idnits 2.17.1 draft-irtf-icnrg-icntraceroute-06.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** There are 2 instances of too long lines in the document, the longest one being 66 characters in excess of 72. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (3 May 2022) is 724 days in the past. Is this intentional? Checking references for intended status: Experimental ---------------------------------------------------------------------------- == Outdated reference: A later version (-15) exists of draft-irtf-icnrg-ccninfo-08 == Outdated reference: A later version (-07) exists of draft-oran-icnrg-pathsteering-01 Summary: 1 error (**), 0 flaws (~~), 3 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 ICNRG S. Mastorakis 3 Internet-Draft University of Nebraska at Omaha 4 Intended status: Experimental J. Gibson 5 Expires: 4 November 2022 Cisco Systems 6 I. Moiseenko 7 Apple Inc 8 R. Droms 9 Unaffiliated 10 D. Oran 11 Network Systems Research and Design 12 3 May 2022 14 ICN Traceroute Protocol Specification 15 draft-irtf-icnrg-icntraceroute-06 17 Abstract 19 This document presents the design of an ICN Traceroute protocol. 20 This includes the operation of both the client and the forwarder. 21 This document is a product of the IRTF Information-Centric Networking 22 Research Group (ICNRG). 24 Status of This Memo 26 This Internet-Draft is submitted in full conformance with the 27 provisions of BCP 78 and BCP 79. 29 Internet-Drafts are working documents of the Internet Engineering 30 Task Force (IETF). Note that other groups may also distribute 31 working documents as Internet-Drafts. The list of current Internet- 32 Drafts is at https://datatracker.ietf.org/drafts/current/. 34 Internet-Drafts are draft documents valid for a maximum of six months 35 and may be updated, replaced, or obsoleted by other documents at any 36 time. It is inappropriate to use Internet-Drafts as reference 37 material or to cite them other than as "work in progress." 39 This Internet-Draft will expire on 4 November 2022. 41 Copyright Notice 43 Copyright (c) 2022 IETF Trust and the persons identified as the 44 document authors. All rights reserved. 46 This document is subject to BCP 78 and the IETF Trust's Legal 47 Provisions Relating to IETF Documents (https://trustee.ietf.org/ 48 license-info) in effect on the date of publication of this document. 49 Please review these documents carefully, as they describe your rights 50 and restrictions with respect to this document. 52 Table of Contents 54 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 55 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 56 2. Background on IP-Based Traceroute Operation . . . . . . . . . 3 57 3. Traceroute Functionality Challenges and Opportunities in 58 ICN . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 59 4. ICN Traceroute CCNx Packet Format . . . . . . . . . . . . . . 6 60 4.1. ICN Traceroute Request CCNx Packet Format . . . . . . . . 6 61 4.2. Traceroute Reply CCNx Packet Format . . . . . . . . . . . 8 62 5. ICN Traceroute NDN Packet Format . . . . . . . . . . . . . . 12 63 5.1. ICN Traceroute Request NDN Packet Format . . . . . . . . 12 64 5.2. Traceroute Reply NDN Packet Format . . . . . . . . . . . 13 65 6. Forwarder Operation . . . . . . . . . . . . . . . . . . . . . 14 66 7. Protocol Operation For Locally-Scoped Namespaces . . . . . . 15 67 8. Security Considerations . . . . . . . . . . . . . . . . . . . 16 68 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17 69 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 17 70 10.1. Normative References . . . . . . . . . . . . . . . . . . 17 71 10.2. Informative References . . . . . . . . . . . . . . . . . 17 72 Appendix A. Traceroute Client Application (Consumer) 73 Operation . . . . . . . . . . . . . . . . . . . . . . . . 18 74 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 19 76 1. Introduction 78 In TCP/IP, routing and forwarding are based on IP addresses. To 79 ascertain the route to an IP address and to measure the transit 80 delays, the traceroute utility is commonly used. In ICN, routing and 81 forwarding are based on name prefixes. To this end, the problem of 82 ascertaining the characteristics (i.e., transit forwarders and 83 delays) of at least one of the available routes to a name prefix is a 84 fundamendal requirement for instumentation and network management. 86 In order to carry out meaningful experimentation and deployment of 87 ICN protocols, tools to manage and debug the operation of ICN 88 architectures and protocols are needed analogous to ping and 89 traceroute used for TCP/IP. This document describes the design of a 90 management and debugging protocol analogous to the traceroute 91 protocol of TCP/IP, which will aid the experimental deployment of ICN 92 protocols. As the community continues its experimentation with ICN 93 architectures and protocols, the design of ICN Traceroute might 94 change accordingly. ICN Traceroute is designed as a tool to 95 troubleshoot ICN architectures and protocols. As such, this document 96 is classified as an experimental RFC. 98 This document is not an Internet Standards Track specification; it is 99 published for examination, experimental implementation, and 100 evaluation. This document defines an Experimental Protocol for the 101 Internet community. This document is a product of the Internet 102 Research Task Force (IRTF). The IRTF publishes the results of 103 Internet-related research and development activities. These results 104 might not be suitable for deployment. This RFC represents the 105 consensus of the Information-Centric Networking Research Group of the 106 Internet Research Task Force (IRTF). Documents approved for 107 publication by the IRSG are not candidates for any level of Internet 108 Standard; see Section 2 of RFC 7841. 110 1.1. Requirements Language 112 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 113 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 114 document are to be interpreted as described in [RFC2119]. 116 2. Background on IP-Based Traceroute Operation 118 In IP-based networks, traceroute is based on the expiration of the 119 Time To Live (TTL) IP header field. Specifically, a traceroute 120 client sends consecutive packets (depending on the implementation and 121 the user-specified behavior such packets can be either UDP datagrams, 122 ICMP Echo Request or TCP SYN packets) with a TTL value increased by 123 1, essentially performing a expanding ring search. In this way, the 124 first IP packet sent will expire at the first router along the path, 125 the second IP packet at the second router along the path, etc, until 126 the router (or host) with the specified destination IP address is 127 reached. Each router along the path towards the destination, 128 responds by sending back an ICMP Time Exceeded packet, unless 129 explicitly prevented from doing so by a security policy. 131 The IP-based traceroute utility operates on IP addresses, and in 132 particular depends on the IP packets having source IP addresses that 133 are used as the destination address for replies. Given that ICN 134 forwards based on names rather than destination IP addresses, that 135 the names do not refer to unique endpoints (multi-destination), and 136 that the packets do not contain source addresses, a substantially 137 different approach is needed. 139 3. Traceroute Functionality Challenges and Opportunities in ICN 141 In the NDN and CCN protocols, the communication paradigm is based 142 exclusively on named objects. An Interest is forwarded across the 143 network based on its name. Eventually, it retrieves a content object 144 either from a producer application or some forwarder's Content Store 145 (CS). 147 An ICN network differs from an IP network in at least 4 important 148 ways: 150 * IP identifies interfaces to an IP network with a fixed-length 151 address, and delivers IP packets to one or more interfaces. ICN 152 identifies units of data in the network with a variable length 153 name consisting of a hierarchical list of components. 155 * An IP-based network depends on the IP packets having source IP 156 addresses that are used as the destination address for replies. 157 On the other hand, ICN Interests do not have source addresses and 158 they are forwarded based on names, which do not refer to a unique 159 end-point. Data packets follow the reverse path of the Interests 160 based on hop-by-hop state created during Interest forwarding. 162 * An IP network supports multi-path, single destination, stateless 163 packet forwarding and delivery via unicast, a limited form of 164 multi-destination selected delivery with anycast, and group-based 165 multi-destination delivery via multicast. In contrast, ICN 166 supports multi-path and multi-destination stateful Interest 167 forwarding and multi-destination data delivery to units of named 168 data. This single forwarding semantic subsumes the functions of 169 unicast, anycast, and multicast. As a result, consecutive (or 170 retransmitted) ICN Interest messages may be forwarded through an 171 ICN network along different paths, and may be forwarded to 172 different data sources (e.g., end-node applications, in-network 173 storage) holding a copy of the requested unit of data. The 174 ability to discover multiple available (or potentially all) paths 175 towards a name prefix is a desirable capability for an ICN 176 traceroute protocol, since it can be beneficial for congestion 177 control purposes. Knowing the number of available paths for a 178 name can also be useful in cases that Interest forwarding based on 179 application semantics/preferences is desirable. 181 * In the case of multiple Interests with the same name arriving at a 182 forwarder, a number of Interests may be aggregated in a common 183 Pending Interest Table (PIT) entry. Depending on the lifetime of 184 a PIT entry, the round-trip time an Interest-Data exchange might 185 significantly vary (e.g., it might be shorter than the full round- 186 trip time to reach the original content producer). To this end, 187 the round-trip time experienced by consumers might also vary even 188 under constant network load. 190 These differences introduce new challenges, new opportunities and new 191 requirements in the design of ICN traceroute. Following this 192 communication model, a traceroute client should be able to express 193 traceroute requests directed to a name prefix and receive responses. 195 Our goals are the following: 197 * Trace one or more paths towards an ICN forwarder (for 198 troubleshooting purposes). 200 * Trace one or more paths along which an named data of an 201 application can be reached in the sense that Interest packets can 202 be forwarded toward it. 204 * Test whether a specific named object is cached in some on-path CS, 205 and, if so, trace the path towards it and return the identity of 206 the corresponding forwarder. 208 * Perform transit delay network measurements. 210 To this end, a traceroute target name can represent: 212 * An administrative name that has been assigned to a forwarder. 213 Assigning a name to a forwarder implies the presence of a 214 management application running locally, which handles Operations, 215 Administration and Management (OAM) operations. 217 * A name that includes an application's namespace as a prefix. 219 * A named object that might reside in some in-network storage. 221 In order to provide stable and reliable diagnostics, it is desirable 222 that the packet encoding of a traceroute request enable the 223 forwarders to distinguish this request from a normal Interest, while 224 also preserving forwarding behavior as similar as possible to that 225 for an Interest packet. In the same way, the encoding of a 226 traceroute reply should allow for processing as similar as possible 227 to that of a data packet by the forwarders. 229 The term "traceroute session" is used for an iterative process during 230 which an endpoint client application generates a number of traceroute 231 requests to successively traverse more distant hops in the path until 232 it receives a final traceroute reply from a forwarder. It is 233 desirable that ICN traceroute be able to discover a number of paths 234 towards the expressed prefix within the same session or subsequent 235 sessions. To discover all the hops in a path, we need a mechanism 236 (Interest Steering) to steer requests along different paths. Such a 237 capability was initially published in [PATHSTEERING] and has been 238 specified for CCNx in [I-D.oran-icnrg-pathsteering]. 240 It is also important, in the case of traceroute requests for the same 241 prefix from different sources, to have a mechanism to avoid 242 aggregating those requests in the PIT. To this end, we need some 243 encoding in the traceroute requests to make each request for a common 244 prefix unique, and hence avoid PIT aggregation and further enabling 245 the exact matching of a response with a particular traceroute packet. 247 The packet types and format are presented in Section 4. The 248 procedures, e.g. the procedures for determining and indicating that a 249 destination has been reached, are specified in Section 6. 251 4. ICN Traceroute CCNx Packet Format 253 In this section, we present the CCNx packet format [RFC8609] of ICN 254 traceroute, where messages exist within outermost containments 255 (packets). Specifically, we propose two types of traceroute packets, 256 a traceroute request and a traceroute reply packet type. 258 4.1. ICN Traceroute Request CCNx Packet Format 260 The format of the traceroute request packet is presented below: 262 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 264 +---------------+---------------+---------------+---------------+ 265 | | | | 266 | Version | TrRequest | PacketLength | 267 | | | | 268 +---------------+---------------+---------------+---------------+ 269 | | | | | 270 | HopLimit | Reserved | Flags | HeaderLength | 271 | | | | | 272 +---------------+---------------+---------------+---------------+ 273 / / 274 / Path label TLV / 275 / / 276 +---------------+---------------+---------------+---------------+ 277 | | 278 | Traceroute Request Message TLVs | 279 | | 280 +---------------+---------------+---------------+---------------+ 282 Figure 1: Traceroute Request CCNx Packet Format 284 The existing packet header fields have similar functionality to the 285 header fields of a CCNx Interest packet. The value of the packet 286 type field is TrRequest. The exact numeric value of this field type 287 is to be assigned in the Packet Type IANA Registry for CCNx (see 288 section 4.1 of [RFC8609]. 290 Compared to the typical format of a CCNx packet header [RFC8609], 291 there is a new optional fixed header added to the packet header: 293 * A Path Steering hop-by-hop header TLV, which is constructed hop- 294 by-hop in the traceroute reply and included in the traceroute 295 request to steer consecutive requests expressed by a client 296 towards a common or different forwarding paths. The Path label 297 TLV is specified in [I-D.oran-icnrg-pathsteering] 299 The message of a traceroute request is presented below: 301 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 303 +---------------+---------------+---------------+---------------+ 304 | | | 305 | MessageType = 1 | MessageLength | 306 | | | 307 +---------------+---------------+---------------+---------------+ 308 | | 309 | Name TLV | 310 | | 311 +---------------+---------------+---------------+---------------+ 313 Figure 2: Traceroute Request Message Format 315 The traceroute request message is of type Interest in order to 316 leverage the Interest forwarding behavior provided by the network. 317 The Name TLV has the structure described in [RFC8609]. The name 318 consists of the target (destination) prefix appended with a nonce 319 typed name component as its last component (to avoid Interest 320 aggregation and allow exact matching of requests with responses). 321 The value of this TLV is a 64-bit nonce. 323 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 325 +---------------+---------------+---------------+---------------+ 326 | | | 327 | Name_Nonce_Type | Name_Nonce_Length = 8 | 328 | | | 329 +---------------+---------------+---------------+---------------+ 330 | | 331 | | 332 | | 333 | Name_Nonce_Value | 334 | | 335 | | 336 +---------------+---------------+---------------+---------------+ 338 Figure 3: Name Nonce Typed Component TLV 340 4.2. Traceroute Reply CCNx Packet Format 342 The format of a traceroute reply packet is presented below: 344 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 346 +---------------+---------------+---------------+---------------+ 347 | | | | 348 | Version | TrReply | PacketLength | 349 | | | | 350 +---------------+---------------+---------------+---------------+ 351 | | | | 352 | Reserved | Flags | HeaderLength | 353 | | | | 354 +---------------+---------------+---------------+---------------+ 355 | | 356 | Path label TLV | 357 | | 358 +---------------+---------------+---------------+---------------+ 359 | | 360 | Traceroute Reply Message TLVs | 361 | | 362 +---------------+---------------+---------------+---------------+ 364 Figure 4: Traceroute Reply CCNx Packet Format 366 The header of a traceroute reply consists of the header fields of a 367 CCNx Content Object and a hop-by-hop path steering TLV. The value of 368 the packet type field is TrReply. The exact numeric value of this 369 field type is to be assigned in the Packet Type IANA Registry for 370 CCNx (see section 4.1 of [RFC8609]. 372 A traceroute reply message is of type Content Object, contains a Name 373 TLV (name of the corresponding traceroute request), a PayloadType TLV 374 and an ExpiryTime TLV with a value of 0 to indicate that replies must 375 not be returned from network caches. 377 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 379 +---------------+---------------+---------------+---------------+ 380 | | | 381 | MessageType = 2 | MessageLength | 382 | | | 383 +---------------+---------------+---------------+---------------+ 384 | | 385 | Name TLV | 386 | | 387 +---------------+---------------+---------------+---------------+ 388 | | 389 | PayloadType TLV | 390 | | 391 +---------------+---------------+---------------+---------------+ 392 | | 393 | ExpiryTime TLV | 394 | | 395 +---------------+---------------+---------------+---------------+ 397 Figure 5: Traceroute Reply Message Format 399 The PayloadType TLV is presented below. It is of type 400 T_PAYLOADTYPE_DATA, and the data schema consists of 3 TLVs: 402 1) the name of the sender of this reply (with the same structure as 403 a CCNx Name TLV), 405 2) the sender's signature of their own name (with the same structure 406 as a CCNx ValidationPayload TLV), 408 3) a TLV with return codes to indicate whether the request was 409 satisfied due to the existence of a local application, a CS hit 410 or a match with a forwarder's name, or the HopLimit value of the 411 corresponding request reached 0. 413 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 415 +---------------+---------------+---------------+---------------+ 416 | | | 417 | T_PAYLOADTYPE_DATA | Length | 418 | | | 419 +---------------+---------------+---------------+---------------+ 420 | | 421 | Sender's Name TLV | 422 | | 423 +---------------+---------------+---------------+---------------+ 424 | | 425 | Sender's Signature TLV | 426 | | 427 +---------------+---------------+---------------+---------------+ 428 | | 429 | TrReply Code TLV | 430 | | 431 +---------------+---------------+---------------+---------------+ 433 Figure 6: Traceroute Reply Message Format 435 The goal of including the name of the sender in the reply is to 436 enable the user to reach this entity directly to ask for further 437 management/administrative information using generic Interest-Data 438 exchanges or by employing a more comprehensive management tool such 439 as CCNInfo [I-D.irtf-icnrg-ccninfo] after a successful verification 440 of the sender's name. 442 The structure of the TrReply Code TLV is presented below (16-bit 443 value). The assigned values are the following: 445 1: Indicates that the target name matched the administrative name of 446 a forwarder (as served by its internal management application). 448 2: Indicates that the target name matched a prefix served by an 449 application (other than the internal management application of a 450 forwarder). 452 3: Indicates that the target name matched the name of an object in a 453 forwarder's CS. 455 4: Indicates that the the Hop limit reached the 0 value. 457 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 459 +---------------+---------------+---------------+---------------+ 460 | | | 461 | TrReply_Code_Type | TrReply_Code_Length = 2 | 462 | | | 463 +---------------+---------------+---------------+---------------+ 464 | | 465 | TrReply_Code_Value | 466 +---------------+---------------+---------------+---------------+ 468 Figure 7: TrReply Code TLV 470 5. ICN Traceroute NDN Packet Format 472 In this section, we present the ICN traceroute Request and Reply 473 Format according to the NDN packet specification [NDNTLV]. 475 5.1. ICN Traceroute Request NDN Packet Format 477 A traceroute request is encoded as an NDN Interest packet. Its 478 format is the following: 480 TracerouteRequest = INTEREST-TYPE TLV-LENGTH 481 Name 482 MustBeFresh 483 Nonce 484 HopLimit 485 ApplicationParameters? 487 Figure 8: Traceroute Request NDN Packet Format 489 The name of a request consists of the target name, a nonce value (it 490 can be the value of the Nonce field) and the suffix "traceroute" to 491 denote that this Interest is a traceroute request (added as a 492 KeywordNameComponent). When the "ApplicationParameters" element is 493 present, a ParametersSha256DigestComponent is added as the last name 494 component. 496 The "ApplicationParameters" field of the Request contains the a Path 497 label TLV as specified in [I-D.oran-icnrg-pathsteering]. 499 Since the NDN packet format does not provide a mechanism to prevent 500 the network from caching specific data packets, we instead use the 501 MustBeFresh selector for requests (in combination with a Freshness 502 Period TLV of value 1 for replies) to avoid fetching cached 503 traceroute replies with a freshness period that has expired 504 [REALTIME]. 506 5.2. Traceroute Reply NDN Packet Format 508 A traceroute reply is encoded as an NDN Data packet. Its format is 509 the following: 511 TracerouteReply = DATA-TLV TLV-LENGTH 512 Name 513 MetaInfo 514 Content 515 Signature 516 Path label TLV 518 Figure 9: Traceroute Reply NDN Packet Format 520 Compared to the format of a regular NDN Data packet, a traceroute 521 reply contains a Path label TLV field, which is not included in the 522 security envelope, since it might be modified in a hop-by-hop fashion 523 by the forwarders along the reverse path. 525 The name of a traceroute reply is the name of the corresponding 526 traceroute request, while the format of the MetaInfo field is the 527 following: 529 MetaInfo = META-INFO-TYPE TLV-LENGTH 530 ContentType 531 FreshnessPeriod 533 Figure 10: MetaInfo TLV 535 The value of the ContentType TLV is 0. The value of the 536 FreshnessPeriod TLV is 1, so that the replies are treated as stale 537 data (almost instantly) as they are received by a forwarder. 539 The content of a traceroute reply consists of the following 2 TLVs: 540 Sender's name (an NDN Name TLV) and Traceroute Reply Code. There is 541 no need to have a separate TLV for the sender's signature in the 542 content of the reply, since every NDN data packet carries the 543 signature of the data producer. 545 The Traceroute Reply Code TLV format is the following (with the 546 values specified in Section 4.2): 548 TrReplyCode = TRREPLYCODE-TLV-TYPE TLV-LENGTH 2*OCTET 550 Figure 11: Traceroute Reply Code TLV 552 6. Forwarder Operation 554 When a forwarder receives a traceroute request, the hop limit value 555 is checked and decremented and the target name (i.e, the name of the 556 traceroute request without the last nonce name component as well as 557 the suffix "traceroute" and the ParametersSha256DigestComponent in 558 the case of a request with the NDN packet format) is extracted. 560 If the HopLimit has not expired (its value is greater than 0), the 561 forwarder will forward the request upstream based on CS lookup, PIT 562 creation, LPM lookup and the path steering value, if present. If no 563 valid next-hop is found, an InterestReturn indicating "No Route" in 564 the case of CCNx or a network NACK in the case of NDN is sent 565 downstream. 567 If the HopLimit value is equal to zero, the forwarder generates a 568 traceroute reply. This reply includes the forwarder's administrative 569 name and signature, and a Path label TLV. This TLV initially has a 570 null value since the traceroute reply originator does not forward the 571 request and, thus, does not make a path choice. The reply will also 572 include the corresponding TrReply Code TLV. 574 A traceroute reply will be the final reply of a traceroute session if 575 any of the following conditions are met: 577 * If a forwarder has been given one or more administrative names, 578 the target name matches one of them. 580 * The target name exactly matches the name of a content-object 581 residing in the forwarder's CS (unless the traceroute client 582 application has chosen not to receive replies due to CS hits as 583 specified in Appendix A). 585 * The target name matches (in a Longest Prefix Match manner) a FIB 586 entry with an outgoing face referring to a local application. 588 The TrReply Code TLV value of the reply is set to indicate the 589 specific condition that was met. If none of those conditions was 590 met, the TrReply Code is set to 4 to indicate that the hop limit 591 value reached 0. 593 A received traceroute reply will be matched to an existing PIT entry 594 as usual. On the reverse path, the path steering TLV of a reply will 595 be updated by each forwarder to encode its choice of next-hop(s). 596 When included in subsequent requests, this path steering TLV allows 597 the forwarders to steer the requests along the same path. 599 7. Protocol Operation For Locally-Scoped Namespaces 601 In this section, we elaborate on 2 alternative design approaches in 602 cases that the traceroute target prefix corresponds to a locally- 603 scoped namespace not directly routable from the client's local 604 network. 606 The first approach leverages the NDN Link Object [SNAMP]. 607 Specifically, the traceroute client attaches to the expressed request 608 a LINK Object that contains a number of routable name prefixes, based 609 on which the request can be forwarded across the Internet until it 610 reaches a network region, where the request name itself is routable. 611 A LINK Object is created and signed by a data producer allowed to 612 publish data under a locally-scoped namespace. The way that a client 613 retrieves a LINK Object depends on various network design factors and 614 is out of the scope of the current draft. 616 Based on the current deployment of the LINK Object by the NDN team, a 617 forwarder at the border of the region, where an Interest name becomes 618 routable has to remove the LINK Object from the incoming Interests. 619 The Interest state maintained along the entire forwarding path is 620 based on the Interest name regardless of whether it was forwarded 621 based on this name or a prefix in the LINK Object. 623 The second approach is based on prepending a routable prefix to the 624 locally-scoped name. The resulting prefix will be the name of the 625 traceroute requests expressed by the client. In this way, a request 626 will be forwarded based on the routable part of its name. When it 627 reaches the network region where the original locally-scoped name is 628 routable, the border forwarder rewrites the request name and deletes 629 its routable part. There are two conditions for a forwarder to 630 perform this rewriting operation on a request: 632 1) the routable part of the request name matches a routable name of 633 the network region adjacent to the forwarder (assuming that a 634 forwarder is aware of those names), and 636 2) the remaining part of the request name is routable across the 637 network region of this forwarder. 639 The state maintained along the path, where the locally-scoped name is 640 not routable, is based on the routable prefix along with the locally- 641 scoped prefix, while within the network region that the locally- 642 scoped prefix is routable is based only on it. To ensure that the 643 generated replies will reach the client, the border forwarder has 644 also to rewrite the name of a reply and prepend the routable prefix 645 of the corresponding request. 647 8. Security Considerations 649 A reflection attack could occur in the case of a traceroute reply 650 with the CCNx packet format if a compromised forwarder includes in 651 the reply the name of a victim forwarder. This could redirect the 652 future administrative traffic towards the victim. To foil such 653 reflection attacks, the forwarder that generates a traceroute reply 654 MUST sign the name included in the payload. In this way, the client 655 is able to verify that the included name is legitimate and refers to 656 the forwarder that generated the reply. Alternatively, the forwarder 657 could include in the reply payload their routable prefix(es) encoded 658 as a signed NDN Link Object [SNAMP]. 660 This approach does not protect against on-path attacks, where a 661 compromised forwarder that receives a traceroute reply replaces the 662 forwarder's name and the signature in the message with its own name 663 and signature to make the client believe that the reply was generated 664 by the compromised forwarder. To foil such attack scenarios, a 665 forwarder can sign the reply message itself. In such cases, the 666 forwarder does not have to sign its own name in reply message, since 667 the message signature protects the message as a whole and will be 668 invalidated in the case of an on-path attack. 670 Signing each traceroute reply message can be expensive and can 671 potentially lead to computation attacks against forwarders. To 672 mitigate such attack scenarios, the processing of traceroute requests 673 and the generation of the replies SHOULD be handled by a separate 674 management application running locally on each forwarder. Serving 675 traceroute replies therefore is thereby separated from load on the 676 forwarder itself. The approaches used by ICN applications to manage 677 load may also apply to the forwarder's management application. 679 Interest flooding attack amplification is possible in the case of the 680 second approach to deal with locally-scoped namespaces described in 681 Section 7. A border forwarder will have to maintain extra state to 682 prepend the correct routable prefix to the name of an outgoing reply, 683 since the forwarder might be attached to multiple network regions 684 (reachable under different prefixes) or a network region attached to 685 this forwarder might be reachable under multiple routable prefixes. 687 We also note that traceroute requests have the same privacy 688 characteristics as regular Interests. 690 9. IANA Considerations 692 The exact numeric values of the field types of Traceroute requests 693 and Traceroute replies are to be assigned in the Packet Type IANA 694 Registry for CCNx (see section 4.1 of [RFC8569]. 696 10. References 698 10.1. Normative References 700 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 701 Requirement Levels", BCP 14, RFC 2119, 702 DOI 10.17487/RFC2119, March 1997, 703 . 705 [RFC8569] Mosko, M., Solis, I., and C. Wood, "Content-Centric 706 Networking (CCNx) Semantics", RFC 8569, 707 DOI 10.17487/RFC8569, July 2019, 708 . 710 [RFC8609] Mosko, M., Solis, I., and C. Wood, "Content-Centric 711 Networking (CCNx) Messages in TLV Format", RFC 8609, 712 DOI 10.17487/RFC8609, July 2019, 713 . 715 10.2. Informative References 717 [I-D.irtf-icnrg-ccninfo] 718 Asaeda, H., Ooka, A., and X. Shao, "CCNinfo: Discovering 719 Content and Network Information in Content-Centric 720 Networks", Work in Progress, Internet-Draft, draft-irtf- 721 icnrg-ccninfo-08, 27 July 2021, 722 . 725 [I-D.oran-icnrg-pathsteering] 726 Moiseenko, I. and D. Oran, "Path Steering in CCNx and 727 NDN", Work in Progress, Internet-Draft, draft-oran-icnrg- 728 pathsteering-01, 23 April 2020, 729 . 732 [NDNTLV] "NDN Packet Format Specification.", 2021, 733 . 735 [PATHSTEERING] 736 Moiseenko, I. and D. Oran, "Path switching in content 737 centric and named data networks", in Proceedings of the 738 4th ACM Conference on Information-Centric Networking, 739 2017. 741 [REALTIME] Mastorakis, S., Gusev, P., Afanasyev, A., and L. Zhang, 742 "Real-Time Data Retrieval in Named Data Networking", in 743 Proceedings of the 1st IEEE International Conference on 744 Hot Topics in Information-Centric Networking, 2017. 746 [SNAMP] Afanasyev, A. and , "SNAMP: Secure namespace mapping to 747 scale NDN forwarding", IEEE Conference on Computer 748 Communications Workshops (INFOCOM WKSHPS), 2015. 750 Appendix A. Traceroute Client Application (Consumer) Operation 752 This section is an informative appendix regarding the proposed 753 traceroute client operation. 755 The client application is responsible for generating traceroute 756 requests for prefixes provided by users. 758 The overall process can be iterative: the first traceroute request of 759 each session will have a HopLimit of value 1 to reach the first hop 760 forwarder, the second of value 2 to reach the second hop forwarder 761 and so on and so forth. 763 When generating a series of requests for a specific name, the first 764 one will typically not include a Path label TLV, since no TLV value 765 is known. After a traceroute reply containing a Path label TLV is 766 received, each subsequent request might include the received path 767 steering value in the Path label header TLV to drive the requests 768 towards a common path as part of checking the network performance. 769 To discover more paths, a client can omit the Path label TLV in 770 future requests. Moreover, for each new traceroute request, the 771 client has to generate a new nonce and record the time that the 772 request was expressed. It will also set the lifetime of a request, 773 which will have semantics similar to the lifetime of an Interest. 775 Moreover, the client application might not wish to receive replies 776 due to CS hits. In CCNx, a mechanism to achieve that would be to use 777 a Content Object Hash Restriction TLV with a value of 0 in the 778 payload of a traceroute request message. In NDN, the exclude filter 779 selector can be used. 781 When it receives a traceroute reply, the client would typically match 782 the reply to a sent request and compute the round-trip time of the 783 request. It should parse the Path label value and decode the reply's 784 payload to parse the sender's name and signature. The client should 785 verify that both the received message and the forwarder's name have 786 been signed by the key of the forwarder, whose name is included in 787 the payload of the reply (by fetching this forwarder's public key and 788 verifying the contained signature). In the case that the client 789 receives an TrReply Code TLV with a valid value, it can stop sending 790 requests with increasing HopLimit values and potentially start a new 791 traceroute session. 793 In the case that a traceroute reply is not received for a request 794 within a certain time interval (lifetime of the request), the client 795 should time-out and send a new request with a new nonce value up to a 796 maximum number of requests to be sent specified by the user. 798 Authors' Addresses 800 Spyridon Mastorakis 801 University of Nebraska at Omaha 802 Omaha, NE 803 United States of America 804 Email: smastorakis@unomaha.edu 806 Jim Gibson 807 Cisco Systems 808 Cambridge, MA 809 United States of America 810 Email: gibson@cisco.com 812 Ilya Moiseenko 813 Apple Inc 814 Cupertino, CA 815 United States of America 816 Email: iliamo@mailbox.org 818 Ralph Droms 819 Unaffiliated 820 Hopkinton, MA 821 United States of America 822 Email: rdroms.ietf@gmail.com 823 Dave Oran 824 Network Systems Research and Design 825 Cambridge, MA 826 United States of America 827 Email: daveoran@orandom.net