Internet-Draft New TCP and IPv6 EH IPFIX IEs September 2023
Boucadair & Claise Expires 22 March 2024 [Page]
Workgroup:
OPSAWG
Internet-Draft:
draft-ietf-opsawg-ipfix-tcpo-v6eh-01
Published:
Intended Status:
Standards Track
Expires:
Authors:
M. Boucadair
Orange
B. Claise
Huawei

Extended TCP Options and IPv6 Extension Headers IPFIX Information Elements

Abstract

This document specifies new IP Flow Information Export (IPFIX) Information Elements (IEs) to solve some issues with existing ipv6ExtensionHeaders and tcpOptions IPFIX IEs, especially the ability to export any observed IPv6 extension headers or TCP options.

Discussion Venues

This note is to be removed before publishing as an RFC.

Discussion of this document takes place on the Operations and Management Area Working Group Working Group mailing list (opsawg@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/opsawg/.

Source for this draft and an issue tracker can be found at https://github.com/boucadair/ipfix-tcpoptions-and-v6eh.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 22 March 2024.

1. Introduction

This document specifies new IP Flow Information Export (IPFIX) Information Elements (IEs) to solve a set of issues encountered with the specifications of ipv6ExtensionHeaders (to export IPv6 extension headers) and tcpOptions (to export TCP options). More details about these issues are provided in the following sub-sections.

1.1. ipv6ExtensionHeaders Issues

The specification of ipv6ExtensionHeaders IPFIX IE does not:

  • Cover the full extension headers range (Section 4 of [RFC8200]).
  • Specify the procedure to follow when all bits are exhausted.
  • Specify a means to export the number of occurences of a given extension header.
  • Specify how to automatically update the IANA IPFIX registry ([IANA-IPFIX]) when a new value is assigned in [IANA-EH].

The last issue is now solved in [I-D.ietf-opsawg-ipfix-fixes] which defines a new IANA registry entitled "ipv6ExtensionHeaders Bits" under the IANA IPFIX registry group [IANA-IPFIX].

Section 3 addresses three first issues.

1.2. tcpOptions Issues

The specification of tcpOptions IPFIX IE does not:

  • Describe how any observed TCP option in a packet can be exported using IPFIX. Only TCP options having a kind =< 63 can be exported in a tcpOptions IPFIX IE.
  • Support means to report the observed Experimental Identifiers (ExIDs) that are carried in shared TCP options (kind=253 or 254) [RFC6994].

Section 4 addresses these issues.

2. Conventions and Definitions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

This document uses the IPFIX-specific terminology (Information Element, Template, Collector, Data Record, Flow Record, Exporting Process, Collecting Process, etc.) defined in Section 2 of [RFC7011]. As in [RFC7011], these IPFIX-specific terms have the first letter of a word capitalized.

3. IPv6 Extension Header

3.1. ipv6ExtensionHeadersFull Information Element

Name:

ipv6ExtensionHeadersFull

ElementID:

TBD1

Description:

IPv6 extension headers observed in packets of this Flow. The information is encoded in a set of bit fields. For each IPv6 extension header, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding IPv6 extension header. Otherwise, if no observed packet of this Flow contained the respective IPv6 extension header, the value of the corresponding bit is 0. The IPv6 extension header associated with each bit is provided in [NEW_IPFIX_IPv6EH_SUBREGISTRY].

The value should be encoded in fewer octets as per the guidelines in Section 6.2 of [RFC7011].

Abstract Data Type:

unsigned

Data Type Semantics:

flags

Additional Information:

See the assigned bits to each IPv6 extension header type in [NEW_IPFIX_IPv6EH_SUBREGISTRY].

See Section 4 of [RFC8200] for the general definition of IPv6 extension headers and [IANA-EH] for assigned extension header types.

Reference:

This-Document

  • Note to the RFC Editor: Please replace [NEW_IPFIX_IPv6EH_SUBREGISTRY] with the link to the "ipv6ExtensionHeaders Bits" registry created by [I-D.ietf-opsawg-ipfix-fixes].

3.2. ipv6ExtensionHeaderCount Information Element

Name:

ipv6ExtensionHeaderCount

ElementID:

TBD2

Description:

As per [RFC8200], IPv6 nodes must accept and attempt to process extension headers in occurring any number of times in the same packet. This Information Element echoes the order and number of occurences of the same extension header instance in an IPv6 packet.

IPFIX reduced-size encoding as per Section 6.2 of [RFC7011] is used as required.

 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 ...
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |  EH Type#1    |   Count       |...|  EH Type#n      |   Count       |
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Abstract Data Type:

unsigned64

Data Type Semantics:

identifier

Additional Information:

See the assigned IPv6 extension header types in [IANA-EH].

See [RFC8200] for the general definition of IPv6 extension headers.

Reference:

This-Document

4. Information Elements for TCP Options

4.1. tcpOptionsFull Information Element

This section specifies a new Information Element to cover the full TCP options range.

Name:

tcpOptionsFull

ElementID:

TBD3

Description:

TCP options in packets of this Flow. The information is encoded in a set of bit fields. For each TCP option, there is a bit in this set. The bit is set to 1 if any observed packet of this Flow contains the corresponding TCP option. Otherwise, if no observed packet of this Flow contained the respective TCP option, the value of the corresponding bit is 0.

Options are mapped to bits according to their option numbers. Option number X is mapped to bit position X. TCP option numbers are maintained by IANA.

The value should be encoded in fewer octets as per the guidelines in Section 6.2 of [RFC7011].

Abstract Data Type:

unsigned

Data Type Semantics:

flags

Additional Information:

See the assigned TCP option kinds at [IANA-TCP].

See [RFC9293] for the general definition of TCP options.

Reference:

This-Document

4.2. New Information Elements for Shared TCP Options

ExIDs can be either 2 or 4 bytes in length [RFC6994]. Two new IPFIX IEs are defined to accomodate these two lengths without introducing extra complexity in mixing both types in the same IPFIX IE.

4.2.1. tcpSharedOptionExID16 Information Element

Name:

tcpSharedOptionExID16

ElementID:

TBD4

Description:

Observed 2-byte Expermients IDs (ExIDs) in a shared TCP option (Kind=253 or 254). The information is encoded in a set of 16-bit fields. Each 16-bit field carries the observed 2-byte ExID in a shared option.

Abstract Data Type:

octetArray

Data Type Semantics:

identifier

Additional Information:

See assigned 16-bit ExIDs at [IANA-TCP-EXIDs].

Reference:

This-Document

4.2.2. tcpSharedOptionExID32 Information Element

Name:

tcpSharedOptionExID32

ElementID:

TBD5

Description:

Observed 4-byte Expermients ID (ExIDs) in a shared TCP option (Kind=253 or 254). The information is encoded in a set of 16-bit fields. Each 32-bit field carries the observed 4-byte ExID in a shared option.

Abstract Data Type:

octetArray

Data Type Semantics:

identifier

Additional Information:

See assigned 32-bit ExIDs at [IANA-TCP-EXIDs].

Reference:

This-Document

5. Security Considerations

IPFIX security considerations are discussed in Section 8 of [RFC7012].

6. IANA Considerations

This document requests IANA to add the following new IPFIX IEs to the IANA IPFIX registry [IANA-IPFIX]:

Table 1: New IPFIX Information Elements
Value Name Reference
TBD1 ipv6ExtensionHeadersFull Section 3.1 of This-Document
TBD2 ipv6ExtensionHeaderCount Section 3.2 of This-Document
TBD3 tcpOptionsFull Section 4.1 of This-Document
TBD4 tcpSharedOptionExID16 Section 4.2.1 of This-Document
TBD5 tcpSharedOptionExID32 Section 4.2.2 of This-Document

7. References

7.1. Normative References

[IANA-EH]
IANA, "Internet Protocol Version 6 (IPv6) Parameters, IPv6 Extension Header Types", <https://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml#ipv6-parameters-1>.
[IANA-IPFIX]
IANA, "IP Flow Information Export (IPFIX) Entities", <https://www.iana.org/assignments/ipfix/ipfix.xhtml>.
[IANA-TCP]
IANA, "Transmission Control Protocol (TCP) Parameters, TCP Option Kind Numbers", <https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-parameters-1>.
[IANA-TCP-EXIDs]
IANA, "Transmission Control Protocol (TCP) Parameters, TCP Experimental Option Experiment Identifiers (TCP ExIDs)", <https://www.iana.org/assignments/tcp-parameters/tcp-parameters.xhtml#tcp-exids>.
[RFC2119]
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <https://www.rfc-editor.org/rfc/rfc2119>.
[RFC6994]
Touch, J., "Shared Use of Experimental TCP Options", RFC 6994, DOI 10.17487/RFC6994, , <https://www.rfc-editor.org/rfc/rfc6994>.
[RFC7011]
Claise, B., Ed., Trammell, B., Ed., and P. Aitken, "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information", STD 77, RFC 7011, DOI 10.17487/RFC7011, , <https://www.rfc-editor.org/rfc/rfc7011>.
[RFC7012]
Claise, B., Ed. and B. Trammell, Ed., "Information Model for IP Flow Information Export (IPFIX)", RFC 7012, DOI 10.17487/RFC7012, , <https://www.rfc-editor.org/rfc/rfc7012>.
[RFC8174]
Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, , <https://www.rfc-editor.org/rfc/rfc8174>.
[RFC8200]
Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", STD 86, RFC 8200, DOI 10.17487/RFC8200, , <https://www.rfc-editor.org/rfc/rfc8200>.
[RFC9293]
Eddy, W., Ed., "Transmission Control Protocol (TCP)", STD 7, RFC 9293, DOI 10.17487/RFC9293, , <https://www.rfc-editor.org/rfc/rfc9293>.

7.2. Informative References

[I-D.ietf-opsawg-ipfix-fixes]
Boucadair, M. and B. Claise, "Simple Fixes to the IP Flow Information Export (IPFIX) IANA Registry", Work in Progress, Internet-Draft, draft-ietf-opsawg-ipfix-fixes-01, , <https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-ipfix-fixes-01>.

Acknowledgments

Thanks to Paul Aitken for the review.

Authors' Addresses

Mohamed Boucadair
Orange
Benoit Claise
Huawei