Removing a Restriction on the use of MPLS Explicit NULL
A rule change that lets two reserved MPLS labels appear anywhere in a label stack, not only at the bottom.
Rosen, E., "Removing a Restriction on the use of MPLS Explicit NULL", RFC 4182, DOI 10.17487/RFC4182, September 2005, <https://www.rfc-editor.org/info/rfc4182>.
@misc{rfc4182,
series = {Request for Comments},
number = 4182,
howpublished = {RFC 4182},
publisher = {RFC Editor},
doi = {10.17487/RFC4182},
url = {https://www.rfc-editor.org/info/rfc4182},
author = {E. Rosen},
title = {{Removing a Restriction on the use of MPLS Explicit NULL}},
pagetotal = 7,
year = 2005,
month = sep,
} RFC text
Contents
Network Working Group E. Rosen
Request for Comments: 4182 Cisco Systems, Inc.
Updates: 3032 September 2005
Category: Standards Track
Removing a Restriction on the use of MPLS Explicit NULL
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2005).
Abstract
The label stack encoding for Multi-protocol Label Switching (MPLS)
defines a reserved label value known as "IPv4 Explicit NULL" and a
reserved label value known as "IPv6 Explicit NULL". Previously,
these labels were only legal when they occurred at the bottom of the
MPLS label stack. This restriction is now removed, so that these
label values may legally occur anywhere in the stack.
This document updates RFC 3032.
Table of Contents
1. Introduction ....................................................2
2. Detail of Change ................................................2
3. Reasons for Change ..............................................3
4. Deployment Considerations .......................................5
5. Security Considerations .........................................5
6. Acknowledgments .................................................5
7. Normative References ............................................5
8. Informative References ..........................................5
1. Introduction
RFC 3032 defines a reserved label value known as "IPv4 Explicit NULL"
and a reserved label value known as "IPv6 Explicit NULL" [RFC3032].
It states that these label values are only legal at the bottom of the
MPLS label stack. However, no reason is given for this restriction.
It has turned out that in practice there are some situations in which
it is useful to send MPLS packets that have Explicit NULL occur
somewhere other than at that bottom of the label stack. While the
intended semantics are obvious enough, the fact that such packets are
gratuitously declared by RFC 3032 to be illegal has made it difficult
to handle these situations in an interoperable manner.
This document updates RFC 3032 by removing the unnecessary
restriction, so that the two aforementioned label values are legal
anywhere in the label stack.
2. Detail of Change
RFC 3032 states on page 4:
There are several reserved label values:
i. A value of 0 represents the "IPv4 Explicit NULL Label". This
label value is only legal at the bottom of the label stack.
It indicates that the label stack must be popped, and the
forwarding of the packet must then be based on the IPv4
header.
iii. A value of 2 represents the "IPv6 Explicit NULL Label". This
label value is only legal at the bottom of the label stack.
It indicates that the label stack must be popped, and the
forwarding of the packet must then be based on the IPv6
header.
Paragraph i is hereby changed to read:
i. A value of 0 represents the "IPv4 Explicit NULL Label".
An IPv4 Explicit NULL at the top of the label stack means that
the stack must be popped.
If the NULL was not the only label on the stack, this will
cause the label beneath it to rise to the top of the stack.
The disposition of the packet is based on the label that has
now risen to the top.
If, on the other hand, the NULL was the only label on the
stack, then the stack is now empty. The resulting packet is
treated as an IPv4 packet, and its disposition is based on the
IPv4 header.
Paragraph iii is hereby changed to read:
iii. A value of 2 represents the "IPv6 Explicit NULL Label".
An IPv6 Explicit NULL at the top of the label stack means that
the stack must be popped.
If the NULL was not the only label on the stack, this will
cause the label beneath it to rise to the top of the stack.
The disposition of the packet is based on the label that has
now risen to the top.
If, on the other hand, the NULL was the only label on the
stack, then the stack is now empty. The resulting packet is
treated as an IPv6 packet, and its disposition is based on the
IPv6 header.
3. Reasons for Change
Restricting Explicit NULL to the bottom of the stack has caused some
problems in practice.
With this restriction in place, one should not distribute, to a
particular label distribution peer, a binding of Explicit NULL to a
particular Forwarding Equivalence Class (FEC), unless the following
condition (call it "Condition L") holds: all MPLS packets received by
that peer with an incoming label corresponding to that FEC contain
only a single label stack entry. If Explicit NULL is bound to the
FEC, but Condition L doesn't hold, the peer is being requested to
create illegal packets. None of the MPLS specifications say what the
peer is actually supposed to do in this case. This situation is made
more troublesome by the facts that, in practice, Condition L rarely
holds, and it is not possible, in general, to determine whether it
holds or not.
Further, if one is supporting the Pipe Model of RFC 3270 [RFC3270],
there are good reasons to create label stacks in which Explicit NULL
is at the top of the label stack, but a non-null label is at the
bottom.
RFC 3270 specifies the procedures for MPLS support of Differentiated
Services. In particular, it defines a "Pipe Model" in which (quoting
from RFC 3270, Section 2.6.2):
"tunneled packets must convey two meaningful pieces of Diff-Serv
information:
- the Diff-Serv information which is meaningful to intermediate
nodes along the LSP span including the LSP Egress (which we refer
to as the 'LSP Diff-Serv Information'). This LSP Diff-Serv
Information is not meaningful beyond the LSP Egress: Whether
Traffic Conditioning at intermediate nodes on the LSP span
affects the LSP Diff-Serv information or not, this updated Diff-
Serv information is not considered meaningful beyond the LSP
Egress and is ignored.
- the Diff-Serv information which is meaningful beyond the LSP
Egress (which we refer to as the 'Tunneled Diff-Serv
Information'). This information is to be conveyed by the LSP
Ingress to the LSP Egress. This Diff-Serv information is not
meaningful to the intermediate nodes on the LSP span."
When the Pipe Model is in use, it is common practice for the LSP
Egress to bind Explicit Null to the tunnel's FEC. The intention is
that the LSP Diff-Serv information will be carried in the EXP bits of
the Explicit Null label stack entry, and the tunneled Diff-Serv
information will be carried in whatever is "below" the Explicit Null
label stack entry, i.e., in the IP header DS bits or in the EXP bits
of the next entry on the MPLS label stack.
Naturally, this practice causes a problem if the Pipe Model LSP is
being used to tunnel MPLS packets (i.e., if Condition L does not
hold). With strict adherence to RFCs 3031 and 3036, this practice
results in an MPLS packet where Explicit NULL is at the top of the
label stack, even though it is not the only entry in the label stack.
However, RFC 3032 makes this packet illegal.
Some implementations simply transmit the illegal packet. Others try
to convert it to a legal packet by stripping off the Explicit NULL
before transmitting it. However, that breaks the Pipe Model by
discarding the LSP Diff-Serv information. It is conceivable that
there may be an implementation that drops the illegal packet
entirely; this would also break the Pipe Model, as it would lose not
only the LSP Diff-Serv information, but the entire packet.
Of course the LSP egress is not compelled to bind Explicit NULL to
the tunnel's FEC; an ordinary label could be used instead. However,
using Explicit NULL enables the egress to determine immediately
(i.e., without need for lookup in the Label Information Base) that
the further forwarding of the packet is to be determined by whatever
is below the label. Avoiding this lookup can have favorable
implications on forwarding performance.
Removing the restriction that Explicit Null only occur at the bottom
of the stack is the simplest way to facilitate the proper operation
of the Pipe Model.
4. Deployment Considerations
Implementations that adhere to this specification will interoperate
correctly, and will correctly support the Pipe Model.
Implementations that do not adhere to this specification may not
interoperate. In particular, if a router advertises a binding of
Explicit NULL, and if that router has an upstream LDP peer that will
not transmit a packet that has multiple label stack entries with
Explicit Null at top of the stack, then it will not be possible to
use Explicit NULL to support the Pipe Model until the upstream LDP
peer is brought into compliance with this specification.
It is possible that there may be a router implementation, preceding
this specification, which will discard any received packet with
multiple label stack entries and a top label value of Explicit Null.
It is advisable to configure any such routers so that they do not
advertise any bindings to Explicit Null.
5. Security Considerations
This document updates RFC 3032 by allowing Explicit NULL to occur at
any position in the label stack. This modification does not impose
any new security considerations beyond those discussed in RFC 3032.
6. Acknowledgments
Thanks to Rahul Aggarwal, Francois LeFaucheur, Yakov Rekhter, and Dan
Tappan for their helpful comments.
7. Normative References
[RFC3032] Rosen, E., Tappan, D., Fedorkow, G., Rekhter, Y.,
Farinacci, D., Li, T., and A. Conta, "MPLS Label Stack
Encoding", RFC 3032, January 2001.
8. Informative References
[RFC3270] Le Faucheur, F., Wu, L., Davie, B., Davari, S., Vaananen,
P., Krishnan, R., Cheval, P., and J. Heinanen, "Multi-
Protocol Label Switching (MPLS) Support of Differentiated
Services", RFC 3270, May 2002.
Author's Address
Eric C. Rosen
Cisco Systems, Inc.
1414 Massachusetts Avenue
Boxborough, MA 01719
EMail: erosen@cisco.com
Full Copyright Statement
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at ietf-
ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
ISO Plain Language
On this page
§1The Restriction Being Removed
RFC 3032 defines a reserved label value known as IPv4 Explicit NULL and a reserved label value known as IPv6 Explicit NULL. It states that these label values are only legal at the bottom of the MPLS label stack. However, no reason is given for this restriction.
It has turned out that in practice there are some situations in which it is useful to send MPLS packets that have Explicit NULL occur somewhere other than at that bottom of the label stack. While the intended semantics are obvious enough, the fact that such packets are gratuitously declared by RFC 3032 to be illegal has made it difficult to handle these situations in an interoperable manner.
This document updates RFC 3032 by removing the unnecessary restriction, so that the two label values are legal anywhere in the label stack.
The rule existed but nobody could say why. In practice, engineers kept running into packets that broke it, and because the standards did not say what a router should do with such a packet, two implementations could behave differently and the network would not work.
- Label value 0The IPv4 Explicit NULL Label. It says to pop the stack and forward on the IPv4 header.
- Label value 2The IPv6 Explicit NULL Label. It says to pop the stack and forward on the IPv6 header.
- Where it was allowedOnly at the bottom of the label stack, under the original rule in RFC 3032.
- Where it is allowed nowAnywhere in the label stack, after this document.
§2The New Wording for RFC 3032
| Aspect | Before RFC 4182 | After RFC 4182 |
|---|---|---|
| Position in the label stack THIS RFC | Only legal at the bottom | Legal anywhere in the stack |
| Popping the NULL | The stack is emptied and the IP header decides the disposition | The stack is popped; if other labels remain, the one beneath rises to the top |
| What decides the disposition | The IPv4 or IPv6 header | The label that has risen to the top, or the IP header if the stack is now empty |
RFC 3032 stated that a value of 0 represents the IPv4 Explicit NULL Label and that this label value is only legal at the bottom of the label stack, and that a value of 2 represents the IPv6 Explicit NULL Label with the same restriction. This document changes both paragraphs.
Paragraph i now reads that a value of 0 represents the IPv4 Explicit NULL Label, that an IPv4 Explicit NULL at the top of the label stack means that the stack must be popped, and that if the NULL was not the only label on the stack, this will cause the label beneath it to rise to the top of the stack, with the disposition of the packet based on the label that has now risen to the top. If, on the other hand, the NULL was the only label on the stack, then the stack is now empty, and the resulting packet is treated as an IPv4 packet with its disposition based on the IPv4 header.
Paragraph iii says the same for the IPv6 Explicit NULL Label, except that an empty stack leaves a packet treated as an IPv6 packet, with its disposition based on the IPv6 header.
The new text is deliberately short. A router that finds an Explicit NULL label pops the stack. If there are labels left underneath, the next one up takes over the job of deciding where the packet goes. If the stack is now empty, the packet is just an ordinary IP packet again.
i. A value of 0 represents the "IPv4 Explicit NULL Label".
An IPv4 Explicit NULL at the top of the label stack means that
the stack must be popped.
If the NULL was not the only label on the stack, this will
cause the label beneath it to rise to the top of the stack.
The disposition of the packet is based on the label that has
now risen to the top.
If, on the other hand, the NULL was the only label on the
stack, then the stack is now empty. The resulting packet is
treated as an IPv4 packet, and its disposition is based on the
IPv4 header.§3Why the Restriction Caused Trouble
Restricting Explicit NULL to the bottom of the stack has caused some problems in practice. With the restriction in place, one should not distribute, to a particular label distribution peer, a binding of Explicit NULL to a particular Forwarding Equivalence Class unless the following condition, called Condition L, holds: all MPLS packets received by that peer with an incoming label corresponding to that FEC contain only a single label stack entry. If Explicit NULL is bound to the FEC but Condition L does not hold, the peer is being requested to create illegal packets. None of the MPLS specifications say what the peer is actually supposed to do in this case. The situation is made more troublesome by the facts that, in practice, Condition L rarely holds, and that it is not possible in general to determine whether it holds or not.
Some implementations simply transmit the illegal packet. Others try to convert it to a legal packet by stripping off the Explicit NULL before transmitting it, which breaks the Pipe Model by discarding the LSP Diff-Serv information. It is conceivable that there may be an implementation that drops the illegal packet entirely, which would also break the Pipe Model, as it would lose not only the LSP Diff-Serv information but the entire packet.
A router could be told to use the Explicit NULL label for a certain kind of traffic, and then find itself sending packets that the rules said were illegal. There was no safe answer, so implementations did different things: some sent the packet anyway, some quietly removed the label, and some threw the packet away.
§3How the Pipe Model Uses Explicit NULL
There are good reasons to create label stacks in which Explicit NULL is at the top of the label stack but a non-null label is at the bottom, when supporting the Pipe Model of RFC 3270, which specifies the procedures for MPLS support of Differentiated Services. RFC 3270 defines a Pipe Model in which tunneled packets must convey two meaningful pieces of Diff-Serv information: the LSP Diff-Serv Information, which is meaningful to intermediate nodes along the LSP span including the LSP Egress but is not meaningful beyond the LSP Egress and is ignored there; and the Tunneled Diff-Serv Information, which is meaningful beyond the LSP Egress, is conveyed by the LSP Ingress to the LSP Egress, and is not meaningful to the intermediate nodes on the LSP span.
When the Pipe Model is in use, it is common practice for the LSP Egress to bind Explicit Null to the tunnel's FEC. The intention is that the LSP Diff-Serv information will be carried in the EXP bits of the Explicit NULL label stack entry, and the tunneled Diff-Serv information will be carried in whatever is below the Explicit NULL label stack entry, that is, in the IP header DS bits or in the EXP bits of the next entry on the MPLS label stack. Naturally this causes a problem if the Pipe Model LSP is being used to tunnel MPLS packets, that is, if Condition L does not hold, because with strict adherence to RFCs 3031 and 3036 the result is an MPLS packet where Explicit NULL is at the top of the label stack even though it is not the only entry in the stack. However, RFC 3032 makes this packet illegal.
The LSP Egress is not compelled to bind Explicit NULL to the tunnel's FEC, since an ordinary label could be used instead. However, using Explicit NULL enables the egress to determine immediately, without a lookup in the Label Information Base, that the further forwarding of the packet is to be determined by whatever is below the label. Avoiding this lookup can have favourable implications on forwarding performance. Removing the restriction that Explicit Null only occur at the bottom of the stack is the simplest way to facilitate the proper operation of the Pipe Model.
The Pipe Model needs two pieces of service-quality information in one packet: one that matters to the routers along the tunnel, and one that matters to whoever receives the tunnel. Explicit NULL is the natural place to put the first, with the second carried underneath it. That is only possible if Explicit NULL can sit on top of another label, which is exactly what this document allows.
- LSP Diff-Serv informationMeaningful to the nodes along the tunnel, and carried in the EXP bits of the Explicit NULL label.
- Tunneled Diff-Serv informationMeaningful beyond the tunnel egress, and carried in the IP header DS bits or the EXP bits of the next label.
- Why Explicit NULLIt lets the egress decide at once that forwarding continues with whatever is below the label, with no lookup in the Label Information Base.
§4Deployment Considerations
Implementations that adhere to this specification will interoperate correctly, and will correctly support the Pipe Model.
Implementations that do not adhere to this specification may not interoperate. In particular, if a router advertises a binding of Explicit NULL and that router has an upstream LDP peer that will not transmit a packet that has multiple label stack entries with Explicit NULL at the top of the stack, then it will not be possible to use Explicit NULL to support the Pipe Model until the upstream LDP peer is brought into compliance with this specification.
It is possible that there may be a router implementation, preceding this specification, that will discard any received packet with multiple label stack entries and a top label value of Explicit Null. It is advisable to configure any such routers so that they do not advertise any bindings to Explicit Null.
Old equipment may still refuse these packets, so the change has to be made from both ends. Until the neighbour that sends the packet is upgraded too, the safe move is not to advertise the Explicit NULL binding at all.
§5Security Considerations
This document updates RFC 3032 by allowing Explicit NULL to occur at any position in the label stack. This modification does not impose any new security considerations beyond those discussed in RFC 3032.
Allowing a label in more places does not change how packets are protected, so the document adds nothing new here. The security analysis stays where it was, in the document that defines the label stack.