Operating the Network Service Header (NSH) with Next Protocol "None"
Extracted elements (26)
A suggested default rate limit is no more than one metadata-only packet per ten data packets on any flow in a time unit equal to the end-to-end delivery time on the flow, to prevent congestion from flooding.
Metadata-only packets (Next Protocol 'None') allow metadata to be exchanged without requiring traffic to be flowing. When traffic is flowing, they avoid the potentially costly hardware operation of inserting substantial metadata into data packets.
The mechanism is explicitly not applicable to per-packet metadata because, by definition, when 'Next Protocol' is 'None' there is no subsequent packet for the metadata to be associated with.
When 'Next Protocol' is 'None', the identity of the flow for per-flow metadata cannot be inferred from payload data; instead, the flow identity must be carried within the metadata itself.
Legacy SFC-aware nodes unaware of Next Protocol value 'None' will silently drop packets with that value unless explicitly configured to forward them per RFC 8300 Section 2.2. SFFs may be configured to forward them; SFC proxies, SFIs, and classifiers will most likely drop them.
SFC-aware nodes at the end of an SFP that perform 'pop and forward' processing must not forward zero-length payload packets; packets with Next Protocol 'None' are expected to have zero payload length after NSH removal and must not be forwarded.
A node conforming to this specification that wishes to send metadata without a data packet MUST create a packet carrying an NSH with the desired metadata and MUST set the 'Next Protocol' field to 0x00.
A node sending a metadata-only packet MUST encapsulate and send the packet as normal for tunneling to the next hop on the SFP, the same as for any NSH packet carrying user data.
A node sending a metadata-only packet SHOULD ensure that there are no bytes following the end of the NSH (i.e., no payload data).
A transit node (SFF, SFI, or classifier) conforming to this specification that receives a packet with 'Next Protocol' set to 'None' MUST NOT attempt to parse or process beyond the end of the NSH, but SHOULD process the NSH and metadata as normal.
All implementations SHOULD implement rate limits on the generation of per-SFP packets with 'Next Protocol' set to 'None'. These rate limits SHOULD be configurable and applied per SFP and per application.
An SFC-aware node SHOULD NOT create a packet with 'Next Protocol' set to 'None', Metadata Type set to 0x2, and an NSH Length of 0x2, as this would produce a packet with no metadata and no payload.
An SFP egress node MUST NOT forward packets with 'Next Protocol' indicating 'None' even if some bytes appear after the NSH.
Implementations SHOULD apply incoming rate limits for SFC packets with 'Next Protocol' set to 'None' to protect against other nodes not applying suitable rate limits. When a packet is dropped due to rate limits, a counter SHOULD be incremented and an alert MAY be raised.
Packets from which an intermediate node strips all metadata, leaving an NSH with no metadata and no payload, SHOULD NOT continue to be forwarded along the SFP.
When an implementation finds it is unable to generate or send a packet, it SHOULD increment a counter accessible by the operator and MAY raise an alert; such alerts SHOULD themselves be rate limited.
Where use of Next Protocol 'None' is not desired, administrators SHOULD instruct SFC-aware nodes to not create such packets and to discard received packets with Next Protocol 'None'.
A new NSH 'Next Protocol' value of 0x00 is defined to indicate 'None', meaning there is no user/payload data following the NSH. The NSH itself (including metadata) still has meaning when this value is set.
Metadata-only packets can carry OAM information independent of payload data. The NSH O bit from RFC 8300 indicates OAM content. This allows OAM to be sent when no traffic is flowing, at predictable intervals, and without rewriting payload data buffers.
Per-SFP metadata-only packets are sent by setting the correct SPI in the NSH and setting the SI to the correct value for the SFP hop where metadata is introduced, enabling metadata installation at points of consumption without accompanying data packets.
SFPs can be established specifically as a Data Control Network (DCN) or Management Control Network (MCN) by using metadata-only packets to carry control-plane and management-plane messages within the SFC network.
IANA allocated value 0x00 with description 'None' in the 'NSH Next Protocol' sub-registry of the 'Network Service Header (NSH) Parameters' registry, as defined by this document.
Metadata may contain sensitive data or information used to control SFI behavior. Protection requires encrypted transport between SFC entities or encryption of the metadata itself, plus authentication of the metadata sender.
Metadata-only packets (Next Protocol 'None') provide a covert channel. This differs from normal NSH metadata only in that it can be sent without any data flow present, making the covert channel available at any time.
The amount of packets with 'Next Protocol' set to 'None' on an SFP SHOULD be rate limited at each point on the SFP to provide additional network security against flooding attacks.
The mechanism may be used to illegitimately introduce packets or false metadata into the SFC overlay network. Measures SHOULD be taken to ensure authorization of sources of such packets, and tunneling of such packets into the network SHOULD be prevented.