RFC 7676
IPv6 Support for Generic Routing Encapsulation (GRE)
IPv6 Support for Generic Routing Encapsulation (GRE) 🎀
okay bestie, so this is RFC 7676 💖 and it's all about making GRE work with IPv6. Here's the title block:
- Number: RFC 7676
- Authors: C. Pignataro (Cisco Systems), R. Bonica (Juniper Networks), S. Krishnan (Ericsson)
- Category: Standards Track 👑
- ISSN: 2070-1721
- Date: October 2015 📅
- Obsoletes / Updates: none listed in the title block 🙅♀️
Abstract ✨
okay so GRE is this super flexible tunnel thing that can carry basically any network-layer payload protocol over any network-layer delivery protocol 🦋 but right now the GRE rules only cover IPv4, whether IPv4 is the payload or the delivery protocol. IPv6 got left out, and that's the gap this doc fills 💅
this document specifies GRE procedures for IPv6, used as either the payload or delivery protocol. ✨
Status of This Memo 📜
this is an Internet Standards Track document 👑
it's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). if you want more on Internet Standards, check out Section 2 of RFC 5741 🌸
for the current status, any errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc7676 🧚
Copyright Notice 💜
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved. 🌈
this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as of the publication date. please actually read these, because they spell out your rights and restrictions for this document 🙈 any Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Simplified BSD License 💅
Table of Contents 🗂️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
2. GRE Header Fields . . . . . . . . . . . . . . . . . . . . . . 4
2.1. Checksum Present . . . . . . . . . . . . . . . . . . . . 4
3. IPv6 as GRE Payload . . . . . . . . . . . . . . . . . . . . . 5
3.1. GRE Protocol Type Considerations . . . . . . . . . . . . 5
3.2. MTU Considerations . . . . . . . . . . . . . . . . . . . 5
3.3. Fragmentation Considerations . . . . . . . . . . . . . . 5
4. IPv6 as GRE Delivery Protocol . . . . . . . . . . . . . . . . 6
4.1. Next Header Considerations . . . . . . . . . . . . . . . 6
4.2. Checksum Considerations . . . . . . . . . . . . . . . . . 6
4.3. MTU Considerations . . . . . . . . . . . . . . . . . . . 8
5. Security Considerations . . . . . . . . . . . . . . . . . . . 8
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 8
6.1. Normative References . . . . . . . . . . . . . . . . . . 8
6.2. Informative References . . . . . . . . . . . . . . . . . 9
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 10
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 111. Introduction 💖
GRE [RFC2784] [RFC2890] can carry any network-layer payload protocol over any network-layer delivery protocol ✨ right now GRE only has rules for IPv4 [RFC791], whether it's the payload or the delivery protocol. IPv6 [RFC2460] has no GRE rules yet, which is kind of a big deal 😭
this document specifies GRE procedures for IPv6, used as either the payload or delivery protocol. like RFC 2784, it also describes how several vendors have actually implemented GRE 🦋
1.1. Requirements Language 🔑
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💜
1.2. Terminology 📖
these are the terms used in this document:
- GRE delivery header: an IPv4 or IPv6 header whose source address represents the GRE ingress node and whose destination address represents the GRE egress node. The GRE delivery header encapsulates a GRE header. 🚚
- GRE header: the GRE protocol header. It's encapsulated in the GRE delivery header and encapsulates the GRE payload. 🎁
- GRE payload: a network-layer packet that the GRE header encapsulates. 📦
- GRE overhead: the combined size of the GRE delivery header and the GRE header, measured in octets. 📏
- Path MTU (PMTU): the minimum MTU of all the links in a path between a source node and a destination node. If the source and destination node are connected through Equal-Cost Multipath (ECMP), the PMTU equals the minimum link MTU of all links contributing to the multipath. 🛣️
- Path MTU Discovery (PMTUD): a procedure for dynamically discovering the PMTU between two nodes on the Internet. PMTUD procedures for IPv6 are defined in [RFC1981]. 🔍
- GRE MTU (GMTU): the maximum transmission unit, i.e., maximum packet size in octets, that can be conveyed over a GRE tunnel without fragmentation of any kind. The GMTU equals the PMTU for the path between the GRE ingress and the GRE egress, minus the GRE overhead. 🌟
2. GRE Header Fields 🦋
this document doesn't change the GRE header format or any behaviors specified by RFC 2784 or RFC 2890 🙌
2.1. Checksum Present 🧮
the GRE ingress node SHOULD set the Checksum Present field in the GRE header to zero. However, implementations MAY support a configuration option that makes the GRE ingress node set the Checksum Present field to one 🎛️
as per Section 2.2 of RFC 2784, the GRE egress node uses the Checksum Present field to work out the length of the GRE header. If the Checksum Present field is set to one, the GRE egress node MUST use the GRE Checksum to verify the integrity of the GRE header and payload 🔐
setting Checksum Present to zero cuts down on the computational cost of GRE encapsulation and decapsulation ⚡ in lots of cases, the GRE Checksum is partly redundant with other checksums. For example:
- If the payload protocol is IPv4, the IPv4 header is protected by both the GRE Checksum and the IPv4 Checksum. 🧁
- If the payload carries TCP [RFC793], the TCP pseudo header, TCP header, and TCP payload are protected by both the GRE Checksum and TCP Checksum. 🍓
- If the payload carries UDP [RFC768], the UDP pseudo header, UDP header, and UDP payload are protected by both the GRE Checksum and UDP Checksum. 🫧
but if the GRE Checksum Present field is set to zero, the GRE header isn't protected by any checksum 😬 and depending on which of the conditions above are true, some parts of the GRE payload won't be protected by any checksum either.
network operators should evaluate the risk factors in their networks and configure GRE ingress nodes accordingly 🛡️
3. IPv6 as GRE Payload 🧚
these considerations apply to GRE tunnels that carry an IPv6 payload 💫
3.1. GRE Protocol Type Considerations 🏷️
the Protocol Type field in the GRE header MUST be set to Ether Type [RFC7042] 0x86DD (IPv6) 🎯
3.2. MTU Considerations 📐
a GRE tunnel MUST be able to carry a 1280-octet IPv6 packet from ingress to egress, without fragmenting the payload packet. Every GRE tunnel with a GMTU of 1280 octets or greater satisfies this. GRE tunnels that can fragment and reassemble delivery packets also satisfy it, no matter their GMTU. Still, being able to fragment and reassemble delivery packets is not a requirement of this specification. This spec only requires that GRE ingress nodes avoid activating GRE tunnels that don't meet the requirement above 🙅♀️
before activating a GRE tunnel, and periodically after that, the GRE ingress node MUST verify the tunnel's ability to carry a 1280-octet IPv6 payload packet from ingress to egress, without fragmenting the payload. Once that's done, the GRE ingress node MUST activate or deactivate the tunnel accordingly ✅
the implementation details for those verification procedures are out of scope for this document. But a GRE ingress node can check tunnel capabilities by sending a 1280-octet IPv6 packet addressed to itself through the tunnel being tested 🔬
lots of existing implementations [RFC7588] don't support the verification procedures above 😤 unless they're deployed in environments where the GMTU is guaranteed to be greater than 1280, these implementations MUST be configured so that the GRE endpoints can fragment and reassemble the GRE delivery packet 🧩
3.3. Fragmentation Considerations ✂️
when the GRE ingress receives an IPv6 payload packet whose length is less than or equal to the GMTU, it can encapsulate and forward the packet without fragmentation of any kind. In this case, the GRE ingress router MUST NOT fragment the payload or delivery packets 🙅♀️
when the GRE ingress receives an IPv6 payload packet whose length is greater than the GMTU, and the GMTU is greater than or equal to 1280 octets, the GRE ingress router MUST:
- discard the IPv6 payload packet 🗑️
- send an ICMPv6 Packet Too Big (PTB) [RFC4443] message to the IPv6 payload packet source. The MTU field in the ICMPv6 PTB message is set to the GMTU. 📨
when the GRE ingress receives an IPv6 payload packet whose length is greater than the GMTU, and the GMTU is less than 1280 octets, the GRE ingress router MUST:
- encapsulate the entire IPv6 packet in a single GRE header and IP delivery header 🎁
- fragment the delivery header, so the GRE egress can reassemble it 🧷
4. IPv6 as GRE Delivery Protocol 👑
these considerations apply when the delivery protocol is IPv6 💅
4.1. Next Header Considerations 🔗
when the GRE delivery protocol is IPv6, the GRE header MAY immediately follow the GRE delivery header. Alternatively, IPv6 extension headers MAY be inserted between the GRE delivery header and the GRE header 🧵
if the GRE header immediately follows the GRE delivery header, the Next Header field in the IPv6 header of the GRE delivery packet MUST be set to 47. If extension headers are inserted between the GRE delivery header and the GRE header, the Next Header field in the last IPv6 extension header MUST be set to 47 🌈
(part 2 is coming next, so stay tuned 🦋)
4.2. Checksum Considerations ✨
okay so [RFC2784] says the GRE header can carry a checksum 🧐 and if it's there, it can catch corruption in the GRE header and the GRE payload. cute, right? 🎀
BUT (and this is a big but 😭), the GRE checksum can't catch corruption in the IPv6 delivery header. And the IPv6 delivery header doesn't have a checksum of its own 💀. So no checksum we've got can catch corruption there. no cap, that's a lot of trust to put in one header 🙈
Now let's talk about the spicy failure scenario 🌶️. The destination address in the IPv6 delivery header gets corrupted, so the packet ends up at some node that isn't the GRE egress node it was meant for. What happens next depends on that node's state and config. It can do one of three things:
a) Drop the packet
b) Decapsulate the payload and forward it to its intended destination
c) Decapsulate the payload and forward it to a node other than its intended destination
a) and b) are acceptable 💖. c) is NOT acceptable 😤.
c) can only happen when all of these are true:
- The intended GRE egress node is a Virtual Private Network (VPN) Provider Edge (PE) router.
- The node the GRE delivery packet is mistakenly delivered to is also a VPN PE router.
- VPNs are attached to both of those nodes. At least two of those VPNs' hosts are using a non-unique address space (for example, [RFC1918]).
- The intended GRE egress node has state that makes it decapsulate the packet and forward the payload to its intended destination.
- The node the packet was mistakenly delivered to has state that makes it decapsulate the packet and forward the payload to an identically numbered host in another VPN.
Is this scenario super unlikely? Yes, extremely 🙏. But one misdelivered packet can still mess with the apps running on the node it landed on 😭. And leaking packets across VPN boundaries is a full-on security breach 🚨. The risk from c) could be lowered with end-to-end authentication of the payload 🔐.
Before deploying GRE over IPv6, network operators should consider how likely c) is in their network. GRE over IPv6 MUST NOT be deployed unless the network operator decides the risk from c) is acceptable. Main character decision energy 👑.
4.3. MTU Considerations 🦋
By default, the GRE ingress node can't fragment the IPv6 delivery header. Lowkey limiting, but that's the default 🫶. Implementations MAY support an optional configuration that lets the GRE ingress node fragment the IPv6 delivery header.
Also by default, the GRE egress node can't reassemble the IPv6 delivery header 🧩. Implementations MAY support an optional configuration that lets the GRE egress node reassemble the IPv6 delivery header.
5. Security Considerations 🔐💅
The Security Considerations section of [RFC4023] lists the threats you run into when MPLS is carried over GRE 😬. Those threats apply to any GRE payload. As RFC 4023 says, you can handle them by authenticating and/or encrypting the delivery packet with IPsec [RFC4301]. Or, when the payload is IPv6, you can authenticate and/or encrypt the payload with IPsec instead of the delivery packet 🔒. Other than that, this specification doesn't add any security considerations beyond the ones in RFC 2784 🎀.
More generally, security considerations for IPv6 are covered in [RFC4942] 🌈. Operational security for IPv6 is covered in [OPSEC-V6], and security concerns for tunnels in general are covered in [RFC6169] 🦋.
6. References 📚
6.1. Normative References
[RFC768] Postel, J., "User Datagram Protocol", STD 6, RFC 768,
DOI 10.17487/RFC0768, August 1980,
<http://www.rfc-editor.org/info/rfc768>.
[RFC791] Postel, J., "Internet Protocol", STD 5, RFC 791,
DOI 10.17487/RFC0791, September 1981,
<http://www.rfc-editor.org/info/rfc791>.
[RFC793] Postel, J., "Transmission Control Protocol", STD 7,
RFC 793, DOI 10.17487/RFC0793, September 1981,
<http://www.rfc-editor.org/info/rfc793>.
[RFC1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery
for IP version 6", RFC 1981, DOI 10.17487/RFC1981, August
1996, <http://www.rfc-editor.org/info/rfc1981>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6
(IPv6) Specification", RFC 2460, DOI 10.17487/RFC2460,
December 1998, <http://www.rfc-editor.org/info/rfc2460>.
[RFC2784] Farinacci, D., Li, T., Hanks, S., Meyer, D., and P.
Traina, "Generic Routing Encapsulation (GRE)", RFC 2784,
DOI 10.17487/RFC2784, March 2000,
<http://www.rfc-editor.org/info/rfc2784>.
[RFC2890] Dommety, G., "Key and Sequence Number Extensions to GRE",
RFC 2890, DOI 10.17487/RFC2890, September 2000,
<http://www.rfc-editor.org/info/rfc2890>.
[RFC4023] Worster, T., Rekhter, Y., and E. Rosen, Ed.,
"Encapsulating MPLS in IP or Generic Routing Encapsulation
(GRE)", RFC 4023, DOI 10.17487/RFC4023, March 2005,
<http://www.rfc-editor.org/info/rfc4023>.
[RFC4301] Kent, S. and K. Seo, "Security Architecture for the
Internet Protocol", RFC 4301, DOI 10.17487/RFC4301,
December 2005, <http://www.rfc-editor.org/info/rfc4301>.
[RFC4443] Conta, A., Deering, S., and M. Gupta, Ed., "Internet
Control Message Protocol (ICMPv6) for the Internet
Protocol Version 6 (IPv6) Specification", RFC 4443,
DOI 10.17487/RFC4443, March 2006,
<http://www.rfc-editor.org/info/rfc4443>.6.2. Informative References
[OPSEC-V6] Chittimaneni, K., Kaeo, M., and E. Vyncke, "Operational
Security Considerations for IPv6 Networks", Work in
Progress, draft-ietf-opsec-v6-07, September 2015.
[RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.,
and E. Lear, "Address Allocation for Private Internets",
BCP 5, RFC 1918, DOI 10.17487/RFC1918, February 1996,
<http://www.rfc-editor.org/info/rfc1918>.
[RFC4942] Davies, E., Krishnan, S., and P. Savola, "IPv6 Transition/
Co-existence Security Considerations", RFC 4942,
DOI 10.17487/RFC4942, September 2007,
<http://www.rfc-editor.org/info/rfc4942>.
[RFC6169] Krishnan, S., Thaler, D., and J. Hoagland, "Security
Concerns with IP Tunneling", RFC 6169,
DOI 10.17487/RFC6169, April 2011,
<http://www.rfc-editor.org/info/rfc6169>.
[RFC7042] Eastlake 3rd, D. and J. Abley, "IANA Considerations and
IETF Protocol and Documentation Usage for IEEE 802
Parameters", BCP 141, RFC 7042, DOI 10.17487/RFC7042,
October 2013, <http://www.rfc-editor.org/info/rfc7042>.
[RFC7588] Bonica, R., Pignataro, C., and J. Touch, "A Widely
Deployed Solution to the Generic Routing Encapsulation
(GRE) Fragmentation Problem", RFC 7588,
DOI 10.17487/RFC7588, July 2015,
<http://www.rfc-editor.org/info/rfc7588>.Acknowledgements 💜
Huge thank-you to the authors' besties for their thorough reviews and useful comments 🫶🌸: Fred Baker, Stewart Bryant, Benoit Claise, Ben Campbell, Carlos Jesus Bernardos Cano, Spencer Dawkins, Dino Farinacci, David Farmer, Brian Haberman, Tom Herbert, Kathleen Moriarty, Fred Templin, Joe Touch, Andrew Yourtchenko, and Lucy Yong ✨👑.
Authors' Addresses 🧚
Carlos Pignataro
Cisco Systems
7200-12 Kit Creek Road
Research Triangle Park, North Carolina 27709
United States
Email: cpignata@cisco.com
Ron Bonica
Juniper Networks
2251 Corporate Park Drive
Herndon, Virginia
United States
Email: rbonica@juniper.net
Suresh Krishnan
Ericsson
8400 Decarie Blvd.
Town of Mount Royal, QC
Canada
Phone: +1 514 345 7900 x42871
Email: suresh.krishnan@ericsson.com📦 where this page comes from
- ietf: rfc7676 2015-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms