An MPLS-Based Forwarding Plane for Service Function Chaining
Extracted elements (25)
The MPLS encoding of the logical NSH does not support per-packet metadata (where metadata differs packet-to-packet on the same flow or SFP); only per-SFP and per-flow metadata are supported. Per-packet metadata requires the NSH itself.
The SPI requires 24 bits as defined in RFC 8300, but the MPLS 20-bit Label field can only carry 20 bits and reserves values 0-15. This constrains deployments to SPI values in the range 16...2^20-1, a limitation not present when using the NSH directly.
This document provides a mechanism to represent NSH semantics in MPLS label stacks for brownfield networks where NSH is not ubiquitously deployed. It does not deprecate or replace the NSH but acknowledges the need for interim SFC deployment in existing MPLS infrastructure.
An SFC proxy is needed for legacy SFIs that are not SFC-aware; the proxy strips and reimposed MPLS SFC encapsulation. Metadata delivery requires specific handling when an SFC proxy is in use, regardless of whether NSH or MPLS encoding is used.
Both ends of a tunnel between adjacent SFFs must know the tunnel is used for SFC and must agree on the form of NSH representation (MPLS encoding vs. NSH). The MPLS encoding of the logical NSH may be used even when the inter-SFF tunnel is not itself an MPLS tunnel.
A system using MPLS representation of the logical NSH MUST NOT assign SPI values greater than 2^20 - 1 or less than 16, because the 20-bit MPLS Label field cannot carry the full 24-bit NSH SPI and values 0-15 are reserved as special-purpose labels.
An SFF MUST decrement the TTL by one each time it performs a lookup to forward a packet to the next SFF. If the TTL decrements to zero, the SFF MUST NOT send the packet and MUST discard it.
If an application requiring metadata is sensitive to potential loss or attack from in-band metadata distribution, it SHOULD NOT use in-band metadata distribution but SHOULD rely on control-plane or management-plane mechanisms that include confirmation of delivery.
It is RECOMMENDED that an entropy label be included in the label stack immediately after the tunnel labels and before the SFC labels when entropy is desired for MPLS-tunneled packets.
SFIs MUST ignore the TTL but MUST mirror it back to the SFF unmodified along with the SI. Each component of the SFC system MUST NOT increase the SI TTL value; otherwise, loops may go undetected.
The S (Bottom of Stack) bit MUST be clear in the SFC Context Label stack entry. In the SF Label stack entry, it MUST be clear except when the label is at the bottom of the stack, when it MUST be set.
The TC bits in both SFC label stack entries SHOULD be set to zero when a packet is sent and MUST be ignored on receipt.
When a classifier places a packet onto an SFP, it MUST set the TTL to a value between 1 and 255. It SHOULD set this according to the expected length of the SFP but MAY set it to a larger value. The maximum TTL supported in an NSH is 63, so the practical limit may also be 63.
When an SFF receives a packet, it MUST discard any packets with TTL set to zero. It SHOULD log such occurrences but MUST apply rate limiting to any such logs.
When changing metadata for a specific MPI, it is RECOMMENDED that a new MPI be used to install a new entry in the metadata table and packets be marked with the equivalent new MLI, to avoid out-of-date metadata being applied during the transition.
In mixed-mode forwarding, an SFF determines from the incoming interface context and top label whether to process an {SPI, SI} pair (label swapping) or a {context label, SFI index} pair (label stacking) and selects the appropriate SFI accordingly.
IANA allocated two values from the 'Extended Special-Purpose MPLS Label Values' subregistry: value 16 for Metadata Label Indicator (MLI) and value 17 for Metadata Present Indicator (MPI), both referencing RFC 8595.
Packets originating outside the SFC-enabled domain MUST be dropped if they contain an NSH (or MPLS encoding of a logical NSH), and packets exiting the SFC-enabled domain MUST be dropped if they contain such encapsulation. The classifier is a fully trusted element whose classification decisions are treated as accurate.
The MPLS forwarding plane has no built-in security mechanisms and provides no cryptographic integrity protection on MPLS headers. The design relies on the MPLS network being a closed network where insertion, modification, or inspection of packets by outside parties is not possible.
Vulnerabilities in the management plane or control plane of an SFC system imply vulnerabilities in the whole SFC system. Control-plane solutions and management-plane mechanisms must include security measures to protect SFC systems.
In-band metadata programming uses three label stack entries after the SFC unit: Extension Label (value 15), Metadata Present Indicator (MPI, value 17), and a Metadata Label. Metadata is formatted as a TLV with 16-bit Length, 16-bit Metadata Type (from NSH MD Types registry), and variable-length Metadata padded to a 4-octet boundary.
In the label-stacking case, one or more instances of the basic SFC unit (SFC Context Label + SF Label) are stacked; the SFC Context Label carries the SPI and may also encode how to interpret the SF Label. The SF Label identifies the next SFI and comes from the range 16...2^20-1.
In the label-swapping case, the SPI is encoded as a 20-bit integer in the SFC Context Label (SPI Label), and the SI is carried in the top 8 most-significant bits of the SF Label field with the low-order 12 bits set to zero.
Metadata is indicated via an SFC Metadata Label consisting of three label stack entries: Extension Label (value 15), Metadata Label Indicator (MLI, value 16), and a Metadata Label (ML) that indexes a programmed metadata table.
The basic unit of MPLS label stack for SFC comprises two 32-bit label stack entries: an SFC Context Label and an SF Label, each containing a 20-bit Label field, 3-bit TC, 1-bit S (Bottom of Stack), and 8-bit TTL.