SFC Y. Wei, Ed. Internet-Draft ZTE Corporation Intended status: Standards Track U. Elzur Expires: November 13, 2021 Intel S. Majee Individual contributor C. Pignataro Cisco May 12, 2021 Network Service Header Metadata Type 2 Variable-Length Context Headers draft-ietf-sfc-nsh-tlv-06 Abstract Service Function Chaining (SFC) uses the Network Service Header (NSH) [RFC8300] to steer and provide context Metadata (MD) with each packet. Such Metadata can be of various Types including MD Type 2 variable length context headers. This document specifies several such context headers that can be used within a service function path. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on November 13, 2021. Copyright Notice Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents Wei, et al. Expires November 13, 2021 [Page 1] Internet-Draft NSH MD2 Context Headers May 2021 carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Conventions used in this document . . . . . . . . . . . . . . 3 2.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 2.2. Requirements Language . . . . . . . . . . . . . . . . . . 3 3. NSH MD Type 2 format . . . . . . . . . . . . . . . . . . . . 3 4. NSH MD Type 2 Context Headers . . . . . . . . . . . . . . . . 4 4.1. Forwarding Context . . . . . . . . . . . . . . . . . . . 4 4.2. Tenant Identifier . . . . . . . . . . . . . . . . . . . . 5 4.3. Ingress Network Node Information . . . . . . . . . . . . 6 4.4. Ingress Network Source Interface . . . . . . . . . . . . 6 4.5. Flow ID . . . . . . . . . . . . . . . . . . . . . . . . . 7 4.6. Source and/or Destination Groups . . . . . . . . . . . . 7 4.7. Policy Identifier (POLICY_ID) . . . . . . . . . . . . . . 8 5. Security Considerations . . . . . . . . . . . . . . . . . . . 8 6. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 8 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 7.1. Forwarding Context Types . . . . . . . . . . . . . . . . 9 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 9 8.1. Normative References . . . . . . . . . . . . . . . . . . 10 8.2. Informative References . . . . . . . . . . . . . . . . . 10 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 11 1. Introduction The Network Service Header (NSH) [RFC8300] is the Service Function Chaining (SFC) encapsulation required to support the SFC architecture [RFC7665]. As such, the NSH provides following key elements: 1. Service Function Path identification. 2. Indication of location within a Service Function Path. 3. Optional, per-packet metadata (fixed-length or variable-length). [RFC8300] further defines two metadata formats (MD Types): 1 and 2. MD Type 1 defines the fixed-length, 16-octet long metadata, whereas MD Type 2 defines a variable-length context format for metadata. This document defines serveral common metadata context headers for use with NSH MD Type 2. These supplement the Subscriber Identity and Wei, et al. Expires November 13, 2021 [Page 2] Internet-Draft NSH MD2 Context Headers May 2021 Performance Policy MD Type 2 metadata context headers specified in [RFC8979]. This document does not address metadata usage, updating/chaining of metadata, or other SFP functions. Those topics are described in [RFC8300]. 2. Conventions used in this document 2.1. Terminology This document uses the terminology defined in the SFC Architecture [RFC7665] and the Network Service Header [RFC8300]. 2.2. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 3. NSH MD Type 2 format An NSH is composed of a 4-octet Base Header, a 4-octet Service Path Header and Context Headers. The Base Header identifies the MD-Type in use: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Ver|O|U| TTL | Length |U|U|U|U|MD Type| Next Protocol | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 1: NSH Base Header Please refer to NSH [RFC8300] for a detailed header description. When the base header specifies MD Type = 0x2, zero or more Variable Length Context Headers MAY be added, immediately following the Service Path Header. Therefore, Length = 0x2 indicates that only the Base Header followed by the Service Path Header is present. The value of the Length field, of optional Variable Length Context Headers, MUST be an integer indicating the length in 4-octet words. Figure 2 below depicts the format of the Context Header as defined in Section 2.5.1 of [RFC8300]. Wei, et al. Expires November 13, 2021 [Page 3] Internet-Draft NSH MD2 Context Headers May 2021 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class | Type |U| Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Variable-Length Metadata | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 2: NSH Variable-Length Context Headers 4. NSH MD Type 2 Context Headers [RFC8300] specifies Metadata Class 0x0000 as IETF Base NSH MD Class. In this document, metadata types are defined for the IETF Base NSH MD Class. 4.1. Forwarding Context This metadata context carries a network forwarding context, used for segregation and forwarding scope. Forwarding context can take several forms depending on the network environment. For example, VXLAN/VXLAN-GPE VNID, VRF identification, or VLAN. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA1 |U| Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | CT | Reserved | Forwarding Context ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 3: Forwarding Context - 1 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA1 |U| Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | CT | Reserved | Forwarding Context ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 4: Forwarding Context - 2 Wei, et al. Expires November 13, 2021 [Page 4] Internet-Draft NSH MD2 Context Headers May 2021 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA1 |U| Length = 4 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | CT | Resv | Forwarding Context ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 5: Forwarding Context - 3 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA1 |U| Length = 8 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | CT | Reserved | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Forwarding Context ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 6: Forwarding Context - 4 where: Context Type (CT) is four bits-long field that defines the length and the interpretation of the Tenant ID field. Please see the IANA Considerations in Section 7. This document defines these CT values: 0x0 - 12 bits VLAN identifier. See Figure Figure 3. Reserved bits MUST be sent as zero and ignored on receipt 0x1 - 20 bits MPLS VPN label. See Figure Figure 4. Reserved bits MUST be sent as zero and ignored on receipt 0x2 - 24 bits virtual network identifier (VNI). See Figure Figure 5. Reserved bits MUST be sent as zero and ignored on receipt 0x3 - 32 bits Session ID ([RFC3931]). This is called Key in GRE [RFC2890]. See Figure Figure 6. 4.2. Tenant Identifier Tenant identification is often used for segregation within a multi- tenant environment. Orchestration system-generated tenant IDs are an example of such data. This context header carries both the format and value of the Tenant identifier. Wei, et al. Expires November 13, 2021 [Page 5] Internet-Draft NSH MD2 Context Headers May 2021 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA2 |U| Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ Tenant ID ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 7: Tenant Identifier List The fields are described as follows: Length: Indicates the length of the Tenant ID in bytes (see Section 2.5.1 of [RFC8300]). Tenant ID: Represents an opaque value pointing to Orchestration system-generated tenant identifier. The structure and semantics of this field are deployment specific. 4.3. Ingress Network Node Information This context header carries a Node ID of the ingress network node. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA3 |U| Length = var| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ Node ID ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 8: Ingress Network Node ID where: The fields are described as follows: Length: Indicates the length of the Node ID in bytes (see Section 2.5.1 of [RFC8300]). Node ID: Represents an opaque value of the ingress network node ID. The structure and semantics of this field are deployment specific. For example, Node ID may be a 4 bytes IPv4 address Node ID, or a 16 bytes IPv6 address Node ID, or a 6 bytes MAC address, or 8 bytes MAC address, etc,. 4.4. Ingress Network Source Interface This context identifies the ingress interface of the ingress network node. This is an opaque quantity to the NSH. Wei, et al. Expires November 13, 2021 [Page 6] Internet-Draft NSH MD2 Context Headers May 2021 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA4 |U| Length = var| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ Source Interface/Port ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 9: Ingress Network Source Interface 4.5. Flow ID Flow ID provides a field in the NSH MD Type 2 to label packets belonging to the same flow. Absence of this field, or a value of zero denotes that packets have not been labeled. [RFC6437] defined IPv6 Flow Label as a 20-bit long unsigned integer. Also, [RFC6790], which defined the use of an entropy label in the MPLS network, is 20-bit long. The Flow ID is right justified (appears in the least significant bits of the Flow ID word) and is padded on the left with bits which MUST be sent as zero and ignored on receipt. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA5 |U| Length = var| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ Flow ID ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 10: Flow ID 4.6. Source and/or Destination Groups Intent-based systems can use this data to express the logical grouping of source and/or destination objects. [GROUPBASEDPOLICY] and [GROUPPOLICY] provide examples of such a system. Each is expressed as a 32-bit opaque object. Wei, et al. Expires November 13, 2021 [Page 7] Internet-Draft NSH MD2 Context Headers May 2021 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA6 |U| Length=8 | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Group | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Dest Group | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 11: Source/Dest Groups 4.7. Policy Identifier (POLICY_ID) Traffic handling policies are often referred to by a system-generated identifier, which is then used by the devices to look up the policy's content locally. For example, this identifier could be an index to an array, a lookup key, a database Id. The identifier allows enforcement agents or services to lookup up the content of their part of the policy quite efficiently. This identifier is treated as an opaque value. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Metadata Class = 0x0000 | Type = TBA7 |U| Length=var | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ POLICY_ID ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 12: POLICY_ID 5. Security Considerations [RFC8300] describes the general security considerations for protecting NSH. [I-D.ietf-sfc-nsh-integrity] specifies methods of protecting NSH metadata. 6. Acknowledgments The authors would like to thank Paul Quinn, Behcet Sarikaya, Dirk von Hugo, Mohamed Boucadair, Gregory Mirsky, Joel Halpern, Donald Eastlake for providing invaluable concepts and content for this document. Wei, et al. Expires November 13, 2021 [Page 8] Internet-Draft NSH MD2 Context Headers May 2021 7. IANA Considerations IANA is requested to assign the following types from the "NSH IETF- Assigned Optional Variable-Length Metadata Types" (0x0000 IETF Base NSH MD Class) registry available at [IANA-NSH-MD2]: This document defines the following new values (Table 1) in the Network Service Header (NSH) metadata context Type registry: +-------+----------------------------------+---------------+ | Value | Description | Reference | +-------+----------------------------------+---------------+ | TBA1 | Forwarding Context | This document | | TBA2 | Tenant Identifier | This document | | TBA3 | Ingress Network NodeID | This document | | TBA4 | Ingress Network Interface | This document | | TBA5 | Flow ID | This document | | TBA6 | Source and/or Destination Groups | This document | | TBA7 | Policy Identifier | This document | +-------+----------------------------------+---------------+ Table 1: Type Values 7.1. Forwarding Context Types IANA is requested to create a new sub-registry for "Forwarding Context" context types at [IANA-NSH-MD2] as follows: +---------+-----------------------------------------+---------------+ | Value | Forwarding Context Header Types | Reference | +---------+-----------------------------------------+---------------+ | 0x0 | 12-bit VLAN identifier | This document | | 0x1 | 20-bits MPLS VPN label | This document | | 0x2 | 24-bits virtual network identifier | This document | | | (VNI) | | | 0x3 | 32-bit Session ID | This document | | 0x4-0xE | Unassigned | IETF Review | | 0xF | Reserved | This document | +---------+-----------------------------------------+---------------+ Table 2: Forwarding Context Types 8. References Wei, et al. Expires November 13, 2021 [Page 9] Internet-Draft NSH MD2 Context Headers May 2021 8.1. Normative References [I-D.ietf-sfc-nsh-integrity] Boucadair, M., Reddy, T., and D. Wing, "Integrity Protection for the Network Service Header (NSH) and Encryption of Sensitive Context Headers", draft-ietf-sfc- nsh-integrity-05 (work in progress), March 2021. [IANA-NSH-MD2] IANA, "NSH IETF-Assigned Optional Variable-Length Metadata Types", . [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC3931] Lau, J., Ed., Townsley, M., Ed., and I. Goyret, Ed., "Layer Two Tunneling Protocol - Version 3 (L2TPv3)", RFC 3931, DOI 10.17487/RFC3931, March 2005, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8300] Quinn, P., Ed., Elzur, U., Ed., and C. Pignataro, Ed., "Network Service Header (NSH)", RFC 8300, DOI 10.17487/RFC8300, January 2018, . 8.2. Informative References [GROUPBASEDPOLICY] OpenStack, "Group Based Policy", 2014. [GROUPPOLICY] OpenDaylight, "Group Policy", 2014. [RFC2890] Dommety, G., "Key and Sequence Number Extensions to GRE", RFC 2890, DOI 10.17487/RFC2890, September 2000, . [RFC6437] Amante, S., Carpenter, B., Jiang, S., and J. Rajahalme, "IPv6 Flow Label Specification", RFC 6437, DOI 10.17487/RFC6437, November 2011, . Wei, et al. Expires November 13, 2021 [Page 10] Internet-Draft NSH MD2 Context Headers May 2021 [RFC6790] Kompella, K., Drake, J., Amante, S., Henderickx, W., and L. Yong, "The Use of Entropy Labels in MPLS Forwarding", RFC 6790, DOI 10.17487/RFC6790, November 2012, . [RFC7665] Halpern, J., Ed. and C. Pignataro, Ed., "Service Function Chaining (SFC) Architecture", RFC 7665, DOI 10.17487/RFC7665, October 2015, . [RFC8979] Sarikaya, B., von Hugo, D., and M. Boucadair, "Subscriber and Performance Policy Identifier Context Headers in the Network Service Header (NSH)", RFC 8979, DOI 10.17487/RFC8979, February 2021, . Authors' Addresses Yuehua (Corona) Wei (editor) ZTE Corporation No.50, Software Avenue Nanjing 210012 China Email: wei.yuehua@zte.com.cn Uri Elzur Intel Email: uri.elzur@intel.com Sumandra Majee Individual contributor Email: Sum.majee@gmail.com Carlos Pignataro Cisco Email: cpignata@cisco.com Wei, et al. Expires November 13, 2021 [Page 11]