Forwarding and Control Element Separation (ForCES) Protocol Specification
updated by
Extracted elements (31)
The 32-bit ForCES ID address space is split uniformly between FEs and CEs (each 2^30 addresses) even though NEs typically have far more FEs than CEs; uniform split was chosen for simplicity rather than optimizing allocation proportionality.
TLV structuring is used throughout the protocol because it provides binary type-value encoding analogous to XML tag-value pairs, enables fast generalized binary parsing, and supports forward/backward compatibility—old implementations silently ignore unknown TLVs just as XML parsers ignore unknown tags.
TRCOMP is added beyond classical two-phase commit (2PC) to allow FEs to release rollback state once the CE confirms the transaction is complete. Without it, FEs would need to retain rollback buffers indefinitely after committing.
Upon re-association, the FE discards all prior state and fetches entirely new state from the CE. This design prioritizes simplicity over efficiency, explicitly avoiding the additional complexity of managing graceful restarts, even though the approach may cause temporary data-path traffic loss.
Only one PL is defined but multiple independent TMLs are expected to be standardized. A CE and FE MUST use the same TML definition to interoperate; TML interoperability is guaranteed only when both endpoints conform to the same TML specification.
All ForCES protocol layer implementations MUST be portable across all TMLs; all TMLs MUST expose the top-edge semantics defined in this document. Implementations that support this specification MUST implement the SCTP-based TML defined in RFC 5811.
For AdminDisable state transition, the FE MUST stop packet forwarding. During the AdminDisable state, the FE MUST NOT process packets unless the CE sets FEState back to OperEnable.
If all participating FEs respond with success to the EOT COMMIT within the expected time, the CE MUST issue a TRCOMP operation to all participating FEs. An FE MUST NOT respond to a TRCOMP.
In a two-phase commit transaction, all messages MUST have the AT flag set. Before the CE issues a COMMIT, the FE MUST only validate that operations can be executed but MUST NOT execute them. All messages in a transaction MUST use the execute-all-or-none execution mode; other EM settings result in a transaction failure.
The FE MUST echo the same correlator value from the Request message into the corresponding Response message; the correlator is handled transparently by the FE. When no response is expected, the correlator field is set to 0.
The FE MUST respond to the CE's EOT (End of Transaction) COMMIT message. If any participating FE responds with failure or no response is received within a specified timeout, the CE MUST abort the transaction by sending a Config message with the ABT TP flag and a COMMIT operation.
The reserved (rsvd) 4-bit field in the common header MUST be set to zero by senders and MUST be ignored by receivers.
The TML MUST implement a congestion control mechanism that prevents transport congestive collapse (per RFC 2914) on either the FE or CE side. The TML MUST also define mechanisms to prevent node overload, addressing both transport-congestion-induced and non-congestion CPU overload scenarios (including DoS table-hash attacks).
The TML MUST NOT re-order configuration packets that have the same priority level, and MUST support the TML HA link failover capability so the PL can participate in link failover schemes.
The TML MUST provide a mechanism to authenticate ForCES CEs and FEs, preventing unauthorized entities from participating in control and data-path processing of a ForCES NE.
The TML SHOULD provide message authentication to prevent injection of incorrect data into PL messages, SHOULD provide confidentiality to prevent disclosure of PL-level information, and SHOULD deliver these services via TLS or IPsec.
Upon re-association, the FE MUST discard any state it has as invalid and retrieve entirely new state from the newly associated CE. This applies to the current protocol version as defined in this document.
The FE Protocol LFB (FEPO) is a core mandatory LFB that controls the ForCES protocol itself; it defines timers for heartbeat and association-loss detection and the CE failover policy. It demonstrates that the ForCES protocol is self-configurable using the same LFB architecture it uses for IP forwarding.
The ForCES protocol defines 8 priority levels (0–7) encoded in the 3-bit Pri field of the Flags. Higher values indicate greater importance. TMLs that support fewer than 8 hardware priority levels MUST map the 8 protocol levels across the available TML levels.
The heartbeat mechanism is traffic-sensitive: an HB message is sent only when no PL traffic has been exchanged within a configured interval. The CE may request a response from the FE in an HB; the FE generates HBs only when explicitly configured to do so by the CE via the FE Protocol LFB.
Three execution modes are selected by the 2-bit EM flag: execute-all-or-none (0b01, rollback on any failure), execute-until-failure (0b10, stop on first failure, no rollback), and continue-execute-on-failure (0b11, process all regardless of failures). Value 0b00 is reserved.
This document creates seven IANA registries: Message Type Namespace (Appendix A.1), Operation Selection (A.2), Header Flags (A.3), TLV Type Namespace (A.4), RESULT-TLV Result Values (A.5), Association Setup Response codes (A.6), and Association Teardown Message reason codes (A.7).
An attacker who can inject false PL messages can subvert FE data-path behavior by spoofing CE commands, or corrupt CE state by spoofing FE events and responses. CE/FE endpoint authentication and PL message authentication at the TML layer are the primary countermeasures.
PL messages may carry sensitive data including network configuration, encryption keys, and routing state. The TML SHOULD provide confidentiality via TLS or IPsec. A 'no security' deployment option (Section 9.1) is described but is appropriate only in physically secured environments.
The FE Object LFB FEState component drives data-path availability: FE initializes in OperDisable, transitions to OperEnable when ready for packet processing. The CE may set FEState to AdminDisable to pause the FE; the FE stays there until the CE explicitly restores OperEnable. Loss of association may trigger return to pre-association per configured policy.
The FE transitions between two major phases: pre-association (TML/PL initialization and parameter discovery) and post-association (triggered by CE sending an Association Setup message). Within post-association there are three sub-stages: Association Setup, Established, and Association Lost.
ILV encoding uses a 32-bit Identifier (a local ForCES component ID), a 32-bit Length field (covering I+L+Value), and a variable-length Value field. ILV identifiers are of local scope defined by the LFB class definition, distinct from TLV global type spaces.
The 32-bit Flags field in the common header encodes: ACK indicator (2 bits), Priority (3 bits, values 0–7), reserved (3 bits), Execution Mode EM (2 bits), Atomic Transaction AT (1 bit), Transaction Phase TP (2 bits), and remaining reserved bits.
The 32-bit ForCES ID uses a 2-bit Type Switch (TS): 0b00 for FE IDs (0x00000000–0x3FFFFFFF), 0b01 for CE IDs (0x40000000–0x7FFFFFFF), 0b11 for multicast IDs, with reserved ranges and special broadcast addresses 0xFFFFFFFD (all CEs), 0xFFFFFFFE (all FEs), and 0xFFFFFFFF (entire NE).
The ForCES common header is 24 octets: version (4 bits), rsvd (4 bits), Message Type (8 bits), Length (16 bits, in 4-byte DWORDs), Source ID (32 bits), Dest ID (32 bits), Correlator (64 bits), and Flags (32 bits). All fields are in network byte order and the message is 32-bit aligned.
TLV encoding uses a 16-bit Type field, a 16-bit Length field (covering T+L+Value octets before alignment padding), and a variable-length Value field. Padding to a 32-bit boundary is required; minimum TLV size is 4 octets (empty value).