RFC 7045

Transmission and Processing of IPv6 Extension Headers

📅 published December 2013, from ietf

RFC 7045: Transmission and Processing of IPv6 Extension Headers 🎀

Okay bestie, this one is RFC 7045 and it's giving careful clean-up energy 💖

Here's the title block so you know who's behind it 🌸

Authors: B. Carpenter (Univ. of Auckland) and S. Jiang (Huawei Technologies Co., Ltd.) ✨
Category: Standards Track
ISSN: 2070-1721
Date: December 2013
Updates: RFC 2460 and RFC 2780. There's no Obsoletes entry in the header 🦋
Publisher: Internet Engineering Task Force (IETF) 🧚

Abstract

Okay so IPv6 extension headers have been standardised ever since the IPv6 standard first came out, and there are a bunch of them now 🌈 This document updates RFC 2460 so it's clearer how intermediate nodes should deal with those headers, plus any new ones that show up later 💅 It also says how IANA should register extension headers, with a small, minor update to RFC 2780 🫶

Status of This Memo

This is an Internet Standards Track document 🔥

It's a product of the Internet Engineering Task Force (IETF), it represents the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication 👑 If you want more on Internet Standards, check Section 2 of RFC 5741 🍓

Info about the current status, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc7045 💜

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Please actually read these, bestie, because they spell out your rights and restrictions for this document 🙈 Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License ⭐

1.  Introduction and Problem Statement  . . . . . . . . . . . . .   2
  1.1.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   4
2.  Requirement to Transmit Extension Headers . . . . . . . . . .   5
  2.1.  All Extension Headers . . . . . . . . . . . . . . . . . .   5
  2.2.  Hop-by-Hop Options  . . . . . . . . . . . . . . . . . . .   6
3.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
4.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   7
5.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   8
6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
  6.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
  6.2.  Informative References  . . . . . . . . . . . . . . . . .   8

1. Introduction and Problem Statement 🦋

Okay so first, what even IS an extension header? 🤔 In IPv6, it's any header that comes after the first 40 bytes of the packet and before the upper-layer header. That upper-layer header might be a transport header, an ICMPv6 header, or a notional "No Next Header" 💖

The original set of IPv6 extension headers was defined in [RFC2460], which also explained how intermediate nodes should handle them. The one exception was the Hop-by-Hop Options header 🌈 Here's the big rule from RFC 2460:

...extension headers are not examined or processed by any node along a packet's delivery path, until the packet reaches the node (or each of the set of nodes, in the case of multicast) identified in the Destination Address field of the IPv6 header.

So forwarding nodes were supposed to be totally transparent to extension headers 🫶 They weren't allowed to change them, remove them, insert them, or use them to influence forwarding. That's why new extension headers could be rolled out gradually and only used by hosts that had been updated to build and read them [RFC6564]. The extension header mechanism is a huge part of the IPv6 architecture, and several new extension headers have been standardised since RFC 2460 came out ✨

Now here's where it gets messy 😭 Today, IPv6 packets aren't always forwarded just by plain IP routing based on their first 40 bytes. Some routers, plus a bunch of intermediate nodes often called middleboxes (think firewalls, load balancers, or packet classifiers), might look at other parts of each packet. A lot of those middlebox functions are actually built right into routers too. Experience shows that the network is NOT transparent to IPv6 extension headers as a result 💀 Contrary to Section 4 of RFC 2460, middleboxes sometimes examine and process the entire IPv6 packet before they decide whether to forward or discard it. That means they have to walk the chain of extension headers, if there is one, until they reach the transport header (or an encrypted payload). Unfortunately, not all IPv6 extension headers follow a uniform TLV format, so this process is clumsy and needs knowledge of each extension header's format. A separate problem is that the header chain may even be fragmented [HEADER-CHAIN] 🙈

That whole process is slow as well as clumsy, which might rule it out for nodes trying to process packets at line speed. This document does NOT try to solve that problem, because it comes from the fundamental architecture of IPv6 extension headers. Instead, this document focuses on clarifying how the header chain should be handled in the current IPv6 architecture 💅

When some firewalls hit an unrecognised extension header type, they treat the packet as suspect and drop it 😤 It's an established fact that several widely used firewalls don't recognise some or all of the extension headers standardised since RFC 2460 came out. It's also been observed that certain firewalls can't even handle all the extension headers standardised in RFC 2460, including the fragment header [FRAGDROP], which causes real end-to-end connectivity problems 💔 This hits hardest for firewalls that try to inspect packets at very high speed, since they can't spare the time to reassemble fragmented packets, especially while under a denial-of-service attack 🔥

Other types of middleboxes, like load balancers or packet classifiers, might also fail when they run into extension headers they don't recognise 🌸

A big contributing factor is this: extension headers are numbered out of the existing IP Protocol Number space, so there's no collected list of them anywhere. That makes it hard for an implementor to quickly find the full set of standard extension headers. An implementor who only reads RFC 2460 will miss every extension header defined afterwards 🙈

All of this creates a "Catch-22" situation [Heller] for deploying any newly standardised extension header, except for local use. It can't be widely deployed because existing middleboxes will drop it on many paths through the Internet. But most middleboxes won't be updated to let the new header through until it's been proven safe and useful on the open Internet, and that's impossible until the middleboxes have been updated 😩 Iykyk, it's a whole loop.

The uniform TLV format now defined for extension headers [RFC6564] will help, but only for future extensions 🧚 Some tricky and potentially malicious cases will be avoided by forbidding very long chains of extension headers that need to be fragmented [HEADER-CHAIN]. That should ease concerns that stateless firewalls can't locate a complete header chain, which the present document requires 🦋

Even so, these changes aren't enough to fix the underlying problem 💖 This document clarifies that the requirement above from RFC 2460 applies to ALL types of nodes that forward IPv6 packets, and to all extension headers standardised now and in the future. It also asks IANA to create a subsidiary registry that clearly identifies extension header types, and it updates RFC 2780 to match 👑 Fundamental changes to the IPv6 extension header architecture are out of scope for this document 🚫

Also, a lot of high-speed routers don't handle hop-by-hop options, or they only process them on a slow path 🐢 So this document also updates the requirements for processing the Hop-by-Hop Options header, to make them more realistic ✨

1.1. Terminology 🌈

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💅

For the rest of this document, the term "forwarding node" means any router, firewall, load balancer, prefix translator, or any other device or middlebox that forwards IPv6 packets, whether or not it looks inside the packet in any way 🫶

In this document, "standard" IPv6 extension headers are the ones specified in detail by IETF Standards Actions [RFC5226]. "Experimental" extension headers include those defined by any Experimental RFC, plus the header values 253 and 254 defined by [RFC3692] and [RFC4727] when they're used as experimental extension headers 🧪 "Defined" extension headers are the "standard" ones plus the "experimental" ones 🎀

2. Requirement to Transmit Extension Headers ✨

Part 2 is coming up next, bestie 🧚

2.1. All Extension Headers 🎀

okay so, forwarding nodes that toss packets just because they have extension headers are known to cause connectivity fails and deployment drama 💀 That's why it's sooo important that forwarding nodes which peek inside IPv6 headers can parse all the defined extension headers and handle them properly. Here's the vibe 🫶

Any forwarding node on an IPv6 packet's path that forwards the packet for any reason SHOULD do so regardless of which extension headers are present, as RFC 2460 says. BUT there's an exception ✨ If a forwarding node is designed to examine extension headers for any reason, like firewalling, it MUST recognise and deal appropriately with all standard IPv6 extension header types, and SHOULD recognise and deal appropriately with experimental IPv6 extension header types. IANA keeps the list of standard and experimental extension header types (see Section 4), and implementors are advised to check that list regularly for updates 📋

RFC 2460 requires destination hosts to discard packets with unrecognised extension headers, which is giving strict 💅 However, intermediate forwarding nodes SHOULD NOT do this, because they might accidentally drop traffic using a recently standardised extension header they don't recognise yet. The exceptions to this rule are coming up next 👑

Okay, now the important part 🚨 If a forwarding node discards a packet containing a standard IPv6 extension header, it MUST be the result of a configurable policy, NOT just the result of failing to recognise the header. So the discard policy for each standard type of extension header MUST be individually configurable. The default configuration SHOULD allow all standard extension headers. Main character energy for standard headers 🌸

Experimental IPv6 extension headers SHOULD be treated the same way as standard extension headers, including an individually configurable discard policy. However, the default configuration MAY drop experimental extension headers 🧚

Forwarding nodes MUST be configurable to allow packets containing unrecognised extension headers, but the default configuration MAY drop such packets 🍓

Now the routing header tea ☕ The IPv6 Routing Header Types 0 and 1 have been deprecated. Type 0 was deprecated by [RFC5095]. However, that does NOT mean the IPv6 Routing Header can be unconditionally dropped by forwarding nodes, bestie 🙅‍♀️ Packets containing standardised and undeprecated Routing Headers SHOULD be forwarded by default. At the time of writing, those are Type 2 [RFC6275], Type 3 [RFC6554], and the experimental Routing Header Types 253 and 254 [RFC4727]. Others may be defined in the future 🦋

2.2. Hop-by-Hop Options 🌈

The IPv6 Hop-by-Hop Options header SHOULD be processed by intermediate forwarding nodes as described in [RFC2460]. Lowkey though, high-performance routers will probably either ignore it or push packets carrying it onto a slow processing path 🐢 So if you're planning to use a hop-by-hop option, be aware that this is the likely behaviour 👀

Also, a quick reminder 💜 RFC 2460 states that the Hop-by-Hop Options header, if present, must be first.

3. Security Considerations 🔐

Forwarding nodes that operate as firewalls MUST conform to the requirements in the previous section so they respect the IPv6 extension header architecture. Basically, packets with standard extension headers should only be discarded as the result of an intentionally configured policy 🛡️

These changes do NOT stop a firewall from filtering out traffic with unwanted or suspect extension headers, if it's configured to do that. The changes DO, however, require firewalls to be capable of permitting any or all extension headers, if configured to do so. The default configurations are meant to allow normal use of any standard extension header, which avoids the connectivity issues described in Sections 1 and 2.1 🫧

As noted above, the default configuration might drop packets containing experimental extension headers. There's no header length field in an IPv6 header, and header types 253 and 254 might be used either for experimental extension headers OR for experimental payload types. So there's no generic algorithm a firewall can use to tell these two cases apart and analyze the rest of the packet. This should be considered when deciding on the appropriate default action for header types 253 and 254 😬

When new extension headers are standardised in the future, the people implementing and configuring forwarding nodes (firewalls included) will need to take them into account. A newly defined header will exercise new code paths in a host that does recognise it, so caution may be required 🚧 Additional security issues with experimental values or new extension headers can be found in [RFC4727] and [RFC6564]. So the deployment process is expected to be slow and to depend on satisfactory operational experience. Until deployment is complete, the new extension will fail in some parts of the Internet. This needs to be considered when deciding to standardise a new extension. Specific security considerations for each new extension should be documented in the document that defines it 💀✨

4. IANA Considerations 📋

IANA has added an extra column titled "IPv6 Extension Header" to the "Assigned Internet Protocol Numbers" registry, which clearly marks the values that are ALSO IPv6 extension header types defined by an IETF Standards Action or IESG Approval (see list below). This applies to IPv6 extension header types defined in the future too 🌟

IANA has also closed the existing, empty "Next Header Types" registry to new entries and is redirecting users to a new "IPv6 Extension Header Types" registry. This new registry contains ONLY those protocol numbers that are also marked as IPv6 Extension Header types in the "Assigned Internet Protocol Numbers" registry. Experimental values will be marked as such. The initial list is below 👇

   o  0, IPv6 Hop-by-Hop Option, [RFC2460]

   o  43, Routing Header for IPv6, [RFC2460], [RFC5095]

   o  44, Fragment Header for IPv6, [RFC2460]

   o  50, Encapsulating Security Payload, [RFC4303]

   o  51, Authentication Header, [RFC4302]

   o  60, Destination Options for IPv6, [RFC2460]

   o  135, Mobility Header, [RFC6275]

   o  139, Experimental use, Host Identity Protocol [RFC5201]

   o  140, Shim6 Protocol, [RFC5533]

   o  253, Use for experimentation and testing, [RFC3692], [RFC4727]

   o  254, Use for experimentation and testing, [RFC3692], [RFC4727]

This list leaves out type 59, No Next Header, [RFC2460], which is not an extension header as such 🙃

The references to the IPv6 Next Header field in [RFC2780] are to be interpreted as also applying to the IPv6 Extension Header field, and the "IPv6 Extension Header Types" registry will be managed accordingly 🧾

5. Acknowledgements 🫶

This document was triggered by mailing list discussions including John Leslie, Stefan Marksteiner, and others. Valuable comments and contributions came from Dominique Barthel, Tim Chown, Lorenzo Colitti, Fernando Gont, C. M. Heard, Bob Hinden, Ray Hunter, Suresh Krishnan, Marc Lampo, Sandra Murphy, Michael Richardson, Dan Romascanu, Dave Thaler, Joe Touch, Bjoern Zeeb, and others. Huge thank yous 💖

Brian Carpenter was a visitor at the Computer Laboratory at Cambridge University during part of this work 🇬🇧✨

6. References 📚

6.1. Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC2460]  Deering, S. and R. Hinden, "Internet Protocol, Version 6
              (IPv6) Specification", RFC 2460, December 1998.

   [RFC2780]  Bradner, S. and V. Paxson, "IANA Allocation Guidelines For
              Values In the Internet Protocol and Related Headers", BCP
              37, RFC 2780, March 2000.

   [RFC3692]  Narten, T., "Assigning Experimental and Testing Numbers
              Considered Useful", BCP 82, RFC 3692, January 2004.

   [RFC4727]  Fenner, B., "Experimental Values In IPv4, IPv6, ICMPv4,
              ICMPv6, UDP, and TCP Headers", RFC 4727, November 2006.

   [RFC6564]  Krishnan, S., Woodyatt, J., Kline, E., Hoagland, J., and
              M. Bhatia, "A Uniform Format for IPv6 Extension Headers",
              RFC 6564, April 2012.

6.2. Informative References

   [FRAGDROP] Jaeggli, J., Colitti, L., Kumari, W., Vyncke, E., Kaeo,
              M., and T. Taylor, "Why Operators Filter Fragments and
              What It Implies", Work in Progress, June 2013.

   [HEADER-CHAIN]
              Gont, F., Manral, V., and R. Bonica, "Implications of
              Oversized IPv6 Header Chains", Work in Progress, October
              2013.

   [Heller]   Heller, J., "Catch-22", Simon and Schuster, November 1961.

   [RFC4302]  Kent, S., "IP Authentication Header", RFC 4302, December
              2005.

   [RFC4303]  Kent, S., "IP Encapsulating Security Payload (ESP)", RFC
              4303, December 2005.

   [RFC5095]  Abley, J., Savola, P., and G. Neville-Neil, "Deprecation
              of Type 0 Routing Headers in IPv6", RFC 5095, December
              2007.

   [RFC5201]  Moskowitz, R., Nikander, P., Jokela, P., and T. Henderson,
              "Host Identity Protocol", RFC 5201, April 2008.

   [RFC5226]  Narten, T. and H. Alvestrand, "Guidelines for Writing an
              IANA Considerations Section in RFCs", BCP 26, RFC 5226,
              May 2008.

   [RFC5533]  Nordmark, E. and M. Bagnulo, "Shim6: Level 3 Multihoming
              Shim Protocol for IPv6", RFC 5533, June 2009.

   [RFC6275]  Perkins, C., Johnson, D., and J. Arkko, "Mobility Support
              in IPv6", RFC 6275, July 2011.

   [RFC6554]  Hui, J., Vasseur, JP., Culler, D., and V. Manral, "An IPv6
              Routing Header for Source Routes with the Routing Protocol
              for Low-Power and Lossy Networks (RPL)", RFC 6554, March
              2012.

Authors' Addresses 📮

   Brian Carpenter
   Department of Computer Science
   University of Auckland
   PB 92019
   Auckland  1142
   New Zealand

   EMail: brian.e.carpenter@gmail.com


   Sheng Jiang
   Huawei Technologies Co., Ltd.
   Q14, Huawei Campus
   No. 156 Beiqing Road
   Hai-Dian District, Beijing  100095
   P.R. China

   EMail: jiangsheng@huawei.com

📦 where this page comes from

ietf: rfc7045 2013-12
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms