RFC 8957
Synonymous Flow Label Framework
RFC 8957: Synonymous Flow Label Framework 🦋✨
Okay bestie, here's the title block, so you know who's behind this and what kind of doc it is 💖
- Authors: S. Bryant (Futurewei Technologies Inc.), M. Chen (Huawei), G. Swallow (Southend Technical Center), S. Sivabalan (Ciena Corporation), and G. Mirsky (ZTE Corp.) 🧚
- Category: Standards Track, which means it's an official Internet Standard 👑
- Date: January 2021 📅
- Stream: Internet Engineering Task Force (IETF)
- ISSN: 2070-1721
- Obsoletes / Updates: the title block doesn't list any RFCs that this one obsoletes or updates, so there's nothing to report there 🙈
Abstract ✨
Okay so, RFC 8372 ("MPLS Flow Identification Considerations") lays out why MPLS needs a way to give flows their own identities. This doc is the answer, and it's giving "clever" 💅 The technique is called "Synonymous Flow Labels." It's a label that acts like another label (it mimics it) but also carries the identification job. The receiving label switching router can use these labels to trigger per-flow operations on each packet 🌸
Status of This Memo 📜
This is an Internet Standards Track document, so it's a real standard, not a draft vibe 🔥
It's a product of the Internet Engineering Task Force (IETF), which means it reflects the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 7841 🎀
For the current status, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc8957 💜
Copyright Notice 🌈
Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved 🦋
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stood on the publication date. Please read these carefully because they spell out your rights and restrictions for this document 📖 Any Code Components pulled out of this doc must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License 💅
Table of Contents 🗂️
1. Introduction
2. Requirements Language
3. Synonymous Flow Labels
4. User Service Traffic in the Data Plane
4.1. Application Label Present
4.1.1. Setting TTL and the Traffic Class Bits
4.2. Single-Label Stack
4.2.1. Setting TTL and the Traffic Class Bits
4.3. Aggregation of SFL Actions
5. Equal-Cost Multipath Considerations
6. Privacy Considerations
7. Security Considerations
8. IANA Considerations
9. References
9.1. Normative References
9.2. Informative References
Contributors
Authors' Addresses1. Introduction 🌷
So, [RFC8372] ("MPLS Flow Identification Considerations") is the one that says MPLS needs flow identities. This doc shows how to do it with a technique called "Synonymous Flow Labels (SFLs)." These are labels that mimic the behavior of other MPLS labels while also providing the identification service. The receiving label switching router can then use them to trigger per-flow operations on the packet 🦋
2. Requirements Language 💅
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in BCP 14 [RFC2119] [RFC8174], but only when they show up in all capitals, exactly like that 🎀 If they're lowercase, they're just regular words, no cap 🙈
3. Synonymous Flow Labels 🧚
Okay, here's the core idea. An SFL is a label that does exactly the same thing at the egress Label Edge Router (LER) as the label it replaces. The difference is that it also triggers one or more extra actions that the peer LERs already agreed on. There are lots of options for those extra actions: counting how many packets arrived in a flow, triggering an IP Flow Information Export (IPFIX) [RFC7011] capture, running other kinds of deep packet inspection, or identifying the packet's source 🔥
Take Performance Monitoring (PM) as an example. The agreed action could be recording that a packet arrived by bumping a packet counter. That's a natural action in lots of MPLS implementations, and where it's supported, you get high-quality packet loss measurement without changing the packet-forwarding system at all. Iconic, honestly 👑
Let's walk through it. Start with the case where there's an "application" label in the MPLS label stack. Picture a pseudowire (PW) [RFC3985] where you want to measure packet loss. You get two labels that are synonymous with the PW labels from the egress terminating provider edge (T-PE). You alternate between these SFLs and use them in place of the PW label, so the PW packets can be batched for counting without changing how the PW forwards anything [RFC8321]. Quick side note: strictly speaking, only one SFL is needed for this application, but using just one is an optimization, and that's up to the implementor 🧠 How you get these extra labels is out of scope for this text. One control protocol that does provide a way to get SFLs is described in [MPLS-SFL-CONTROL] 💜
Next up is an MPLS application that's multipoint to point, like a VPN. Here you need to identify a packet batch from a specific source. The fix is to make the SFLs source specific, so batches from one source get marked differently from batches from another. The sources all work independently and asynchronously, and each one coordinates with the destination separately. So each ingress LER can set up its own SFL to identify its subflow, which enables PM per flow 🌸
Finally, there's the case with no MPLS application label. This happens when you send IP over a Label Switched Path (LSP), so there's just a single label in the MPLS label stack. Here, if you made an SFL that was synonymous with the LSP label, you'd be introducing network-wide forwarding state. That's a no-go for scaling reasons 🙅 So there's no choice but to add an extra label. With penultimate hop popping (PHP) in use, the semantics of this extra label can be similar to the LSP label. Without PHP, the semantics are similar to an MPLS Explicit NULL [RFC3032]. Either way, the label carries the SFL semantics on top of that 🫶
Note that to hit the goals above, SFLs need to be allocated from the platform label table ✨
4. User Service Traffic in the Data Plane 🌈
As noted in Section 3, there are two cases to think about:
- Application label is present
- Single-label stack
4.1. Application Label Present 🎀
Figure 1 shows the case where both an LSP label and an application label are in the MPLS label stack. Traffic with no SFL function runs over the "normal" stack, and SFL-enabled flows run over the SFL stack, with the SFL used to indicate the packet batch 💖
+-----------------+ +-----------------+
| LSP | | LSP |
| Label | | Label |
| (May be PHPed) | | (May be PHPed) |
+-----------------+ +-----------------+
| | | |
| Application | | Synonymous Flow |
| Label | | Label |
+-----------------+ <= BoS +-----------------+ <= Bottom of Stack
| | | |
| Payload | | Payload |
| | | |
+-----------------+ +-----------------+
"Normal" Label Stack Label Stack with SFL
Figure 1: Use of Synonymous Labels in a Two-Label MPLS Label StackAt the egress LER, the LSP label gets popped (if it's there). Then the SFL is processed, executing both the synonymous function and the matching application function 💅
4.1.1. Setting TTL and the Traffic Class Bits ⭐
The TTL and the Traffic Class bits [RFC5462] in the SFL label stack entry (LSE) would normally be set to the same values as the label the SFL is synonymous with. That's the default vibe. But it's recognized that, if there's an application need, these fields in the SFL LSE MAY be set to some other value 🦋 For example, you might want the SFL to trigger an action in the TTL expiry exception path as part of the label action 🍓
That's where I'll pause for part 1! Part 2 picks up with Section 4.2 (Single-Label Stack) and keeps going all the way through the rest of the spec 🧚💜
4.2.1. Setting TTL and the Traffic Class Bits ✨
Okay bestie, the TTL and Traffic Class stuff from Section 4.1.1 applies here too 🎀 Same rules, no changes, no drama 💅
4.3. Aggregation of SFL Actions 🧚
Sometimes you want to aggregate an SFL action across a bunch of labels. Like, you might want one counter to count the packets coming in over a whole group of application labels 📦 Or the app might use a ton of labels, and the number of labels you'd need to allocate for the SFL actions could get so big it's no longer practical 😭 When that happens, you'd need to add an extra label into the stack to act as an aggregate instruction 🫶 This isn't really a synonymous action, because the SFL isn't replacing an existing label. It's more like the single-label case from Section 4.2, though, and the same signaling, management, and configuration tools would still work 🔧
+-----------------+
| LSP |
| Label |
| (May be PHPed) |
+-----------------+ +-----------------+
| LSP | | |
| Label | | Aggregate |
| (May be PHPed) | | SFL |
+-----------------+ +-----------------+
| | | |
| Application | | Application |
| Label | | Label |
+-----------------+ <=BoS +-----------------+ <= Bottom of Stack
| | | |
| Payload | | Payload |
| | | |
+-----------------+ +-----------------+
"Normal" Label Stack Label Stack with SFLFigure 3: Aggregate SFL Actions 🎀
Here's the vibe: in Figure 3 the aggregate SFL sits in front of the application label, but whether it goes before or after the application label is totally up to the application 🦋 In the case from Section 4.1, the SFL already has the full application context by definition 👑 So the placement comes down to two things: does the SFL action need the whole application context to do its job, and would putting the SFL after the application label make the application more complicated to handle? 🤔
5. Equal-Cost Multipath Considerations 🌈
Okay, this one's important 😭 Adding an SFL to an existing flow can make that flow take a different path through the network when Equal-Cost Multipath (ECMP) is in play. That can break certain uses of the SFL, like performance measurement stuff 📉 If that's a problem for you, there are two solutions worth thinking about:
- The operator MAY choose to always keep the SFL in place in the MPLS label stack 💜
- The operator can choose to use entropy labels [RFC6790] in a network that fully supports this type of ECMP ✨ If you go this route, the network in between MUST NOT load balance on any packet field other than the entropy label 🚫 Note that this is stricter than the text in Section 4.3 of [RFC6790] 💅
6. Privacy Considerations 🙈
IETF concerns about pervasive monitoring are covered in [RFC7258] 👀 Including originating and/or flow information in a packet gives more identity info, which can make the communication less private to an attacker who can see the added identifier 😬 Sure, the extra granularity gives more insight into flow characteristics, but it doesn't specifically point out which node originated the packet, unless the attacker can inspect the network at the point of ingress or inspect the control protocol packets 🕵️ This privacy threat can be eased by encrypting the control protocol packets, by regularly changing the synonymous labels, or by using a bunch of these labels at once, or any combo of those methods 🔐 Keeping the scope of the identity indication small also helps keep the flow characteristics less observable 🌸 And whenever IPFIX or other deep packet inspection (DPI) technique is used, their relevant privacy considerations apply too 🧐
7. Security Considerations 🔥
There are no new security issues associated with the MPLS data plane 🛡️ But any control protocol used to request SFLs will need to make sure the request is legit, i.e., that the requesting node is authorized to make that SFL request by the network operator 🚨 This part is serious, bestie. Don't skip it 😤
8. IANA Considerations 🍓
This document has no IANA actions 🌷
9. References 📚
9.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC3032] Rosen, E., Tappan, D., Fedorkow, G., Rekhter, Y.,
Farinacci, D., Li, T., and A. Conta, "MPLS Label Stack
Encoding", RFC 3032, DOI 10.17487/RFC3032, January 2001,
<https://www.rfc-editor.org/info/rfc3032>.
[RFC5462] Andersson, L. and R. Asati, "Multiprotocol Label Switching
(MPLS) Label Stack Entry: "EXP" Field Renamed to "Traffic
Class" Field", RFC 5462, DOI 10.17487/RFC5462, February
2009, <https://www.rfc-editor.org/info/rfc5462>.
[RFC6790] Kompella, K., Drake, J., Amante, S., Henderickx, W., and
L. Yong, "The Use of Entropy Labels in MPLS Forwarding",
RFC 6790, DOI 10.17487/RFC6790, November 2012,
<https://www.rfc-editor.org/info/rfc6790>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.9.2. Informative References
[MPLS-SFL-CONTROL]
Bryant, S., Swallow, G., and S. Sivabalan, "A Simple
Control Protocol for MPLS SFLs", Work in Progress,
Internet-Draft, draft-bryant-mpls-sfl-control-09, 7
December 2020, <https://tools.ietf.org/html/draft-bryant-
mpls-sfl-control-09>.
[RFC3985] Bryant, S., Ed. and P. Pate, Ed., "Pseudo Wire Emulation
Edge-to-Edge (PWE3) Architecture", RFC 3985,
DOI 10.17487/RFC3985, March 2005,
<https://www.rfc-editor.org/info/rfc3985>.
[RFC6374] Frost, D. and S. Bryant, "Packet Loss and Delay
Measurement for MPLS Networks", RFC 6374,
DOI 10.17487/RFC6374, September 2011,
<https://www.rfc-editor.org/info/rfc6374>.
[RFC7011] Claise, B., Ed., Trammell, B., Ed., and P. Aitken,
"Specification of the IP Flow Information Export (IPFIX)
Protocol for the Exchange of Flow Information", STD 77,
RFC 7011, DOI 10.17487/RFC7011, September 2013,
<https://www.rfc-editor.org/info/rfc7011>.
[RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an
Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May
2014, <https://www.rfc-editor.org/info/rfc7258>.
[RFC8321] Fioccola, G., Ed., Capello, A., Cociglio, M., Castaldelli,
L., Chen, M., Zheng, L., Mirsky, G., and T. Mizrahi,
"Alternate-Marking Method for Passive and Hybrid
Performance Monitoring", RFC 8321, DOI 10.17487/RFC8321,
January 2018, <https://www.rfc-editor.org/info/rfc8321>.
[RFC8372] Bryant, S., Pignataro, C., Chen, M., Li, Z., and G.
Mirsky, "MPLS Flow Identification Considerations",
RFC 8372, DOI 10.17487/RFC8372, May 2018,
<https://www.rfc-editor.org/info/rfc8372>.Contributors 🫶
Zhenbin Li
Huawei
Email: lizhenbin@huawei.comAuthors' Addresses 💖
Stewart Bryant
Futurewei Technologies Inc.
Email: sb@stewartbryant.com
Mach(Guoyi) Chen
Huawei
Email: mach.chen@huawei.com
George Swallow
Southend Technical Center
Email: swallow.ietf@gmail.com
Siva Sivabalan
Ciena Corporation
Email: ssivabal@ciena.com
Gregory Mirsky
ZTE Corp.
Email: gregimirsky@gmail.com📦 where this page comes from
- ietf: rfc8957 2021-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms