RFC 6436

Rationale for Update to the IPv6 Flow Label Specification

📅 published November 2011, from ietf

Rationale for Update to the IPv6 Flow Label Specification 🎀

Heads up, bestie: this is the Internet Engineering Task Force (IETF) doc, RFC 6436 💅. It was written by S. Amante (Level 3), B. Carpenter (Univ. of Auckland), and S. Jiang (Huawei). It's dated November 2011, it's Informational (so not a Standards Track spec 🌸), and its ISSN is 2070-1721. It doesn't obsolete anything, and it doesn't formally update RFC 3697. It's more of a "here's why we should update RFC 3697" kind of doc 🧚

Abstract ✨

Okay so, a bunch of published proposals for using the IPv6 flow label don't fit the original spec in RFC 3697 😭. And honestly? Almost nobody uses the flow label, partly because people aren't totally sure how the spec is supposed to be read 🙈. This doc talks through why and proposes changes to clarify the spec and give it some more flexibility. It's giving glow-up 💖

Status of This Memo ✨

Quick vibe check: this is not an Internet Standards Track specification. It's published just for info 🦋

It's a product of the IETF, so it reflects what the IETF community agreed on. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you're curious 👀

For the latest status, errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc6436 🔗

Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved 🌈

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Please read them carefully, because they explain your rights and restrictions for this doc 📜

Code Components pulled out of this doc must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 💜

Table of Contents 🧚

1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
2.  Impact of Current Specification  . . . . . . . . . . . . . . .  3
3.  Changes to the Specification . . . . . . . . . . . . . . . . .  6
4.  Discussion . . . . . . . . . . . . . . . . . . . . . . . . . .  8
5.  Security Considerations  . . . . . . . . . . . . . . . . . . .  9
6.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . .  9
7.  Informative References . . . . . . . . . . . . . . . . . . . . 10
Appendix A.  Alternative Approaches  . . . . . . . . . . . . . . . 12

1. Introduction 🦋

Okay, so the flow label field in the IPv6 header was reserved but left Experimental by [RFC2460]. That RFC only says this, and I'm quoting it exactly 🎀:

"Hosts or routers that do not support the functions of the Flow Label field are required to set the field to zero when originating a packet, pass the field on unchanged when forwarding a packet, and ignore the field when receiving a packet."

The flow label field got its real, normative spec from [RFC3697] 💅. The three rules that matter most from that RFC are:

a. "The Flow Label value set by the source MUST be delivered unchanged to the destination node(s)."

b. "IPv6 nodes MUST NOT assume any mathematical or other properties of the Flow Label values assigned by source nodes."

c. "Router performance SHOULD NOT be dependent on the distribution of the Flow Label values. Especially, the Flow Label bits alone make poor material for a hash key."

Here's the tea ☕: RFC 3697 doesn't say how a host should pick a default flow label value when no specific method is in use 🙈. People figured there'd be signaling methods for agreeing on values, but none got standardized, except for a pre-existing option in RSVP [RFC2205] 😬.

The flow label is barely used in real-world IPv6 setups, though some operating systems do set it [McGann05] 💖. Part of that is because everyone's focused on just getting IPv6 deployed. But the lack of a default way to choose a value means most host implementations just set it to zero 0️⃣. There's also anecdotal evidence that those rules above have left people unsure about what's actually allowed ✨. And a bunch of proposed use cases break one rule or another. None of those proposals made it to a standard, and there isn't any significant deployment of a mechanism to set the flow label 🥀.

This doc is here to explain the situation in more detail and to motivate changes to RFC 3697. The goal is to clear up the confusion and encourage actual use of the flow label 🌈. It does not formally update RFC 3697. It's background reading for [RFC6437] 🫶

to be continued, part 2 is coming next 💜✨

2. Impact of Current Specification ✨

okay so rule (a) basically makes it impossible for the routing system to use the flow label as any kind of dynamic routing tag 🙃 this was a deliberate choice back in the early days of IPv6, and there's no realistic way to revisit it now, since IPv6 is deployed with the same conventional routing mechanisms we use for IPv4 🌸 but here's the catch: this rule also makes it impossible to use the flow label at all unless hosts choose to set it 😭 and it forbids clearing the flow label for security reasons 💀

this last point is where the security story gets messy 🔒 the flow label field is always unprotected as it travels through the network. there's no IPv6 header checksum, and the flow label isn't included in transport pseudo-header checksums or IPsec checksums either 🫠 so intentional and malicious changes to its value can't be detected. it could also be used as a covert data channel, since apparently pseudo-random flow label values could actually be carrying covert data [NIST] 👀 and if the flow label ever carried quality-of-service semantics, it would be just like the diffserv code point [RFC2474] and wouldn't be intrinsically trustworthy across domain boundaries 🚩 so some security specialists think flow labels should be cleared for safety [LABEL-SEC] [NSA] 🛡️ these points must be considered whenever we talk about the immutability of the flow label across domain boundaries 🧐

ngl the word "immutable" is confusing 🙈 it implies a property the flow label field doesn't actually have, so it was abandoned as a descriptive term in [RFC6437]. it only shows up in this document to explain why it was dropped 💅

rule (b) seems to forbid any usage where the bits of the flow label carry a specific semantic meaning 👀 but the words "MUST NOT assume" need to be read very precisely. if a router knows, either by configuration or by signaling, that the flow label was assigned in a certain way, it's allowed to use that knowledge ✨ the rule doesn't make clear that there's an implied difference between stateless models (no signaling, so no specific assumption about what the flow label value means can be made) and stateful models (there is signaling, so the router has explicit knowledge about the label) 🧩

if the word "alone" gets overlooked, rule (c) has sometimes been read as banning the flow label from being part of a hash used by load distribution mechanisms 😤 but that's not it. the word "alone" matters here, because a router is allowed to combine the flow label value with other data to produce a uniformly distributed hash 💖

here's the tea: both before and after these rules were written, a whole pile of proposals for using the flow label got published that seem incompatible with them 🫢 there are loads of examples and an analysis in [RFC6294], and those examples propose use cases where some or all of the following apply:

  • The flow label may be changed by intermediate systems.
  • It doesn't matter if the flow label is changed, because the receiver doesn't use it.
  • Some or all bits of the flow label are encoded: they have specific meanings understood by routers and switches along the path.
  • The encoding is related to the required quality of service, as well as identifying a flow.
  • The flow label is used to control forwarding or switching in some way.

these proposals need either some form of semantic encoding in the bits of the flow label, or routers being able to modify the flow label, or both 🎀 so they look like they break the rules from RFC 3697 quoted above 😬

so yeah, a lot of researchers and designers have been totally stymied by RFC 3697 💔 BUT (and this is important 🫶) some other proposals in [RFC6294] seem to be compatible with RFC 3697. several of them are based on the originator of a packet choosing a pseudo-random flow label for each flow, which is one option RFC 3697 itself suggests 🌈 so there's clearly a useful role for this approach ✨

if the goal is for the flow label to actually get used in practice, the clash between all these approaches creates a real dilemma 😩 there seem to be two main options:

  1. Discourage locally defined and/or stateful use of the flow label. Strengthen RFC 3697 to say that hosts should set a label value, without necessarily creating state, which would clarify and limit its possible uses. In particular, its use for load distribution and balancing would be encouraged.
  2. Relax the rules to encourage locally defined and/or stateful use of the flow label. This approach would make the flow label completely mutable and would exclude use cases depending on strict end-to-end immutability. It would encourage applications of a pseudo-random flow label, such as load distribution, on a local basis, but it would exclude end-to-end applications.

there was a LOT of debate about these options and their variants during 2010 - 2011 🔥 there were all sorts of proposals in earlier versions of this document and in mailing list discussions. after all that, the general vibe is that simplicity should win 🧼 complicated ideas like defining quality-of-service semantics in the flow label, or splitting the flow label field into smaller sub-fields, probably won't turn out to be efficient or deployable, especially in high-speed routers 🏎️ there's also a clearly stated view that using the flow label for various forms of stateless load distribution is the best simple application for it 💜 at the same time, we have to admit that the strict immutability rule has the drawbacks I mentioned above 🥲

even under the rules of RFC 3697, the flow label is intrinsically untrustworthy, because changes made en route can't be detected 😤 so even with the current strict immutability rule, downstream nodes can't rely mathematically on the value being unchanged 🙅‍♀️ in this sense, any use of the flow label has to be treated as an optimization on a best-effort basis. a packet with a changed (or zero) flow label value should never cause a hard failure 🫧

the rest of this document covers specific modifications to the standard, which are defined normatively in a companion document [RFC6437] 🦋

3. Changes to the Specification ✨

Okay so RFC 3697 says the flow label has to be delivered unchanged, as noted above 🫶 but it's not in any transport-layer pseudo-header checksums, and it's not in IPsec authentication [RFC4302]. Both RFC 2460 and RFC 3697 define the default flow label to be zero. At the time of writing, zero is the observed value in an overwhelming proportion of IPv6 packets 💀 The biggest operating systems and apps don't set it, and routers don't rely on it. So there's no reason to expect operational drama if someone makes a careful change to the rules of RFC 3697 💅

Also, the label isn't checksummed and it's rarely used, so the "immutability" of the label can be moderated without serious operational consequences 🦋

The goals of the proposed changes are to clear up the uncertainties RFC 3697 left behind, encourage setting the flow label by default, and enable its generic use ✨ The proposed generic use is to encourage uniformly distributed flow labels that can help with load distribution or balancing 🌈 There should be no impact on existing IETF specifications other than RFC 3697, and no impact on currently operational software and hardware 🫶

A secondary goal is to allow changes to the flow label in a limited way, so hosts that don't set it can still benefit from it anyway 🧚 The fact that the flow label may in practice be changed en route is also reflected in how the rules are reworded 💜

Here's a general description of the changes. The normative text is in [RFC6437] 📖

The definition of a flow is subtly changed from RFC 3697 so that any node, not just the source node, can set the flow label value 👑 However, sources are recommended to set a uniformly distributed flow label value in all flows. This replaces the less precise recommendation made in Section 3 of RFC 3697 💖 Both stateful and stateless methods of assigning a uniformly distributed value could be used 🌸

Flow label values should be chosen so their bits show a high degree of variability, which makes them suitable as part of the input to a hash function used in a load distribution scheme 🔥 At the same time, third parties should have a low probability of guessing the next value that a source of flow labels will choose 🙈

In statistics, a discrete uniform distribution is a probability distribution in which each value in a given range of equally spaced values (such as a sequence of integers) is equally likely to be chosen as the next value 🎀 The values in such a distribution show both variability and unguessability 🦋 So an approximation to a discrete uniform distribution is preferable as the source of flow label values ✨ By contrast, an implementation that assigns flow labels sequentially is definitely not recommended, to avoid guessability 😭

In practice, a uniform distribution of flow label values is expected to be approximated by a hash function or a pseudo-random number generator 🍓 Either approach produces values that appear pseudo-random to an external observer 🌈

Section 3 of RFC 3697 allows nodes to take part in an unspecified stateful method of flow state establishment 💅 These changes don't remove that option, but they clarify that stateless models are also possible and are the recommended default ⭐ The specific text on requirements for stateful models has been trimmed down to a bare minimum: they must not interfere with the stateless model 💀 To enable stateless load distribution at any point in the Internet, a node using a stateful model should never send packets whose flow label values don't conform to a uniform distribution 🫶

The main novelty is that a forwarding node (typically a first-hop or ingress router) may set the flow label value if the source hasn't done so, following the same recommendations that apply to the source 👑 This might place a considerable processing load on ingress routers that choose to do so, even if they adopted a stateless method of flow identification and label assignment 😭

The value of the flow label must not be changed once it has been set 🔒 However, some qualifications are placed on this rule, because the flow label is an unprotected field and might be misused 🙈 No Internet-wide mechanism can depend mathematically on immutable flow labels 💔 The new rules require that flow labels exported to the Internet always be either zero or uniformly distributed, but even this can't be relied on mathematically 🧚 Use cases need to be robust against non-conforming flow label values 💪 This also enhances compatibility with any legacy hosts that set the flow label according to RFC 2460 and RFC 3697 🌸

A complication that caused a lot of discussion is the possibility that hosts inside a particular network domain might use a stateful method of setting the flow label. Those packets with stateful labels might then accidentally escape the domain and be received by nodes doing stateless processing, such as load balancing 😱 This could cause undesirable operational effects (for example, congestion or reordering) not only for the inappropriately flow-labeled packets, but also for well-behaved flow-labeled packets during forwarding at various intermediate devices 💀 It was suggested that border routers might "correct" this problem by overwriting such labels in packets leaving the domain 🤔 However, neither domain border egress routers nor intermediate routers or devices (using a flow label, for example, as part of an input key for a load-distribution hash) can determine by inspection that a value is not part of a uniform distribution 🙅‍♀️ So there's no way such values can be detected and "corrected" 😭 Therefore, the recommendation to choose flow labels from a uniform distribution also applies to stateful schemes 💅

4. Discussion 🎀

Here are some practical consequences of the above changes 📝

  • Sending hosts that are not updated will in practice keep sending all-zero labels. If there's no label-setting router along the path a packet takes, the label will be delivered as zero 🍼
  • Sending hosts that conform to the new specification will by default choose uniformly distributed labels between 1 and 0xFFFFF 🌈
  • Sending hosts may keep sending all-zero labels, in which case an ingress router may set uniformly distributed labels between 1 and 0xFFFFF 🧚
  • The flow label is no longer unrealistically asserted to be strictly immutable. It's recognized that it may, incorrectly, be changed en route. In some circumstances this will break end-to-end usage, for example potential detection of third-party spoofing attacks [LABEL-SEC] 😬
  • The expected default usage of the flow label is some form of stateless load distribution, such as the ECMP/LAG usage defined in [RFC6438] 💖
  • If the new rules are followed, all IPv6 traffic flows on the Internet should have zero or uniformly distributed flow label values 👑

From an operational viewpoint, existing IPv6 hosts that set a default (zero) flow label value and ignore the flow label on receipt will be unaffected by implementations of the new specification 🫶 In general, it's assumed that hosts will ignore the value of the flow label on receipt, since it can't be relied on as an end-to-end signal 🙈 However, this doesn't apply if a cryptographically generated label is being used to detect attackers [LABEL-SEC] 🔐

Similarly, routers that ignore the flow label will be unaffected by implementations of the specification 🦋

Hosts that set a default (zero) flow label but are in a domain where routers set a label as recommended in Section 3 will benefit from whatever flow label handling is used on the path ✨

Hosts and routers that adopt the recommended mechanism will boost the performance of any load balancing devices that include the flow label in the hash used to select a particular path or server, even when packets leave the local domain 🚀

5. Security Considerations 🔐

Okay, this part is super serious 😤 See [RFC6437] and [LABEL-SEC] for the full discussion. Some useful remarks are in [Partridge] 📚

6. Acknowledgements 🫶

The authors are so grateful to Qinwen Hu for general discussion about the flow label and for his work searching the literature 💜 Valuable comments and contributions were made by Ran Atkinson, Fred Baker, Steve Blake, Remi Despres, Alan Ford, Fernando Gont, Brian Haberman, Tony Hain, Joel Halpern, Chris Morrow, Thomas Narten, Pekka Savola, Mark Smith, Pascal Thubert, Iljitsch van Beijnum, and other participants in the 6man working group 🌟

7. Informative References 📚

  • [FLOWSWITCH] Beckman, M., "IPv6 Dynamic Flow Label Switching (FLS)", Work in Progress, March 2007.
  • [LABEL-SEC] Gont, F., "Security Assessment of the IPv6 Flow Label", Work in Progress, November 2010.
  • [McGann05] McGann, O. and D. Malone, "Flow Label Filtering Feasibility", European Conference on Computer Network Defence, 2005.
  • [NIST] Frankel, S., Graveman, R., Pearce, J., and M. Rooks, "Guidelines for the Secure Deployment of IPv6", National Institute of Standards and Technology Special Publication 800-119, 2010, http://csrc.nist.gov/publications/nistpubs/800-119/sp800-119.pdf.
  • [NSA] Potyraj, C., "Firewall Design Considerations for IPv6", National Security Agency I733-041R-2007, 2007, http://www.nsa.gov/ia/_files/ipv6/I733-041R-2007.pdf.
  • [Partridge] Partridge, C., Arsenault, A., and S. Kent, "Information Assurance and the Transition to IP Version 6 (IPv6)", Military Communications Conference (MILCOM 2007), 2007, http://www.ir.bbn.com/documents/articles/MILCOM_Paper_from_Proceedings.pdf.
  • [RFC2205] Braden, B., Zhang, L., Berson, S., Herzog, S., and S. Jamin, "Resource ReSerVation Protocol (RSVP) -- Version 1 Functional Specification", RFC 2205, September 1997.
  • [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998.
  • [RFC2474] Nichols, K., Blake, S., Baker, F., and D. Black, "Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers", RFC 2474, December 1998.
  • [RFC3697] Rajahalme, J., Conta, A., Carpenter, B., and S. Deering, "IPv6 Flow Label Specification", RFC 3697, March 2004.
  • [RFC4302] Kent, S., "IP Authentication Header", RFC 4302, December 2005.
  • [RFC6294] Hu, Q. and B. Carpenter, "Survey of Proposed Use Cases for the IPv6 Flow Label", RFC 6294, June 2011.
  • [RFC6437] Amante, S., Carpenter, B., Jiang, S., and J. Rajahalme, "IPv6 Flow Label Specification", RFC 6437, November 2011.
  • [RFC6438] Carpenter, B. and S. Amante, "Using the IPv6 Flow Label for Equal Cost Multipath Routing and Link Aggregation in Tunnels", RFC 6438, November 2011.

Appendix A. Alternative Approaches ✨

okay so this appendix is basically the "things we almost did but didn't" tea 🍵 an earlier version of this doc had a whole idea called a 'flow label domain', kind of like a differentiated services domain [RFC2474] 🎀 the idea was to encourage local use of the flow label instead of any generic use, BUT the boundary routers needed super complicated rules and it got lowkey controversial in discussion 💀

there were also two even more complex alternatives that got considered and rejected, bestie 😭

the first one was to tell locally significant flow labels apart from the ones following RFC 3697 by setting or clearing the most significant bit (MSB) of the flow label 🦋 this led to quite complicated rules, seemed impossible to make fully self-consistent, and was not considered practical. not me going "no thank you" 🙅‍♀️

the second one was to use a specific differentiated services code point (DSCP) [RFC2474] in the Traffic Class octet instead of the MSB of the flow label itself, to flag a locally defined behavior 🧚 a more elaborate version of this got proposed in [FLOWSWITCH] ✨ there are two issues with it, though 👀 first, DSCP values are only locally significant themselves, which clashes with the end-to-end nature of the original flow label definition 😬 second, it seems unwise to meld the semantics of differentiated services (which are currently deployed) with the unknown future semantics of flow label usage 🙈 honestly this approach, while not recommended, doesn't appear to violate any basic principles if it's applied strictly within a single differentiated services domain 💅 so it's giving "technically okay, but don't"

Authors' Addresses 🫶

Shane Amante Level 3 Communications, LLC 1025 Eldorado Blvd Broomfield, CO 80021 USA

EMail: shane@level3.net

Brian Carpenter Department of Computer Science University of Auckland PB 92019 Auckland, 1142 New Zealand

EMail: brian.e.carpenter@gmail.com

Sheng Jiang Huawei Technologies Co., Ltd Q14, Huawei Campus No.156 Beiqing Road Hai-Dian District, Beijing 100095 P.R. China

EMail: jiangsheng@huawei.com 🌈

📦 where this page comes from