BGP Flow Specification Filter for MPLS Label

Abstract

This draft proposes BGP flow specification rules that are used to filter MPLS labeled packets.¶

2. The Flow Specification Encoding for MPLS Match

This document proposes new flow specifications rules that is encoded in NLRI.¶

Type TBD1- MPLS Match1

Function: The match1 applies to MPLS Label field on the label stack.¶

Encoding: <type(1 octet), length(1 octet), [operator,value]+>.¶

It contains a set of {operator, value} pairs that are used for matching filter.¶

The operator byte is encoded as:¶

          0   1   2   3   4   5   6   7
    +---+---+---+---+---+---+---+---+
    | e | a | i |  pos  |   Resv    |
    +---+---+---+---+---+---+---+---+

¶

where:¶

e - end of list bit:

Set in the last {op, value} pair in the list.¶

a - AND bit:

If unset, the previous term is logically ORed with the current one. If set, the operation is a logical AND. It should be unset in the first operator byte of a sequence. The AND operator has higher priority than OR for the purposes of evaluating logical expressions.¶

i - before bit:

If unset, apply matching filter before MPLS label data plane action; if set, apply matching filter after MPLS label data plane action.¶

pos - the label position indication bits:

where:¶

00:any position on the label stack

- the presented label value is used to match any label on the label stack. When apply it, at least one label on the stack match the value¶

01:top label indication-

the presented label value MUST be used to match the top label on the label stack.¶

10: bottom label indication-

If it is set, the presented label value MUST match the bottom label on the label stack. When it is clear, the present label value can match to any label on the label stack¶

11:

(for reserved labels)¶

The value field is encoded as:¶

     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |                Label                  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

¶

Type TBD2 - MPLS Match2

Function: MPLS Match2 applies to MPLS Label experiment bits (EXP) on the top label in the label stack.¶

Encoding: <type (1 octet), [op, value]+>¶

[op,value] - Defines a list of {operation, value} pairs used to match 3-bit exp field on the top label of packets [RFC3032].¶

Values are encoded using a single byte, where the five most significant bits are zero and the three least significant bits contain the exp value.¶

3. Deployment Example: DDoS Traffic

In this example, 5 local policy rules in the filter-based RIBs (FB-RB, aka Policy Routing) will match n-tuples (destination IP address, Destination Port, source IP address, Source IP Address, protocols (ICMP and STCP). These policy rules can be created by standard yang modules for filter-based RIBS (configuration, and ephemeral configuration) or ACLs, or vendor based policy. These policies will put the DDoS attack data onto one LSP (LSP1) in order to send the DDoS traffic to the IDS/IPS processing attached to PE2.¶

The MPLS Filter allows the BGP Flow specification to match on the LSP label rather than the IP address so that PE2 (with the FB-RIBs on PE2) can forward the traffic to a set of IDS/IPS machines. The BGP Flow Specification (BGP-FS) can forward this simple match policy along with an action policy that constraints the traffic on this Flow to a certain rate (bytes/second).¶

      |<---------------- AS1 ----------------->|
     +---------+   +-----+    +-----+    +-----+
  ===| PE1     |---|IBGP |----|IBGP |----| PE2 |--IDS-1/IPS
     | Filters |   |     |    |     |    |     |--IDS-2/IPS
     +---------+   +-----+    +-----+    +-----+
         |-------------------------------|
        MPLS travel on LSP-1 with label-1

               BGP Flow Specification Filter 1

     BGP Flow Specification
     Match Policy
            Destination IP address (0/0) [Required by RFC5575]
        MPLS Label match (label-1)
     Action Policy
        Traffic-rate (n bytes)

4. Security Considerations

The validation of BGP Flow Specification policy relies on the security of the BGP protocol and RFC 5575 checks ([RFC5575], [I-D.hr-idr-rfc5575bis]) for BGP Flow specification version 1 and BGP Flow specification version 2 ([I-D.hares-idr-flowspec-v2]). For Option 1, the MPLS Match can be one of the match filtes, and and the final match is an "AND" of all the filters. Match filters are tested in the order specified in [I-D.hares-idr-flowspec-v2] and/or an RFC5575bis document.¶

6. References