Advertising Seamless Bidirectional Forwarding Detection (S-BFD) Discriminators in the Layer Two Tunneling Protocol Version 3 (L2TPv3)
Extracted elements (10)
Although RFC 7880 (S-BFD) primarily concerns advertising a single discriminator, the L2TPv3 AVP encoding was designed to allow an arbitrary number of S-BFD Discriminators for extensibility. This enables future use cases requiring multiple discriminators without a format change.
When one S-BFD Discriminator is advertised, it is associated with the L2TPv3 session. When multiple S-BFD Discriminators are advertised, the mapping of a given discriminator to a specific use case is explicitly out of scope for this document.
An LCCE MAY include the S-BFD Target Discriminator ID AVP in an L2TP control message (ICRQ, ICRP, OCRQ, OCRP). The receiving LCCE MAY use this AVP if it wants to monitor connectivity to the advertising LCCE using S-BFD.
If the receiving LCCE does not wish to monitor connectivity using S-BFD, it MAY safely discard the S-BFD Target Discriminator ID AVP without affecting the rest of session negotiation.
The M (Mandatory) bit of the L2TP control message MUST NOT be set inside the S-BFD Target Discriminator ID AVP. This ensures that peers that do not understand the AVP can safely ignore it without tearing down the session.
When an LCCE includes the S-BFD Target Discriminator ID AVP, at least one S-BFD Discriminator MUST be included in the advertisement.
The S-BFD Target Discriminator ID AVP (Attribute Type 102) is exchanged during L2TPv3 session negotiation using ICRQ, ICRP, OCRQ, and OCRP control messages. It advertises S-BFD target discriminator(s) supported by an LCCE for S-BFD reflector operation.
IANA assigned Attribute Type 102 ('S-BFD Target Discriminator ID') in the 'Control Message Attribute Value Pairs' sub-registry maintained per RFC 3438.
Advertising S-BFD Discriminators via L2TPv3 makes it possible for attackers to initiate S-BFD sessions using the advertised discriminator values. The introduction of this AVP introduces no new security risks beyond those addressed in RFC 3931 (L2TPv3), and the S-BFD-specific vulnerabilities and mitigations are discussed in RFC 7880.
The S-BFD Target Discriminator ID AVP Attribute Value field encodes one or more 32-bit (4-octet) discriminator values in sequence. At least one discriminator must be present; additional discriminators are optional and follow immediately with no delimiter.