) | (RH3,RPI) | | 1795 +---------+--------+-------------+--------------+--------------+-----+ 1796 |Untouched| -- | -- | -- | -- | -- | 1797 | headers | | | | | | 1798 +---------+--------+-------------+--------------+--------------+-----+ 1800 Figure 18: Non-SM: Summary of the use of headers from Internet to RUL 1801 [1] The last 6LR before the IPv6 node. 1803 8.3. Non-SM: Interaction between Leafs 1805 In this section is described the communication flow in Non Storing 1806 Mode (Non-SM) between, 1808 RAL to RAL 1810 RAL to RUL 1812 RUL to RAL 1814 RUL to RUL 1816 8.3.1. Non-SM: Example of Flow from RAL to RAL 1818 In this case the flow comprises: 1820 RAL src --> 6LR_ia --> root (6LBR) --> 6LR_id --> RAL dst 1822 For example, a communication flow could be: Node F --> Node D --> 1823 Node B --> Node A (root) --> Node B --> Node E --> Node H 1824 6LR_ia are the intermediate routers from source to the root In this 1825 case, 1 <= ia <= n, n is the number of routers (6LR) that the packet 1826 goes through from RAL to the root. 1828 6LR_id are the intermediate routers from the root to the destination. 1829 In this case, "1 <= ia <= m", m is the number of the intermediate 1830 routers (6LR). 1832 This case involves only nodes in same RPL Domain. The originating 1833 node will add a RPI header to the original packet, and send the 1834 packet upwards. 1836 The originating node must put the RPI (RPI1) into an IPv6-in-IPv6 1837 header addressed to the root, so that the 6LBR can remove that 1838 header. If it does not, then additional resources are wasted on the 1839 way down to carry the useless RPI option. 1841 The 6LBR will need to insert an RH3 header, which requires that it 1842 add an IPv6-in-IPv6 header. It should be able to remove the 1843 RPI(RPI1), as it was contained in an IPv6-in-IPv6 header addressed to 1844 it. Otherwise, there may be a RPI header buried inside the inner IP 1845 header, which should get ignored. The root inserts a RPI (RPI2) 1846 alongside the RH3. 1848 Networks that use the RPL P2P extension [RFC6997] are essentially 1849 non-storing DODAGs and fall into this scenario or scenario 1850 Section 8.1.2, with the originating node acting as 6LBR. 1852 The Figure 19 shows the table that summarizes what headers are needed 1853 for this use case. 1855 +---------+------------+----------+------------+----------+------------+ 1856 | Header | RAL | 6LR_ia | 6LBR | 6LR_id | RAL | 1857 | | src | | | | dst | 1858 +---------+------------+----------+------------+----------+------------+ 1859 | Inserted|IPv6-in-IPv6| |IPv6-in-IPv6| -- | -- | 1860 | headers | (RPI1) | |(RH3-> RAL, | | | 1861 | | | | RPI2) | | | 1862 +---------+------------+----------+------------+----------+------------+ 1863 | Removed | -- | -- |IPv6-in-IPv6| -- |IPv6-in-IPv6| 1864 | headers | | | (RPI1) | | (RH3, | 1865 | | | | | | RPI2) | 1866 +---------+------------+----------+------------+----------+------------+ 1867 | Re-added| -- | -- | -- | -- | -- | 1868 | headers | | | | | | 1869 +---------+------------+----------+------------+----------+------------+ 1870 | Modified| -- |IP6-in-IP6| -- |IP6-in-IP6| -- | 1871 | headers | | (RPI1) | | (RPI2) | | 1872 +---------+------------+----------+------------+----------+------------+ 1873 |Untouched| -- | -- | -- | -- | -- | 1874 | headers | | | | | | 1875 +---------+------------+----------+------------+----------+------------+ 1877 Figure 19: Non-SM: Summary of the use of headers for RAL to RAL. 1878 IP6-in-IP6 refers to IPv6-in-IPv6. 1880 8.3.2. Non-SM: Example of Flow from RAL to RUL 1882 In this case the flow comprises: 1884 RAL --> 6LR_ia --> root (6LBR) --> 6LR_id --> RUL (IPv6 dst node) 1886 For example, a communication flow could be: Node F --> Node D --> 1887 Node B --> Node A (root) --> Node B --> Node E --> Node G 1889 6LR_ia are the intermediate routers from source to the root In this 1890 case, 1 <= ia <= n, n is the number of intermediate routers (6LR) 1892 6LR_id are the intermediate routers from the root to the destination. 1893 In this case, "1 <= ia <= m", m is the number of the intermediate 1894 routers (6LRs). 1896 As in the previous case, the RAL (6LN) will insert a RPI (RPI_1) 1897 header which must be in an IPv6-in-IPv6 header addressed to the root 1898 so that the 6LBR can remove this RPI. The 6LBR will then insert an 1899 RH3 inside a new IPv6-in-IPv6 header addressed to the last 6LR_id 1900 (6LR_id = m). 1902 The Figure 20 shows the table that summarizes what headers are needed 1903 for this use case. 1905 +-----------+---------+---------+---------+---------+---------+------+ 1906 | Header | RAL | 6LR_ia | 6LBR | 6LR_id | 6LR_m | RUL | 1907 | | src | | | | | dst | 1908 | | node | | | | | node | 1909 +-----------+---------+---------+---------+---------+---------+------+ 1910 | Inserted | IP6-IP6 | | IP6-IP6 | -- | -- | -- | 1911 | headers | (RPI1) | | (RH3, | | | | 1912 | | | | RPI2) | | | | 1913 +-----------+---------+---------+---------+---------+---------+------+ 1914 | Removed | -- | -- | IP6-IP6 | -- | IP6-IP6 | -- | 1915 | headers | | | (RPI1) | | (RH3, | | 1916 | | | | | | RPI2) | | 1917 +-----------+---------+---------+---------+---------+---------+------+ 1918 | Re-added | -- | -- | -- | -- | -- | -- | 1919 | headers | | | | | | | 1920 +-----------+---------+---------+---------+---------+---------+------+ 1921 | Modified | -- | IP6-IP6 | -- | IP6-IP6 | | -- | 1922 | headers | | (RPI1) | | (RH3, | | | 1923 | | | | | RPI2) | | | 1924 +-----------+---------+---------+---------+---------+---------+------+ 1925 | Untouched | -- | -- | -- | -- | -- | -- | 1926 | headers | | | | | | | 1927 +-----------+---------+---------+---------+---------+---------+------+ 1929 Figure 20: Non-SM: Summary of the use of headers from RAL to RUL. 1931 8.3.3. Non-SM: Example of Flow from RUL to RAL 1933 In this case the flow comprises: 1935 RUL (IPv6 src node) --> 6LR_1 --> 6LR_ia --> root (6LBR) --> 6LR_id 1936 --> RAL dst (6LN) 1938 For example, a communication flow could be: Node G --> Node E --> 1939 Node B --> Node A (root) --> Node B --> Node E --> Node H 1941 6LR_ia are the intermediate routers from source to the root. In this 1942 case, 1 <= ia <= n, n is the number of intermediate routers (6LR) 1944 6LR_id are the intermediate routers from the root to the destination. 1945 In this case, "1 <= ia <= m", m is the number of the intermediate 1946 routers (6LR). 1948 This scenario is mostly identical to the previous one. The RPI 1949 (RPI1) is added by the first 6LR (6LR_1) inside an IPv6-in-IPv6 1950 header addressed to the root. The 6LBR will remove this RPI, and add 1951 it's own IPv6-in-IPv6 header containing an RH3 header and an RPI 1952 (RPI2). 1954 The Figure 21 shows the table that summarizes what headers are needed 1955 for this use case. 1957 +-----------+------+---------+---------+---------+---------+---------+ 1958 | Header | RUL | 6LR_1 | 6LR_ia | 6LBR | 6LR_id | RAL | 1959 | | src | | | | | dst | 1960 | | node | | | | | node | 1961 +-----------+------+---------+---------+---------+---------+---------+ 1962 | Inserted | -- | IP6-IP6 | -- | IP6-IP6 | -- | -- | 1963 | headers | | (RPI1) | | (RH3, | | | 1964 | | | | | RPI2) | | | 1965 +-----------+------+---------+---------+---------+---------+---------+ 1966 | Removed | -- | | -- | IP6-IP6 | -- | IP6-IP6 | 1967 | headers | | | | (RPI1) | | (RH3, | 1968 | | | | | | | RPI2) | 1969 +-----------+------+---------+---------+---------+---------+---------+ 1970 | Re-added | -- | | -- | -- | -- | -- | 1971 | headers | | | | | | | 1972 +-----------+------+---------+---------+---------+---------+---------+ 1973 | Modified | -- | | IP6-IP6 | -- | IP6-IP6 | -- | 1974 | headers | | | (RPI1) | | (RH3, | | 1975 | | | | | | RPI2) | | 1976 +-----------+------+---------+---------+---------+---------+---------+ 1977 | Untouched | -- | | -- | -- | -- | -- | 1978 | headers | | | | | | | 1979 +-----------+------+---------+---------+---------+---------+---------+ 1981 Figure 21: Non-SM: Summary of the use of headers from RUL to RAL. 1983 8.3.4. Non-SM: Example of Flow from RUL to RUL 1985 In this case the flow comprises: 1987 RUL (IPv6 src node) --> 6LR_1 --> 6LR_ia --> root (6LBR) --> 6LR_id 1988 --> RUL (IPv6 dst node) 1990 For example, a communication flow could be: Node G --> Node E --> 1991 Node B --> Node A (root) --> Node C --> Node J 1993 6LR_ia are the intermediate routers from source to the root. In this 1994 case, 1 <= ia <= n, n is the number of intermediate routers (6LR) 1995 6LR_id are the intermediate routers from the root to the destination. 1996 In this case, "1 <= ia <= m", m is the number of the intermediate 1997 routers (6LR). 1999 This scenario is the combination of the previous two cases. 2001 The Figure 22 shows the table that summarizes what headers are needed 2002 for this use case. 2004 +---------+------+-------+-------+---------+-------+---------+------+ 2005 | Header | RUL | 6LR_1 | 6LR_ia| 6LBR |6LR_id | 6LR_m | RUL | 2006 | | src | | | | | | dst | 2007 | | node | | | | | | node | 2008 +---------+------+-------+-------+---------+-------+---------+------+ 2009 | Inserted| -- |IP6-IP6| -- | IP6-IP6 | -- | -- | -- | 2010 | headers | | (RPI1)| | (RH3, | | | | 2011 | | | | | RPI2) | | | | 2012 +---------+------+-------+-------+---------+-------+---------+------+ 2013 | Removed | -- | -- | -- | IP6-IP6 | -- | IP6-IP6 | -- | 2014 | headers | | | | (RPI1) | | (RH3, | | 2015 | | | | | | | RPI2) | | 2016 +---------+------+-------+-------+---------+-------+---------+------+ 2017 | Re-added| -- | -- | -- | -- | -- | -- | -- | 2018 | headers | | | | | | | | 2019 +---------+------+-------+-------+---------+-------+---------+------+ 2020 | Modified| -- | -- |IP6-IP6| -- |IP6-IP6| -- | -- | 2021 | headers | | | (RPI1)| | (RH3, | | | 2022 | | | | | | RPI2)| | | 2023 +---------+------+-------+-------+---------+-------+---------+------+ 2024 |Untouched| -- | -- | -- | -- | -- | -- | -- | 2025 | headers | | | | | | | | 2026 +---------+------+-------+-------+---------+-------+---------+------+ 2028 Figure 22: Non-SM: Summary of the use of headers from RUL to RUL 2030 9. Operational Considerations of supporting RUL-leaves 2032 Roughly half of the situations described in this document involve 2033 leaf ("host") nodes that do not speak RPL. These nodes fall into two 2034 further categories: ones that drop a packet that have RPI or RH3 2035 headers, and ones that continue to process a packet that has RPI and/ 2036 or RH3 headers. 2038 [RFC8200] provides for new rules that suggest that nodes that have 2039 not been configured (explicitly) to examine Hop-by-Hop headers, 2040 should ignore those headers, and continue processing the packet. 2041 Despite this, and despite the switch from 0x63 to 0x23, there may be 2042 hosts that are pre-RFC8200, or simply intolerant. Those hosts will 2043 drop packets that continue to have RPL artifacts in them. In 2044 general, such hosts can not be easily supported in RPL LLNs. 2046 There are some specific cases where it is possible to remove the RPL 2047 artifacts prior to forwarding the packet to the leaf host. The 2048 critical thing is that the artifacts have been inserted by the RPL 2049 root inside an IPv6-in-IPv6 header, and that the header has been 2050 addressed to the 6LR immediately prior to the leaf node. In that 2051 case, in the process of removing the IPv6-in-IPv6 header, the 2052 artifacts can also be removed. 2054 The above case occurs whenever traffic originates from the outside 2055 the LLN (the "Internet" cases above), and non-storing mode is used. 2056 In non-storing mode, the RPL root knows the exact topology (as it 2057 must be create the RH3 header), and therefore knows what the 6LR 2058 prior to the leaf. For example, in Figure 5, node E is the 6LR prior 2059 to the leaf node G, or node C is the 6LR prior to the leaf node J. 2061 traffic originating from the RPL root (such as when the data 2062 collection system is co-located on the RPL root), does not require an 2063 IPv6-in-IPv6 header (in either mode), as the packet is originating at 2064 the root, and the root can insert the RPI and RH3 headers directly 2065 into the packet, as it is formed. Such a packet is slightly smaller, 2066 but only can be sent to nodes (whether RPL aware or not), that will 2067 tolerate the RPL artifacts. 2069 An operator that finds itself with a lot of traffic from the RPL root 2070 to RPL-not-aware-leaves, will have to do IPv6-in-IPv6 encapsulation 2071 if the leaf is not tolerant of the RPL artifacts. Such an operator 2072 could otherwise omit this unnecessary header if it was certain of the 2073 properties of the leaf. 2075 As storing mode can not know the final path of the traffic, 2076 intolerant (that drop packets with RPL artifacts) leaf nodes can not 2077 be supported. 2079 10. Operational considerations of introducing 0x23 2081 This section describes the operational considerations of introducing 2082 the new RPI value of 0x23. 2084 During bootstrapping the node gets the DIO with the information of 2085 RPL Option Type, indicating the new RPI in the DODAG Configuration 2086 Option Flag. The DODAG root is in charge to configure the current 2087 network to the new value, through DIO messages and when all the nodes 2088 are set with the new value. The DODAG should change to a new DODAG 2089 version. In case of rebooting, the node does not remember the RPL 2090 Option Type. Thus, the DIO is sent with a flag indicating the new 2091 RPI value. 2093 The DODAG Configuration option is contained in a RPL DIO message, 2094 which contains a unique DTSN counter. The leaf nodes respond to this 2095 message with DAO messages containing the same DTSN. This is a normal 2096 part of RPL routing; the RPL root therefore knows when the updated 2097 DODAG Configuration Option has been seen by all nodes. 2099 Before the migration happens, all the RPL-aware nodes should support 2100 both values . The migration procedure it is triggered when the DIO 2101 is sent with the flag indicating the new RPI value. Namely, it 2102 remains at 0x63 until it is sure that the network is capable of 0x23, 2103 then it abruptly change to 0x23. This options allows to send packets 2104 to not-RPL nodes, which should ignore the option and continue 2105 processing the packets. 2107 In case that a node join to a network that only process 0x63, it 2108 would produce a flag day as was mentioned previously. Indicating the 2109 new RPI in the DODAG Configuration Option Flag is a way to avoid the 2110 flag day in a network. It is recommended that a network process both 2111 options to enable interoperability. 2113 11. IANA Considerations 2115 This document updates the registration made in [RFC6553] Destination 2116 Options and Hop-by-Hop Options registry from 0x63 to 0x23 as shown in 2117 Figure 23. 2119 +-------+-------------------+------------------------+---------- -+ 2120 | Hex | Binary Value | Description | Reference | 2121 + Value +-------------------+ + + 2122 | | act | chg | rest | | | 2123 +-------+-----+-----+-------+------------------------+------------+ 2124 | 0x23 | 00 | 1 | 00011 | RPL Option |[RFCXXXX](*)| 2125 +-------+-----+-----+-------+------------------------+------------+ 2126 | 0x63 | 01 | 1 | 00011 | RPL Option(DEPRECATED) | [RFC6553] | 2127 | | | | | |[RFCXXXX](*)| 2128 +-------+-----+-----+-------+------------------------+------------+ 2130 Figure 23: Option Type in RPL Option.(*)represents this document 2132 DODAG Configuration option is updated as follows (Figure 24): 2134 +------------+-----------------+---------------+ 2135 | Bit number | Description | Reference | 2136 +------------+-----------------+---------------+ 2137 | 3 | RPI 0x23 enable | This document | 2138 +------------+-----------------+---------------+ 2140 Figure 24: DODAG Configuration Option Flag to indicate the RPI-flag- 2141 day. 2143 12. Security Considerations 2145 The security considerations covered in [RFC6553] and [RFC6554] apply 2146 when the packets are in the RPL Domain. 2148 The IPv6-in-IPv6 mechanism described in this document is much more 2149 limited than the general mechanism described in [RFC2473]. The 2150 willingness of each node in the LLN to decapsulate packets and 2151 forward them could be exploited by nodes to disguise the origin of an 2152 attack. 2154 While a typical LLN may be a very poor origin for attack traffic (as 2155 the networks tend to be very slow, and the nodes often have very low 2156 duty cycles) given enough nodes, they could still have a significant 2157 impact, particularly if attack is targeting another LLN. 2158 Additionally, some uses of RPL involve large backbone ISP scale 2159 equipment [I-D.ietf-anima-autonomic-control-plane], which may be 2160 equipped with multiple 100Gb/s interfaces. 2162 Blocking or careful filtering of IPv6-in-IPv6 traffic entering the 2163 LLN as described above will make sure that any attack that is mounted 2164 must originate from compromised nodes within the LLN. The use of 2165 BCP38 [BCP38] filtering at the RPL root on egress traffic will both 2166 alert the operator to the existence of the attack, as well as drop 2167 the attack traffic. As the RPL network is typically numbered from a 2168 single prefix, which is itself assigned by RPL, BCP38 filtering 2169 involves a single prefix comparison and should be trivial to 2170 automatically configure. 2172 There are some scenarios where IPv6-in-IPv6 traffic should be allowed 2173 to pass through the RPL root, such as the IPv6-in-IPv6 mediated 2174 communications between a new Pledge and the Join Registrar/ 2175 Coordinator (JRC) when using [I-D.ietf-anima-bootstrapping-keyinfra] 2176 and [I-D.ietf-6tisch-dtsecurity-secure-join]. This is the case for 2177 the RPL root to do careful filtering: it occurs only when the Join 2178 Coordinator is not co-located inside the RPL root. 2180 With the above precautions, an attack using IPv6-in-IPv6 tunnels can 2181 only be by a node within the LLN on another node within the LLN. 2182 Such an attack could, of course, be done directly. An attack of this 2183 kind is meaningful only if the source addresses are either fake or if 2184 the point is to amplify return traffic. Such an attack, could also 2185 be done without the use of IPv6-in-IPv6 headers using forged source 2186 addresses. If the attack requires bi-directional communication, then 2187 IPv6-in-IPv6 provides no advantages. 2189 Whenever IPv6-in-IPv6 headers are being proposed, there is a concern 2190 about creating security issues. In the security section of 2191 [RFC2473], it was suggested that tunnel entry and exit points can be 2192 secured, via "Use IPsec". This recommendation is not practical for 2193 RPL networks. [RFC5406] goes into some detail on what additional 2194 details would be needed in order to "Use IPsec". Use of ESP would 2195 prevent RFC8183 compression (compression must occur before 2196 encryption), and RFC8183 compression is lossy in a way that prevents 2197 use of AH. These are minor issues. The major issue is how to 2198 establish trust enough such that IKEv2 could be used. This would 2199 require a system of certificates to be present in every single node, 2200 including any Internet nodes that might need to communicate with the 2201 LLN. Thus, "Use IPsec" requires a global PKI in the general case. 2203 More significantly, the use of IPsec tunnels to protect the IPv6-in- 2204 IPv6 headers would in the general case scale with the square of the 2205 number of nodes. This is a lot of resource for a constrained nodes 2206 on a constrained network. In the end, the IPsec tunnels would be 2207 providing only BCP38-like origin authentication! That is, IPsec 2208 provides a transitive guarantee to the tunnel exit point that the 2209 tunnel entry point did BCP38 on traffic going in. Just doing BCP38 2210 origin filtering at the entry and exit of the LLN provides a similar 2211 level amount of security without all the scaling and trust problems 2212 of using IPsec as RFC2473 suggested. IPsec is not recommended. 2214 An LLN with hostile nodes within it would not be protected against 2215 impersonation with the LLN by entry/exit filtering. 2217 The RH3 header usage described here can be abused in equivalent ways 2218 (to disguise the origin of traffic and attack other nodes) with an 2219 IPv6-in-IPv6 header to add the needed RH3 header. As such, the 2220 attacker's RH3 header will not be seen by the network until it 2221 reaches the end host, which will decapsulate it. An end-host should 2222 be suspicious about a RH3 header which has additional hops which have 2223 not yet been processed, and SHOULD ignore such a second RH3 header. 2225 In addition, the LLN will likely use [RFC8138] to compress the IPv6- 2226 in-IPv6 and RH3 headers. As such, the compressor at the RPL-root 2227 will see the second RH3 header and MAY choose to discard the packet 2228 if the RH3 header has not been completely consumed. A consumed 2229 (inert) RH3 header could be present in a packet that flows from one 2230 LLN, crosses the Internet, and enters another LLN. As per the 2231 discussion in this document, such headers do not need to be removed. 2232 However, there is no case described in this document where an RH3 is 2233 inserted in a non-storing network on traffic that is leaving the LLN, 2234 but this document should not preclude such a future innovation. It 2235 should just be noted that an incoming RH3 must be fully consumed, or 2236 very carefully inspected. 2238 The RPI header, if permitted to enter the LLN, could be used by an 2239 attacker to change the priority of a packet by selecting a different 2240 RPLInstanceID, perhaps one with a higher energy cost, for instance. 2241 It could also be that not all nodes are reachable in an LLN using the 2242 default instanceID, but a change of instanceID would permit an 2243 attacker to bypass such filtering. Like the RH3, a RPI header is to 2244 be inserted by the RPL root on traffic entering the LLN by first 2245 inserting an IPv6-in-IPv6 header. The attacker's RPI header 2246 therefore will not be seen by the network. Upon reaching the 2247 destination node the RPI header has no further meaning and is just 2248 skipped; the presence of a second RPI header will have no meaning to 2249 the end node as the packet has already been identified as being at 2250 it's final destination. 2252 The RH3 and RPI headers could be abused by an attacker inside of the 2253 network to route packets on non-obvious ways, perhaps eluding 2254 observation. This usage is in fact part of [RFC6997] and can not be 2255 restricted at all. This is a feature, not a bug. 2257 [RFC7416] deals with many other threats to LLNs not directly related 2258 to the use of IPv6-in-IPv6 headers, and this document does not change 2259 that analysis. 2261 Nodes within the LLN can use the IPv6-in-IPv6 mechanism to mount an 2262 attack on another part of the LLN, while disguising the origin of the 2263 attack. The mechanism can even be abused to make it appear that the 2264 attack is coming from outside the LLN, and unless countered, this 2265 could be used to mount a Distributed Denial Of Service attack upon 2266 nodes elsewhere in the Internet. See [DDOS-KREBS] for an example of 2267 such attacks already seen in the real world. 2269 If an attack comes from inside of LLN, it can be alleviated with SAVI 2270 (Source Address Validation Improvement) using [RFC8505] with 2271 [I-D.ietf-6lo-ap-nd]. The attacker will not be able to source 2272 traffic with an address that is not registered, and the registration 2273 process checks for topological correctness. Notice that there is an 2274 L2 authentication in most of the cases. If an attack comes from 2275 outside LLN IPv6-in- IPv6 can be used to hide inner routing headers, 2276 but by construction, the RH3 can typically only address nodes within 2277 the LLN. That is, a RH3 with a CmprI less than 8 , should be 2278 considered an attack (see RFC6554, section 3). 2280 Nodes outside of the LLN will need to pass IPv6-in-IPv6 traffic 2281 through the RPL root to perform this attack. To counter, the RPL 2282 root SHOULD either restrict ingress of IPv6-in-IPv6 packets (the 2283 simpler solution), or it SHOULD walk the IP header extension chain 2284 until it can inspect the upper-layer-payload as described in 2285 [RFC7045]. In particular, the RPL root SHOULD do [BCP38] processing 2286 on the source addresses of all IP headers that it examines in both 2287 directions. 2289 Note: there are some situations where a prefix will spread across 2290 multiple LLNs via mechanisms such as the one described in 2291 [I-D.ietf-6lo-backbone-router]. In this case the BCP38 filtering 2292 needs to take this into account, either by exchanging detailed 2293 routing information on each LLN, or by moving the BCP38 filtering 2294 further towards the Internet, so that the details of the multiple 2295 LLNs do not matter. 2297 13. Acknowledgments 2299 This work is done thanks to the grant given by the StandICT.eu 2300 project. 2302 A special BIG thanks to C. M. Heard for the help with the 2303 Section 4. Much of the redaction in that section is based on his 2304 comments. 2306 Additionally, the authors would like to acknowledge the review, 2307 feedback, and comments of (alphabetical order): Robert Cragie, Simon 2308 Duquennoy, Ralph Droms, Cenk Guendogan, Rahul Jadhav, Benjamin Kaduk, 2309 Matthias Kovatsch, Charlie Perkins, Alvaro Retana, Peter van der 2310 Stok, Xavier Vilajosana, Eric Vyncke and Thomas Watteyne. 2312 14. References 2314 14.1. Normative References 2316 [BCP38] Ferguson, P. and D. Senie, "Network Ingress Filtering: 2317 Defeating Denial of Service Attacks which employ IP Source 2318 Address Spoofing", BCP 38, RFC 2827, DOI 10.17487/RFC2827, 2319 May 2000, . 2321 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 2322 Requirement Levels", BCP 14, RFC 2119, 2323 DOI 10.17487/RFC2119, March 1997, 2324 . 2326 [RFC6040] Briscoe, B., "Tunnelling of Explicit Congestion 2327 Notification", RFC 6040, DOI 10.17487/RFC6040, November 2328 2010, . 2330 [RFC6282] Hui, J., Ed. and P. Thubert, "Compression Format for IPv6 2331 Datagrams over IEEE 802.15.4-Based Networks", RFC 6282, 2332 DOI 10.17487/RFC6282, September 2011, 2333 . 2335 [RFC6550] Winter, T., Ed., Thubert, P., Ed., Brandt, A., Hui, J., 2336 Kelsey, R., Levis, P., Pister, K., Struik, R., Vasseur, 2337 JP., and R. Alexander, "RPL: IPv6 Routing Protocol for 2338 Low-Power and Lossy Networks", RFC 6550, 2339 DOI 10.17487/RFC6550, March 2012, 2340 . 2342 [RFC6553] Hui, J. and JP. Vasseur, "The Routing Protocol for Low- 2343 Power and Lossy Networks (RPL) Option for Carrying RPL 2344 Information in Data-Plane Datagrams", RFC 6553, 2345 DOI 10.17487/RFC6553, March 2012, 2346 . 2348 [RFC6554] Hui, J., Vasseur, JP., Culler, D., and V. Manral, "An IPv6 2349 Routing Header for Source Routes with the Routing Protocol 2350 for Low-Power and Lossy Networks (RPL)", RFC 6554, 2351 DOI 10.17487/RFC6554, March 2012, 2352 . 2354 [RFC7045] Carpenter, B. and S. Jiang, "Transmission and Processing 2355 of IPv6 Extension Headers", RFC 7045, 2356 DOI 10.17487/RFC7045, December 2013, 2357 . 2359 [RFC8025] Thubert, P., Ed. and R. Cragie, "IPv6 over Low-Power 2360 Wireless Personal Area Network (6LoWPAN) Paging Dispatch", 2361 RFC 8025, DOI 10.17487/RFC8025, November 2016, 2362 . 2364 [RFC8138] Thubert, P., Ed., Bormann, C., Toutain, L., and R. Cragie, 2365 "IPv6 over Low-Power Wireless Personal Area Network 2366 (6LoWPAN) Routing Header", RFC 8138, DOI 10.17487/RFC8138, 2367 April 2017, . 2369 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2370 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 2371 May 2017, . 2373 [RFC8200] Deering, S. and R. Hinden, "Internet Protocol, Version 6 2374 (IPv6) Specification", STD 86, RFC 8200, 2375 DOI 10.17487/RFC8200, July 2017, 2376 . 2378 [RFC8504] Chown, T., Loughney, J., and T. Winters, "IPv6 Node 2379 Requirements", BCP 220, RFC 8504, DOI 10.17487/RFC8504, 2380 January 2019, . 2382 14.2. Informative References 2384 [DDOS-KREBS] 2385 Goodin, D., "Record-breaking DDoS reportedly delivered by 2386 >145k hacked cameras", September 2016, 2387 . 2390 [I-D.ietf-6lo-ap-nd] 2391 Thubert, P., Sarikaya, B., Sethi, M., and R. Struik, 2392 "Address Protected Neighbor Discovery for Low-power and 2393 Lossy Networks", draft-ietf-6lo-ap-nd-12 (work in 2394 progress), April 2019. 2396 [I-D.ietf-6lo-backbone-router] 2397 Thubert, P., Perkins, C., and E. Levy-Abegnoli, "IPv6 2398 Backbone Router", draft-ietf-6lo-backbone-router-13 (work 2399 in progress), September 2019. 2401 [I-D.ietf-6tisch-dtsecurity-secure-join] 2402 Richardson, M., "6tisch Secure Join protocol", draft-ietf- 2403 6tisch-dtsecurity-secure-join-01 (work in progress), 2404 February 2017. 2406 [I-D.ietf-anima-autonomic-control-plane] 2407 Eckert, T., Behringer, M., and S. Bjarnason, "An Autonomic 2408 Control Plane (ACP)", draft-ietf-anima-autonomic-control- 2409 plane-20 (work in progress), July 2019. 2411 [I-D.ietf-anima-bootstrapping-keyinfra] 2412 Pritikin, M., Richardson, M., Eckert, T., Behringer, M., 2413 and K. Watsen, "Bootstrapping Remote Secure Key 2414 Infrastructures (BRSKI)", draft-ietf-anima-bootstrapping- 2415 keyinfra-29 (work in progress), October 2019. 2417 [I-D.ietf-intarea-tunnels] 2418 Touch, J. and M. Townsley, "IP Tunnels in the Internet 2419 Architecture", draft-ietf-intarea-tunnels-10 (work in 2420 progress), September 2019. 2422 [I-D.ietf-roll-unaware-leaves] 2423 Thubert, P. and M. Richardson, "Routing for RPL Leaves", 2424 draft-ietf-roll-unaware-leaves-06 (work in progress), 2425 November 2019. 2427 [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 2428 (IPv6) Specification", RFC 2460, DOI 10.17487/RFC2460, 2429 December 1998, . 2431 [RFC2473] Conta, A. and S. Deering, "Generic Packet Tunneling in 2432 IPv6 Specification", RFC 2473, DOI 10.17487/RFC2473, 2433 December 1998, . 2435 [RFC4443] Conta, A., Deering, S., and M. Gupta, Ed., "Internet 2436 Control Message Protocol (ICMPv6) for the Internet 2437 Protocol Version 6 (IPv6) Specification", STD 89, 2438 RFC 4443, DOI 10.17487/RFC4443, March 2006, 2439 . 2441 [RFC5406] Bellovin, S., "Guidelines for Specifying the Use of IPsec 2442 Version 2", BCP 146, RFC 5406, DOI 10.17487/RFC5406, 2443 February 2009, . 2445 [RFC6437] Amante, S., Carpenter, B., Jiang, S., and J. Rajahalme, 2446 "IPv6 Flow Label Specification", RFC 6437, 2447 DOI 10.17487/RFC6437, November 2011, 2448 . 2450 [RFC6775] Shelby, Z., Ed., Chakrabarti, S., Nordmark, E., and C. 2451 Bormann, "Neighbor Discovery Optimization for IPv6 over 2452 Low-Power Wireless Personal Area Networks (6LoWPANs)", 2453 RFC 6775, DOI 10.17487/RFC6775, November 2012, 2454 . 2456 [RFC6997] Goyal, M., Ed., Baccelli, E., Philipp, M., Brandt, A., and 2457 J. Martocci, "Reactive Discovery of Point-to-Point Routes 2458 in Low-Power and Lossy Networks", RFC 6997, 2459 DOI 10.17487/RFC6997, August 2013, 2460 . 2462 [RFC7102] Vasseur, JP., "Terms Used in Routing for Low-Power and 2463 Lossy Networks", RFC 7102, DOI 10.17487/RFC7102, January 2464 2014, . 2466 [RFC7416] Tsao, T., Alexander, R., Dohler, M., Daza, V., Lozano, A., 2467 and M. Richardson, Ed., "A Security Threat Analysis for 2468 the Routing Protocol for Low-Power and Lossy Networks 2469 (RPLs)", RFC 7416, DOI 10.17487/RFC7416, January 2015, 2470 . 2472 [RFC8180] Vilajosana, X., Ed., Pister, K., and T. Watteyne, "Minimal 2473 IPv6 over the TSCH Mode of IEEE 802.15.4e (6TiSCH) 2474 Configuration", BCP 210, RFC 8180, DOI 10.17487/RFC8180, 2475 May 2017, . 2477 [RFC8505] Thubert, P., Ed., Nordmark, E., Chakrabarti, S., and C. 2478 Perkins, "Registration Extensions for IPv6 over Low-Power 2479 Wireless Personal Area Network (6LoWPAN) Neighbor 2480 Discovery", RFC 8505, DOI 10.17487/RFC8505, November 2018, 2481 . 2483 Authors' Addresses 2485 Maria Ines Robles 2486 Aalto University, Finland - / - Universidad Tecnologica Nacional - Facultad Regional Mendoza, Argentina 2488 Email: mariainesrobles@gmail.com 2490 Michael C. Richardson 2491 Sandelman Software Works 2492 470 Dawson Avenue 2493 Ottawa, ON K1Z 5V7 2494 CA 2496 Email: mcr+ietf@sandelman.ca 2497 URI: http://www.sandelman.ca/mcr/ 2499 Pascal Thubert 2500 Cisco Systems, Inc 2501 Building D 2502 45 Allee des Ormes - BP1200 2503 MOUGINS - Sophia Antipolis 06254 2504 FRANCE 2506 Phone: +33 497 23 26 34 2507 Email: pthubert@cisco.com