Segment Identifiers in SRv6

Segment Routing over IPv6 (SRv6) uses IPv6 as the underlying data plane. In SRv6, SR source nodes initiate packets with a segment identifier in the Destination Address of the IPv6 header, and SR segment endpoint nodes that process a local segment present the Destination Address of an IPv6 header. Thus Segment Identifiers (SIDs) in SRv6 can and do appear in the Destination Address field of IPv6 datagrams by design.

The following terms are used as defined in . Segment Routing (SR) SR Domain Segment Segment Identifier (SID) SRv6 SRv6 SID SR Policy. The following terms are used as defined in . Segment Routing Header (SRH) SR Source Node Transit Node SR Segment Endpoint Node Reduced SRH Segments Left Last Entry The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

defines the Segment List of the SRH as a contiguous array of 128-bit IPv6 addresses, and that each of the elements in this list are SIDs. But all of these elements are not necessarily made equal. Some of these elements may represent a local interface as described in Section 4.3 of as "A FIB entry that represents a local interface, not locally instantiated as an SRv6 SID". From this it follows that all the SIDs that appear in the SRH are not SRv6 SIDs as defined by . It is also fairly clear that the non-SRv6-SID elements that appear in the SRH SID list are simply IPv6 addresses assigned to local interfaces annd MUST conform to . So, the following discussions are intended to be applicable solely to SRv6 SIDs that are not assigned to local interfaces. One of the key questions to address is how these SRv6 SIDs appearing as IPv6 Destination Addresses are perceived and treated by "transit nodes" (that are not required to be capable of processing a Segment or the Segment Routing Header). Section 3.1. of describes the format of an SRv6 SID as composed of three parts LOC:FUNCT:ARG, where a locator (LOC) is encoded in the L most significant bits of the SID, followed by F bits of function (FUNCT) and A bits of arguments (ARG). Such a SID is assigned to a node within a prefix defined as a Locator of length L. When an SRv6 SID occurs in the IPv6 destination address field of an IPv6 header, only the longest match prefix corresponding to the locator is used to forward the packet to the node identified by the Locator. It is clear that this format for SRv6 SIDs is not compliant with the requirements set forth in for IPv6 addresses but it is also clear that SRv6 SIDs are not intended for assignment onto interfaces on end hosts. They look and act similar to other mechanisms that use IPv6 addresses with different formats such as that defines the IPv6 Addressing of IPv4/IPv6 Translators and that describes ORCHIDv2 (a cryptographic hash identifier format). While looking at the transit nodes it becomes apparent that these addresses are used purely for routing and not for packet delivery to end hosts. Hence the relevant standard to apply here is that allows the use of variable length prefixes in forwarding while explicitly decoupling IPv6 routing and forwarding from the IPv6 address/prefix semantics described in . Please note that does not override the rules in , but merely limits where their impact is observed Furthermore, in the SRv6 specifications, all SIDs assigned within a given Locator prefix are located inside the node identified by Locator. Therefore there does not appear to be a conflict with section 2.6.1 of since subnet-router anycast addresses are neither required nor useful within a node.

The C-SID document describes how to use a single entry in the SRH list as a container for multiple SIDs and defines a few flavors of how to do so. A node taking part in this mechanism accomplishes this by using the ARG part of the Destination address field of the IPv6 header to come up with a new Destination address in some of these flavors. i.e. The destination address field of the packet changes at a segment endpoint in a way similar to how the address changes as the result of processing a segment in the SRH. One key thing to note in here is that the Locator Block at the beginning of the address does not get modified by the operations needed for supporting compressed SIDs. As we have established that the SRv6 SIDs are being treated simply as routing prefixes on transit nodes this does not constitute a modification to the IPv6 data plane on such transit nodes and any changes are restricted to SR aware nodes.

There are a few issues that need to be addressed in the C-SID draft prior to its publication as RFC: This draft needs to provide an updated definition for the SegmentsLeft field of the SRH since the current definition in no longer holds true in the presence of C-SIDs. In some cases it is possible that the SR policy can be expressed purely with C-SIDs without requiring an SRH. In this case, to allow the SR domain to fail closed, some form of filtering based on the LOC part of the SRv6 SID is required as relying purely on the presence of an SRH will not be sufficient. The use of C-SIDs might cause some difficulty in troubleshooting error conditions signaled by ICMPv6. Section 5.4 of describes the ICMPv6 error processing that is required to be performed on the SR Source Nodes to correlate packets since the Destination Address field of the packet changes in flight. Similar logic needs to be specified for SR Source Nodes that use C-SIDs to determine the destination address for use by protocol-error handlers.

The spring working group is in the process of analyzing multiple mechanisms for compressing the SRv6 SID list as described in . Even though this document focuses on , the considerations specified in this document might also be applicable to the other mechanisms being analyzed and compared.

All of the SRv6 related specifications discussed above are intended to be applicable to a contained SR Domain or between collaborating SR Domains. Hence the behavior of SRv6 SIDs is visible purely within the SR domain and they would be treated solely as IPv6 routing prefixes by nodes that are not SR aware. As an added factor of safety, it might be prudent to allocate some address space that explicitly signals that the addresses within that space are not intended to comply with . As described in Section 3 above, there is precedent for mechanisms that use IPv6 addresses in a manner different from that specified in . This would be useful in identifying and potentially filtering packets at the edges of the SR Domains as described in . The SRv6 operational community, which is the first intended user of this block, is requested to come up with conventions and guidelines for the use of this newly allocated address block in line with their requirements.

IANA is requested to assign a /16 address block for the purposes described in Section 5 out of the "Reserved by IETF" range defined in the Internet Protocol Version 6 Address Space registry.

The security considerations for the use of Segment Routing , SRv6 , and SRv6 network programming apply to the use of these addresses. The use of IPv6 tunneling mechanisms (including SRv6) also brings up additional concerns such as those described in .

The author would like to extend a special note of thanks to Brian Carpenter and Erik Kline for their precisely summarized thoughts on this topic that provided the seed of this draft. The author would also like to thank Andrew Alston, Ron Bonica, Bruno Decraene, Darren Dukes, Clarence Filsfils, Jim Guichard, Joel Halpern, Bob Hinden, Alvaro Retana, Ole Troan, Eric Vyncke and Jen Linkova for their ideas and comments to improve this document.