Seamless Bidirectional Forwarding Detection (S-BFD)
updates
- rfc-5880 — Bidirectional Forwarding Detection (BFD)
Extracted elements (30)
Keeping the SBFDReflector discriminator pool separate from BFD/SBFDInitiator pools is recommended because S-BFD Discriminators may be derived from protocol IDs (System-ID, Router-ID) or network targets (IP addresses), which could collide with arbitrarily assigned BFD Discriminators if the pools were shared.
S-BFD eliminates the negotiation 'seam' of traditional BFD by removing the DOWN-to-UP transition delay, enabling any node that knows a remote S-BFD Discriminator to immediately perform a continuity test without session setup. This is the core motivation for the 'Seamless' designation.
S-BFD eliminates the requirement for egress nodes to maintain per-path/LSP/function active BFD sessions when only one side desires continuity testing. The Reflector BFD concept replaces a large number of active BFD sessions with a small number of stateless reflectors, significantly reducing total session count in large networks.
The Demand (D) bit is used to break the infinite reflection loop that a Man-in-the-Middle could trigger: SBFDInitiators always set D=1, SBFDReflectors always clear D=0 and discard any received packet with D=0. Without this, a single spoofed packet could cause two reflectors to bounce packets between each other indefinitely at TTL=255.
S-BFD can co-exist with classical BFD sessions on the same node because the demultiplexing procedure in Section 7.1 uses lower-layer signals (dedicated UDP port, Channel Type) to distinguish S-BFD packets from classical BFD packets before discriminator lookup.
A Reflector BFD session MUST be capable of sending only two states: UP and AdminDown. The INIT and DOWN states are not used by the reflector.
A Reflector BFD session MUST NOT transmit any S-BFD packets based on local timer expiry; it is purely reactive.
A Reflector BFD session MUST transmit an S-BFD Control packet in response to each received S-BFD Control packet that contains a valid locally allocated S-BFD Discriminator in the Your Discriminator field, unless prohibited by local policy (administrative, security, or rate-limiter).
An S-BFD Discriminator MUST be unique within an administrative domain. Duplicate values can cause S-BFD Control packets to falsely terminate on the wrong node, resulting in spurious reflector responses.
An S-BFD packet MUST be demultiplexed using lower-layer information (e.g., dedicated destination UDP port or associated Channel Type) before inspecting the Your Discriminator field. Packets bound for an SBFDReflector are looked up in the S-BFD Discriminator table; others are looked up in the BFD Discriminator table and MUST be discarded if no match is found.
bfd.DemandMode MUST be initialized to 1 for SBFDInitiator sessions and to 0 for SBFDReflector sessions. This divergence from RFC 5880 defaults is essential to prevent infinite reflection loops (see Appendix A).
For the very first S-BFD packet transmitted by an SBFDInitiator, the implementation MUST NOT expect a response S-BFD packet to arrive before a time equal to the sum of the initiator-to-responder and responder-to-initiator latencies.
If an SBFDInitiator receives an S-BFD Control packet with the Demand (D) bit set, the packet MUST be discarded. This is symmetric to the reflector's D-bit check and prevents loop exploitation.
If an SBFDReflector receives an S-BFD Control packet with the Demand (D) bit cleared, the packet MUST be discarded. This prevents the infinite reflection loop described in Appendix A.
S-BFD Control packets transmitted by an SBFDInitiator MUST set the Your Discriminator field to the S-BFD Discriminator corresponding to the remote target entity. Every SBFDInitiator MUST also have a locally unique My Discriminator allocated from the BFD Discriminator pool.
S-BFD Control packets transmitted by the SBFDReflector MUST set Required Min RX Interval to the minimum interval in microseconds that the reflector can handle, allowing it to throttle the rate at which SBFDInitiators send packets.
S-BFD Echo packets MUST NOT be processed by any Reflector BFD session on the target node; they are self-generated and self-terminated, expected to U-turn at the target in the data plane only.
The responder MUST discard any incoming S-BFD Control packet whose Your Discriminator field is not one of the locally allocated S-BFD Discriminator entries.
When a system supports classical BFD, the BFD Discriminator pool SHOULD be shared by SBFDInitiator sessions and classical BFD sessions. The S-BFD Discriminator pool for SBFDReflector sessions SHOULD be a separate pool to avoid collisions with derived discriminator values.
When an SBFDInitiator receives a response S-BFD Control packet with State=AdminDown, it MUST NOT conclude that the remote entity is unreachable, and MUST back off its packet transmission interval to no faster than 1 second.
When BFD is used across multiple hops, a congestion control mechanism MUST be implemented, and when congestion is detected the BFD implementation MUST reduce the amount of traffic it generates. Operators must correctly provision S-BFD packet transmission rates.
When the monitored local entity is in service the SBFDReflector MUST set the State field to UP; when the entity is temporarily out of service the state SHOULD be set to AdminDown.
When using the S-BFD Echo function, it is RECOMMENDED that both S-BFD Control packets and S-BFD Echo packets be sent together, so that Control packets can verify the identity of the U-turn node and detect AdminDown transitions that Echo packets alone cannot detect.
A new state variable bfd.SessionType is introduced with allowable values SBFDInitiator and SBFDReflector, describing whether a session performs continuity tests or listens for and reflects incoming S-BFD Control packets. It MUST be initialized to the appropriate type at session creation.
S-BFD Control packets sent by an SBFDInitiator always set Demand (D) to 1 (indicating initiator origin), Your Discriminator to the remote entity's S-BFD Discriminator, and both Required Min RX Interval and Required Min Echo RX Interval to 0.
S-BFD Control packets sent by an SBFDReflector mirror several fields from the received packet: My Discriminator is copied from received Your Discriminator, Your Discriminator from received My Discriminator, Detect Mult and Desired Min TX Interval are copied verbatim, Demand (D) bit is set to 0, and State reflects either UP or AdminDown.
Simple Password authentication (RFC 5880) is discouraged for S-BFD because intercepted S-BFD packets could expose password values that are reused for other services. Strong authentication forms are strongly encouraged.
The SBFDReflector MAY use the Auth Key ID in the incoming packet to verify Authentication Data and MUST accept the packet if authentication succeeds. This approach keeps the reflector stateless while still enabling BFD authentication, and prevents replay attacks because the initiator only accepts responses carrying the sequence number it originally sent.
The SBFDReflector MUST NOT use the cryptographic sequence number to decide whether to accept a packet, because the reflector is stateless and may receive packets from multiple SBFDInitiators with differing sequence numbers. Instead, the reflector MUST echo back the same sequence number it received, while the SBFDInitiator SHOULD accept responses only within a permissible sequence-number range.
The SBFDInitiator finite state machine has two states, DOWN and UP. The machine transitions from DOWN to UP upon receiving a packet with State=UP; it transitions from UP to DOWN upon receiving AdminDown or on Detection Timer expiry. The INIT state of classical BFD is absent because SBFDReflectors never send INIT.