RFC 7880
Seamless Bidirectional Forwarding Detection (S-BFD)
Hiii bestie 🎀 Okay, so this is the RFC for Seamless BFD (S-BFD). It's basically the spec for making failure detection faster to set up and way more flexible. Let's get into it 💅
Title Block ✨
Okay so, the paperwork first, but make it cute 🦋
- Title: Seamless Bidirectional Forwarding Detection (S-BFD) 💖
- Number: RFC 7880, published by the IETF (the Internet Engineering Task Force) 🌸
- Authors: C. Pignataro (Cisco), D. Ward (Cisco), N. Akiya (Big Switch Networks), M. Bhatia (Ionos Networks), and S. Pallagatti 👑
- Category: Standards Track, so it's an actual Internet standard, not just vibes 🔥
- Date: July 2016 🍓
- ISSN: 2070-1721 ✨
- Updates: RFC 5880. This one tweaks the original BFD spec, so it's a big deal (iykyk) 🧚
Abstract
Okay so the vibe here is that this doc defines Seamless Bidirectional Forwarding Detection (S-BFD), which is a simplified way to use BFD where a ton of the negotiation stuff is just gone 🫶 That means you get quick provisioning, plus better control and flexibility for the network nodes that start the path monitoring. Iconic ✨
This document updates RFC 5880. 🦋
Status of This Memo
This one is an Internet Standards Track document 💅
It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on Internet Standards, check Section 2 of RFC 7841 🌈
Info about the current status of this doc, any errata, and how to send feedback is at http://www.rfc-editor.org/info/rfc7880 🎀
Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. 🔒
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication of this document. Please review these documents carefully, because they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License. ⭐
Table of Contents 📚
1. Introduction ....................................................4
2. Terminology .....................................................4
3. Seamless BFD Overview ...........................................6
4. S-BFD Discriminators ............................................7
4.1. S-BFD Discriminator Uniqueness .............................7
4.2. Discriminator Pools ........................................7
5. Reflector BFD Session ...........................................8
6. State Variables .................................................9
6.1. New State Variables ........................................9
6.2. State Variable Initialization and Maintenance ..............9
7. S-BFD Procedures ...............................................10
7.1. Demultiplexing of S-BFD Control Packet ....................10
7.2. Responder Procedures ......................................11
7.2.1. Responder Demultiplexing ...........................11
7.2.2. Transmission of S-BFD Control Packet by
SBFDReflector ......................................11
7.2.3. Additional SBFDReflector Behaviors .................12
7.3. Initiator Procedures ......................................13
7.3.1. SBFDInitiator State Machine ........................14
7.3.2. Transmission of S-BFD Control Packet by
SBFDInitiator ......................................15
7.3.3. Additional SBFDInitiator Behaviors .................15
7.4. Diagnostic Values .........................................16
7.5. The Poll Sequence .........................................16
8. Operational Considerations .....................................16
8.1. Scaling Aspect ............................................17
8.2. Congestion Considerations .................................17
9. Co-existence with Classical BFD Sessions .......................17
10. S-BFD Echo Function ...........................................18
11. Security Considerations .......................................19
12. References ....................................................20
12.1. Normative References .....................................20
12.2. Informative References ...................................20
Appendix A. Loop Problem and Solution .............................22
Acknowledgements ..................................................23
Contributors ......................................................23
Authors' Addresses ................................................241. Introduction ✨
Okay so Bidirectional Forwarding Detection (BFD), as described in [RFC5880] and related docs, has efficiently generalized the failure detection mechanism for multiple protocols and applications. 🙌 But there's still room to make it fit existing technologies better, and it could also evolve to fit new ones. This doc is all about improving efficiency, expanding failure detection coverage, and letting BFD be used in wider scenarios 💜 More use cases are listed in [RFC7882] if you wanna nerd out.
So specifically, this doc defines Seamless Bidirectional Forwarding Detection (S-BFD), a simplified mechanism for using BFD with a large proportion of negotiation aspects eliminated. The benefits? Quick provisioning, plus improved control and flexibility for network nodes that initiate path monitoring 🦋 S-BFD lets cases that benefit from core BFD tech work in a way that uses existing implementations and protocol machinery, while giving you a pretty simplified and mostly stateless setup for continuity testing. It's giving efficient and chill 🌸
Here's the key thing: this mechanism gets rid of the time between a network node wanting to do a continuity test and actually finishing it ⏱️ In traditional BFD terms, the initial state changes from DOWN to UP are basically nonexistent. Removing this "seam" (i.e., time delay) makes everything feel smooth and continuous for applications, which is why it's called "Seamless BFD" (S-BFD). Main character energy 👑
2. Terminology 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. 💅
You're expected to already know the BFD [RFC5880], IP [RFC791] [RFC2460], and MPLS [RFC3031] terms and protocol constructs 🧚 The rest of this section introduces some new terms that S-BFD brings to the table:
- Classical BFD: BFD session types based on [RFC5880]. 🌈
- S-BFD: Seamless BFD. 💖
- S-BFD Control packet: a BFD Control packet for the S-BFD mechanism. 🎀
- S-BFD Echo packet: a BFD Echo packet for the S-BFD mechanism. 🦋
- S-BFD packet: a BFD Control packet or a BFD Echo packet. 🌸
- Entity: a function on a network node that the S-BFD mechanism lets remote network nodes run continuity tests against. An entity can be abstract (e.g., reachability) or specific (e.g., IP addresses, Router-IDs, functions). 🔮
- SBFDInitiator: an S-BFD session on a network node that runs a continuity test to a remote entity by sending S-BFD packets. 🚀
- SBFDReflector: an S-BFD session on a network node that listens for incoming S-BFD Control packets to local entities and generates response S-BFD Control packets. 🪞
- Reflector BFD session: synonymous with SBFDReflector. ✨
- S-BFD Discriminator: a BFD Discriminator allocated for a local entity. An SBFDReflector listens for S-BFD Discriminators. 🎯
- BFD Discriminator: a BFD Discriminator allocated for an SBFDInitiator. 🫶
- Initiator: a network node hosting an SBFDInitiator. 👑
- Responder: a network node hosting an SBFDReflector. 💜
Figure 1 shows how all these S-BFD terms relate to each other. Look at this diagram, it's so satisfying 😭
+---------------------+ +------------------------+
| Initiator | | Responder |
| +-----------------+ | | +-----------------+ |
| | SBFDInitiator |---S-BFD Ctrl pkt----->| SBFDReflector | |
| | +-------------+ |<--S-BFD Ctrl pkt------| +-------------+ | |
| | | BFD Discrim | | | | | |S-BFD Discrim| | |
| | | | |---S-BFD Echo pkt---+ | | | | |
| | +-------------+ | | | | | +----------^--+ | |
| +-----------------+<-------------------+ +------------|----+ |
| | | | |
| | | +---v----+ |
| | | | Entity | |
| | | +--------+ |
+---------------------+ +------------------------+
Figure 1: S-BFD Terminology Relationship3. Seamless BFD Overview 🦋
okay so picture this: every network node runs an S-BFD module 💅 It grabs one or more S-BFD Discriminators for its local entities and spins up a Reflector BFD session. Those discriminators can get advertised by applications like OSPF or IS-IS 📣 The whole point is that applications on other nodes learn about the discriminators a remote node assigned to its remote entities. Then the Reflector BFD session, when it gets an S-BFD Control packet aimed at one of its local S-BFD Discriminator values, is meant to send a response S-BFD Control packet right back to the initiator 🔁
once that setup is done, any node that knows about a remote node's S-BFD Discriminator can run a continuity test to that remote entity super fast. It just sends S-BFD Control packets with the matching value in the Your Discriminator field ⚡ no drama, no cap
Figure 2 shows this off 🌸
<------- IS-IS Network ------->
+---------+
| |
A---------B---------C---------D
^ ^
| |
System-ID System-ID
xxx yyy
BFD Discrim BFD Discrim
123 456
Figure 2: S-BFD for IS-IS Networkso Node A is a system with IS-IS System-ID xxx. Its S-BFD module allocates S-BFD Discriminator 123, and IS-IS advertises that 123 in an IS-IS TLV 📨 Node D (System-ID yyy) allocates S-BFD Discriminator 456, and IS-IS advertises that one in a TLV too. A Reflector BFD session gets created on both Node A and Node D 🎀 When Node A wants to check whether Node D is reachable, it can send an S-BFD Control packet to Node D with the Your Discriminator field set to 456. When the Reflector BFD session on Node D gets that packet, it sends a response S-BFD Control packet back to Node A, and that's how Node A finishes the continuity test ✨ iconic
now the tea ☕ if one node allocates multiple S-BFD Discriminators, how remote nodes figure out which discriminator belongs to which entity is still unspecified 🙈 so using multiple S-BFD Discriminators on one node is kinda discouraged until there's a way to learn that mapping.
4. S-BFD Discriminators 👑
4.1. S-BFD Discriminator Uniqueness
one major vibe of an S-BFD Discriminator is that it MUST be unique within an administrative domain 🔒 If multiple network nodes allocate the same S-BFD Discriminator value, then S-BFD Control packets that land on the wrong node can make a Reflector BFD session send back a response, just because the Your Discriminator value matches. That is clearly not it 💀
4.2. Discriminator Pools
this subsection walks through a discriminator pool technique that helps cut down on S-BFD Discriminator collisions 🧚 It's a way for an implementation to better meet the S-BFD Discriminator uniqueness requirement from Section 4.1.
- An SBFDInitiator is to allocate a discriminator from the BFD Discriminator pool. If the system also supports classical BFD (i.e., implements [RFC5880]), then the BFD Discriminator pool SHOULD be shared by SBFDInitiator sessions and classical BFD sessions.
- An SBFDReflector is to allocate a discriminator from the S-BFD Discriminator pool. The S-BFD Discriminator pool SHOULD be a separate pool from the BFD Discriminator pool.
the rest of this subsection explains why those suggestions make sense 🤓
Locally allocated S-BFD Discriminator values for entities that SBFDReflector sessions are listening for may be arbitrarily allocated or derived from values provided by applications. These values may be protocol IDs (e.g., System-ID, Router-ID) or network targets (e.g., IP address). To avoid derived S-BFD Discriminator values already being assigned to other BFD sessions (i.e., SBFDInitiator sessions and classical BFD sessions), it is RECOMMENDED that the discriminator pool for SBFDReflector sessions be separate from other BFD sessions 🫶
even with the "separate discriminator pool" approach, a collision can still happen between different S-BFD applications that derive S-BFD Discriminator values using different values and algorithms 😬 If two applications use S-BFD for the same purpose (e.g., network reachability), then the colliding S-BFD Discriminator value can be shared. If the two applications use S-BFD for different purposes, then the collision has to be dealt with. Using multiple S-BFD Discriminators on a single network node is still discouraged (see Section 3) 💅
5. Reflector BFD Session 🌈
each network node creates one or more Reflector BFD sessions. A Reflector BFD session transmits S-BFD Control packets in response to received S-BFD Control packets whose Your Discriminator field holds an S-BFD Discriminator allocated for a local entity. Specifically, a Reflector BFD session has these characteristics:
- MUST NOT transmit any S-BFD packets based on local timer expiry.
- MUST transmit an S-BFD Control packet in response to a received S-BFD Control packet having a valid S-BFD Discriminator in the Your Discriminator field, unless prohibited by local policies (e.g., administrative, security, rate-limiter).
- MUST be capable of sending only two states: UP and AdminDown.
one Reflector BFD session can handle received S-BFD Control packets for all locally allocated S-BFD Discriminators, or a few Reflector BFD sessions can each take a subset of them 🍓 That's a local decision and outside the scope of this document.
incoming S-BFD Control packets can be based on IPv4, IPv6, or MPLS [RFC7881] 🌐 other options are possible too and might get defined in future documents. How these S-BFD Control packets reach the right Reflector BFD session is also a local matter and outside the scope of this document 🧚
6. State Variables 💜
S-BFD adds new state variables and changes how some existing ones get used 🔧
6.1. New State Variables
one new state variable gets added to the base specification for S-BFD 🎀
bfd.SessionType: This is a new state variable that describes the type of a particular session. Allowable values for S-BFD sessions are:SBFDInitiator- an S-BFD session on a network node that performs a continuity test to a target entity by sending S-BFD packets.SBFDReflector- an S-BFD session on a network node that listens for incoming S-BFD Control packets to local entities and generates response S-BFD Control packets.
bfd.SessionType MUST be initialized to the appropriate type when an S-BFD session is created ✨
6.2. State Variable Initialization and Maintenance
state variables (defined in Section 6.8.1 of [RFC5880]) need to be initialized or manipulated differently depending on the session type 🦋
bfd.DemandMode: This variable MUST be initialized to 1 for session type SBFDInitiator and MUST be initialized to 0 for session type SBFDReflector. This is done to prevent loops (see Appendix A). 🔁
7. S-BFD Procedures 🎀
7.1. Demultiplexing of S-BFD Control Packet
An S-BFD packet MUST be demultiplexed with lower-layer information (e.g., dedicated destination UDP port [RFC7881], associated Channel Type [RFC7885]). The following procedure SHOULD be executed on both initiator and reflector 🫶
If the packet is an S-BFD packet
If the S-BFD packet is for an SBFDReflector
The packet MUST be looked up to locate a corresponding
SBFDReflector session based on the value from the
Your Discriminator field in the table describing S-BFD
Discriminators.
Else
The packet MUST be looked up to locate a corresponding
SBFDInitiator session or classical BFD session based on the
value from the Your Discriminator field in the table
describing BFD Discriminators. If no match, then the
received packet MUST be discarded.
If the session is an SBFDInitiator session
The destination of the packet (i.e., the destination IP
address) SHOULD be verified as being for itself.
Else
The packet MUST be discarded.
Else
The procedure described in Section 6.8.6 of [RFC5880] MUST be
applied.more details on S-BFD Control packet demultiplexing live in the relevant S-BFD data-plane documents 📚
7.2. Responder Procedures
a network node that receives S-BFD Control packets sent by an initiator is called the responder 💁♀️ When the responder gets S-BFD Control packets, it verifies that they're valid, as described in [RFC5880].
7.2.1. Responder Demultiplexing
An S-BFD packet MUST be demultiplexed with lower-layer information. The following procedure SHOULD be executed by the responder:
If the Your Discriminator field is not one of the entries
allocated for local entities
The packet MUST be discarded.
Else
The packet is determined to be handled by a Reflector BFD
session responsible for that S-BFD Discriminator.
If allowable per local policy (e.g., administrative, security,
rate-limiter)
The chosen Reflector BFD session SHOULD transmit a response
BFD Control packet using the procedures described in
Section 7.2.2.7.2.2. Transmission of S-BFD Control Packet by SBFDReflector
the contents of S-BFD Control packets sent by an SBFDReflector MUST be set as per Section 6.8.7 of [RFC5880] 📝 A few fields need to be set differently from [RFC5880], like this:
State (Sta): Set tobfd.SessionState(either UP or AdminDown only). More on the Reflector BFD session state is in Section 7.2.3. 🌸Demand (D): Set to 0, to indicate that the S-BFD packet is sent by the SBFDReflector. 🙌Detect Mult: Value to be copied from the Detection Multiplier field of the received BFD packet. 🔢My Discriminator: Value to be copied from the Your Discriminator field of the received BFD packet. 🪞Your Discriminator: Value to be copied from the My Discriminator field of the received BFD packet. 🔄Desired Min TX Interval: Value to be copied from the Desired Min TX Interval field of the received BFD packet. ⏱️Required Min RX Interval: Set tobfd.RequiredMinRxInterval. This is the minimum interval, in microseconds, between received S-BFD Control packets. Further details are in Section 7.2.3. 🕰️Required Min Echo RX Interval: If the device supports looping back S-BFD Echo packets, set this to the minimum required S-BFD Echo packet receive interval for this session. Otherwise, set it to 0. 🪄
7.2.3. Additional SBFDReflector Behaviors ✨
- okay bestie, S-BFD Control packets sent by the SBFDReflector MUST have
Required Min RX Intervalset to a value in microseconds that says the smallest gap between incoming S-BFD Control packets this SBFDReflector can actually handle 🫶. The SBFDReflector can control how fast SBFDInitiators send S-BFD Control packets to it by making sureRequired Min RX Intervalmatches the current load 🔥. - when the SBFDReflector gets an S-BFD Control packet from an SBFDInitiator, it has to figure out what "state" to put in the response 👀. If the monitored local entity is in service, the state MUST be set to UP ✅. If it's "temporarily out of service," the state SHOULD be set to AdminDown 💤.
- if an SBFDReflector gets an S-BFD Control packet with the
Demand (D)bit cleared, that packet MUST be discarded (see Appendix A) 🗑️. Not me, not allowed 💅.
7.3. Initiator Procedures 🦋
S-BFD Control packets sent by an SBFDInitiator MUST set the Your Discriminator field to an S-BFD Discriminator that matches the remote entity 🎯.
Every SBFDInitiator MUST have a locally unique My Discriminator value, allocated from the BFD Discriminator pool 🌸.
Figure 3 is the big-picture vibe of continuity testing with S-BFD 🌈. R2 allocates XX as the S-BFD Discriminator for network reachability purposes and advertises XX to its neighbors. Then Figure 3 shows R1 and R4 running a continuity test to R2 🫧.
+--- md=50/yd=XX (ping) ----+
| |
|+-- md=XX/yd=50 (pong) --+ |
|| | |
|v | v
R1 ==================== R2[*] ========= R3 ========= R4
| ^ |^
| | ||
| +-- md=60/yd=XX (ping) --+|
| |
+---- md=XX/yd=60 (pong) ---+
[*] Reflector BFD session on R2.
=== Links connecting network nodes.
--- S-BFD Control packet traversal.
Figure 3: S-BFD Continuity Test7.3.1. SBFDInitiator State Machine 🧠
An SBFDInitiator may be a "persistent" session on the initiator with a timer for S-BFD Control packet transmissions (stateful SBFDInitiator) ⏰. An SBFDInitiator may also be a module, a script, or a tool on the initiator that sends one or more S-BFD Control packets "when needed" (stateless SBFDInitiator) 🎀. For stateless SBFDInitiators, a complete BFD state machine may not be applicable 🤷♀️. For stateful SBFDInitiators, the states and the state machine in [RFC5880] will not work, because the SBFDReflector session only sends the UP and AdminDown states (so it never sends INIT) 🙈.
The next diagram gives you the RECOMMENDED state machine for stateful SBFDInitiators 👑. Each arc shows the state of the SBFDInitiator (as received in the State field of the S-BFD Control packet), or the expiration of the Detection Timer ✨. See Figure 4.
+--+
ADMIN DOWN, | |
TIMER | V
+------+ UP +------+
| |-------------------->| |----+
| DOWN | | UP | | UP
| |<--------------------| |<---+
+------+ ADMIN DOWN, +------+
TIMER
Figure 4: SBFDInitiator Finite State MachineHeads up, this state machine is different from the base BFD spec in [RFC5880] 🚨. That's because INIT is no longer a thing for the SBFDInitiator. The other big difference is the jump from DOWN to UP when the SBFDInitiator receives a packet with an UP state setting 🦋. The states and events mean the same things they do in the base BFD spec [RFC5880] 💜.
7.3.2. Transmission of S-BFD Control Packet by SBFDInitiator 📦
The contents of S-BFD Control packets sent by an SBFDInitiator MUST be set as per Section 6.8.7 of [RFC5880] 📋. A few fields need to be set differently from [RFC5880], so here's the tea:
Demand (D): used to show that the S-BFD packet came from the SBFDInitiator. Always set to 1 💖.Your Discriminator: set to bfd.RemoteDiscr. bfd.RemoteDiscr is set to the Discriminator value of the remote entity. It MAY be learnt from routing protocols or configured locally 🧚.Required Min RX Interval: set to 0 🫧.Required Min Echo RX Interval: set to 0 🫧.
7.3.3. Additional SBFDInitiator Behaviors 💅
- if the SBFDInitiator gets a valid S-BFD Control packet back in response to one it sent to a remote entity, the SBFDInitiator SHOULD conclude that the S-BFD Control packet reached the intended remote entity 🎉.
- when an SBFDInitiator gets a response S-BFD Control packet and the state is AdminDown, the SBFDInitiator MUST NOT conclude that reachability to that remote entity is lost. It MUST also back off its packet transmission interval for that remote entity to an interval no faster than 1 second 🐢. Calm down, girl 🙃.
- when a sufficient number of S-BFD packets have not arrived as they should, the SBFDInitiator SHOULD declare loss of reachability to the remote entity 📉. The criteria for declaring loss of reachability, and the action triggered as a result, are outside the scope of this document. The action MAY include logging an error 📝.
- regarding the third bullet item, it's critical for an implementation to understand the latency to and from the Reflector BFD session on the responder 🧐. In other words, for the very first S-BFD packet the SBFDInitiator transmits, an implementation MUST NOT expect a response S-BFD packet for a time equal to the sum of the latencies: initiator to responder, and responder back to initiator ⏳.
- if the SBFDInitiator gets an S-BFD Control packet with the
Demand (D)bit set, that packet MUST be discarded (see Appendix A) 🗑️.
7.4. Diagnostic Values 🔍
The diagnostic value in both directions MAY be set to a certain value, so both ends can try to share more info 💬. Implementations MAY use the already-existing diagnostic values defined in Section 4.1 of [RFC5880] 🌟. Details about this topic are outside the scope of this specification, though 🙃.
7.5. The Poll Sequence 🔁
The Poll Sequence MAY be used in both directions 🦋. The Poll Sequence MUST operate in accordance with [RFC5880] 📜. An SBFDReflector MAY use the Poll Sequence to slow down how fast S-BFD Control packets are generated by an SBFDInitiator 🐌. It does this using the procedures in Section 7.2.3, by setting the Poll (P) bit in the reflected S-BFD Control packet 🪄. The SBFDInitiator is then supposed to send the next S-BFD Control packet with the Final (F) bit set 💌. If an SBFDReflector receives an S-BFD Control packet with the P bit set, the SBFDReflector MUST respond with an S-BFD Control packet that has the P bit cleared and the F bit set 🫶.
8. Operational Considerations ✨
S-BFD gives you a smooth and continuous (i.e., seamless) operational experience as an Operations, Administration, and Maintenance (OAM) mechanism for connectivity checking and connection verification 🌊. It gets there with a simplified mechanism that drops a large chunk of the negotiation, so provisioning is faster and simpler 🚀.
Because the mechanism is so simple, a misconfiguration could cause an SBFDInitiator to send S-BFD Control packets to a target that doesn't exist, or that is outside the S-BFD administrative domain 😬. As explained in Section 7.3.1, an SBFDInitiator can be a persistent initiator or a "when needed" one. When an S-BFD persistent SBFDInitiator is used, a deployment SHOULD make sure S-BFD Control packets don't propagate for an extended period of time outside the administrative domain that uses it 🚧. Operational measures SHOULD also be taken to spot when responses to S-BFD packets stop coming back for an extended period, and then fix the situation 🛠️. These concerns are largely mitigated by dynamic advertisement mechanisms for S-BFD, and by automation checks before configurations are applied 🤖.
8.1. Scaling Aspect 📈
This mechanism brings one noticeable difference in terms of scaling: the number of SBFDReflectors 🪞. This specification removes the need for egress nodes to have fully active BFD sessions when only one side wants to run continuity tests 🙌. With the Reflector BFD concept, egress no longer has to create any active BFD sessions on a per-path/LSP/function basis 💫. So the total number of BFD sessions in a network goes down 📉.
8.2. Congestion Considerations 🚦
When S-BFD does failure detection, it uses up resources, including bandwidth and CPU processing 💻. To avoid congestion, operators really do need to provision the rates at which S-BFD packets are transmitted correctly 🫠. When BFD is used across multiple hops, a congestion control mechanism MUST be implemented, and when congestion is detected, the BFD implementation MUST reduce the amount of traffic it generates 🛑. The exact mechanism for detecting congestion is outside the scope of this specification, but it may include detecting lost BFD Control packets or other means 🔎. The SBFDReflector can limit the rate at which SBFDInitiators send S-BFD Control packets by using Required Min RX Interval, but the trade-off is detection time, which will increase 🐢.
9. Co-existence with Classical BFD Sessions 🧚
Demultiplexing requirements for the initial packet are described in Section 7.1 🔀. Because of this, the S-BFD mechanism can co-exist with classical BFD sessions 🫂.
10. S-BFD Echo Function 🦋
okay so the S-BFD Echo function is basically the cousin of the BFD Echo function from [RFC5880] 💅 S-BFD Echo packets have the destination of "self", so they're self-generated and self-terminated after they go across a link or path ✨ they're supposed to U-turn on the target node in the data plane, and they MUST NOT be processed by any Reflector BFD sessions on the target node 🙅♀️
When using the S-BFD Echo function, it is RECOMMENDED that:
- Both S-BFD Control packets and S-BFD Echo packets be sent. 🌸
- Both S-BFD Control packets and S-BFD Echo packets have the same semantics in the forward direction to reach the target node. 🎀
so basically it's not preferable to send just S-BFD Echo packets without also sending S-BFD Control packets 💀 there are two reasons for this:
- S-BFD Control packets can verify the reachability of the intended target node. this lets you feel confident that S-BFD Echo packets are U-turning on the expected target node 🫶
- S-BFD Control packets can detect when the target node is going out of service (i.e., by receiving AdminDown state). the main character of this whole situation is the Control packet 👑
S-BFD Echo packets can be spoofed and can U-turn in a transit node before reaching the expected target node 😭 when the S-BFD Echo function is used, it is RECOMMENDED in this specification that both S-BFD Control packets and S-BFD Echo packets be sent. the extra Control packets fix both of those worries, but some form of authentication MAY still be included 🔐
The usage of the Required Min Echo RX Interval field is described in Sections 7.2.2 and 7.3.2. because SBFDReflector sessions are stateless, a value in the Required Min Echo RX Interval field isn't really meaningful to the SBFDReflector 🧚 so it is RECOMMENDED that the Required Min Echo RX Interval field simply be set to zero by the SBFDInitiator. the SBFDReflector MAY set the Required Min Echo RX Interval field to a sensible value to control the rate at which it wants to receive S-BFD Echo packets 🍓
the following aspects of S-BFD Echo functions are left as implementation details and are outside the scope of this document:
- Format of the S-BFD Echo packet (e.g., data beyond UDP header). 🌈
- Procedures on when and how to use the S-BFD Echo function. ✨
11. Security Considerations 🔐
the same security considerations as those described in [RFC5880] apply to this document 💜 on top of that, doing the following will strengthen the security of the mechanism in this document, so pay attention bestie 👀
- The SBFDInitiator MAY pick a sequence number to be set in "sequence number" in the Authentication Section, based on the configured authentication mode. 🎀
- The SBFDReflector MUST NOT use the crypto sequence number to make a decision about accepting the packet. this is because the SBFDReflector doesn't keep any S-BFD peer state, and it can receive S-BFD packets from multiple SBFDInitiators. so BFD authentication can be used, but the sequence number cannot 🙅♀️
- The SBFDReflector MAY use the Auth Key ID in the incoming packet to verify the Authentication Data. 🔑
- The SBFDReflector MUST accept the packet if authentication is successful. ✅
- The SBFDReflector MUST compute the Authentication Data and MUST use the same sequence number that it received in the S-BFD Control packet to which it is responding. 🪞
- The SBFDInitiator SHOULD accept an S-BFD Control packet with a sequence number within the permissible range. one potential approach is the procedure explained in [BFD-GEN-AUTH]. 🦋
Using the above method,
- SBFDReflectors continue to remain stateless, despite using security. 🧚
- SBFDReflectors are not susceptible to replay attacks, as they always respond to S-BFD Control packets irrespective of the sequence number carried. no replay drama here 💅
- An attacker cannot impersonate the responder, since the SBFDInitiator will only accept S-BFD Control packets that come with the sequence number that it had originally used when sending the S-BFD Control packet. 🛡️
Additionally, the use of strong forms of authentication is strongly encouraged for S-BFD. 🚨 the use of Simple Password authentication [RFC5880] potentially puts other services at risk if S-BFD packets can be intercepted and those password values are reused for other services. this is a full-on 😭 situation, so please don't reuse passwords 🫠
Considerations related to loop problems are covered in Appendix A. 🔁
12. References 📚
12.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>.
[RFC5880] Katz, D. and D. Ward, "Bidirectional Forwarding Detection (BFD)", RFC 5880, DOI 10.17487/RFC5880, June 2010, <http://www.rfc-editor.org/info/rfc5880>.
12.2. Informative References
[BFD-GEN-AUTH] Bhatia, M., Manral, V., Zhang, D., and M. Jethanandani, "BFD Generic Cryptographic Authentication", Work in Progress, draft-ietf-bfd-generic-crypto-auth-06, April 2014.
[RFC791] Postel, J., "Internet Protocol", STD 5, RFC 791, DOI 10.17487/RFC791, September 1981, <http://www.rfc-editor.org/info/rfc791>.
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, DOI 10.17487/RFC2460, December 1998, <http://www.rfc-editor.org/info/rfc2460>.
[RFC3031] Rosen, E., Viswanathan, A., and R. Callon, "Multiprotocol Label Switching Architecture", RFC 3031, DOI 10.17487/RFC3031, January 2001, <http://www.rfc-editor.org/info/rfc3031>.
[RFC7881] Pignataro, C., Ward, D., and N. Akiya, "Seamless Bidirectional Forwarding Detection (S-BFD) for IPv4, IPv6, and MPLS", RFC 7881, DOI 10.17487/RFC7881, July 2016, <http://www.rfc-editor.org/info/rfc7881>.
[RFC7882] Aldrin, S., Pignataro, C., Mirsky, G., and N. Kumar, "Seamless Bidirectional Forwarding Detection (S-BFD) Use Cases", RFC 7882, DOI 10.17487/RFC7882, July 2016, <http://www.rfc-editor.org/info/rfc7882>.
[RFC7885] Govindan, V. and C. Pignataro, "Seamless Bidirectional Forwarding Detection (S-BFD) for Virtual Circuit Connectivity Verification (VCCV)", RFC 7885, DOI 10.17487/RFC7885, July 2016, <http://www.rfc-editor.org/info/rfc7885>.
Appendix A. Loop Problem and Solution 🌀
okay this one is a little dramatic, but it's the loop problem and its fix 🎢 consider a scenario where we have two nodes, and both are S-BFD capable 💖
Node A (IP 2001:db8::1) ----------------- Node B (IP 2001:db8::2)
|
|
Man in the Middle (MITM)assume that Node A reserved a discriminator 0x01010101 for target identifier 2001:db8::1 and has a reflector session in listening mode. similarly, Node B reserved a discriminator 0x02020202 for its target identifier 2001:db8::2 and also has a reflector session in listening mode 🧚
now suppose that a MITM sends a spoofed packet with My Discriminator = 0x01010101, Your Discriminator = 0x02020202, source IP as 2001:db8::1, and destination IP as 2001:db8::2. when this packet reaches Node B, the reflector session on Node B swaps the discriminators and IP addresses of the received packet and reflects it back, since the Your Discriminator value of the received packet matches the reserved discriminator of Node B 😳 the reflected packet that reaches Node A has My Discriminator = 0x02020202 and Your Discriminator = 0x01010101. since the Your Discriminator value of the received packet matches the reserved discriminator of Node A, Node A swaps the discriminators and reflects the packet back to Node B 🔄 since the reflectors must set the TTL of the reflected packets to 255, the above scenario results in an infinite loop, all because of just one malicious packet injected from the MITM 💀
the solution is to avoid the loop problem by using the D bit (Demand mode bit). the initiator always sets the D bit, and the reflector always clears it. this way, a device can tell whether a received packet was a reflected packet and avoid reflecting it back ✅🫶
Acknowledgements 🙏
the authors would like to thank Jeffrey Haas, Greg Mirsky, Marc Binderberger, and Alvaro Retana for performing thorough reviews and providing a number of suggestions 🌷 they would also like to thank Girija Raghavendra Rao, Les Ginsberg, Srihari Raghavan, Vanitha Neelamegam, and Vengada Prasad Govindan from Cisco Systems for providing valuable comments 💜 finally, the authors would also like to thank John E. Drake and Pablo Frank for providing comments and suggestions 🎀
Contributors 🌟
the following are key contributors to this document:
- Tarek Saad, Cisco Systems, Inc.
- Siva Sivabalan, Cisco Systems, Inc.
- Nagendra Kumar, Cisco Systems, Inc.
- Mallik Mudigonda, Cisco Systems, Inc.
- Sam Aldrin, Google
Authors' Addresses 📮
Carlos Pignataro Cisco Systems, Inc.
Email: cpignata@cisco.com
Dave Ward Cisco Systems, Inc.
Email: wardd@cisco.com
Nobo Akiya Big Switch Networks
Email: nobo.akiya.dev@gmail.com
Manav Bhatia Ionos Networks
Email: manav@ionosnetworks.com
Santosh Pallagatti
Email: santosh.pallagatti@gmail.com
📦 where this page comes from
- ietf: rfc7880 2016-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms