Traffic Selectors for Flow Bindings
Extracted elements (17)
Binary traffic selector formats were chosen to allow efficient identification of flows based on well-known fields in IPv4, IPv6, TCP, and UDP headers. A flag-per-field scheme avoids transmitting absent fields, keeping the sub-option compact while supporting a wide range of matching criteria.
The DS and TC range fields are defined as 8 bits wide even though only 6 bits are significant, and the 2 LSBs are explicitly required to be ignored during comparison. This preserves the byte boundary alignment while accommodating the RFC 3168 ECN reclamation of those bits.
The IPv6 flow label field is stored as a 32-bit quantity despite being only 24 bits wide per RFC 2460; senders zero-pad the high 8 bits and receivers ignore them. This decision keeps the field 32-bit aligned within the sub-option without introducing a special-case partial-word encoding.
This specification depends on the traffic selector sub-option container format defined in RFC 6089. Implementations must pair these binary selector formats with the sub-option framing from RFC 6089 and must use the TS Format field values defined here to identify which encoding is in use.
An End field (e.g., End Source Address, End Destination Port, End IPsec SPI) MUST NOT be included in a traffic selector unless the corresponding Start field is also included.
For the IPv4 (K)Start DS field, the 2 least significant bits MUST be ignored in any comparison, as they are reserved for ECN use per RFC 3168. The same rule applies to the (L)End DS field, which MUST be coded the same way as (K).
For the IPv6 (G)Start Flow Label field, the sender MUST prefix the 24-bit flow label value with 8 bits of '0' before inserting it into the 32-bit field. The receiver SHOULD ignore the first 8 bits before using the value in comparisons.
For the IPv6 (M)Start TC and (N)End TC fields, the 2 least significant bits MUST be ignored in any comparison, consistent with the DS/ECN split defined in RFC 3168. The (N)End TC field MUST be coded the same way as (M)Start TC.
Reserved bits in both IPv4 and IPv6 traffic selectors MUST be set to zero by the sender and ignored by the receiver.
The (E)/(F) IPsec SPI range fields in both IPv4 and IPv6 traffic selectors are 32-bit values as defined in RFC 4303, allowing selection of flows protected by a specific SPI or contiguous range of SPIs.
The IPv4 traffic selector supports matching on source/destination IPv4 address ranges (32-bit each), IPsec SPI ranges (32-bit), source/destination TCP/UDP port ranges (16-bit), differentiated services ranges (8-bit), and IP protocol number ranges (8-bit). All fields are optional and their presence is indicated by per-field flags A through N.
The IPv6 traffic selector extends the IPv4 variant with 128-bit address ranges and adds IPv6-specific fields: a 32-bit flow label range (with the actual 24-bit flow label zero-padded to 32 bits) and an 8-bit next header range, replacing the IPv4 protocol field. Flags A through P indicate presence of each field.
The TS Format field within the traffic selector sub-option (defined in RFC 6089) selects the encoding: value 1 selects the IPv4 binary traffic selector; value 2 selects the IPv6 binary traffic selector.
Two new values are assigned in the 'Traffic Selector Format' namespace defined by RFC 6089: value 1 for 'IPv4 Binary Traffic Selector' and value 2 for 'IPv6 Binary Traffic Selector'.
The document defines only the wire format of the traffic selector sub-option for flow bindings; no security concerns beyond those already identified in RFC 6089 (the flow bindings specification) are introduced by this format definition.
The IPv4 binary traffic selector is a variable-length sub-option containing a 2-bit flags word (A–N) indicating which fields are present, followed by optional fields: 32-bit source/destination address ranges, 32-bit IPsec SPI range, 16-bit source/destination port ranges, 8-bit DS range, and 8-bit protocol range. Alignment is 4n if address or SPI fields are present, 2n for port fields, and n for DS or protocol fields.
The IPv6 binary traffic selector sub-option carries a 16-bit flags word (A–P) followed by optional fields: 128-bit source/destination address ranges, 32-bit IPsec SPI range, 32-bit flow label range, 16-bit source/destination port ranges, 8-bit traffic class range, and 8-bit next header range. Alignment is 8n if IPv6 address fields are set, 4n for SPI/flow label, 2n for ports, and n for TC/NH fields.