| RFC 9516 | Active OAM for SFC | November 2023 |
| Mirsky, et al. | Standards Track | [Page] |
A set of requirements for active Operations, Administration,and Maintenance (OAM) for Service Function Chaining (SFC) in a network is presented in this document. Based on these requirements, an encapsulation of active OAM messages in SFC anda mechanism to detect and localize defects are described.¶
This is an Internet Standards Track document.¶
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained athttps://www.rfc-editor.org/info/rfc9516.¶
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
[RFC7665] defines data plane elements necessary to implement Service Function Chaining (SFC). These include the following:¶
There are different views from different levels of SFC. One is the service function chain, an entirely abstract view, which defines an ordered set of SFs that must be applied to packets selected based on classification rules. But the service function chain doesn't specify the exact mapping between SFFs and SFs. Thus, another logical construct used in SFC is a Service Function Path (SFP). According to[RFC7665], an SFP is the instantiation of SFC in the network and provides a level of indirection between the entirely abstract SFCs and a fully specified, ordered list of SFF and SF identities that the packet will visit when it traverses SFC. The latter entity is referred to as Rendered Service Path (RSP). The main difference between an SFP and RSP is that the former is the logical construct, while the latter is the realization of the SFP via the sequence of specific SFC data plane elements.¶
This document defines how active Operations, Administration, and Maintenance (OAM), per the definition of active OAM in[RFC7799], is implemented when the Network Service Header (NSH)[RFC8300] is used as the SFC encapsulation. Following the analysis of SFC OAM in[RFC8924], this document applies and, when necessary, extends requirements listed inSection 4 of [RFC8924] for the use of active OAM in an SFP supporting fault management and performance monitoring. Active OAM tools that are conformant to this specification improve OAM's ability for Fault Management (FM) by, for example, using the query mechanism to troubleshoot and localize defects, which conforms to the stateless character of transactions in SFC NSH[RFC8300]. Note that Performance Monitoring OAM, as required by[RFC8924], is not satisfied by this document and is out of scope. For the purpose of FM OAM in SFC, the SFC Echo Request and Echo Reply are specified inSection 6. These mechanisms enable on-demand continuity check and connectivity verification, among other operations, over SFC in networks and address functionalities discussed in Sections4.1,4.2, and4.3 of[RFC8924].The SFC Echo Request and Echo Reply can be used with encapsulations other than the NSH, for example,using MPLS encapsulation, as described in[RFC8595]. The applicability of the SFC Echo Request/Reply mechanismin SFC encapsulations other than the NSH is outside the scope of this document.¶
The intended scope of SFC active OAM is for use within a single provider's operational domain. The SFC active OAM deployment scope is deliberately constrained, as explained in[RFC7665] and[RFC8300], and limited to a single network administrative domain.¶
The terminology defined in[RFC7665] is used extensively throughout this document, and the reader is expected to be familiar with it.¶
In this document, SFC OAM refers to an active OAM[RFC7799] in an SFC architecture. Additionally, "Echo Request/Reply" and "SFC Echo Request/Reply" are used interchangeably.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14[RFC2119][RFC8174] when, and only when, they appear in all capitals, as shown here.¶
As discussed in[RFC8924], SFC-specific means are needed to perform the FM OAM task in an SFC architecture, including failure detection, defect characterization, and localization. This document defines the set of requirements for active FM OAM mechanisms to be used in an SFC architecture.¶
+-----+ +-----+ +-----+ +-----+ +-----+ +-----+ |SFI11| |SFI12| |SFI21| |SFI22| |SFI31| |SFI32| +-----+ +-----+ +-----+ +-----+ +-----+ +-----+ \ / \ / \ / +----------+ +----+ +----+ +----+ |Classifier|---|SFF1|---------|SFF2|----------|SFF3| +----------+ +----+ +----+ +----+
The architecture example depicted inFigure 1 considers a service function chain that includes three distinct service functions. In this example, the SFP traverses SFF1, SFF2, and SFF3. Each SFF is connected to two Service Function Instances (SFIs) of the same SF. End-to-End (E2E) SFC OAM has the Classifier as the ingress and SFF3 as its egress. The scope of Segment SFC OAM is between two elements that are part of the same SFP. The following are the requirements for an FM SFC OAM, whether with the E2E or segment scope:¶
The fate sharing, in the SFC environment, is achieved when a test packet traverses the same path and receives the same treatment in the underlay network layer as an SFC-encapsulated packet.¶
An SFC failure might be declared when several consecutive test packets are not received within a predetermined time. For example, in the E2E FM SFC OAM case, i.e., the egress, SFF3 (Figure 1) could be the entity that detects the SFP's failure by monitoring a flow of periodic test packets. The ingress may be capable of recovering from the failure, e.g., using redundant SFC elements. Thus, it is beneficial for the egress to signal the new defect state to the ingress, which in this example, is the Classifier, hence, the following requirement:¶
Once an SFF detects the defect, the objective of the SFC OAM changes from the detection of a defect to defect characterization and localization.¶
In the example presented inFigure 1, two distinct instances of the same SF share the same SFF. In this example, the SFP can be realized over several RSPs that use different instances of the SF of the same type, for instance, RSP1(SFI11--SFI21--SFI31) and RSP2(SFI12--SFI22--SFI32). Available RSPs can be discovered using the trace function discussed inSection 4.3 of [RFC8924] or the procedure defined inSection 6.5.4.¶
The SFC OAM layer model described in[RFC8924] offers an approach for defect localization within a service function chain. As the first step, the SFP's continuity for SFFs that are part of the same SFP could be verified. After the reachability of SFFs has already been verified, SFFs that serve an SF may be used as a test packet source. In such a case, an SFF can act as a proxy for another element within the service function chain.¶
The conformance of the SFC Echo Request/Reply mechanism to these requirements is reflected below:¶
SFC active OAM combines OAM commands and/or data included in a message that immediately follows the NSH. To identify the SFC active OAM message, the Next Protocol fieldMUST be set to SFC Active OAM (0x07) (Section 9.1). The O bit in the NSHMUST be set, according to[RFC9451]. A case when the O bit is clear and the Next Protocol field value is set to SFC Active OAM (0x07) is considered an erroneous combination. An implementationMUST report it. Although the notification mechanism is outside the scope of this specification, note that itMUST include rate-limiting control. The packetSHOULD be dropped. An implementationMAY have control to enable the processing of the OAM payload.¶
SFC OAM is required to perform multiple tasks. Several active OAM protocols could be used to address all the requirements. When IP/UDP encapsulation of an SFC OAM control message is used, protocols can be demultiplexed using the destination UDP port number. But an extra IP/UDP header, especially in an IPv6 network, adds overhead compared to the length of an Active OAM Control Packet (e.g., BFD Control packet[RFC5880]). In some environments, for example, when measuring performance metrics, it is beneficial to transmit OAM packets in a broad range of lengths to emulate application traffic closer. This document defines an Active OAM Header (Figure 2) to demultiplex active OAM protocols on SFC.¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| V | Msg Type | Reserved | Length |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+~ SFC Active OAM Control Packet ~+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The Echo Request/Reply is a well-known active OAM mechanism extensively used to verify a path's continuity, detect inconsistencies between a state in control and the data planes, and localize defects in the data plane. ICMP ([RFC0792] for IPv4 and[RFC4443] for IPv6 networks) and MPLS[RFC8029] are examples of broadly used active OAM protocols based on the Echo Request/Reply principle. The SFC Echo Request/Reply control message (format is presented inFigure 3) is an instance of the SFC Active OAM Control Packet that is a part of the SFC Active OAM Header (Figure 2).¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Echo Request Flags | Reserved |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Echo Type | Reply Mode | Return Code |Return Subcode |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Sender's Handle |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Sequence Number |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+~ TLVs ~+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The interpretation of the fields is as follows:¶
TLV is a variable-length construct whose length is multiple four-octet words. Multiple TLVsMAY be placed in an SFC Echo Request/Reply packet. None, one, or more sub-TLVs may be enclosed in the value part of a TLV, subject to the semantics of the (outer) TLV. If no TLVs are included in an SFC Echo Request/Reply, the value of the Length field in the SFC Active OAM HeaderMUST be 16 octets.Figure 4 presents the format of an SFC Echo Request/Reply TLV, where the fields are defined as follows:¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Type | Reserved | Length |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+~ Value ~+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The value of the Return Code fieldMUST be set to zero by the sender of an Echo Request. The receiver of said Echo RequestMUST set it to one of the values in IANA's "SFC Echo Return Codes" registry (Section 9.2.5) in the corresponding Echo Reply that it generates.¶
Authentication can be used to protect the integrity of the information in the SFC Echo Request and/or Echo Reply.In[RFC9145], a variable-length Context Header has been defined to protect the integrityof the NSH and the payload. The header can also be used for the optional encryption of sensitive metadata.The MAC#1 Context Header is more suitable for the integrity protection of SFC active OAM,particularly of the SFC Echo Request and Echo Reply, as defined in this document. On the other hand, using the MAC#2 Context Header allows the detectionof mishandling of the O bit by a transient SFC element.¶
The SFC Echo Request control packetMUST use the appropriate underlay network encapsulation of the monitoredSFP. The Echo RequestMUST set the O bit in the NSH, as defined in[RFC9451].The NSHMUST be immediately followed by the SFC Active OAM Header defined inSection 4.The Echo Type field's value in the SFC Active OAM HeaderMUST be set to the SFC Echo Request/Reply value (1), perSection 9.2.1.¶
The value of the Reply Mode fieldMUST be set to one of the following:¶
The responder to the SFC Echo Request encapsulates the SFC Echo Reply message in the IP/UDP packet if the Reply Mode is "Reply via an IPv4/IPv6 UDP Packet" or "Reply via an IPv4/IPv6 UDP Packet with the data integrity protection". Because the NSH does not identify the ingress node that generated the Echo Request, information that sufficiently identifies the sourceMUST be included in the message so that the IP destination address and destination UDP port number for IP/UDP encapsulation of the SFC Echo Reply could be derived. The sender of the SFC Echo RequestMUST include the Source ID TLV (Figure 5).¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Source ID | Reserved1 | Length |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Port Number | Reserved2 |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+~ IP Address ~+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are defined as follows:¶
A single Source ID TLV for each address family, i.e., IPv4 and IPv6,MAY be present in an SFC Echo Request message. If the Source ID TLVs for both address families are present in an SFC Echo Request message, the SFFMUST NOT replicate an SFC Echo Reply but choose the destination IP address for the one SFC Echo Reply it sends based on the local policy. The source IP address used in the IP/UDP encapsulation of the SFC Echo Reply is one of the IP addresses associated with the responder. The value of the Port Number fieldMUST be used as the destination UDP port number in the IP/UDP encapsulation of the SFC Echo Reply message. The responder selects the source UDP port number from the dynamic range of port numbers. If more than one Source ID TLV per the address family is present, the receiverMUST use the first TLV and ignore the rest. The Echo Reply message, including relevant TLVs, follows the IP/UDP headers immediately.¶
Punting a received SFC Echo Request to the control plane for validation and processing is triggered by one of the following packet processing exceptions: NSH TTL expiration, NSH Service Index expiration, or the receiver is the terminal SFF for an SFP.¶
An SFF that received the SFC Echo RequestMUST validate the packet as follows:¶
If the SFC Echo Request is integrity protected, the receiving SFF firstMUST verify the authentication.¶
Validate the Source ID TLV, as defined inSection 6.3.1.¶
If the Return Code for the Echo Reply is determined as 2 ("One or more of the TLVs was not understood"), the Errored TLVs TLV might be included in an Echo Reply. The use of this TLVis meant to inform the sender of an Echo Request of TLVs either notsupported by an implementation or parsed and found to be in error.¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Errored TLVs | Reserved | Length |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Value |. .. .. .| |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are defined as follows:¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Sub-TLV Type | Reserved | Sub-TLV Length |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+~ Sub-TLV Value ~+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are defined as follows:¶
The Reply Mode field directs whether and how the Echo Reply message should be sent.The Echo Request senderMAY use TLVs to request that the corresponding Echo Replybe transmitted over the specified path. For example, a TLV that specifies the return path of the Echo Reply if the Return Mode in the Echo Request is setto Reply via Specified Path (4) is described inSection 6.5.1.Value 1 is the "Do Not Reply" mode andsuppresses the Echo Reply packet transmission. The value 2 of the Reply Mode field requestssending the Echo Reply packet out-of-band as an IPv4/IPv6 UDP packet.¶
While the SFC Echo Request always traverses the SFP it is directed to byusing the NSH, the corresponding Echo Reply usually is sent without the NSH.In some cases, an operator might choose to direct the responderto send and Echo Reply with the NSH over a particular SFP.This section defines a new TLV, i.e., Reply Service Function Path TLV, for Reply via Specified Path mode of the SFC Echo Reply.¶
The Reply Service Function Path TLV can provide an efficient mechanism to test SFCs, such as bidirectional and hybrid SFC, as defined inSection 2.2 of [RFC7665]. For example, it allows an operator to test both directions of the bidirectional or hybrid SFP with a single SFC Echo Request/Reply operation.¶
The Reply Service Function Path TLV carries the information that sufficiently identifies the return SFP that the SFC Echo Reply message is expected to follow. The format of Reply Service Function Path TLV is shown inFigure 8.¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Reply SFP | Reserved | Length |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Reply Service Function Path Identifier | Service Index |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are defined as follows:¶
[RFC7110] defines a mechanism to control the return path for the MPLS Label Switched Path (LSP) Echo Reply. In the SFC's case, the return path is an SFP along which the SFC Echo Reply messageMUST be transmitted. Hence, the Reply Service Function Path TLV included in the SFC Echo Request messageMUST sufficiently identify the SFP that the sender of the Echo Request message expects the receiver to use for the corresponding SFC Echo Reply.¶
When sending an Echo Request, the senderMUST set the value of the Reply Mode field to "Reply via Specified Path", defined inSection 6.3, and if the specified path is an SFC path, the RequestMUST include the Reply Service Function Path TLV. The Reply Service Function Path TLV consists of the identifier of the reverse SFP and an appropriate Service Index.¶
If the NSH of the received SFC Echo Request includes the MAC Context Header, the packet's authenticationMUST be verified before using any data, as defined inSection 6.4.¶
The destination SFF of the SFP being tested and the SFF at which the NSH TTL expired (as per[RFC8300]) are referred to as responding SFFs. The processing described below equally applies to both cases.¶
If the Echo Request message with the Reply Service Function Path TLV received by the responding SFF has the Reply Mode value of "Reply via Specified Path" but no Reply Service Function Path TLV is present, then the responding SFFMUST send an Echo Reply with the Return Code set to 6 ("Reply Service Function Path TLV is missing"). If the responding SFF cannot find the requested SFP, itMUST send an Echo Reply with the Return Code set to 7 ("Reply SFP was not found") and include the Reply Service Function Path TLV from the Echo Request message.¶
Suppose the SFC Echo Request receiver cannot determine whether the specified return path SFP has the route to the initiator. In that case, itSHOULD set the value of the Return Code field to 8 ("Unverifiable Reply Service Function Path"). The receiverMAY drop the Echo Request when it cannot determine whether the SFP's return path has the route to the initiator. When sending the Echo Request, the senderSHOULD choose a proper source address according to the specified return path SFP to help the receiver find the viable return path.¶
The ability to specify the return path for an Echo Reply might be used in the case of bidirectional SFC. The egress SFF of the forward SFP might not be co-located with a classifier of the reverse SFP, and thus, the egress SFF has no information about the reverse path of SFC. Because of that, even for bidirectional SFC, a reverse SFP needs to be indicated in a Reply Service Function Path TLV in the Echo Request message.¶
An SFFSHOULD NOT accept the SFC Echo Reply unless the received message passes the following checks:¶
The SFC Echo Request/Reply can be used to isolate a defect detected in the SFP and trace an RSP. As with the ICMP Echo Request/Reply[RFC0792] and the MPLS Echo Request/Reply[RFC8029], this mode is referred to as "traceroute". In the traceroute mode, the sender transmits a sequence of SFC Echo Request messages starting with the NSH TTL value set to 1 and is incremented by 1 in each next Echo Request packet. The sender stops transmitting SFC Echo Request packets when the Return Code in the received Echo Reply equals 5 ("End of the SFP").¶
Suppose a specialized information element (e.g., IPv6 Flow Label[RFC6437] or Flow ID[RFC9263]) is used for distributing the load across Equal Cost Multipath or Link Aggregation Group paths. In that case, such an elementSHOULD also be used for the SFC OAM traffic. Doing so is meant to induce the SFC Echo Request to follow the same RSP as the monitored flow.¶
The consistency of an SFP can be verified by comparing the view of the SFP from the control or management plane with information collected from traversing by an SFC Echo Request/Reply message (Figure 3). The sender of an SFP Consistency Verification Request (CVReq) messageMUST set the value of the SFC Echo Request/Reply Echo Type field to 3 ("SFP Consistency Verification Request"). The sender of an SFP Consistency Verification Reply (CVRep) messageMUST set the value of the SFC Echo Request/Reply Echo Type field to 4 ("SFP Consistency Verification Reply"). All processing steps of SFC Echo Request and Echo Reply messages described in Sections6.3 through6.5 apply to the processing of CVReq and CVRep, respectively.¶
Every SFF that receives a CVReq messageMUST perform the following actions:¶
As a result, the ingress SFF collects information about all traversed SFFs and SFs, i.e., information on the actual path the CVReq packet has traveled. That information can be used to verify the SFC's path consistency. The mechanism for the SFP consistency verification is outside the scope of this document.¶
For the received CVReq, an SFF that supports this specificationMUST include in the CVRep message the information about SFs that are available from that SFF instance for the specified SFP. The SFFMUST include the SFF Information Record TLV (Figure 9) in the CVRep message. Every SFF sends back a single CVRep message, including information on all the SFs attached to that SFF on the SFP, as requested in the received CVReq message using the SF Information Sub-TLV (Section 6.6.2).¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|SFF Record TLV | Reserved | Length |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| Service Path Identifier (SPI) | Reserved |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| || SF Information Sub-TLV |~ ~| |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The SFF Information Record TLV is a variable-length TLV that includes the information of all SFs available from the particular SFF instance for the specified SFP.Figure 9 presents the format of an SFF Information Record TLV, where the fields are defined as follows:¶
If the NSH of the received SFC Echo Reply includes the MAC Context Header[RFC9145], the authentication of the packetMUST be verified before using any data. If the verification fails, the receiverMUST stop processing the SFF Information Record TLV and notify an operator. The notification mechanismSHOULD include control of rate-limited messages. Specification of the notification mechanism is outside the scope of this document.¶
Every SFF receiving a CVReq packetMUST include the SF characteristic data into the CVRep packet. The format of an SF Information Sub-TLV, included in a CVRep packet, is shown inFigure 10.¶
After the CVReq message traverses the SFP, all the information about the SFs on the SFP is available from the TLVs included in CVRep messages.¶
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| SF Sub-TLV | Reserved | Length |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+|Service Index | SF Type | SF ID Type |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+| SF Identifier |~ ~| |+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Each SFF in the SFPMUST send one and only one CVRep corresponding to the CVReq. If only one SF is attached to the SFF in the SFP, only one SF Information Sub-TLV is included in the CVRep. If several SFs are attached to the SFF in the SFP, the SF Information Sub-TLVMUST be constructed as described below in either Section6.6.3.1 or6.6.3.2.¶
Multiple SFs attached to the same SFF can be the hops of the SFP. The service indexes of these SFs on that SFP will be different. Service Function Types of these SFs could be different or be the same. Information about all SFsMAY be included in the CVRep message. Information about each SFMUST be listed as separate SF Information Sub-TLVs in the CVRep message. The same SF can even appear more than once in an SFP with a different service index.¶
An example of the SFP consistency verification procedure for this case is shown inFigure 11. The Service Function Path (SPI=x) is SF1->SF2->SF4->SF3. SF1, SF2, and SF3 are attached to SFF1, and SF4 is attached to SFF2. The CVReq message is sent to the SFFs in the sequence of the SFP(SFF1->SFF2->SFF1). Every SFF(SFF1, SFF2) replies with the information of SFs belonging to the SFP. The SF Information Sub-TLV inFigure 10 contains information for each SF (SF1, SF2, SF3, and SF4).¶
SF1 SF2 SF4 SF3 +------+------+ | | CVReq ......> SFF1 ......> SFF2 ......> SFF1 (SPI=x) . . . <............ <.......... <........... CVRep1(SF1,SF2) CVRep2(SF4) CVRep3(SF3)
Multiple SFs may be attached to the same SFF to spread the load; in other words, that means that the particular traffic flow will traverse only one of these SFs. These SFs have the same Service Function Type and Service Index. For this case, the SF ID Type, which must be the same for all of these SFs, appears once, but all the respective SF Identifiers will be listed sequentially in the SF Identifier field of the Service Function Information Sub-TLV (seeFigure 10). The number of these SFs can be calculated from the SF ID Type and the value of the Length field of the sub-TLV.¶
An example of the SFP consistency verification procedure for this case is shown inFigure 12. The Service Function Path (SPI=x) is SF1a/SF1b->SF2a/SF2b. The Service Functions SF1a and SF1b are attached to SFF1, which balances the load among them. The Service Functions SF2a and SF2b are attached to SFF2, which in turn, balances its load between them. The CVReq message is sent to the SFFs in the sequence of the SFP (i.e., SFF1->SFF2). Every SFF (SFF1, SFF2) replies with the information of SFs belonging to the SFP. The SF Information Sub-TLV inFigure 10 contains information for all SFs at that hop.¶
/SF1a /SF2a \SF1b \SF2b | | SFF1 SFF2 CVReq .........> . .........> . (SPI=x) . . <............ <............... CVRep1(SF1a,SF1b) CVRep2(SF2a,SF2b)
As an element of SFC OAM and, specifically, based on the NSH, the Echo Request/Reply mechanism described in this document inherits security considerations discussed in[RFC7665] and[RFC8300].¶
When the integrity protection for SFC active OAM, particularly the SFC Echo Request/Reply, is required,using one of the Context Headers defined in[RFC9145] isRECOMMENDED.The MAC#1 Context Header could be more suitable for SFC active OAM because it does not require recalculation of theMAC when the value of the NSH Base Header's TTL field is changed.Integrity protection for SFC active OAM can also be achievedusing mechanisms in the underlay data plane.For example, if the underlay is an IPv6 network, i.e., an IP Authentication Header[RFC4302]or IP Encapsulating Security Payload Header[RFC4303], it can be used to provide integrity protection.Confidentiality for the SFC Echo Request/Reply exchanges can be achieved using the IP Encapsulating SecurityPayload Header[RFC4303].Also, the security needs for the SFC Echo Request/Reply are similar to those of ICMP ping[RFC0792][RFC4443]and MPLS LSP ping[RFC8029].¶
There are at least three approaches to attacking a node in the overlay network using the mechanisms defined in the document. One is a Denial-of-Service attack, i.e., sending SFC Echo Requests to overload an element of SFC. The second may use spoofing, hijacking, replying, or otherwise tampering with SFC Echo Requests and/or Replies to misrepresent and alter the operator's view of the state of the SFC. The third is an unauthorized source using an SFC Echo Request/Reply to obtain information about the SFC and/or its elements, e.g., SFFs and/or SFs.¶
It isRECOMMENDED that implementations throttle the number of SFC Echo Request/Reply messages going to the control plane to mitigate potential Denial-of-Service attacks.¶
Reply and spoofing attacks involving faking or replying to SFC Echo Reply messages would have to match the Sender's Handle and Sequence Number of an outstanding SFC Echo Request message, which is highly unlikely for off-path attackers. A non-matching reply would be discarded.¶
To protect against unauthorized sources trying to obtain information about the overlay and/or underlay, an implementationMUST have means to check that the source of the Echo Request is part of the SFP.¶
Also, since the SF Information Sub-TLV discloses information about the SFP, the spoofed CVReq packetmay be used to obtain network information. Thus, implementationsMUST provide a means of checking the source addresses of CVReq messages, as specified inSection 6.3.1 ("Source ID TLV"), against an access list before accepting the message.¶
This section provides information about operational aspects of the SFC NSH Echo Request/Replyaccording to recommendations in[RFC5706].¶
The SFC NSH Echo Request/Reply provides essential OAM functions for network operators. The SFC NSH Echo Request/Reply is intended to detect and localize defects in SFC. For example, by comparing results of the trace function in operational and failed states, an operator can locate the defect, e.g., the connection between SFF1 and SFF2 (Figure 1). After narrowing down a failure to an overlay link, a more specific failure location can be determined using OAM tools in the underlay network. The mechanism defined in this document can be used on demand or for periodic validation of an SFP or RSP. Because the protocol makes use of the control plane, which may have limited capacity, an operator must be able to rate limit Echo Request and Echo Reply messages. A reasonably selected default interval between Echo Request control packets can provide additional benefit for an operator. If the protocol is incrementally deployed in the NSH domain, SFC elements, e.g., Classifier or SFF, that don't support SFC active OAM will discard the protocol's packets.If SFC uses a reclassification along the SFP or when the principle of load balancing is unknown,the fate sharing between data and active OAM packets cannot be guaranteed.As a result, the OAM outcome might not reflect the state of the entire SFC properly but only its segment.In general, it is an operational task to consider the cases where active OAM may not share fate with the monitored SFP. The SFC NSH Echo Request/Reply also can be used in combination with the existing mechanisms discussed in[RFC8924], filling the gaps and extending their functionalities.¶
Management of the SFC NSH Echo Request/Reply protocol can be provided by a proprietary tool, e.g., command line interface, or based on a data model that is structured or standardized.¶
The terms used in the IANA considerations below are intended to be consistent with[RFC8126].¶
IANA has assigned the following new type in the "NSH Next Protocol" registry within the "Network Service Header (NSH) Parameters" group of registries:¶
| Next Protocol | Description | Reference |
|---|---|---|
| 0x07 | SFC Active OAM | RFC 9516 |
IANA has created the "Service Function Chaining (SFC) Active Operations, Administration, and Maintenance (OAM)" group of registries, which contains the registries described in the following subsections.¶
IANA has created the "SFC Active OAM Message Types" registry as follows:¶
| Value | Description | Reference |
|---|---|---|
| 0 | Reserved | RFC 9516 |
| 1 | SFC Echo Request/Reply | RFC 9516 |
| 2 - 62 | Unassigned | |
| 63 | Reserved | RFC 9516 |
IANA has created the "SFC Echo Request Flags" registry to track the assignment of the 16 flags in the SFC Echo Request Flags field of the SFC Echo Request message. The flags are numbered from 0 (the most significant bit is transmitted first) to 15.¶
IANA has created the "SFC Echo Request Flags" registry as follows:¶
| Bit Number | Description | Reference |
|---|---|---|
| 0 - 15 | Unassigned |
IANA has created the "SFC Echo Types" registry as follows:¶
| Value | Description | Reference |
|---|---|---|
| 0 | Reserved | RFC 9516 |
| 1 | SFC Echo Request | RFC 9516 |
| 2 | SFC Echo Reply | RFC 9516 |
| 3 | SFP Consistency Verification Request | RFC 9516 |
| 4 | SFP Consistency Verification Reply | RFC 9516 |
| 5 - 239 | Unassigned | |
| 240 - 251 | Reserved for Experimental Use | RFC 9516 |
| 252 - 254 | Reserved for Private Use | RFC 9516 |
| 255 | Reserved | RFC 9516 |
IANA has created the "SFC Echo Reply Modes" registry as follows:¶
| Value | Description | Reference |
|---|---|---|
| 0 | Reserved | RFC 9516 |
| 1 | Do Not Reply | RFC 9516 |
| 2 | Reply via an IPv4/IPv6 UDP Packet | RFC 9516 |
| 3 | Unassigned | |
| 4 | Reply via Specified Path | RFC 9516 |
| 5 | Reply via an IPv4/IPv6 UDP Packet with the data integrity protection | RFC 9516 |
| 6 | Unassigned | |
| 7 | Reply via Specified Path with the data integrity protection | RFC 9516 |
| 8 - 239 | Unassigned | |
| 240 - 251 | Reserved for Experimental Use | RFC 9516 |
| 252 - 254 | Reserved for Private Use | RFC 9516 |
| 255 | Reserved | RFC 9516 |
IANA has created the "SFC Echo Return Codes" registry as follows:¶
| Value | Description | Reference |
|---|---|---|
| 0 | No Error | RFC 9516 |
| 1 | Malformed Echo Request received | RFC 9516 |
| 2 | One or more of the TLVs was not understood | RFC 9516 |
| 3 | Authentication failed | RFC 9516 |
| 4 | SFC TTL Exceeded | RFC 9516 |
| 5 | End of the SFP | RFC 9516 |
| 6 | Reply Service Function Path TLV is missing | RFC 9516 |
| 7 | Reply SFP was not found | RFC 9516 |
| 8 | Unverifiable Reply Service Function Path | RFC 9516 |
| 9 - 251 | Unassigned | |
| 252 - 254 | Reserved for Private Use | RFC 9516 |
| 255 | Reserved | RFC 9516 |
IANA has created the "SFC Active OAM TLV Types" registry as follows:¶
| Value | Description | Reference |
|---|---|---|
| 0 | Reserved | RFC 9516 |
| 1 | Source ID TLV | RFC 9516 |
| 2 | Errored TLVs | RFC 9516 |
| 3 | Reply Service Function Path Type | RFC 9516 |
| 4 | SFF Information Record Type | RFC 9516 |
| 5 | SF Information | RFC 9516 |
| 6 - 239 | Unassigned | |
| 240 - 251 | Reserved for Experimental Use | RFC 9516 |
| 252 - 254 | Reserved for Private Use | RFC 9516 |
| 255 | Reserved | RFC 9516 |
IANA has created the "SF Identifier Types" as follows:¶
| Value | Description | Reference |
|---|---|---|
| 0 | Reserved | RFC 9516 |
| 1 | IPv4 | RFC 9516 |
| 2 | IPv6 | RFC 9516 |
| 3 | MAC | RFC 9516 |
| 4 - 251 | Unassigned | |
| 252 - 254 | Reserved for Private Use | RFC 9516 |
| 255 | Reserved | RFC 9516 |
The authors greatly appreciate the thorough review and the most helpful comments fromDan Wing,Dirk von Hugo,Mohamed Boucadair,Donald Eastlake 3rd,Carlos Pignataro, andFrank Brockners. The authors are thankful toJohn Drake for his review and the reference to the work on BGP control plane for NSH SFC. The authors express their appreciation toJoel M. Halpern for his suggestion about the load-balancing scenario. The authors greatly appreciate the thoroughness of comments and thoughtful suggestions byDarren Dukes that significantly improved the document.¶