| Internet-Draft | BGP Flow Specification for SRv6 | September 2026 |
| Li, et al. | Expires 21 March 2027 | [Page] |
This document specifies extensions to BGP Flow Specification (BGP-FS) to enable filtering of IPv6 packets based on the structural components of an SRv6 Segment Identifier (SID) present in the IPv6 Destination Address (representing the active segment of an SRv6 path).¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 21 March 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
[RFC8955] defines the BGP Flow Specification (BGP-FS) Network Layer Reachability Information (NLRI) to distribute traffic filtering rules, which consist of an n-tuple of matching criteria applied to IP packets. [RFC8956] extends this framework to IPv6 data packets. Additionally, [I-D.ietf-idr-flowspec-l2vpn] extends Flowspec rules for Layer 2 Ethernet frames, and [I-D.ietf-idr-flowspec-v2] specifies BGP Flow Specification Version 2.¶
Segment Routing over IPv6 (SRv6) [RFC8754] leverages the IPv6 data plane using a Segment Routing Header (SRH) to instantiate Segment Routing policy paths. The SRv6 Network Programming architecture [RFC8986] defines the structure of an SRv6 Segment Identifier (SID), typically formatted as LOC:FUNCT:ARG::, where:¶
LOC (Locator): A routable prefix assigned to an SRv6 node that instantiates the SID. Operators may choose variable locator lengths.¶
FUNCT (Function): An opaque identifier bound to a local function executed on the node (e.g., End, End.X, End.DT4).¶
ARG (Argument): Optional arguments appended immediately following the FUNCT field for specialized local processing.¶
Existing IPv6 BGP-FS components [RFC8956] allow matching against the entire 128-bit IPv6 Destination Address (DA). However, SRv6 SIDs embed structured sub-fields (Locator, Function, and Argument) within the IPv6 DA. Filtering traffic based solely on a full 128-bit mask lacks the flexibility needed to apply policy rules to specific SRv6 functions or argument ranges across different locators.¶
This document defines a new BGP Flow Specification component type to support sub-field matching for SRv6 SIDs. The matching field is evaluated against the IPv6 Destination Address (or active SID within an SRH when present, as shown in Figure 1). To support this feature, a BGP-FS NLRI with AFI = 2 (IPv6) MUST be used.¶
+-----------------------------+
IPv6 Header| SA | DA |<-- Match Field
+--------------------^--------+
|
+--------------------|--------+
| +-------------+ | +-------------------+
| | Segment[0] +-------> Loc | Func | Arg |
| +-------------+ | +-------------------+
| | Segment[1] | |
| +-------------+ |
| | ... | |
SR Header| +-------------+ |
(RFC 8754)| | Segment[n] | |
| +-------------+ |
| +-------------+ |
| ~ Option TLV ~ |
| +-------------+ |
+-----------------------------+
A Flow Specification NLRI consists of zero or more matching components. Components Type 1 through 13 are defined in [RFC8955] and [RFC8956]. This document defines a new component type for SRv6 SID sub-field filtering.¶
An SRv6 SID consists of Locator, Function, and Argument fields as defined in [RFC8986]. In operational scenarios, operators may need to filter traffic matching specific locators, functions, or arguments, or combinations thereof.¶
The new component type TBD1 (SRv6 SID Structure Match) allows fine-grained matching on these individual fields or aggregated field combinations.¶
Encoding: <type, LOC-Len, FUNCT-Len, ARG-Len, [op, value]+>¶
Validation Constraint:¶
The sum of LOC-Len, FUNCT-Len, and ARG-Len MUST NOT exceed 128 bits. If (LOC-Len + FUNCT-Len + ARG-Len) > 128, the NLRI is considered malformed, and BGP Error Handling MUST be applied according to [RFC7606] and [RFC4760].¶
The Operator byte (op) is encoded as follows:¶
0 1 2 3 4 5 6 7 +---+---+---+---+---+---+---+---+ | e | a | field type|lt |gt |eq | +---+---+---+---+---+---+---+---+¶
The operator semantics follow the Numeric Operator definition in [RFC8955]:¶
e - end-of-list bit. Set in the last {op, value} pair in the sequence.¶
a - AND bit. If unset, the previous term is logically ORed with the current one. If set, the operation is a logical AND. It should be unset in the first operator byte of a sequence. The AND operator has higher priority than OR for the purposes of evaluating logical expressions.¶
field type:¶
lt, gt, eq - Less-than, Greater-than, and Equal-to comparison operators, evaluated bitwise or numerically between the extracted SID sub-field and the provided value.¶
The length of the Value field following the operator byte is determined by the selected field type, rounded up to the nearest byte boundary (i.e., ceil(bits / 8)).¶
+----------------------+-------------------------------------------+ | Field Type | Value Field Length & Contents | +======================+===========================================+ | SID's LOC | ceil(LOC-Len / 8) octets | +----------------------+-------------------------------------------+ | SID's FUNCT | ceil(FUNCT-Len / 8) octets | +----------------------+-------------------------------------------+ | SID's ARG | ceil(ARG-Len / 8) octets | +----------------------+-------------------------------------------+ | SID's LOC:FUNCT | ceil((LOC-Len + FUNCT-Len) / 8) octets | +----------------------+-------------------------------------------+ | SID's FUNCT:ARG | ceil((FUNCT-Len + ARG-Len) / 8) octets | +----------------------+-------------------------------------------+ | SID's LOC:FUNCT:ARG | ceil((LOC-Len+FUNCT-Len+ARG-Len)/8) octets| +----------------------+-------------------------------------------+¶
Consider a rule targeting all SRv6 traffic directed to Locator 2001:db8:3::/48 with a Function ID within the range [0x0100, 0x0300].¶
Given:¶
Hexadecimal Encoding Sequence:¶
Some Parts of SID
|
length v LOC==20010db80003 FUN>=100 FUN<=300
0x11 TBD1 30 10 40 01 2001 0db8 0003 4b 0100 8d 0300
^ ^ ^
| | |
Length of LOC FUN ARG¶
Detailed Field Breakdown:¶
Decoded:
Value
0x11 length 17 octets (if len<240, 1 octet)
TBD1 type type TBD1 - Some Parts of SID
0x30 LOC Length = 48 (bits)
0x10 FUNCT Length = 16 (bits)
0x40 ARG Length = 64 (bits)
0x01 op LOC ==
0x2001 value LOC's value = 2001:db8:3
0x0db8
0x0003
0x4b op "AND", FUNCT >=
0x0100 value FUNCT's value = 0100
0x8d op end-of-list, "AND", FUNCT <=
0x0300 value FUNCT's value = 0300
¶
This document introduces no new security vulnerabilities beyond those already documented in [RFC8955] and [RFC8956]. Because Flowspec rules can result in packet dropping or rate-limiting, implementations MUST verify the authorization of BGP peers sending SRv6 Flowspec rules to prevent potential Denial-of-Service (DoS) attacks or traffic hijacking.¶
Under "Flow Spec Component Types" registry, IANA is requested to assign the following values:¶
+-------+------------+---------------------------+---------------+ | Value | IPv4 Name | IPv6 Name | Reference | +-------+------------+---------------------------+---------------+ | TBD1 | Unassigned | SRv6 SID Structure Match | This Document | +-------+------------+---------------------------+---------------+¶
The authors would like to thank Joel Halpern, Jeffrey Haas, Ketan Talaulikar, Aijun Wang, Dhruv Dhody, Ming Shen and Rainsword Wang for their valuable suggestions and comments.¶
Lei Li Huawei P.R. China Email: lily.lilei@huawei.com Yanhe Fan Casa Systems United States of America Email: yfan@casa-systems.com Lei Liu Fujitsu United States of America Email: liulei.kddi@gmail.com Xufeng Liu Volta Networks United States of America Email: xufeng.liu.ietf@gmail.com¶