OSPFv2 Extensions for Bit Index Explicit Replication (BIER)
updated by
- rfc-9272 — Underlay Path Calculation Algorithm and Constraints for Bit Index Explicit Replication (BIER)
Extracted elements (23)
The flooding scope is limited to area-local for the BIER Sub-TLV LSA; inter-area propagation is handled explicitly by ABRs copying the Sub-TLV, rather than using a domain-wide flooding scope. This follows OSPF's hierarchical area model.
The OSPFv2 Extended Prefix Opaque LSA (RFC 7684) was chosen for BIER advertisement because BIER information must be associated with a BFR-prefix, and this LSA type naturally carries per-prefix attributes within OSPF.
This document covers only BIER with MPLS encapsulation as defined in RFC 8296. Support for other encapsulation types and the use of multiple encapsulation types are explicitly outside the scope of this document.
All BFRs MUST detect advertisement of duplicate valid BFR-ids for a given MT-ID and sub-domain-id. When such duplication is detected, the BFR MUST behave as described in Section 5 of RFC 8279.
Each BFR sub-domain MUST be associated with one and only one OSPF topology identified by the MT-ID. If the association advertised by other BFRs conflicts with the locally configured association, the BIER Sub-TLV for such conflicting sub-domains MUST be ignored.
If a BFR advertises the same sub-domain-id in multiple BIER Sub-TLVs, the BFR MUST be treated as if it did not advertise a BIER Sub-TLV for such sub-domain.
If the BitString length is set to a value that does not match any of the allowed values specified in RFC 8296, the BIER MPLS Encapsulation Sub-TLV containing the error MUST be ignored.
If the label associated with the Maximum Set Identifier exceeds the 20-bit range, the BIER MPLS Encapsulation Sub-TLV containing the error MUST be ignored.
If the MT-ID contains an invalid value as specified in RFC 4915, the BIER Sub-TLV for such subdomains MUST be ignored.
If the same BitString length is repeated in multiple BIER MPLS Encapsulation Sub-TLVs inside the same BIER Sub-TLV, the whole BIER Sub-TLV containing the conflicts MUST be ignored.
Label ranges within all BIER MPLS Encapsulation Sub-TLVs advertised by the same BFR MUST NOT overlap. If an overlap is detected, all BIER Sub-TLVs advertised by such a router MUST be ignored.
The supported BAR and IPA algorithms MUST be consistent for all routers supporting a given BFR sub-domain. If a router receives a BIER Sub-TLV with mismatched BAR or IPA values, it MUST report a misconfiguration and MUST ignore the BIER Sub-TLV containing the error.
A BFR-prefix is a unique routable IP address within a BIER domain assigned to each BFR. All BIER-specific information advertised to other BFRs is associated with this BFR-prefix, which is carried in the OSPFv2 Extended Prefix Opaque LSA.
The BIER MPLS Encapsulation Sub-TLV is a sub-TLV of the BIER Sub-TLV that advertises MPLS-specific information for BIER, including the label range (first label plus Max SI) and the supported BitString length. It MAY appear multiple times in the BIER Sub-TLV.
The BIER Sub-TLV is a sub-TLV of the OSPFv2 Extended Prefix TLV (RFC 7684) used to distribute BIER information. It carries sub-domain-id (1 octet), MT-ID (1 octet), BFR-id (2 octets), BAR (1 octet), and IPA (1 octet) fields, plus nested sub-TLVs. Type value is 9.
The flooding scope of the OSPFv2 Extended Prefix Opaque LSA used for advertising the BIER Sub-TLV is area-local. To support multi-area BIER deployments, OSPF ABRs propagate BIER information between areas by copying the entire BIER Sub-TLV when originating inter-area Extended Prefix Opaque LSAs.
The label range for BIER MPLS forwarding is the set of labels beginning with the Label field value and ending with (Label + Max SI). A unique label range is allocated for each BitString length and sub-domain-id; each Set Identifier maps to a single label in this range.
IANA allocated two new entries in the 'OSPFv2 Extended Prefix TLV Sub-TLVs' registry defined in RFC 7684: BIER Sub-TLV (Type 9) and BIER MPLS Encapsulation Sub-TLV (Type 10).
An attack on the OSPF control plane cannot be used to cause a BIER BitString DoS attack (setting too many bits), because the BFIR decides which bits to set independently of OSPF control messages; OSPF BIER advertisements are only used to build forwarding tables, not to influence encapsulation decisions.
Implementations MUST ensure that malformed BIER and BIER MPLS Encapsulation Sub-TLVs are detected and do not allow attackers to crash the OSPF router or routing process. Reception of malformed TLVs SHOULD be counted and/or logged, and such logging SHOULD be rate-limited to prevent DoS via log flooding.
In deployments where potential attackers have access to one or more networks in the OSPF routing domain, stronger authentication mechanisms such as those specified in RFC 7474 SHOULD be used. The document assumes BIER and OSPF layers are under a single administrative domain.
The BIER MPLS Encapsulation Sub-TLV wire format (Type 10, Length 8 octets) contains a 1-octet Max SI, a 3-octet Label field (20 rightmost bits are the first label; 4 leftmost bits MUST be ignored), and a 4-bit BS Len field followed by 28 reserved bits.
The BIER Sub-TLV wire format includes a 2-octet Type field (value 9), variable-length Length field, 1-octet sub-domain-id, 1-octet MT-ID, 2-octet BFR-id, 1-octet BAR, 1-octet IPA, 2 reserved octets, and variable sub-TLVs.