Status of This Memo

This is an Internet Standards Track document.¶

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc0000.¶

Copyright Notice

Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶

Table of Contents

2. Terminology and Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

The following terminology defined in [RFC7102] applies to this document: LLN, RPL, RPL domain, and ROLL.¶

Consumed:

A Routing Header is consumed when the Segments Left field is zero, which indicates that the destination in the IPv6 header is the final destination of the packet and that the hops in the Routing Header have been traversed.¶

RPL Leaf:

An IPv6 host that is attached to a RPL router and obtains connectivity through a RPL Destination-Oriented Directed Acyclic Graph (DODAG). As an IPv6 node, a RPL leaf is expected to ignore a consumed Routing Header, and as an IPv6 host, it is expected to ignore a Hop-by-Hop header. Thus, a RPL leaf can correctly receive a packet with RPL artifacts. On the other hand, a RPL leaf is not expected to generate RPL artifacts or to support IP-in-IP encapsulation. For simplification, this document uses the standalone term leaf to mean a RPL leaf.¶

RPL Packet Information (RPI):

The information defined abstractly in [RFC6550] to be placed in IP packets. The term is commonly used, including in this document, to refer to the RPL Option [RFC6553] that transports that abstract information in an IPv6 Hop-by-Hop header. [RFC8138] provides an alternate (more compressed) formatting for the same abstract information.¶

RPL-Aware Node (RAN):

A device that implements RPL. Please note that the device can be found inside the LLN or outside LLN.¶

RPL-Aware Leaf (RAL):

A RPL-aware node that is also a RPL leaf.¶

RPL-Unaware Node:

A device that does not implement RPL, thus the device is RPL unaware. Please note that the device can be found inside the LLN.¶

RPL-Unaware Leaf (RUL):

A RPL-unaware node that is also a RPL leaf.¶

6LoWPAN Node (6LN):

[RFC6775] defines it as the following: "A 6LoWPAN node is any host or router participating in a LoWPAN. This term is used when referring to situations in which either a host or router can play the role described." In this document, a 6LN acts as a leaf.¶

6LoWPAN Router (6LR):

[RFC6775] defines it as the following: "An intermediate router in the LoWPAN that is able to send and receive Router Advertisements (RAs) and Router Solicitations (RSs) as well as forward and route IPv6 packets. 6LoWPAN routers are present only in route-over topologies."¶

6LoWPAN Border Router (6LBR):

[RFC6775] defines it as the following: "A border router located at the junction of separate 6LoWPAN networks or between a 6LoWPAN network and another IP network. There may be one or more 6LBRs at the 6LoWPAN network boundary. A 6LBR is the responsible authority for IPv6 prefix propagation for the 6LoWPAN network it is serving. An isolated LoWPAN also contains a 6LBR in the network, which provides the prefix(es) for the isolated network."¶

Flag Day:

A flag day is caused when a network is reconfigured in a way that nodes running the older configuration cannot communicate with nodes running the new configuration. An example of a flag day is when the ARPANET changed from IP version 3 to IP version 4 on January 1, 1983 [RFC0801]. In the context of this document, a switch from RPI Option Type (0x63) to Option Type (0x23) presents as a disruptive changeover. In order to reduce the amount of time for such a changeover, Section 4.1.3 provides a mechanism to allow nodes to be incrementally upgraded.¶

Non-Storing Mode (Non-SM):

A RPL mode of operation in which the RPL-aware nodes send information to the root about their parents. Thus, the root knows the topology. Because the root knows the topology, the intermediate 6LRs do not maintain routing state, and source routing is needed.¶

Storing Mode (SM):

A RPL mode of operation in which RPL-aware nodes (6LRs) maintain routing state (of the children) so that source routing is not needed.¶

3. RPL Overview

RPL defines the RPL control message (control plane), which is an ICMPv6 message [RFC4443] with a Type of 155. DIS (DODAG Information Solicitation), DIO (DODAG Information Object), and DAO (Destination Advertisement Object) messages are all RPL control messages but with different Code values. A RPL stack is shown in Figure 1.¶

+--------------+
| Upper Layers |
|              |
+--------------+
|   RPL        |
|              |
+--------------+
|   ICMPv6     |
|              |
+--------------+
|   IPv6       |
|              |
+--------------+
|   6LoWPAN    |
|              |
+--------------+
|   PHY-MAC    |
|              |
+--------------+

RPL supports two modes of Downward internal traffic: in Storing mode (SM), it is fully stateful; in Non-Storing mode (non-SM), it is fully source routed. A RPL Instance is either fully Storing or fully Non-Storing, i.e., a RPL Instance with a combination of fully Storing and Non-Storing nodes is not supported with the current specifications at the time of writing this document. External routes are advertised with non-SM messaging even in an SM network, see Section 4.1.1¶

4. Updates to RFC 6550, RFC 6553, and RFC 8138

+-+ ... -+-+ ... +-+- ... -+-+- +-+-+-+ ... +-+-+ ... -+++ ... +-...
|11110001|SRH-6LoRH| RPI-  |IP-in-IP| NH=1      |11110CPP| UDP | UDP
|Page 1  |Type1 S=0| 6LoRH |6LoRH   |LOWPAN_IPHC| UDP    | hdr |Payld
+-+ ... -+-+ ... +-+- ... -+-+-.+-+-+-+-+ ... +-+-+ ... -+ ... +-...
         <-4bytes->                      <-        RFC 6282      ->
                                               No RPL artifact

5. Reference Topology

A RPL network in general is composed of a 6LBR, a Backbone Router (6BBR), a 6LR, and a 6LN as a leaf logically organized in a DODAG structure.¶

Figure 3 shows the reference RPL topology for this document. The nodes are labeled with letters so that they may be referenced in subsequent sections. In the figure, 6LR represents a full router node. The 6LN is a RPL-aware router or host (as a leaf). Additionally, for simplification purposes, it is supposed that the 6LBR has direct access to Internet and is the root of the DODAG, thus the 6BBR is not present in the figure.¶

The 6LN leaves marked as RAL (F, H, and I) are RPL nodes with no children hosts.¶

The leaves marked as RUL (G and J) are devices that do not speak RPL at all (RPL unaware), but use Router Advertisements, 6LoWPAN Duplicate Address Request and Duplicate Address Confirmation (DAR/DAC), and 6LoWPAN Neighbor Discovery (ND) only to participate in the network [RFC8505]. In the document, these leaves (G and J) are also referred to as a RUL.¶

The 6LBR (A) in the figure is the root of the Global DODAG.¶

                  +------------+
                  |  INTERNET  ----------+
                  |            |         |
                  +------------+         |
                                         |
                                         |
                                         |
                                       A |
                                   +-------+
                                   |6LBR   |
                       +-----------|(root) |-------+
                       |           +-------+       |
                       |                           |
                       |                           |
                       |                           |
                       |                           |
                       | B                         |C
                   +---|---+                   +---|---+
                   |  6LR  |                   |  6LR  |
         +---------|       |--+             +---       ---+
         |         +-------+  |             |  +-------+  |
         |                    |             |             |
         |                    |             |             |
         |                    |             |             |
         |                    |             |             |
         | D                  |  E          |             |
       +-|-----+          +---|---+         |             |
       |  6LR  |          |  6LR  |         |             |
       |       |    +------       |         |             |
       +---|---+    |     +---|---+         |             |
           |        |         |             |             |
           |        |         +--+          |             |
           |        |            |          |             |
           |        |            |          |             |
           |        |            |        I |          J  |
        F  |        | G          | H        |             |
     +-----+-+    +-|-----+  +---|--+   +---|---+     +---|---+
     |  RAL  |    | RUL   |  | RAL  |   |  RAL  |     | RUL   |
     |  6LN  |    |  6LN  |  | 6LN  |   |  6LN  |     |  6LN  |
     +-------+    +-------+  +------+   +-------+     +-------+

6. Use Cases

In the data plane, a combination of RFC 6553, RFC 6554, and IPv6-in-IPv6 encapsulation are going to be analyzed for a number of representative traffic flows.¶

The use cases describe the communication in the following cases:¶

• Between RPL-aware nodes with the root (6LBR)¶
• Between RPL-aware nodes with the Internet¶
• Between RUL nodes within the LLN (e.g., see Section 7.1.4)¶
• Inside of the LLN when the final destination address resides outside of the LLN (e.g., see Section 7.2.3)¶

The use cases are as follows:¶

• Interaction between leaf and root:¶

  • RAL to root¶
  • root to RAL¶
  • RUL to root¶
  • root to RUL¶

• Interaction between leaf and Internet:¶

  • RAL to Internet¶
  • Internet to RAL¶
  • RUL to Internet¶
  • Internet to RUL¶

• Interaction between leaves:¶

  • RAL to RAL¶
  • RAL to RUL¶
  • RUL to RAL¶
  • RUL to RUL¶

This document is consistent with the rule that a header cannot be inserted or removed on the fly inside an IPv6 packet that is being routed. This is a fundamental precept of the IPv6 architecture as outlined in [RFC8200].¶

As the rank information in the RPI artifact is changed at each hop, it will typically be zero when it arrives at the DODAG root. The DODAG root MUST force it to zero when passing the packet out to the Internet. The Internet will therefore not see any SenderRank information.¶

Despite being legal to leave the RPI artifact in place, an intermediate router that needs to add an extension header (e.g., RH3 or RPL Option) MUST still encapsulate the packet in an (additional) outer IP header. The new header is placed after this new outer IP header.¶

A corollary is that an intermediate router can remove an RH3 or RPL Option only if it is placed in an encapsulating IPv6 header that is addressed to this intermediate router. When doing the above, the whole encapsulating header must be removed. (A replacement may be added.) This sometimes can result in outer IP headers being addressed to the next-hop router using a link-local address.¶

Both the RPL Option and the RH3 headers may be modified in very specific ways by routers on the path of the packet without the need to add and remove an encapsulating header. Both headers were designed with this modification in mind, and both the RPL RH3 and the RPL Option are marked mutable but recoverable: so an IPsec Authentication Header (AH) can be applied across these headers, but it cannot secure the values that mutate.¶

The RPI MUST be present in every single RPL data packet.¶

Prior to [RFC8138], there was significant interest in creating an exception to this rule and removing the RPI for Downward flows in Non-Storing mode. This exception covered a very small number of cases, and caused significant interoperability challenges while adding significant interest in the code and tests. The ability to compress the RPI down to three bytes or less removes much of the pressure to optimize this any further [ACP].¶

Throughout the following subsections, the examples are described in more detail in the first subsections, and more concisely in the later ones.¶

The use cases are delineated based on the following IPV6 and RPL mandates:¶

• The RPI has to be in every packet that traverses the LLN.¶

  • Because of the above requirement, packets from the Internet have to be encapsulated.¶
  • A header cannot be inserted or removed on the fly inside an IPv6 packet that is being routed.¶
  • Extension headers may not be added or removed except by the sender or the receiver.¶
  • RPI and RH3 headers may be modified by routers on the path of the packet without the need to add and remove an encapsulating header.¶
  • An RH3 or RPL Option can only be removed by an intermediate router if it is placed in an encapsulating IPv6 header, which is addressed to the intermediate router.¶
  • The Non-Storing mode requires downstream encapsulation by the root for RH3.¶

The use cases are delineated based on the following assumptions:¶

• This document assumes that the LLN is using the no-drop RPI Option Type (0x23).¶

  • Each IPv6 node (including Internet routers) obeys [RFC8200], so that the 0x23 RPI Option Type can be safely inserted.¶
  • All 6LRs obey [RFC8200].¶
  • The RPI is ignored at the IPv6 destination (dst) node (RUL).¶
  • In the use cases, we assume that the RAL supports IP-in-IP encapsulation.¶
  • In the use cases, we don't assume that the RUL supports IP-in-IP encapsulation.¶
  • For traffic leaving a RUL, if the RUL adds an opaque RPI, then the 6LR as a RPL Border Router SHOULD rewrite the RPI to indicate the selected Instance and set the flags.¶
  • The description for RALs applies to RAN in general.¶
  • Unconstrained uses of RPL are not in scope of this document.¶
  • Compression is based on [RFC8138].¶
  • The flow label [RFC6437] is not needed in RPL.¶

7. Storing Mode

In Storing mode (SM) (fully stateful), the sender can determine if the destination is inside the LLN by looking if the destination address is matched by the DIO's Prefix Information Option (PIO) option.¶

Table 4 itemizes which headers are needed in each of the following scenarios. It indicates whether an IPv6-in-IPv6 header must be added and to which destination it must be addressed:¶

1. the final destination (the RAL node that is the target (tgt)),¶
2. the "root", or¶
3. the 6LR parent of a RUL.¶

In cases where no IPv6-in-IPv6 header is needed, the column states "No", and the destination is N/A (Not Applicable). If the IPv6-in-IPv6 header is needed, the column shows "must".¶

In all cases, the RPI is needed, since it identifies inconsistencies (loops) in the routing topology. In general, the RH3 is not needed because it is not used in Storing mode. However, there is one scenario (from the root to the RUL in SM) where the RH3 can be used to point at the RUL (Table 8).¶

The leaf can be a router 6LR or a host, both indicated as 6LN. The root refers to the 6LBR (see Figure 3).¶

8. Non-Storing Mode

In Non-Storing mode (Non-SM) (fully source routed), the 6LBR (DODAG root) has complete knowledge about the connectivity of all DODAG nodes and all traffic flows through the root node. Thus, there is no need for all nodes to know about the existence of RPL-unaware nodes. Only the 6LBR needs to act if compensation is necessary for RPL-unaware receivers.¶

Table 19 summarizes which headers are needed in the following scenarios and indicates when the RPI, RH3, and IPv6-in-IPv6 header are to be inserted. The last column depicts the target destination of the IPv6-in-IPv6 header: 6LN (indicated by "RAL"), 6LR (parent of a RUL), or the root. In cases where no IPv6-in-IPv6 header is needed, the column indicates "No". There is no expectation on RPL that RPI can be omitted because it is needed for routing, quality of service, and compression. This specification expects that an RPI is always present. The term "may(up)" means that the IPv6-in-IPv6 header may be necessary in the Upward direction. The term "must(up)" means that the IPv6-in-IPv6 header must be present in the Upward direction. The term "must(down)" means that the IPv6-in-IPv6 header must be present in the Downward direction.¶

The leaf can be a router 6LR or a host, both indicated as 6LN (Figure 3). In Table 19, the (1) indicates a 6TiSCH case [RFC8180], where the RPI may still be needed for the RPLInstanceID to be available for priority/channel selection at each hop.¶

9. Operational Considerations of Supporting RULs

Roughly half of the situations described in this document involve leaf ("host") nodes that do not speak RPL. These nodes fall into two further categories: ones that drop a packet that have RPI or RH3 headers, and ones that continue to process a packet that has RPI and/or RH3 headers.¶

[RFC8200] provides for new rules that suggest that nodes that have not been configured (explicitly) to examine Hop-by-Hop headers should ignore those headers and continue processing the packet. Despite this, and despite the switch from 0x63 to 0x23, there may be nodes that predate RFC 8200 or are simply intolerant. Those nodes will drop packets that continue to have RPL artifacts in them. In general, such nodes cannot be easily supported in RPL LLNs.¶

There are some specific cases where it is possible to remove the RPL artifacts prior to forwarding the packet to the leaf host. The critical thing is that the artifacts have been inserted by the RPL root inside an IPv6-in-IPv6 header, and that the header has been addressed to the 6LR immediately prior to the leaf node. In that case, in the process of removing the IPv6-in-IPv6 header, the artifacts can also be removed.¶

The above case occurs whenever traffic originates from the outside the LLN (the "Internet" cases above), and Non-Storing mode is used. In Non-Storing mode, the RPL root knows the exact topology (as it must create the RH3 header) and therefore knows which 6LR is prior to the leaf. For example, in Figure 3, Node E is the 6LR prior to leaf Node G, or Node C is the 6LR prior to leaf Node J.¶

Traffic originating from the RPL root (such as when the data collection system is co-located on the RPL root), does not require an IPv6-in-IPv6 header (in Storing or Non-Storing mode), as the packet is originating at the root, and the root can insert the RPI and RH3 headers directly into the packet as it is formed. Such a packet is slightly smaller, but can only be sent to nodes (whether RPL aware or not) that will tolerate the RPL artifacts.¶

An operator that finds itself with a high amount of traffic from the RPL root to RPL-unaware leaves will have to do IPv6-in-IPv6 encapsulation if the leaf is not tolerant of the RPL artifacts. Such an operator could otherwise omit this unnecessary header if it was certain of the properties of the leaf.¶

As the Storing mode cannot know the final path of the traffic, intolerant leaf nodes, which drop packets with RPL artifacts, cannot be supported.¶

10. Operational Considerations of Introducing 0x23

This section describes the operational considerations of introducing the new RPI Option Type of 0x23.¶

During bootstrapping, the node receives the DIO with the information of RPI Option Type, indicating the new RPI in the DODAG Configuration option flag. The DODAG root is in charge to configure the current network with the new value, through DIO messages, and determines when all the nodes are set with the new value. The DODAG should change to a new DODAG version. In case of rebooting, the node does not remember the RPI Option Type. Thus, the DIO is sent with a flag indicating the new RPI Option Type.¶

The DODAG Configuration option is contained in a RPL DIO message, which contains a unique Destination Advertisement Trigger Sequence Number (DTSN) counter. The leaf nodes respond to this message with DAO messages containing the same DTSN. This is a normal part of RPL routing; the RPL root therefore knows when the updated DODAG Configuration option has been seen by all nodes.¶

Before the migration happens, all the RPL-aware nodes should support both values. The migration procedure is triggered when the DIO is sent with the flag indicating the new RPI Option Type. Namely, it remains at 0x63 until it is sure that the network is capable of 0x23, then it abruptly changes to 0x23. The 0x23 RPI Option allows the sending of packets to non-RPL nodes. The non-RPL nodes should ignore the option and continue processing the packets.¶

As mentioned previously, indicating the new RPI in the DODAG Configuration option flag is a way to avoid the flag day (abrupt changeover) in a network using 0x63 as the RPI Option Type value. It is suggested that RPL implementations accept both 0x63 and 0x23 RPI Option Type values when processing the header to enable interoperability.¶

11. IANA Considerations

12. Security Considerations

The security considerations covered in [RFC6553] and [RFC6554] apply when the packets are in the RPL Domain.¶

The IPv6-in-IPv6 mechanism described in this document is much more limited than the general mechanism described in [RFC2473]. The willingness of each node in the LLN to decapsulate packets and forward them could be exploited by nodes to disguise the origin of an attack.¶

While a typical LLN may be a very poor origin for attack traffic (as the networks tend to be very slow, and the nodes often have very low duty cycles), given enough nodes, LLNs could still have a significant impact, particularly if the attack is targeting another LLN. Additionally, some uses of RPL involve large-backbone, ISP-scale equipment [ACP], which may be equipped with multiple 100 Gb/s interfaces.¶

Blocking or careful filtering of IPv6-in-IPv6 traffic entering the LLN as described above will make sure that any attack that is mounted must originate from compromised nodes within the LLN. The use of BCP 38 [BCP38] filtering at the RPL root on egress traffic will both alert the operator to the existence of the attack, as well as drop the attack traffic. As the RPL network is typically numbered from a single prefix, which is itself assigned by RPL, BCP38 filtering involves a single prefix comparison and should be trivial to automatically configure.¶

There are some scenarios where IPv6-in-IPv6 traffic should be allowed to pass through the RPL root, such as the IPv6-in-IPv6 mediated communications between a new pledge and the Join Registrar/Coordinator (JRC) when using [BRSKI] and [ZEROTOUCH-JOIN]. This is the case for the RPL root to do careful filtering: it occurs only when the Join Coordinator is not co-located inside the RPL root.¶

With the above precautions, an attack using IPv6-in-IPv6 tunnels can only be by a node within the LLN on another node within the LLN. Such an attack could, of course, be done directly. An attack of this kind is meaningful only if the source addresses are either fake or if the point is to amplify return traffic. Such an attack could also be done without the use of IPv6-in-IPv6 headers using forged source addresses. If the attack requires bidirectional communication, then IPv6-in-IPv6 provides no advantages.¶

Whenever IPv6-in-IPv6 headers are being proposed, there is a concern about creating security issues. In the Security Considerations section of [RFC2473] (Section 9), it was suggested that tunnel entry and exit points can be secured by securing the IPv6 path between them. This recommendation is not practical for RPL networks. [RFC5406] goes into some detail on what additional details would be needed in order to "Use IPsec". Use of Encapsulating Security Payload (ESP) would prevent as defined in [RFC8138] (compression must occur before encryption), and [RFC8138] compression is lossy in a way that prevents use of AH. These are minor issues. The major issue is how to establish trust enough such that Internet Key Exchange Protocol Version 2 (IKEv2) could be used. This would require a system of certificates to be present in every single node, including any Internet nodes that might need to communicate with the LLN. Thus, using IPsec requires a global PKI in the general case.¶

More significantly, the use of IPsec tunnels to protect the IPv6-in-IPv6 headers would, in the general case, scale with the square of the number of nodes. This is a lot of resources for a constrained nodes on a constrained network. In the end, the IPsec tunnels would be providing only BCP38-like origin authentication! That is, IPsec provides a transitive guarantee to the tunnel exit point that the tunnel entry point did BCP38 on traffic going in. Just doing origin filtering per BCP 38 at the entry and exit of the LLN provides a similar level of security without all the scaling and trust problems related to IPv6 tunnels as discussed in [RFC2473]. IPsec is not recommended.¶

An LLN with hostile nodes within it would not be protected against impersonation within the LLN by entry/exit filtering.¶

The RH3 header usage described here can be abused in equivalent ways. An external attacker may form a packet with an RH3 that is not fully consumed and encapsulate it to hide the RH3 from intermediate nodes and disguise the origin of traffic. As such, the attacker's RH3 header will not be seen by the network until it reaches the destination, which will decapsulate it. As indicated in Section 4.2 of [RFC6554], RPL routers are responsible for ensuring that an SRH is only used between RPL routers. As such, if there is an RH3 that is not fully consumed in the encapsulated packet, the node that decapsulates it MUST ensure that the outer packet was originated in the RPL domain and drop the packet otherwise.¶

Also, as indicated by Section 2 of [RFC6554], RPL Border Routers "do not allow datagrams carrying an SRH header to enter or exit a RPL routing domain." This sentence must be understood as concerning non-fully-consumed packets. A consumed (inert) RH3 header could be present in a packet that flows from one LLN, crosses the Internet, and enters another LLN. Per the discussion in this document, such headers do not need to be removed. However, there is no case described in this document where an RH3 is inserted in a Non-Storing network on traffic that is leaving the LLN, but this document should not preclude such a future innovation.¶

In short, a packet that crosses the border of the RPL domain MAY carry an RH3, and if so, that RH3 MUST be fully consumed.¶

The RPI, if permitted to enter the LLN, could be used by an attacker to change the priority of a packet by selecting a different RPLInstanceID, perhaps one with a higher energy cost, for instance. It could also be that not all nodes are reachable in an LLN using the default RPLInstanceID, but a change of RPLInstanceID would permit an attacker to bypass such filtering. Like the RH3, an RPI is to be inserted by the RPL root on traffic entering the LLN by first inserting an IPv6-in-IPv6 header. The attacker's RPI therefore will not be seen by the network. Upon reaching the destination node, the RPI has no further meaning and is just skipped; the presence of a second RPI will have no meaning to the end node as the packet has already been identified as being at its final destination.¶

For traffic leaving a RUL, if the RUL adds an opaque RPI, then the 6LR as a RPL Border Router SHOULD rewrite the RPI to indicate the selected Instance and set the flags. This is done in order to avoid the following scenarios: 1) The leaf is an external router that passes a packet that it did not generate and that carries an unrelated RPI, and 2) The leaf is an attacker or presents misconfiguration and tries to inject traffic in a protected Instance. Also, this applies to the case where the leaf is aware of the RPL Instance and passes a correct RPI; the 6LR needs a configuration that allows that leaf to inject in that instance.¶

The RH3 and RPIs could be abused by an attacker inside of the network to route packets in nonobvious ways, perhaps eluding observation. This usage appears consistent with a normal operation of [RFC6997] and cannot be restricted at all. This is a feature, not a bug.¶

[RFC7416] deals with many other threats to LLNs not directly related to the use of IPv6-in-IPv6 headers, and this document does not change that analysis.¶

Nodes within the LLN can use the IPv6-in-IPv6 mechanism to mount an attack on another part of the LLN, while disguising the origin of the attack. The mechanism can even be abused to make it appear that the attack is coming from outside the LLN, and unless countered, this could be used to mount a DDOS attack upon nodes elsewhere in the Internet. See [DDOS-KREBS] for an example of such attacks already seen in the real world.¶

If an attack comes from inside of LLN, it can be alleviated with SAVI (Source Address Validation Improvement) using [RFC8505] with [RFC8928]. The attacker will not be able to source traffic with an address that is not registered, and the registration process checks for topological correctness. Notice that there is Layer 2 authentication in most of the cases. If an attack comes from outside LLN, IPv6-in-IPv6 can be used to hide inner routing headers, but by construction, the RH3 can typically only address nodes within the LLN. That is, an RH3 with a CmprI less than 8 should be considered an attack (see Section 3 of [RFC6554]).¶

Nodes outside of the LLN will need to pass IPv6-in-IPv6 traffic through the RPL root to perform this attack. To counter, the RPL root SHOULD either restrict ingress of IPv6-in-IPv6 packets (the simpler solution), or it SHOULD walk the IP header extension chain until it can inspect the upper-layer payload as described in [RFC7045]. In particular, the RPL root SHOULD do [BCP38] processing on the source addresses of all IP headers that it examines in both directions.¶

Note: there are some situations where a prefix will spread across multiple LLNs via mechanisms such as the one described in [RFC8929]. In this case, the BCP38 filtering needs to take this into account, either by exchanging detailed routing information on each LLN or by moving the BCP38 filtering further towards the Internet, so that the details of the multiple LLNs do not matter.¶

Acknowledgments

This work is done thanks to the grant given by the StandICT.eu project.¶

A special BIG thanks to C. M. Heard for the help with Section 4. Much of the redaction in that section is based on his comments.¶

Additionally, the authors would like to acknowledge the review, feedback, and comments of the following (in alphabetical order): Dominique Barthel, Robert Cragie, Ralph Droms, Simon Duquennoy, Cenk Guendogan, Rahul Jadhav, Benjamin Kaduk, Matthias Kovatsch, Gustavo Mercado, Subramanian Moonesamy, Marcela Orbiscay, Cristian Perez, Charlie Perkins, Alvaro Retana, Peter van der Stok, Xavier Vilajosana, Éric Vyncke, and Thomas Watteyne.¶

Authors' Addresses