RFC 5331

MPLS Upstream Label Assignment and Context-Specific Label Space

📅 published August 2008, from ietf

MPLS Upstream Label Assignment and Context-Specific Label Space 🦋

okay bestie, this is RFC 5331 🎀 It's a Standards Track doc from August 2008 (Network Working Group), written by R. Aggarwal and Y. Rekhter from Juniper Networks, with E. Rosen from Cisco Systems, Inc. 💅 The title block doesn't list anything it obsoletes or updates.

Status of This Memo ✨

This document is an Internet standards track protocol spec for the Internet community, and it's asking for discussion and suggestions for improvements 🫶 For the current standardization state and status of this protocol, check the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited.

Abstract 🌈

RFC 3031 limits MPLS to downstream-assigned labels 🙈 This doc introduces upstream-assigned MPLS labels, explains how upstream MPLS label assignment works, and introduces the "Context-Specific Label Space" concept 💜

Table of Contents 📝

1. Introduction ....................................................2
2. Specification of Requirements ...................................2
3. Context-Specific Label Space ....................................2
4. Upstream Label Assignment .......................................3
   4.1. Upstream-Assigned and Downstream-Assigned Labels ...........4
5. Assigning Upstream-Assigned Labels ..............................5
6. Distributing Upstream-Assigned Labels ...........................5
7. Upstream Neighbor Label Space ...................................6
8. Context Label on LANs ...........................................9
9. Usage of Upstream-Assigned Labels ..............................10
10. Security Considerations .......................................10
11. Acknowledgements ..............................................11
12. References ....................................................11
   12.1. Normative References .....................................11
   12.2. Informative References ...................................11

1. Introduction 🍓

okay so RFC 3031 [RFC3031] says MPLS only does downstream-assigned labels, which is so real. Here's the exact quote 👀

"In the MPLS architecture, the decision to bind a particular label L to a particular Forwarding Equivalence Class (FEC) F is made by the Label Switching Router (LSR) which is DOWNSTREAM with respect to that binding. The downstream LSR then informs the upstream LSR of the binding. Thus labels are "downstream-assigned", and label bindings are distributed in the "downstream to upstream" direction."

This doc adds upstream-assigned MPLS labels to the MPLS architecture, and it describes how upstream assignment works 🦋

RFC 3031 covers per-platform and per-interface label space. This doc generalizes the per-interface one into a "Context-Specific Label Space," and it uses a "Neighbor Label Space" as an example of that ✨ Upstream-assigned labels are always looked up in a context-specific label space, no exceptions 💅

2. Specification of Requirements 📜

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🫶

3. Context-Specific Label Space 🧚

RFC 3031 describes per-platform and per-interface label spaces. This doc brings in the more general idea of a "Context-Specific Label Space" 💖 An LSR can keep one or more context-specific label spaces. Generally, labels MUST be looked up in the per-platform label space, unless something about the context says a label should be looked up in a particular context-specific label space 🌸

One example is the per-interface label space from RFC 3031. When an MPLS packet comes in over a particular interface, its top label might need to be looked up in that receiving interface's per-interface label space. In that case, the receiving interface is the context of the packet 🎀 Whether packets received over a given interface need their top labels looked up in a per-interface label space depends on some characteristic or configuration of that interface 🙈

Per-interface label space [RFC3031] is an example of a context-specific label space used for downstream-assigned labels. Context-specific label spaces can also be used for upstream-assigned labels, as described below 💅

When MPLS labels are upstream-assigned, the LSR that assigns the label provides the context of that label. That LSR binds the label to a FEC F for a Label Switched Path (LSP) LSP1. It then sends the binding and context to an LSR Lr, which receives MPLS packets on LSP1 with label L. When Lr gets an MPLS packet on LSP1, it MUST be able to figure out the context of that packet 👑

One example of such a context is a tunnel that MPLS packets on LSP1 may be received over. In that case, after tunnel decapsulation, the top label of the MPLS packet gets looked up in a label space specific to the root of the tunnel. This means Lr needs to be able to tell which tunnel the packet came in over. So, if the tunnel is an MPLS tunnel, penultimate-hop-popping (PHP) MUST be disabled for that tunnel 🔥

Another example is the neighbor that MPLS packets on LSP1 may come from. Here, the top label of the MPLS packet, sent by that neighbor on LSP1, gets looked up in a "Neighbor-Specific Label Space" 🦋

Those two examples get more detail in Section 7 🫶

There can be other kinds of contexts too. For instance, we define the idea of an MPLS label being used to establish a context, meaning it identifies a label space. A "context label" is one that identifies a label table where the label right below the context label should be looked up. A context label carried as an outermost label over a particular multi-access subnet/tunnel MUST be unique within the scope of that subnet/tunnel 🧚

4. Upstream Label Assignment 🌈

When two MPLS LSRs are adjacent on an MPLS Label Switched Path (LSP), one of them can be called an "upstream LSR" and the other a "downstream LSR" [RFC3031]. Take two LSRs, Ru and Rd, that agreed to bind Label L to a FEC F for packets sent from Ru to Rd. For that binding, Ru is the "upstream LSR" and Rd is the "downstream LSR"."

If Rd made the binding between L and F and advertised it to Ru, the label binding is called "downstream-assigned". RFC 3031 only talks about downstream-assigned label bindings 💖

If Ru made the binding between L and F and advertised it to Rd, the label binding is called "upstream-assigned" 🌸

If a third party, say R3, made the binding between L and F and then advertised it to both Ru and Rd, we also call that label binding "upstream-assigned" 🎀

Here's a big observation about upstream-assigned labels 👀 When an upstream-assigned label L is at the top of the label stack, it must be looked up by an LSR that is not the LSR that assigned and distributed the label binding for L. So an upstream-assigned label MUST always be looked up in a context-specific label space, as described in Section 7 💅

We don't require any coordination between upstream label assignments and downstream label assignments. A particular label value can be upstream-assigned to one FEC and downstream-assigned to a different FEC 🧚

Using upstream-assigned labels is an OPTIONAL feature 🫶 Upstream-assigned labels MUST NOT be used unless it's known that the downstream LSR supports them 🙈

One use case for upstream-assigned labels is MPLS multicast, and Section 9 has an example of that 🦋

4.1. Upstream-Assigned and Downstream-Assigned Labels 🌸

It's possible that some LSRs on an LSP for FEC F distribute downstream-assigned label bindings for FEC F, while other LSRs distribute upstream-assigned label bindings. It's also possible for an LSR to distribute a downstream-assigned label binding for FEC F to its upstream adjacent LSR and distribute an upstream-assigned label binding for FEC F to its downstream adjacent LSR ✨ When two LSRs, Ru and Rd, are adjacent on an LSP for FEC F (with Ru as the upstream neighbor and Rd as the downstream neighbor), either Ru distributes an upstream-assigned label binding for F to Rd, or Rd distributes a downstream-assigned label binding to Ru, but not both 💅 Whether upstream-assigned or downstream-assigned labels get used for a particular FEC depends on the application using the LSP 👑

Any application that requires upstream-assigned labels MUST say so explicitly. Otherwise, downstream-assigned labels are assumed 🔥 An application on an LSR uses a label distribution protocol to tell its peer LSRs whether a particular label binding distributed by that LSR is upstream-assigned or downstream-assigned. The details of those procedures are outside the scope of this document 🙈 In some cases, a configuration option may decide which one an application uses 🧚

5. Assigning Upstream-Assigned Labels 💜

The only requirement for an upstream LSR assigning upstream-assigned labels is that the label must be unambiguous in the context-specific label space where the downstream LSR will look it up 🫶 An upstream LSR that is the headend of multiple tunnels SHOULD, by default, assign the upstream-assigned labels for all the LSPs carried over those tunnels from a single label space that all those tunnels share 🌈 Also, an upstream LSR that is the head of multiple tunnels SHOULD use the same IP address as the head identifier for those tunnels, as long as the head identifier includes an IP address 🎀 The LSR could assign the same label value to both a downstream-assigned label and an upstream-assigned label. The downstream LSR always looks up upstream-assigned MPLS labels in a context-specific label space, as described in Section 7 🦋

No entry for upstream-assigned labels gets created in the Incoming Label Map (ILM) [RFC3031] at the upstream LSR, because these labels aren't incoming labels 🙈 Instead, from the upstream LSR's point of view, an upstream label is an outgoing label for MPLS packets sent on the MPLS LSP where the upstream LSR is adjacent to the downstream LSR. So an upstream label is part of a Next Hop Label Forwarding Entry (NHLFE) at the upstream LSR 💖

When Ru advertises a binding of label L for FEC F to Rd, it creates an NHLFE entry for L. That NHLFE entry results in label L being imposed on the MPLS label stack of the packets forwarded using that NHLFE entry 🌸 If Ru is a transit router on the LSP for FEC F, it binds the ILM for the LSP to this NHLFE. If Ru is an ingress router on the LSP for FEC F, it binds the FEC to the NHLFE entry ✨

6. Distributing Upstream-Assigned Labels 📮✨

okay bestie, the first rule here is a big one 🚨 upstream-assigned label bindings MUST NOT be used unless it is known that the downstream LSR supports them. how that gets known is outside the scope of this doc, so don't go looking for it here 🙈

MPLS upstream label assignment needs a label distribution protocol to send the binding from the upstream LSR down to the downstream LSR 📬 The considerations for that kind of protocol that are described in [RFC3031] apply here too, so you're not starting from zero 💅

the distribution of upstream-assigned labels is kinda like either ordered LSP control or independent LSP control for downstream-assigned labels 🦋 for ordered, an LSR distributes an upstream-assigned label binding for a FEC F if it is either (a) the ingress LSR for FEC F, or (b) it has already received an upstream label binding for that FEC from its adjacent upstream LSR for FEC F, or (c) it has received a request for a downstream label binding from its upstream adjacent LSR. for independent, each LSR, upon noticing that it recognizes a particular FEC, makes its own independent decision to bind an upstream-assigned label to that FEC and to distribute that binding to its label distribution peers 🌸 so the LSR is doing its own thing, no waiting around, very main character 👑

7. Upstream Neighbor Label Space 🌈

okay this section is the heart of the whole thing 💖 if the top label of an MPLS packet being processed by LSR Rd is upstream-assigned, the label is looked up in a context-specific label space, NOT in a per-platform label space 🙅‍♀️

so Rd uses a context-specific label space that it keeps for Ru to "reserve" MPLS labels that Ru assigned 🎀 which means if Ru distributes an upstream-assigned label binding L for FEC F to Rd, then Rd reserves L in the separate ILM for Ru's context-specific label space. this is the ILM Rd uses to look up an MPLS label that is upstream-assigned by Ru ✨ the label might be the top label on the label stack of a packet received from Ru, or it might show up as the new top label after Rd pops one or more labels off a packet from Ru 🧚

this implies that Rd MUST be able to determine whether the top label of an MPLS packet being processed is upstream-assigned and, if yes, the "context" of that packet 😭 how Rd figures that out depends on the mechanism Ru uses to send the MPLS packet with an upstream-assigned top label L to Rd 💅

if Ru sends the packet by encapsulating it in an IP or MPLS tunnel, then Rd works out that L is upstream-assigned from the tunnel the packet came in on 🦋 whether a given tunnel can carry MPLS packets with downstream-assigned labels, upstream-assigned labels, or both depends on the tunnel type and is described in [RFC5332] 🍓 when Rd gets MPLS packets with a top label L on such a tunnel, it works out the "context" from the tunnel the packet arrived on. there must be a mechanism so Ru can tell Rd that a particular tunnel from Ru to Rd will be used for sending MPLS packets with upstream-assigned MPLS labels. that mechanism will be provided by the label distribution protocol between Ru and Rd, and it will likely need extensions to the existing label distribution protocols 🛠️ describing that mechanism is outside the scope of this document, so we're good 🫶

Rd keeps an "Upstream Neighbor Label Space" for upstream-assigned labels that Ru assigned 🌸 when Ru sends MPLS packets whose top label is upstream-assigned over IP or MPLS tunnels, Rd MUST be able to determine the root of those IP/MPLS tunnels 🔍 then Rd MUST use a separate label space for each unique root 💜

the root is identified by the head-end IP address of the tunnel. if the same upstream router, Ru, uses different head-end IP addresses for different tunnels, then the downstream router, Rd, MUST keep a different Upstream Neighbor Label Space for each of those head-end IP addresses 🙌

let's look at these conditions, it's giving logic puzzle 🧩

Ru is the "root" of two tunnels, call them A and B.
IP address X is an IP address of Ru.
The signaling protocol used to set up tunnel A identified A's root node as IP address X.
The signaling protocol used to set up tunnel B identified B's root node as IP address X.
Packets sent through tunnels A and B may be carrying upstream-assigned labels.
Ru is the LSR that assigned the upstream-assigned labels mentioned in condition 5.

if and only if these conditions hold, then Ru MUST use the same label space when upstream-assigning labels for packets that travel through tunnel A as it uses when upstream-assigning labels for packets that travel through tunnel B 💖 no splitting the label space for those two tunnels, periodt 💅

now suppose Rd is a node that belongs to tunnels A and B but is NOT the root node of either tunnel 🫣 then Rd may assume that the same upstream-assigned label space is used on both tunnels IF AND ONLY IF the signaling protocol used to set up tunnel A identified the root node as IP address X AND the signaling protocol used to set up tunnel B identified the root node as that same IP address X 🦋 the "if and only if" energy is very strong here 😭

also, the protocol used to distribute the upstream-assigned label for a particular tunnel MUST identify the "assigner" using the same IP address that the tunnel setup protocol uses to identify the root node of the tunnel 🎯 implementors, please take note of this, even if the tunnel setup protocol is different from the protocol that distributes the upstream-assigned label over the tunnel 📝

the exact procedure for finding the IP address of the root of a tunnel depends on the protocol used to set up the tunnel, obviously 🙃 for Point-to-Point (P2P) tunnels, the intention is that the headend of the tunnel is the "root" 👑 for Point-to-Multipoint (P2MP) or Multipoint-to-Multipoint (MP2MP) tunnels, you can always pick out one node as the "root" of the tunnel ✨

some tunnels get set up by configuration instead of by signaling 🛠️ for those, the IP address of the root of the tunnel must be configured 🫶

and some tunnels don't even need configuration 🤯 for example, a Generic Routing Encapsulation (GRE) tunnel can be "created" just by encapsulating packets and sending them. in that case the IP address of the root is considered to be the IP source address of the encapsulated packets 🌈

if the tunnel Rd receives MPLS packets with a top label L on is an MPLS tunnel, then Rd determines a) that L is upstream-assigned and b) the context for L, from the labels above L in the label stack 🧚 note that one or more of those labels may also be upstream-assigned labels too, so keep your eyes open 👀

if the tunnel Rd receives MPLS packets with a top label L on is an IP/GRE tunnel, then Rd determines a) that L is upstream-assigned [RFC5332] and b) the context for L, from the source address in the IP header 💜

when Ru and Rd are adjacent to each other on a multi-access data link media 🛜 and Ru would send the packet with top label L by encapsulating it in a data link frame, then Rd can tell whether L is upstream-assigned or downstream-assigned, as described in [RFC5332] 🍓 that works because if L is upstream-assigned, then [RFC5332] uses a different ether type in the data link frame 🎀 BUT that is NOT enough for Rd to figure out the context of the packet 😩 so, to fix that, Ru encapsulates the packet in a one-hop MPLS tunnel. this tunnel uses an MPLS context label that Ru assigns 🦋 Section 8 describes how the context label gets assigned. Rd keeps a separate "Upstream Neighbor Label Space" for Ru. the "context" of the packet, meaning Ru's upstream neighbor label space where L was reserved, is determined by Rd from the top context label and the interface the packet arrives on 🌸 the ether type in the data link frame is set to show that the top label is upstream-assigned, and the second label in the stack is L 💅

8. Context Label on LANs 🏠

for a labeled packet with an ether type of "upstream label assignment", the top label is used as the context 🫶 the context label value is assigned by the upstream LSR and advertised to the downstream LSRs 📣 the mechanisms for advertising the context label will be provided by the label distribution protocol between the upstream and downstream LSRs, and describing that mechanism is outside the scope of this document 🙈

the context label an LSR assigns for use on a particular LAN interface MUST be unique across all the context labels other LSRs assign for use on the same LAN 🔒 and when a labeled packet comes in from the LAN, the context label MUST be looked up in the context of the LAN interface the packet was received on 👀

this document gives two methods an LSR can use to choose a context label to advertise on a particular LAN 💖

the first method says each LSR needs to be provisioned with a 20-bit context label for each LAN interface that needs one 🛠️ then it's up to the provisioning system to make sure the assigned context label is unique across the LAN 🧐

the second method lets the context labels be auto-generated, but it only works if every LSR on the LAN has an IPv4 address as its primary IP address for that LAN interface 🌈 (if any LSR on the LAN has only IPv6 addresses for the LAN interface, then the first method is used instead 🙃)

now the auto-generation trick 🪄 suppose each LAN interface is configured with a primary IPv4 address that is unique on that LAN. the host part of the IPv4 address, as identified by the network mask, is unique. if the IPv4 network mask is greater than 12 bits, you can map the remaining 20 bits into a unique context label value ✨ that lets the LSRs on the LAN auto-generate a unique context label 🧚 to make sure auto-generated context label values don't land in the reserved label space range [RFC3032], the value of the host part of the IPv4 address gets offset with 0x10, but only if this value is not greater than 0xFFFEF 🛡️ host part values greater than 0xFFFEF are NOT allowed to be used as context labels 🚫

let's wrap this with a real example 🎀 consider LSR Rm (downstream) connected to Ru1 (upstream) on a LAN interface and to Ru2 (upstream) on a different LAN interface 🌸 Rm could get a context label value derived from the LAN interface from Ru1 and also from Ru2. it's possible that the context label values used by Ru1 and Ru2 are the same. that would happen if the LAN interfaces of both Ru1 and Ru2 are configured with a primary IPv4 address where the lowest 20 bits are equal 🦋 but honestly, this doesn't create any ambiguity, because it's already been said that the context label MUST be looked up in the context of the LAN interface the packet was received on 💅

9. Usage of Upstream-Assigned Labels ✨

okay so this is the bit where upstream-assigned labels actually do something iconic 💅 The main example is MPLS multicast, and it's here just to illustrate the idea 🦋

Picture this: an upstream LSR Ru is next to a bunch of downstream LSRs <Rd1...Rdn> on an LSP called LSP1. Ru is connected to all of them through a multi-access media or a tunnel, AND Ru wants to send a single copy of an MPLS packet down the LSP to all of <Rd1...Rdn> 🫶

For a tunnel, Ru can distribute an upstream-assigned label L (bound to the FEC for LSP1) to <Rd1..Rdn>, then send an MPLS packet whose top label is L out on the tunnel. Easy peasy 🎀

For a multi-access media, it's a little more layered 🧚 Ru distributes that same upstream-assigned label L to <Rd1..Rdn>, then sends an MPLS packet where the top label is the context label that identifies Ru, and the label right below it is L. Each of <Rd1..Rdn> then interprets the packet in the context of Ru and forwards it appropriately. The whole thing is giving "one packet, many receivers, zero drama" 🌈

Here's the catch, bestie: this means <Rd1..Rdn> MUST all be able to support an Upstream Neighbor Label Space for Ru, and Ru MUST be able to determine this 👑 How they figure that out depends on the application that's using upstream-assigned labels, and that's outside the scope of this document 🙈

10. Security Considerations 🔥

okay security time, and I'm taking it seriously 😭

The security considerations for upstream-assigned labels and context labels are no different in kind than the ones for downstream-assigned labels. Same vibe, same risks 💜

Heads up though: the procedures for distributing upstream-assigned labels and/or context labels are NOT in this document's scope. So any security considerations that might apply to those procedures aren't covered here 💀

Section 8 of this document describes a procedure that automatically generates a unique context label for a LAN. That procedure assumes that the IP addresses of all the LSR interfaces on the LAN will be unique in their low-order 20 bits. If two LSRs whose IP addresses have the same low-order 20 bits end up on the same LAN, other LSRs are likely to misroute packets sent to the LAN by either of those two LSRs. Yikes 😬

For more detailed discussion of security issues relevant to MPLS and GMPLS, including security threats, related defensive techniques, and the mechanisms for detection and reporting, see "Security Framework for MPLS and GMPLS Networks [MPLS-SEC].

11. Acknowledgements 🫶

Huge thanks to IJsbrand Wijnands, specifically for the text that Section 8 is based on. Slay 💖

12. References 📚

12.1. Normative References

[RFC3031]  Rosen, E., Viswanathan, A., and R. Callon, "Multiprotocol
           Label Switching Architecture", RFC 3031, January 2001.

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC5332]  Eckert, T., Rosen, E., Aggarwal, R., and Y. Rekhter, "MPLS
           Multicast Encpsulations", RFC 5332, August 2008.

12.2. Informative References

[RFC3032]  Rosen, E., Tappan, D., Fedorkow, G., Rekhter, Y.,
           Farinacci, D., Li, T., and A. Conta, "MPLS Label Stack
           Encoding", RFC 3032, January 2001.

[MPLS-SEC] Fang, L., Ed., "Security Framework for MPLS and GMPLS
           Networks", Work in Progress, July 2008.

Authors' Addresses 🎀

The authors, in case you want to slide into their inboxes 💌

Rahul Aggarwal
Juniper Networks
1194 North Mathilda Ave.
Sunnyvale, CA 94089

EMail: rahul@juniper.net

Yakov Rekhter
Juniper Networks
1194 North Mathilda Ave.
Sunnyvale, CA 94089

EMail: yakov@juniper.net

Eric C. Rosen
Cisco Systems, Inc.
1414 Massachusetts Avenue
Boxborough, MA 01719

EMail: erosen@cisco.com

Full Copyright Statement 🌸

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🔐

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't represent that it has made any independent effort to identify any such rights. Info on the procedures for rights in RFC documents can be found in BCP 78 and BCP 79 📖

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF online IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org ✨

📦 where this page comes from

ietf: rfc5331 2008-08
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms