RFC 8677

Name-Based Service Function Forwarder (nSFF) Component within a Service Function Chaining (SFC) Framework

๐Ÿ“… published November 2019, from ietf

Name-Based Service Function Forwarder (nSFF) Component within a Service Function Chaining (SFC) Framework ๐ŸŽ€

okay so bestie, this is RFC 8677 ๐Ÿ’–

Here's the title block, all the tea โ˜•: it's an Independent Submission by D. Trossen (InterDigital Europe, Ltd), D. Purkayastha and A. Rahman (InterDigital Communications, LLC). It's Informational (so not a Standards Track spec, just sharing ideas ๐Ÿฆ‹), it was published in November 2019, its ISSN is 2070-1721, and it doesn't obsolete or update any other RFC. ๐ŸŒธ

Status of This Memo โœจ

This document is not an Internet Standards Track specification; it is published for informational purposes.

This is a contribution to the RFC Series, independently of any other RFC stream. The RFC Editor has chosen to publish this document at its discretion and makes no statement about its value for implementation or deployment. Documents approved for publication by the RFC Editor are not candidates for any level of Internet Standard; see Section 2 of RFC 7841. ๐Ÿ’…

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc8677. ๐Ÿงš

Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. ๐Ÿ™ˆ


Abstract โœจ

Okay so the big idea ๐Ÿ’–: cloud and fog tech lets operators deploy one "Service Function" (SF) to lots of "execution locations". ๐ŸŒˆ Where traffic gets sent can change super often based on load, proximity, and so on. Right now, in the Service Function Chaining (SFC) framework, moving traffic around dynamically means doing a whole "rechaining", which is a change to the service function path that reflects the different IP endpoints for the new execution points. That can be complex and slow ๐Ÿ˜ญ.

So to make rechaining simpler and faster, this doc talks about separating the logical Service Function Path (SFP) from the specific execution endpoints. ๐Ÿฆ‹ The trick is identifying SFs by a name instead of a routable IP endpoint (or Layer 2 address). The document describes the extensions, extra functions, and protocol details needed in the Service Function Forwarder (SFF) to handle name-based relationships. โญ

This document presents InterDigital's approach to name-based SFC. It does not represent IETF consensus ๐Ÿ™ˆ, and it's shared so the SFC community can think about this mechanism and whether it could be used in edge data centers. ๐Ÿ“


1. Introduction ๐ŸŒธ

1.1. Hmm, no subsections here, just vibes ๐Ÿ’…

Okay, so... the requirements on today's networks are super diverse ๐Ÿ’–. You've got use cases like the Internet of Things (IoT), Content Distribution, Gaming, and network functions like Cloud Radio Access Network (RAN) and 5G control planes based on a Service-Based Architecture (SBA). ๐ŸŒˆ All of these get deployed, provisioned, and managed with cloud techniques, just like in the IT world ๐Ÿ’ป. Virtualizing compute and storage is the heart of delivering (often web) services to end users, and you can quickly spin up virtualized service endpoints using, e.g., container-based techniques ๐Ÿณ.

That means you can dynamically compose new services from existing ones โœจ. It also lets an operator move a service instance when users move around or resource availability changes ๐Ÿฆ‹. As we go from a purely "distant cloud" model to localized micro data centers at regional, metro, or even street level (often called "edge" data centers ๐Ÿ™๏ธ), those virtualized service instances can live in topologically different places, and the big "distant" data center turns into a network of distributed ones ๐Ÿ‘‘. Content providers like Facebook, Google, NetFlix, and others don't just deploy content servers at the ingress of the customer network anymore ๐Ÿ™…โ€โ™€๏ธ. The trend is deploying multiple Point of Presences (POPs) inside the customer network, connected through proprietary mechanisms [Schlinker2017] to push content ๐Ÿš€.

The Service Function Chaining (SFC) framework [RFC7665] lets network operators and service providers compose new services by chaining individual "service functions" ๐Ÿ”—. These chains are expressed through explicit relationships between functional components (the SFs), realized through their direct Layer 2 (e.g., Media Access Control (MAC) address) or Layer 3 (e.g., IP address) relationship, defined by next-hop information that the network operator sets up ๐Ÿง . See Section 4 for more background on SFC ๐Ÿ“š.

Now, in a dynamic service environment of distributed data centers like the one above, where you keep creating and recreating service endpoints, the SFC framework has to reconfigure the existing chain with info based on the new relationships ๐Ÿ˜ฉ. That creates overhead in a bunch of components, especially the orchestrator that kicks off the initial SFC and handles any reconfiguration ๐Ÿซ .

This document shows how those changes can be handled without starting new and reconfigured SFCs ๐Ÿ™Œ. The trick is lifting the chaining relationship from Layer 2 and Layer 3 info up to SF "names", which could be expressed as URIs ๐Ÿท๏ธ. To transparently support these named relationships, we propose embedding the functionality directly into the Service Function Forwarder (SFF) as described in [RFC7665] ๐Ÿ’œ. So the SFF described here can keep an existing SFC intact, as described by its Service Function Path (SFP), while still picking the right service function endpoint(s) as packets traverse the SFC ๐ŸŽฏ. This document is an Independent Submission to the RFC Editor, not an output of the IETF SFC WG ๐Ÿซถ.


2. Terminology ๐ŸŽ€

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. ๐Ÿ’–

Part 1 of 7 done, bestie! ๐ŸŒˆ More parts coming, so stay tuned ๐Ÿ’…โœจ

3. Example Use Case: 5G Control-Plane Services ๐Ÿฆ‹

okay bestie, let's make this concrete ๐Ÿ’… We're showing why SFs need to be chained at the level of a service name, using a use case from the current 3GPP Release 16 work on Service Based Architecture (SBA) [SDO-3GPP-SBA], [SDO-3GPP-SBA-ENHANCEMENT]. In this work, mobile network control planes are proposed to be realized by replacing the traditional network function interfaces with a fully service-based one. HTTP was chosen as the application-layer protocol for exchanging suitable service requests [SDO-3GPP-SBA]. So picture this: the exchange between, for example, the 3GPP-defined (Rel. 15) Session Management Function (SMF) and the Access and Mobility Management Function (AMF) in a 5G control plane is being described as a set of web-service-like requests, which are then embedded into HTTP requests ๐ŸŒธ Hence, interactions in a 5G control plane can be modeled based on SFCs, where the relationship is between the specific (IP-based) SF endpoints that implement the necessary service endpoints in the SMF and AMF. The SFs are exposed through URIs, and the naming conventions for those URIs are still being worked out.

This move from a network function model (in pre-Release 15 systems of 3GPP) to a service-based model is driven by the explosion of data-center operations for mobile network control-plane services โœจ In other words, typical IT-based methods of service provisioning, particularly virtualization of entire compute resources, are expected to be used in future mobile network operations. Operators of these future mobile networks want to virtualize SF endpoints and direct (control-plane) traffic to the most appropriate current service instance in the most appropriate (local) data center ๐Ÿ“ That data center is envisioned as being interconnected through a software-defined wide area network (SD-WAN). "Appropriate" can be defined by topological or geographical proximity of the service initiator to the SF endpoint. Alternatively, network or service instance compute load can be used to direct a request to a more appropriate (in this case, less loaded) instance, which reduces possible latency of the overall request. This data-center-centric operation is extended by the trend toward regionalization of load through a "regional office" approach, where micro data centers provide virtualizable resources that can be used in service execution. That gives you a much bigger degree of freedom when choosing the "most appropriate" service endpoint for a particular incoming service request ๐Ÿงš

While the move to a service-based model lines up nicely with the SFC framework, choosing the most appropriate service instance at runtime requires so-called "rechaining" of the SFC ๐Ÿ” The reason is that relationships in the SFC are defined through Layer 2 or Layer 3 identifiers, and those identifiers are likely to be different if the chosen service instances live in different parts of the network (e.g., in a regional data center).

So when a traffic flow is forwarded over a service chain expressed as an SFC-compliant SFP, the packets in that flow get processed by the various SF instances, with each SF instance applying an SF before forwarding the packets to the next network node ๐Ÿ’– It's a service-layer concept, and it can possibly work over any virtual network layer and corresponding underlay network. The underlay network can be IP or any Layer 2 technology. At the service layer, SFs are identified using a path identifier and an index. Eventually, that index is translated to an IP address (or MAC address) of the host where the SF is running. Because of this, any change of service function instance is likely to require a change of the path information, since the IP address (if execution moves from one data center to another) or the MAC address will change due to the newly selected SF instance ๐Ÿ˜ญ

Returning to our 5G control-plane example: a user's connection request to access an application server in the Internet may start with signaling in the control plane to set up user-plane bearers ๐ŸŒˆ The connection request may flow through SFs over a service chain in the control plane, as deployed by a network operator. Typical SFs in a 5G control plane may include "RAN termination / processing", "Slice Selection Function", "AMF", and "SMF". A "Network Slice" is a complete logical network including Radio Access Network (RAN) and Core Network (CN). Distinct RAN and CN Slices may exist. A device may access multiple Network Slices simultaneously through a single RAN. The device may provide Network Slice Selection Assistance Information (NSSAI) parameters to the network to help it select a RAN and a Core Network part of a slice instance. Part of the control plane, the Common Control Network Function (CCNF), includes the Network Slice Selection Function (NSSF), which is in charge of selecting core Network Slice instances. The classifier, as described in the SFC architecture, may reside in the user terminal or at the Evolved Node B (eNB). These SFs can be configured to be part of an SFC. We can also say that some of the configurations of the SFP may change at execution time. For example, the SMF may be relocated as the user moves, and a new SMF may be included in the SFP based on user location. Figure 1 shows the example SFC described here ๐ŸŽ€

            +------+   +---------+  +-----+   +-----+
            | User |   | Slice   |  |     |   |     |
            | App  |-->| Control |->| AMF |-->| SMF |-->
            | Fn   |   | Function|  |     |   |     |
            +------+   +---------+  +-----+   +-----+

     Figure 1: Mapping SFC onto Service Function Execution Points
                    along a Service Function Path

4. Background ๐Ÿง 

[RFC7665] describes an architecture for the specification, creation, and ongoing maintenance of SFCs. It includes architectural concepts, principles, and components used to construct composite services through deployment of SFCs. Next, we outline the parts of this SFC architecture that are relevant to our proposed extension, followed by the challenges with the current framework in light of our example use case โœจ

4.1. Relevant Part of SFC Architecture

The SFC architecture, as defined in [RFC7665], describes architectural components such as SF, classifier, and SFF. It describes the SFP as the logical path of an SFC. Forwarding traffic along such an SFP is the responsibility of the SFF. For this, the SFFs in a network maintain the required SFP forwarding information. That SFP forwarding information is associated with a service path identifier (SPI), which is used to uniquely identify an SFP. The service forwarding state is represented by the Service Index (SI), and it lets an SFF identify which SFs of a given SFP should be applied, and in what order ๐Ÿ‘‘ The SFF also has information that allows it to forward packets to the next SFF after applying local SFs.

The operational steps to forward traffic go like this: traffic arrives at an SFF from the network. The SFF determines the appropriate SF the traffic should be forwarded to via information contained in the SFC encapsulation. After SF processing, the traffic is returned to the SFF and, if needed, is forwarded to another SF associated with that SFF. If there is another non-local hop (i.e., to an SF with a different SFF) in the SFP, the SFF further encapsulates the traffic in the appropriate network transport protocol and delivers it to the network for delivery to the next SFF along the path. Related to this forwarding responsibility, an SFF should be able to interact with metadata ๐Ÿฆ‹

4.2. Challenges with Current Framework

As outlined in previous sections, the SFP defines an ordered sequence of specific SF instances used for the interaction between the initiator and SFs along the SFP. These SFs are addressed by IP (or any L2/MAC) addresses and defined as next-hop information in the network locator maps of traversing SFF nodes ๐Ÿ’…

As outlined in our use case, however, the service provider may want to provision SFC nodes based on dynamically spun-up SF instances, so that these (now virtualized) SFs can be reached in the SFC domain using the SFC underlay layer ๐ŸŒธ

Following the original model of SFC, any change in a specific execution point for a specific SF along the SFP will require a change of the SFP information (since the new SF execution point likely carries different IP or L2 address information), and possibly even the next-hop information in SFFs along the SFP. If the availability of new SF instances is rather dynamic (e.g., through the use of container-based virtualization techniques), the current model and realization of SFC could reduce the flexibility of service providers and increase the management complexity caused by frequent changes of (service) forwarding information in the respective SFF nodes ๐Ÿ˜ญ This is because any change of the SFP (and possibly next-hop info) will need to go through suitable management cycles.

To address these challenges with a suitable solution, we identify the following requirements:

  • Relations between Service Execution Points MUST be abstracted so that, from an SFP point of view, the Logical Path never changes.
  • Deriving the Service Execution Points from the abstract SFP SHOULD be fast and incur minimum delay.
  • Identification of the Service Execution Points SHOULD NOT use a combination of Layer 2 or Layer 3 mechanisms.

The next section outlines a solution to this issue, keeping SFC information (represented in its SFP) intact while addressing the flexibility the service provider wants ๐Ÿซถ

5. Name-Based Operation in SFF ๐Ÿ’œ

5.1. General Idea

The general idea is two-pronged ๐Ÿ”ฅ Firstly, we elevate the definition of an SFP to the level of "name-based interactions" rather than limiting SFPs to Layer 2 or Layer 3 information only. Secondly, we extend the operations of the SFF so it can make forwarding decisions that take name-based interactions into account, while remaining backward compatible with the current SFC architecture as defined in [RFC7665]. In the following sections, we outline these two components of our solution.

If the next-hop information in the Network Locator Map (NLM) is described using an L2/L3 identifier, the name-based SFF (nSFF) may operate as described for the (traditional) SFF, as defined in [RFC7665]. On the other hand, if the next-hop information in the NLM is described as a name, then the nSFF operates as described in the following sections ๐ŸŒˆ

In the following sections, we outline the two components of our solution โœจ

5.2. Name-Based Service Function Path (nSFP) โœจ

okay so the existing SFC framework lives in [RFC7665] ๐Ÿ’… Section 4 says the SFP info is basically path info built from Layer 2 or Layer 3 stuff, aka MAC or IP addresses. That's why you keep having to redo everything whenever the execution point changes ๐Ÿ˜ญ So we introduce the "name-based Service Function Path (nSFP)" ๐Ÿฆ‹

ngl, in today's networking, any identifier can count as a name ๐Ÿซถ But we'll show how a "Name-based SFP" works through extended SFF operations (see Section 6) using URIs as names and HTTP as the protocol for exchanging info ๐ŸŒธ The URIs are naming an SF along the nSFP. Also, the nSFP idea is not limited to HTTP as the protocol or URIs as the next-hop identifier ๐Ÿ™ˆ Other identifiers, like an IP address on its own, can be used too, and they count as a "name" in the nSFP. IP addresses and fully qualified domain names that form complex URIs (uniform resource identifiers), like www.example.com/service_name1, are all covered by "name" in this document ๐Ÿ’–

So nSFPs are an ordered sequence of SF "names" ๐Ÿงš A typical nSFP might look like: 192.0.x.x -> www.example.com -> www.example2.com/service1 -> www.example2.com/service2

Our use case from Section 3 can be written as an ordered named sequence too ๐Ÿ‘‘ For example, a session initiation with an authentication step could look like 192.0.x.x -> smf.example.org/session_initiate -> amf.example.org/auth -> smf.example.org/session_complete -> 192.0.x.x. (Heads up, this is only conceptual ๐ŸŽ€ The exact shape of future SBA-based exchanges for 5G control-plane functions hasn't been defined yet by standards bodies like 3GPP.)

Also in line with Section 3, any named service can be realized by more than one replicated SF instance ๐Ÿ”ฅ That means packets get sent to different places dynamically, but along the SAME SFP info that's provided while the SFC runs. By lifting the SFP up to name-based interactions, the SFP stays the same even when the specific execution points change for a given service interaction ๐ŸŒˆ

Figure 2 below shows the nSFP concept and how those named interactions map onto (possibly) replicated instances ๐Ÿ“

  +---------------------------------------------------------------+
  |Service Layer                                                  |
  | 192.0.x.x --> www.example.com --> www.example2.com -->        |
  |                      ||              ||                       |
  +----------------------||--------------||-----------------------+
                         ||              ||
                         ||              ||
  +----------------------||--------------||-----------------------+
  |Underlay Network      \/              \/                       |
  |               +--+ +--+ +--+    +--+ +--+ +--+                |
  |               |  | |  | |  |    |  | |  | |  |                |
  |               +--+ +--+ +--+    +--+ +--+ +--+                |
  |               Compute and       Compute and                   |
  |               storage nodes     storage nodes                 |
  +---------------------------------------------------------------+

     Figure 2: Mapping SFC onto Service Function Execution Points
      along a Service Function Path Based on Virtualized Service
                          Function Instance

5.3. Name-Based Network Locator Map (nNLM) ๐ŸŽ€

okay so to forward a packet within an nSFP, we need to extend the NLM from [RFC8300] ๐Ÿ’… It has to handle name relations based on URIs, plus high-level transport protocols like HTTP, so SFC packet forwarding can work with them โœจ Another example of SFC packet forwarding could be Constrained Application Protocol (CoAP) ๐Ÿซถ

The extended NLM (aka the name-based Network Locator Map, or nNLM) is shown in Table 1, using www.example.com as part of the nSFP ๐Ÿฆ‹ Each SFF in the SFC domain stores this extended nNLM, with the right info filled in during the configuration phase ๐ŸŒธ

+-----+-----+--------------------+------------------------------+
| SPI | SI  | Next Hop(s)        | Transport Encapsulation (TE) |
+=====+=====+====================+==============================+
| 10  | 255 | 192.0.2.1          | VXLAN-gpe                    |
+-----+-----+--------------------+------------------------------+
| 10  | 254 | 198.51.100.10      | GRE                          |
+-----+-----+--------------------+------------------------------+
| 10  | 253 | www.example.com    | HTTP                         |
+-----+-----+--------------------+------------------------------+
| 40  | 251 | 198.51.100.15      | GRE                          |
+-----+-----+--------------------+------------------------------+
| 50  | 200 | 01:23:45:67:89:ab  | Ethernet                     |
+-----+-----+--------------------+------------------------------+
| 15  | 212 | Null (end of path) | None                         |
+-----+-----+--------------------+------------------------------+

             Table 1: Name-Based Network Locator Map

Alternatively, the extended NLM can use implicit name info instead of explicit URIs like in Table 1 ๐Ÿ“ In the Table 2 example, the next hop is a generic HTTP service, and no specific URI is listed in the extended NLM ๐Ÿงš In this case, the SFF forwards the packet by parsing the HTTP request to figure out the host name or URI ๐Ÿ‘‘ It grabs the URI and may apply policy info to decide the destination host/service ๐Ÿ’œ

+-----+-----+--------------------+------------------------------+
| SPI | SI  | Next Hop(s)        | Transport Encapsulation (TE) |
+=====+=====+====================+==============================+
| 10  | 255 | 192.0.2.1          | VXLAN-gpe                    |
+-----+-----+--------------------+------------------------------+
| 10  | 254 | 198.51.100.10      | GRE                          |
+-----+-----+--------------------+------------------------------+
| 10  | 253 | HTTP Service       | HTTP                         |
+-----+-----+--------------------+------------------------------+
| 40  | 251 | 198.51.100.15      | GRE                          |
+-----+-----+--------------------+------------------------------+
| 50  | 200 | 01:23:45:67:89:ab  | Ethernet                     |
+-----+-----+--------------------+------------------------------+
| 15  | 212 | Null (end of path) | None                         |
+-----+-----+--------------------+------------------------------+

     Table 2: Name-Based Network Locator Map with Implicit Name
                            Information

5.4. Name-Based Service Function Forwarder (nSFF) ๐ŸŒˆ

it's giving "make the SFF handle nSFPs without anyone having to shove an SF into the path" ๐Ÿ˜ญ So we want the SFF in the SFC underlay extended to do that transparently ๐Ÿ’… These extended nSFFs are then responsible for forwarding packets across the SFC domain according to the (extended) nSFP definition โœจ

For our example of an extended SFF, this document uses HTTP as the protocol for forwarding SFC packets to the next name-based hop in the nSFP ๐Ÿซถ The URI in the HTTP transaction is the name in our nSFP info, and that's what gets used for name-based forwarding ๐Ÿฆ‹

Following this logic, HTTP requests (especially the plaintext-encoded ones above) are basically the equivalent of packets entering the SFC domain ๐ŸŒธ In the existing SFC framework, an IP payload is usually assumed to be a packet entering the domain ๐Ÿ™ˆ That packet is forwarded to destination nodes using L2 encapsulation, and any Layer 2 network can serve as the underlay ๐Ÿงš This idea now stretches to packets that might be part of a whole higher-layer application, like HTTP requests ๐Ÿ‘‘ How intermediate layers such as TCP and IP get handled is left up to the realization of the (extended) SFF operations toward the next (named) hop ๐Ÿ’œ First we'll outline the general lifecycle of an SFC packet in the next subsection, then look at two examples of determining next-hop info in Section 6.2.3, and finish with a layered view of the nSFF realization in Section 6.2.4 ๐ŸŽ€

5.5. High-Level Architecture ๐Ÿ’–

+----------+
| SF1      |                 +--------+                  +------+
| instance |\                |   NR   |                  | SF2  |
+----------+ \               +--------+                  +------+
              \                  ||                         ||
+------------+ \ +-------+   +---------+   +---------+   +-------+
| Classifier |---| nSFF1 |---|Forwarder|---|Forwarder|---| nSFF2 |
+------------+   +-------+   +---------+   +---------+   +-------+
                                                            ||
                                                        +----------+
                                                        | Boundary |
                                                        |  node    |
                                                        +----------+

                  Figure 3: High-Level Architecture

The high-level architecture for name-based operation in Figure 3 looks a LOT like the SFC architecture from [RFC7665] ๐Ÿ”ฅ Two new functions show up in the diagram: the nSFF and the Name Resolver (NR) ๐Ÿงš

The nSFF is an extension of the existing SFF ๐Ÿ’… It can process SFC packets based on nNLM info, figure out the next SF where the packet should go, and determine the required transport encapsulation (TE) ๐Ÿซถ Like a standard SFF, it adds TE to the SFC packet and forwards it ๐ŸŒธ

The NR is a brand-new functional component ๐Ÿฆ‹ It identifies the execution endpoints where a "named SF" is running, and it gets triggered by suitable resolution requests sent by the nSFF ๐Ÿ’œ It's kinda similar to DNS, but it's not the same ๐Ÿ™ˆ It doesn't use DNS protocols or data records ๐Ÿ‘‘ Instead, a new procedure determines the suitable routing/forwarding info toward the nSFF that serves the next hop of the SFP ๐ŸŽ€ More details come later ๐ŸŒˆ

The other components, like the classifier and SF, are the same as in the SFC architecture defined in [RFC7665] โœจ And the Forwarders in the diagram are traditional Layer 2 switches ๐Ÿ“

5.6. Operational Steps โœจ

okay so now we get to see the whole nSFF thing in action ๐ŸŽ€ the operations are handled by the name-based SFF, which is called "nSFF" ๐Ÿ’… we're gonna use the high-level architecture from Figure 3 to follow traffic between two SF instances of an nSFP-based transaction. our example chain is: 192.0.x.x -> SF1 (www.example.com) -> SF2 (www.example2.com) -> SF3 -> ...

Service Function 3 (SF3) is assumed to be a classical SF ๐Ÿงš so existing SFC mechanisms can already reach it, and we're not gonna dig into it here.

According to the SFC lifecycle in [RFC7665] ๐ŸŒธ based on our example chain, the traffic starts at a classifier or another SFF on the left. It gets processed by the incoming nSFF1 (on the left side) through the steps below, and then it exits at nSFF2 ๐Ÿฆ‹

Step 1: At nSFF1, we assume the following nNLM ๐Ÿ“

+-----+-----+--------------------+------------------------------+
| SPI | SI  | Next Hop(s)        | Transport Encapsulation (TE) |
+=====+=====+====================+==============================+
| 10  | 255 | 192.0.2.1          | VXLAN-gpe                    |
+-----+-----+--------------------+------------------------------+
| 10  | 254 | 198.51.100.10      | GRE                          |
+-----+-----+--------------------+------------------------------+
| 10  | 253 | www.example.com    | HTTP                         |
+-----+-----+--------------------+------------------------------+
| 10  | 252 | www.example2.com   | HTTP                         |
+-----+-----+--------------------+------------------------------+
| 40  | 251 | 198.51.100.15      | GRE                          |
+-----+-----+--------------------+------------------------------+
| 50  | 200 | 01:23:45:67:89:ab  | Ethernet                     |
+-----+-----+--------------------+------------------------------+
| 15  | 212 | Null (end of path) | None                         |
+-----+-----+--------------------+------------------------------+

                      Table 3: nNLM at nSFF1

Step 2: nSFF1 strips off the previous transport encapsulation (TE) for any traffic coming from another SFF or a classifier ๐Ÿ’– traffic from an SF instance doesn't carry any TE in the first place, so it goes straight to processing at the nSFF.

Step 3: nSFF1 then processes the Network Service Header (NSH), as defined in [RFC8300] ๐Ÿ”ฅ it uses the SPI/SI info in the NSH (see Section 4) to find the matching entry in its nNLM (see Table 3), which tells it the name-based identifier of the next SF at the nSFP level. So the nSFF looks in the map for SPI = 10 and SI = 253 and finds the next hop = www.example.com with HTTP as the protocol. Since that next hop is local, the SFC packet gets forwarded to the SF1 instance of www.example.com โœจ also, the next hop could be figured out from the HTTP request itself, if the next-hop info is a generic HTTP service (see Section 5.3) ๐Ÿ‘‘

Step 4: The SF1 instance processes the SFC packet using its service semantics ๐Ÿซถ then it changes the NSH to SPI = 10 and SI = 252 so the packet can keep moving along the SFP. After that, it sends the packet to its local nSFF, which is nSFF1 ๐Ÿ’…

Step 5: nSFF1 checks the NSH of the SFC packet again, now that SF1 has updated it (SPI = 10, SI = 252) ๐ŸŒˆ it pulls the next hop from its nNLM in Table 3, which is www.example2.com. Since this SF isn't available locally, the nSFF checks whatever local routing/forwarding info it has to find a suitable nSFF that can serve this next hop ๐Ÿ˜ญ

Step 6: If that info exists, the packet (plus the NSH info) gets marked to go to the nSFF serving the next hop, using that info in Step 8 ๐Ÿฆ‹

Step 7: If that info doesn't exist, nSFF1 asks the NR to find the right routing/forwarding info toward the nSFF serving the next hop of the SFP ๐Ÿ’œ for future SFC packets heading to this same next hop, the resolved info can be cached locally, so nSFF1 doesn't have to ask the NR for every single packet. The packet is now marked to go over the network in Step 8 โœจ

Step 8: Using the forwarding info from Step 6 or Step 7 ๐ŸŽ€ nSFF1 adds the right TE to the SFC packet before sending it through the forwarders in the network toward the next nSFF22.

Step 9: When the packet (+NSH+TE) shows up at the outgoing nSFF2 ๐ŸŒธ which is the nSFF serving the identified next hop of the SFP, it removes the TE and processes the NSH to find the next-hop info. nSFF2 uses the nNLM in Table 4 for this. Based on that nNLM and the NSH info where SPI = 10 and SI = 252, nSFF2 identifies the next SF as www.example2.com ๐Ÿ‘‘

+-----+-----+--------------------+------------------------------+
| SPI | SI  | Next Hop(s)        | Transport Encapsulation (TE) |
+=====+=====+====================+==============================+
| 10  | 252 | www.example2.com   | HTTP                         |
+-----+-----+--------------------+------------------------------+
| 40  | 251 | 198.51.100.15      | GRE                          |
+-----+-----+--------------------+------------------------------+
| 50  | 200 | 01:23:45:67:89:ab  | Ethernet                     |
+-----+-----+--------------------+------------------------------+
| 15  | 212 | Null (end of path) | None                         |
+-----+-----+--------------------+------------------------------+

                      Table 4: nNLM at SFF2

Step 10: If the next hop is registered locally at the nSFF ๐Ÿงš it forwards the packet (+NSH) to the SF instance using suitable IP/MAC methods for that ๐Ÿ“

Step 11: If the next hop isn't registered locally at the nSFF, the outgoing nSFF adds new TE info to the packet and forwards it (+NSH+TE) to the next SFF or boundary node, as shown in Table 4 ๐Ÿ’… ngl this is the part where the packet is officially on its way to the next hop ๐Ÿฆ‹


6. nSFF Forwarding Operations ๐Ÿ’–

okay so this section lays out how the different nSFF forwarding operations actually get done, and it's all tied to Section 5.6 ๐ŸŒธ Section 5 talks about name-based transactions in general, but here we're gonna show everything with HTTP-based transactions specifically ๐ŸŽ€ that way we have a real protocol to ground the description in. We'll be pointing back at the various steps in each of the subsections below โœจ

6.1. nSFF Protocol Layers ๐Ÿฆ‹

Figure 4 shows the protocol layers based on the high-level architecture in Figure 3 ๐Ÿ’œ

+-------+  +------+----+                              +----+-----+
|App    |  |      |    |   +--------+                 |    |     |
|HTTP   |  |-------->  |   |  NR    |                 |nSFF----->|--
|TCP    |->| TCP  |nSFF|   +---/\---+                 |    | TCP | |
|IP     |  | IP   |    |       ||                     |    | IP  | |
+-------+  +------+----+  +---------+   +---------+   +----------+ |
|   L2  |  |      L2   |->|Forwarder|-->|Forwarder|-->|   L2     | |
+-------+  +------+----+  +---------+   +---------+   +----------+ |
  SF1           nSFF1                                     nSFF2    |
                                              +-------+            |
                                              | App   |/           |
                                              | HTTP  | -----------+
                                              | TCP   |\
                                              | IP    |
                                              | L2    |
                                              +-------+
                                                SF2

                      Figure 4: Protocol Layers

Here the nSFF is drawn as running a full incoming/outgoing TCP/IP protocol stack toward the local SFs ๐Ÿซถ meanwhile, it runs the nSFF-NR and nSFF-nSFF protocols based on the descriptions in Section 6.2.3 ๐Ÿ”ฅ

For HTTP-based SF transactions, the nSFF ends incoming TCP connections and outgoing TCP connections to local SFs โœจ for example, the TCP connection from SF1 ends at nSFF1, and nSFF1 can store connection info like socket information. It also keeps track of the mapping info for the HTTP request, like originating SF, destination SF, and socket ID ๐Ÿ’… nSFF1 can also send keep-alive messages over the socket to keep the connection to SF1 alive ๐ŸŒˆ When an HTTP request comes in from SF1, nSFF1 pulls out the HTTP Request and forwards it toward the next node, as outlined in Section 6.2 ๐Ÿ“ Any response that comes back gets mapped onto the right open socket (for the original request) and sent back to SF1 ๐Ÿ‘‘

At the outgoing nSFF2, the destination SF2/Host is identified from the HTTP request message ๐Ÿ’– if there's no TCP connection to SF2 yet, a new one is opened toward the destination SF2, and the HTTP request is sent over it ๐Ÿฆ‹ nSFF2 can also save the TCP connection info (like socket information) and keep the socket info mapped to the destination SF2 ๐Ÿงš When an HTTP response comes back from SF2 over that TCP connection, nSFF2 pulls out the HTTP response and forwards it to the next node ๐ŸŽ€ nSFF2 can keep the TCP connection going with keep-alive messages too ๐Ÿ’œ

6.2. nSFF Operations ๐ŸŒธ

In this section, we cover three key aspects of nSFF operations, which help carry out the steps in Section 5.6 โœจ Here's the breakdown: (i) registering local SFs (for Step 3 in Section 5.6), (ii) forwarding SFC packets to and from local SFs (for Steps 3, 4, and 10 in Section 5.6), (iii) forwarding to a remote SF (for Steps 5, 6, and 7 in Section 5.6) and to the NR, and (iv) looking up a suitable remote SF (for Step 7 in Section 5.6) ๐Ÿ’… We also talk about keeping local lookup info around to cut down on lookup latency, plus a few other issues ๐ŸŒˆ

6.2.1. Forwarding between nSFFs and nSFF-NRs โœจ

Okay bestie, so the distributed nSFFs need to pass packets to each other and to the NRs over the operator network, and they do it with a path-based approach ๐Ÿ›ค๏ธ That means the source of the packet supplies the path information the network uses to forward it. It's giving segment routing vibes, but the info supplied for this source-based forwarding is a different type, as we'll see ๐Ÿ’…

Here, the forwarding info for a remote nSFF or the NR is called a "path identifier" (pathID), and it has a defined length. The length field tells you the full pathID length ๐ŸŽ€ The payload comes from the operations in the subsections below, and that becomes the overall packet being transmitted. So the generic forwarding format (GFF) for transport over the operator network is shown in Figure 5, with the length field defining the length of the pathID.

   +---------+-----------------+------------------------//------------+
   |         |                 |                       //             |
   | Length  | Path ID         |  Payload             //              |
   |(12 bits)|                 |                     //               |
   +---------+-----------------+--------------------//----------------+

Figure 5: Generic Forwarding Format (GFF)

  • Length (12 bits): Defines the length of the pathID, i.e., up to 4096 bits ๐ŸŒธ
  • Path ID: Variable-length bit field derived from IPv6 source and destination address ๐Ÿฆ‹

For the pathID info, solutions like the ones in [Reed2016] can be used. Here, the IPv6 source and destination addresses are used to get a so-called path-based forwarding from the incoming nSFF to the outgoing nSFF or the NR. The forwarders in Figure 4 are SDN (software-defined networking) switches, doing an AND/CMP operation based on arbitrary wildcard matching over the IPv6 source and destination addresses, as outlined in [Reed2016].

Note that if you use IPv6 address info for path-based forwarding, the step of removing the TE at the outgoing nSFF in Figure 4 is handled by using the provided (existing) IP header. That header was used for the path-based forwarding in [Reed2016], and now it's used for next-hop forwarding, like IP-based routing ๐Ÿงš As described in Step 8 of the extended nSFF operations, this forwarding info is used as traffic encapsulation. With forwarding info that uses existing IPv6 info, IP headers are used as TE in this case.

The next-hop nSFF (see Figure 4) restores the IP header of the packet with the relevant IP info used to forward the SFC packet to SF2. Or it creates suitable TE info to forward the packet to another nSFF or a boundary node. Forwarding at the intermediary forwarders, i.e., SDN switches, examines the pathID info through a flow-matching rule. In that rule, a specific switch-local output port is represented by a specific assigned bit position in the pathID. When the rule gets a positive match, the packet is forwarded on that output port ๐Ÿ’–

Alternatively, [BIER-MULTICAST] suggests using a so-called BIER (Binary Indexed Explicit Replication) underlay. Here, the nSFF would be realized at the ingress to the BIER underlay. It injects the SFC packet header (plus the Network Service Header (NSH)) with BIER-based traffic encapsulation into the BIER underlay, and each of the forwarders in Figure 4 is realized as a so-called Bit-Forwarding Router (BFR) [RFC8279] ๐Ÿ“

6.2.1.1. Transport Protocol Considerations ๐Ÿซถ

Given that the proposed solution operates at the "named-transaction" level, especially for HTTP transactions, forwarding between nSFFs and/or NRs SHOULD be implemented via a transport protocol between nSFFs and/or NRs. That gives you reliability, segmentation of large GFF packets, and flow control, with the GFF in Figure 5 being the basic forwarding format for this ๐Ÿ”ฅ

Note that the nSFFs act as TCP proxies at ingress and egress, so they terminate incoming HTTP sessions to SFs and initiate outgoing ones ๐Ÿ‘‘

Figure 6 shows the packet format used for transmitting data, adapted from the TCP header. Segmentation of large transactions into single transport protocol packets is handled by keeping a "Sequence number". A "Checksum" is calculated over a single data packet using the ones-complement TCP checksum calculation. The "Window Size" field indicates the current maximum number of transport packets that the egress nSFF allows in-flight. A data packet is sent without a "Data" field to indicate the end of the (e.g., HTTP) transaction ๐Ÿ˜ญ

               +----------------------------------------------+
               |         16 bits       |        16 bits       |
               +----------------------------------------------+
               |              Sequence number                 |
               +----------------------------------------------+
               |       Checksum        |      Window Size     |
               +----------------------------------------------+
               |                      ...                     |
               |                Data (Optional)               |
               +----------------------------------------------+

Figure 6: Transport Protocol Data Packet Format

Note that, in order to support future named transactions based on other application protocols, such as Constrained Application Protocol (CoAP), future versions of the transport protocol MAY introduce a "Type" field. That field indicates the type of application protocol used between SF and nSFF, with "Type" 0x01 proposed for HTTP. This is being left for future study ๐ŸŒˆ

Given the path-based forwarding used between nSFFs, the transport protocol between nSFFs uses negative acknowledgements from the egress nSFF toward the ingress nSFF. The transport protocol negative Acknowledgment (NACK) packet carries the number of NACKs, plus the specific sequence numbers indicated as lost in the "NACK number" field(s), as shown in Figure 7 ๐Ÿฆ‹

               +-----------------------+----------------------+
               |         16 bits       |        16 bits       |
               +----------------------------------------------+
               |    Number of NACKs    |                      +
               +----------------------------------------------+
               |                   NACK number                |
               +----------------------------------------------+
               +                ... NACK number               +
               +----------------------------------------------+

Figure 7: Transport Protocol NACK Packet Format

If the indicated number of NACKs in a received NACK packet is nonzero, the ingress nSFF retransmits all sequence numbers signaled in the packet, and it decreases its congestion window size for future transmissions ๐Ÿ’€

If the indicated number of NACKs in a received NACK packet is zero, that means the current congestion window was successfully (and completely) transmitted. The ingress nSFF then increases the congestion window size if it's smaller than the advertised "Window Size" in Figure 6 โœจ

The maintenance of the congestion window is handled at the ingress nSFF and is left for further study in nSFF realizations ๐ŸŒธ

6.2.2. SF Registration ๐Ÿ’…

As outlined in Steps 3 and 10 of Section 5.6, the nSFF needs to figure out whether the SF derived from the Name-Based Network Locator (nNLM) is locally reachable, or whether the packet needs to go to a remote SFF. For this, there's a registration mechanism for local SFs with the local nSFF. Two mechanisms can be used for this ๐ŸŽ€

  1. SF-initiated: We assume that the SF registers its Fully Qualified Domain Name (FQDN) with the local nSFF. For local mechanisms, we foresee that either a Representational State Transfer (REST-based) interface over the link-local link, or configuration of the nSFF (through configuration files or management consoles), can be used. Those local registration events lead to the nSFF registering the given FQDN with the NR, along with a system-unique nSFF identifier that is used for path-computation purposes in the NR. For the registration, the packet format in Figure 8 is used. It's inserted as the payload in the GFF of Figure 5, with the pathID toward the NR ๐Ÿงš
                  +---------+------------------+----------------+
                  |         |                  |                |
                  |   R/D   |    hash(FQDN)    |    nSFF_ID     |
                  | (1 bit) |    (16 bits)     |    (8 bits)    |
                  +---------+------------------+----------------+

Figure 8: Registration Packet Format

  • R/D: 1-bit length (0 for Register, 1 for Deregister)
  • hash(FQDN): 16-bit length for a hash over the FQDN of the SF
  • nSFF_ID: 8-bit length for a system-unique identifier for the SFF related to the SF

We assume that the pathID toward the NR is known to the nSFF through configuration means. The NR keeps an internal table that associates the hash(FQDN), the nSFF_id information, and the pathID information used for communication between nSFFs and NRs. The nSFF locally keeps a mapping of registered FQDNs to IP addresses for the latter, using link-local private IP addresses ๐Ÿฆ‹

  1. Orchestration-based: In this mechanism, we assume that the SFC is orchestrated and the chain is provided through an orchestration template. That template has FQDN info associated with a compute/storage resource that the orchestrator deploys. We also assume the orchestrator knows the resource topology. Based on this, the orchestrator can use the same REST-based protocol defined in option 1 to instruct the NR to register the given FQDN, as provided in the template, at the nSFF it has identified as the locally servicing nSFF, provided as the system-unique nSFF identifier ๐Ÿ‘‘

6.2.3. Local SF Forwarding โœจ

okay so there are two cases of local SF forwarding ๐Ÿ’… The first is when the SF sends an SFC packet to its local nSFF (incoming requests), and the second is when the nSFF sends a packet to the SF (outgoing requests). Both show up as Steps 3 and 10 in Section 5.6 ๐Ÿฆ‹ Below we walk through HTTP as the example-named transaction ๐ŸŒธ

Figure 4 shows how incoming HTTP requests from SFs get pulled out. The incoming TCP connection gets terminated right at their local nSFF, at the TCP level ๐Ÿ”ฅ The nSFF MUST maintain a mapping of open TCP sockets to HTTP requests (using the URI of the request) so it can link up HTTP responses later ๐Ÿงฉ

For outgoing HTTP requests, the nSFF uses its mapping of locally registered FQDNs to link-local IP addresses (see Section 6.2.2, option 1). So when an SFC packet arrives from a remote nSFF (Step 9 in Section 5.6), the nSFF checks whether the SF exists locally through the registration mechanisms in Section 6.2.2 ๐Ÿ‘€ If the SF does exist locally, the HTTP (+NSH) packet, after stripping the TE, gets sent to the local SF as Step 10 in Section 5.6 over a TCP-level connection. Outgoing nSFFs SHOULD keep TCP connections open to local SFs to improve SFC packet delivery in subsequent transactions ๐Ÿ’œ

6.2.4. Handling of HTTP Responses

When Steps 3 and 10 in Section 5.6 are executing, the SFC packet gets delivered to the locally registered next hop ๐Ÿ“ฆ Now the HTTP responses have to make it back along the return path to the originating nSFF (aka the previous hop) ๐Ÿ”™ To make that happen, the nSFF keeps a list of link-local connection info, like sockets to the local SF and the pathID the request came in on ๐Ÿ—‚๏ธ Once the response arrives, the nSFF checks the table to find the pathID of the original request, then builds a suitable GFF-based packet to send back to the previous nSFF โœˆ๏ธ

When the HTTP response shows up at the previous nSFF, that nSFF checks its table of locally open sockets to find the right local SF connection. It matches the received HTTP response URI to the stored request URI ๐ŸŽฏ Then it uses that socket to forward the HTTP response to the locally registered SF ๐ŸŒˆ

6.2.5. Remote SF Forwarding

Okay bestie, in Steps 5, 6, 7, and 8 of Section 5.6, an SFC packet gets forwarded to a remote nSFF based on the nNLM info for the next hop of the nSFP ๐Ÿ—บ๏ธ Section 6.2.5.1 covers what happens if there's no suitable forwarding info for the remote nSFF yet, so the nSFF asks the NR for it ๐Ÿ™‹โ€โ™€๏ธ Section 6.2.5.2 is all about keeping forwarding info at the local nSFF ๐Ÿง  Section 6.2.5.3 explains how to update stale forwarding info ๐Ÿ”„ Quick note: the forwarding in Section 6.2.1 is what actually moves things to the various nSFF components ๐Ÿšš And finally, Section 6.2.5.4 covers forwarding to the remote nSFF via the forwarder network ๐Ÿ

6.2.5.1. Remote SF Discovery

The nSFF talks to the NR for two things: registration and discovery of FQDNs ๐Ÿ“ž The packet format for registration was shown in Figure 8 in Section 6.2.2, and Figure 9 lays out the packet format for the discovery request ๐Ÿ’…

+--------------+-------------+ +--------+-----------------//--------+
|              |             | |        |                //         |
|   hash(FQDN) |  nSFF_ID    | | Length | pathID        //          |
|   (16 bits)  |  (8 bits)   | |(4 bits)|              //           |
+--------------+-------------+ +--------+-------------//------------+
        Path Request                     Path Response

                  Figure 9: Discovery Packet Format

For Path Request:

  • hash(FQDN): 16-bit length for a hash over the FQDN of the SF
  • nSFF_ID: 8-bit length for a system-unique identifier for the SFF related to the SF

For Path Response:

  • Length: 4-bit length that defines the length of the pathID
  • pathID: Variable-length bit field derived from IPv6 source and destination address

To request a path to a specific FQDN, the nSFF sends a hash of the FQDN to the NR together with its nSFF_id. In return it gets a pathID with a length identifier ๐ŸŽ€ The NR SHOULD maintain a table of discovery requests that maps each discovered (hash of) FQDN to the nSFF_id that asked for it, plus the pathID being calculated from that discovery request ๐Ÿ—ƒ๏ธ

Here's the tea โ˜• If an FQDN hasn't been served at the nSFF yet (or its pathID info got flushed by the update operations in Section 6.2.5.3), the discovery goes through the NR and there's some initial latency ๐Ÿ˜ญ After that, any SFC packet sent over the same SFP in a later transaction uses the nSFF-local mapping table, so it's way faster ๐ŸŽ๏ธ You can dodge that initial latency by prepopulating the FQDN-pathID mapping ahead of time as part of the overall orchestration procedure, for example alongside distributing the nNLM info to the nSFF ๐Ÿงš

6.2.5.2. Maintaining Forwarding Information at Local nSFF

Each nSFF MUST maintain an internal table that maps the (hash of the) FQDN information to a suitable pathID ๐Ÿ—บ๏ธ As Step 7 of Section 5.6 outlines, if there's no suitable entry for a given FQDN, the pathID info gets requested with the operations in Section 6.2.5.1. The nSFF then creates the entry locally once it gets a reply, and the forwarding runs as described in Section 6.2.1 โœจ

If the entry does exist (that's Step 6 of Section 5.6), the pathID is pulled locally and used for the forwarding operation in Section 6.2.1 ๐Ÿ™Œ

6.2.5.3. Updating Forwarding Information at nSFF

The forwarding info each nSFF keeps (see Section 6.2.5.2) might need updating for three reasons ๐Ÿฅบ

  1. An existing SF is no longer reachable: In this case, the nSFF where the SF is locally registered deregisters the SF explicitly at the NR. It does this by sending the packet in Figure 6 with the hashed FQDN and the R/D bit set to 1 (for deregister) ๐Ÿ™…โ€โ™€๏ธ
  2. Another SF instance has become reachable in the network (and, therefore, might provide a better alternative to the existing SF): In this case, the NR has received another packet with a format defined in Figure 7, but with a different nSFF_id value ๐Ÿ‘‘
  3. Links along paths might no longer be reachable: The NR might use a suitable southbound interface to transport networks to detect link failures, which it associates to the appropriate pathID bit position ๐Ÿ”Œ

For this purpose, the packet format in Figure 10 is sent from the NR to all affected nSFFs, using the generic format in Figure 5 ๐Ÿ“จ

+---------+-----------------+--------------//----+
|         |                 |             //     |
|   Type  |     #IDs        |  IDs       //      |
| (1 bit) |    (8 bits)     |           //       |
+---------+-----------------+----------//--------+

                  Figure 10: Path Update Format
  • Type: 1-bit length (0 for Nsff ID, 1 for Link ID)
  • #IDs: 8-bit length for number of IDs in the list
  • IDs: List of IDs (Nsff ID or Link ID)

The pathID to the affected nSFFs is computed as the binary OR over all pathIDs to those nSFF_id values that are affected. The pathID info for those affected nSFF_id values comes from the NR-local table maintained in the registration/deregistration operation of Section 6.2.2 ๐Ÿงฎ

The pathID may include the type of info being updated (for example, node identifiers of leaf nodes, or link identifiers for removed links) ๐Ÿƒ The node identifier itself may be a special identifier that signals "ALL NODES" as being affected ๐Ÿšจ The node identifier may also signal network changes that are substantial (for example, parallel link failures) ๐Ÿ’ฅ And it may trigger (or recommend) purging the entire path table, rather than just selectively removing a few nodes ๐Ÿงน

The packet includes info according to the type. The included info may also relate to the type and length info for the number of identifiers being provided ๐Ÿงพ

In cases 1 and 2, the Type bit is set to 1 (type nSFF_id). The affected nSFFs are the ones that have previously sent SF discovery requests, found through the optional table that maps previously registered FQDNs to nSFF_id values. If no table maps the (hash of) FQDN to nSFF_id, the update goes to all nSFFs ๐Ÿ“ฃ When the affected nSFF gets the path update, it removes all of its appropriate nSFF-local mapping entries to pathIDs for the hash(FQDN) identifiers provided. That triggers a fresh NR discovery request at the next remote nSFF forwarding to the appropriate FQDN ๐Ÿ”

In case 3, the Type bit is set to 0 (type linkID). The affected nSFFs are the ones whose discovery requests previously resulted in pathIDs that include the affected link. They're found through the optional table that maps previously registered FQDNs to pathID values (see Section 6.2.5.1) ๐Ÿ•ต๏ธโ€โ™€๏ธ When the node identifier info arrives in the path update, the affected nSFF checks its internal table that maps FQDNs to pathIDs. It figures out which pathIDs got hit by the link problems and removes the path info that includes the received node identifier(s) ๐Ÿงผ To do this, the pathID entries in that table get checked against the linkID values in the ID entry of the path update, using a binary AND/CMP operation to see if the link is in the pathIDs to the FQDNs. If any pathID is affected, that FQDN-pathID entry gets removed, which triggers a new NR discovery request at the next remote nSFF forwarding to the appropriate FQDN ๐Ÿ’ซ

6.2.5.4. Forwarding to Remote nSFF

Once Steps 5, 6, and 7 in Section 5.6 are executing, Step 8 finally sends the SFC packet to the remote nSFF ๐Ÿš€ It uses the pathID returned in the discovery request (Section 6.2.5.1), or the one retrieved from the local pathID mapping table. The SFC packet goes in the payload of the generic forwarding format in Figure 5, together with the pathID. After that, the nSFF runs the forwarding operations in Section 6.2.1 ๐ŸŽ‰


7. IANA Considerations ๐ŸŒท

Good news, IANA: this document has no IANA actions for you ๐Ÿซถ

8. Security Considerations ๐Ÿ”

okay this part is SERIOUS ๐Ÿ˜ค Sections 5 and 6 describe forwarding SFC packets between named SFs, based on URIs exchanged in HTTP messages. So security is needed to protect the communications between the originating node and Ssff, between one Nsff and the next Nsff, and between Nsff and destination. TLS is sufficient for this and SHOULD be used. The TLS handshake lets you determine the FQDN, and that's enough for the service routing decision ๐Ÿชช Supporting TLS also opens the door to HTTPS-based transactions ๐Ÿ”’

It should be noted (per [RFC3986]) that what a URI resolves to is not necessarily stable ๐Ÿซ  That can give you flexibility in deployment, as described in this document, but it can also cause unexpected behavior. It could even be an attack vector, since the resolution of a URI could be "hijacked," and then packets get steered to the wrong place ๐Ÿšจ This could be super important if the SFC is meant to send packets for processing at security functions. Hijacking like this is a new attack surface introduced by using a separate NR ๐Ÿ’€

9. References ๐Ÿ“š

9.1. Normative References โœจ

okay so these are the docs this spec literally can't function without, so they're the ones you have to read ๐Ÿ’…

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>.

[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, <https://www.rfc-editor.org/info/rfc3986>.

[RFC7665] Halpern, J., Ed. and C. Pignataro, Ed., "Service Function Chaining (SFC) Architecture", RFC 7665, DOI 10.17487/RFC7665, October 2015, <https://www.rfc-editor.org/info/rfc7665>. ๐Ÿ”—โœจ

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/info/rfc8174>. ๐ŸŒˆ

[RFC8279] Wijnands, IJ., Ed., Rosen, E., Ed., Dolganow, A., Przygienda, T., and S. Aldrin, "Multicast Using Bit Index Explicit Replication (BIER)", RFC 8279, DOI 10.17487/RFC8279, November 2017, <https://www.rfc-editor.org/info/rfc8279>. ๐Ÿฆ‹

[RFC8300] Quinn, P., Ed., Elzur, U., Ed., and C. Pignataro, Ed., "Network Service Header (NSH)", RFC 8300, DOI 10.17487/RFC8300, January 2018, <https://www.rfc-editor.org/info/rfc8300>. ๐Ÿซถ


9.2. Informative References

these ones are the extra reading, the "ooh tell me more" pile ๐Ÿงš they're not required, but they're giving context and I love a good backstory

[BIER-MULTICAST] Trossen, D., Rahman, A., Wang, C., and T. Eckert, "Applicability of BIER Multicast Overlay for Adaptive Streaming Services", Work in Progress, Internet-Draft, draft-ietf-bier-multicast-http-response-01, 28 June 2019, <https://tools.ietf.org/html/draft-ietf-bier-multicast-http-response-01>. ๐ŸŒธ

[Reed2016] Reed, M.J., Al-Naday, M., Thomas, N., Trossen, D., Petropoulos, G., and S. Spirou, "Stateless multicast switching in software defined networks", IEEE ICC 2016, DOI 10.1109/ICC.2016.7511036, May 2016, <https://ieeexplore.ieee.org/document/7511036>. ๐Ÿ’œ

[Schlinker2017] Schlinker, B., Kim, H., Cui, T., Katz-Bassett, E., Madhyastha, H., Cunha, I., Quinn, J., Hassan, S., Lapukhov, P., and H. Zeng, "Engineering Egress with Edge Fabric, Steering Oceans of Content to the World", ACM SIGCOMM 2017, August 2017, <https://research.fb.com/wp-content/uploads/2017/08/sigcomm17-final177-2billion.pdf>. ๐Ÿ“

[SDO-3GPP-SBA] 3GPP, "Technical Realization of Service Based Architecture", 3GPP TS 29.500 V15.5.0, September 2019, <https://www.3gpp.org/ftp/Specs/html-info/29500.htm>. โญ

[SDO-3GPP-SBA-ENHANCEMENT] 3GPP, "New SID for Enhancements to the Service-Based 5G System Architecture", 3GPP S2-182904, February 2018, <https://www.3gpp.org/ftp/tsg_sa/WG2_Arch/TSGS2_126_Montreal/Docs/S2-182904.zip>. ๐Ÿ‘‘


Acknowledgements โœจ

bestie, the authors wanna give a huge shoutout ๐Ÿซถ they thank Dirk von Hugo and Andrew Malis for their reviews and valuable comments. They also thank Joel Halpern, the chair of the SFC WG, and Adrian Farrel for guiding them through the Independent Submission Editor (ISE) path. honestly the squad goals are real ๐Ÿ˜ญ๐Ÿ’–


Authors' Addresses ๐Ÿฆ‹

here's where to find the authors, all the way from London to Montreal ๐ŸŒโœจ

Dirk Trossen
InterDigital Europe, Ltd
64 Great Eastern Street, 1st Floor
London
EC2A 3QR
United Kingdom

Email: Dirk.Trossen@InterDigital.com


Debashish Purkayastha
InterDigital Communications, LLC
1001 E Hector St
Conshohocken, PA
United States of America

Email: Debashish.Purkayastha@InterDigital.com


Akbar Rahman
InterDigital Communications, LLC
1000 Sherbrooke Street West
Montreal
Canada

Email: Akbar.Rahman@InterDigital.com

and that's a wrap on the whole spec, bestie!! ๐ŸŽ€๐Ÿ’… you did amazing โœจ

๐Ÿ“ฆ where this page comes from