BIER OSPFv2: OSPFv2 Extensions for Bit Index Explicit Replication (BIER)
How OSPFv2 routers tell each other the information BIER multicast forwarding needs, in MPLS networks.
Psenak, P., Ed., Kumar, N., Wijnands, IJ., Dolganow, A., Przygienda, T., Zhang, J., and S. Aldrin, "OSPFv2 Extensions for Bit Index Explicit Replication (BIER)", RFC 8444, DOI 10.17487/RFC8444, November 2018, <https://www.rfc-editor.org/info/rfc8444>.
@misc{rfc8444,
series = {Request for Comments},
number = 8444,
howpublished = {RFC 8444},
publisher = {RFC Editor},
doi = {10.17487/RFC8444},
url = {https://www.rfc-editor.org/info/rfc8444},
author = {P. Psenak and N. Kumar and IJ. Wijnands and A. Dolganow and T. Przygienda and J. Zhang and S. Aldrin},
title = {{OSPFv2 Extensions for Bit Index Explicit Replication (BIER)}},
pagetotal = 12,
year = 2018,
month = nov,
} RFC text
Contents
Internet Engineering Task Force (IETF) P. Psenak, Ed.
Request for Comments: 8444 N. Kumar
Category: Standards Track IJ. Wijnands
ISSN: 2070-1721 Cisco
A. Dolganow
Nokia
T. Przygienda
J. Zhang
Juniper Networks, Inc.
S. Aldrin
Google, Inc.
November 2018
OSPFv2 Extensions for Bit Index Explicit Replication (BIER)
Abstract
Bit Index Explicit Replication (BIER) is an architecture that
provides optimal multicast forwarding through a "BIER domain" without
requiring intermediate routers to maintain multicast-related, per-
flow state. BIER also does not require an explicit tree-building
protocol for its operation. A multicast data packet enters a BIER
domain at a Bit-Forwarding Ingress Router (BFIR) and leaves the BIER
domain at one or more Bit-Forwarding Egress Routers (BFERs). The
BFIR adds a BIER packet header to the packet. The BIER packet header
contains a BitString in which each bit represents exactly one BFER to
forward the packet to. The set of BFERs to which the multicast
packet needs to be forwarded is expressed by the set of bits in the
BIER packet header.
This document describes the OSPF protocol extension (from RFC 2328)
that is required for BIER with MPLS encapsulation (which is defined
in RFC 8296). Support for other encapsulation types and the use of
multiple encapsulation types are outside the scope of this document.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 7841.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc8444.
Copyright Notice
Copyright (c) 2018 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction ....................................................3
2. Flooding of the BIER Information in OSPF ........................4
2.1. BIER Sub-TLV ...............................................4
2.2. BIER MPLS Encapsulation Sub-TLV ............................5
2.3. Flooding Scope of BIER Information .........................7
3. Security Considerations .........................................8
4. IANA Considerations .............................................9
5. References ......................................................9
5.1. Normative References .......................................9
5.2. Informative References ....................................10
Acknowledgments ...................................................11
Authors' Addresses ................................................11
1. Introduction
Bit Index Explicit Replication (BIER) is an architecture that
provides optimal multicast forwarding through a "BIER domain" without
requiring intermediate routers to maintain any multicast-related,
per-flow state. Neither does BIER explicitly require a tree-building
protocol for its operation. A multicast data packet enters a BIER
domain at a Bit-Forwarding Ingress Router (BFIR) and leaves the BIER
domain at one or more Bit-Forwarding Egress Routers (BFERs). The
BFIR router adds a BIER packet header to the packet. The BIER packet
header contains a BitString in which each bit represents exactly one
BFER to forward the packet to. The set of BFERs to which the
multicast packet needs to be forwarded is expressed by the set of
bits in the BIER packet header.
The BIER architecture requires routers participating in BIER to
exchange BIER-related information within a given domain and permits
link-state routing protocols to perform distribution of such
information. This document describes extensions to OSPF necessary to
advertise BIER-specific information in the case where BIER uses MPLS
encapsulation as described in [RFC8296].
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
2. Flooding of the BIER Information in OSPF
All BIER-specific information that a Bit-Forwarding Router (BFR)
needs to advertise to other BFRs is associated with a BFR-prefix. A
BFR-prefix is a unique (within a given BIER domain) routable IP
address that is assigned to each BFR as described in detail in
Section 2 of [RFC8279].
Given that BIER information must be associated with a BFR-prefix, the
OSPFv2 Extended Prefix Opaque LSA [RFC7684] has been chosen for
advertisement.
2.1. BIER Sub-TLV
A sub-TLV of the OSPFv2 Extended Prefix TLV (defined in [RFC7684]) is
defined for distributing BIER information. The sub-TLV is called the
BIER Sub-TLV. Multiple BIER Sub-TLVs may be included in the OSPFv2
Extended Prefix TLV.
The BIER Sub-TLV has the following format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| sub-domain-id | MT-ID | BFR-id |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| BAR | IPA | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sub-TLVs (variable) |
+- -+
| |
Type: 9
Length: Variable, dependent on sub-TLVs.
sub-domain-id: Unique value identifying the BIER sub-domain within
the BIER domain, as described in Section 1 of [RFC8279].
MT-ID: Multi-Topology ID (as defined in [RFC4915]) that identifies
the topology that is associated with the BIER sub-domain.
BFR-id: A 2-octet field encoding the BFR-id, as documented in
Section 2 of [RFC8279]. If the BFR is not locally configured with
a valid BFR-id, the value of this field is set to 0, which is
defined as illegal in [RFC8279].
BAR: Single-octet BIER Algorithm used to calculate underlay paths to
reach other BFRs. Values are allocated from the "BIER Algorithm"
registry defined in [RFC8401].
IPA: Single-octet IGP Algorithm used to either modify, enhance, or
replace the calculation of underlay paths to reach other BFRs as
defined by the BAR value. Values are defined in the "IGP
Algorithm Types" registry [IANA-IGP].
Each BFR sub-domain MUST be associated with one and only one OSPF
topology that is identified by the MT-ID. If the association between
the BIER sub-domain and OSPF topology advertised in the BIER Sub-TLV
by other BFRs is in conflict with the association locally configured
on the receiving router, the BIER Sub-TLV for such conflicting sub-
domains MUST be ignored.
If the MT-ID contains an invalid value as specified in [RFC4915], the
BIER Sub-TLV for such subdomains with conflict MUST be ignored.
If a BFR advertises the same sub-domain-id in multiple BIER Sub-TLVs,
the BFR MUST be treated as if it did not advertise a BIER Sub-TLV for
such sub-domain.
All BFRs MUST detect advertisement of duplicate valid BFR-ids for a
given MT-ID and sub-domain-id. When such duplication is detected by
the BFR, it MUST behave as described in Section 5 of [RFC8279].
The supported BAR and IPA algorithms MUST be consistent for all
routers supporting a given BFR sub-domain. If a router receives a
BIER Sub-TLV advertisement with a value in the BAR or IPA fields that
does not match the locally configured value for a given BFR sub-
domain, the router MUST report a misconfiguration for such BIER sub-
domain and MUST ignore the BIER Sub-TLV containing the error.
The use of non-zero values in either the BAR field or the IPA field
is outside the scope of this document.
2.2. BIER MPLS Encapsulation Sub-TLV
The BIER MPLS Encapsulation Sub-TLV is a sub-TLV of the BIER Sub-TLV.
The BIER MPLS Encapsulation Sub-TLV is used in order to advertise
MPLS-specific information used for BIER. It MAY appear multiple
times in the BIER Sub-TLV.
The BIER MPLS Encapsulation Sub-TLV has the following format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Max SI | Label |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|BS Len | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type: 10
Length: 8 octets
Max SI: A 1-octet field encoding the maximum Set Identifier (SI)
(see Section 1 of [RFC8279]) used in the encapsulation for this
BIER sub-domain for this BitString length.
Label: A 3-octet field, where the 20 rightmost bits represent the
first label in the label range. The 4 leftmost bits MUST be
ignored.
BS Len (BitString Length): A 4-bit field encoding the supported
BitString length associated with this BFR-prefix. The values
allowed in this field are specified in Section 2 of [RFC8296].
Reserved: SHOULD be set to 0 on transmission and MUST be ignored on
reception.
The "label range" is the set of labels beginning with the Label and
ending with (Label + (Max SI)). A unique label range is allocated
for each BitString length and sub-domain-id. These labels are used
for BIER forwarding as described in [RFC8279] and [RFC8296].
The size of the label range is determined by the number of SIs
(Section 1 of [RFC8279]) that are used in the network. Each SI maps
to a single label in the label range: the first label is for SI=0,
the second label is for SI=1, etc.
If the label associated with the Maximum Set Identifier exceeds the
20-bit range, the BIER MPLS Encapsulation Sub-TLV containing the
error MUST be ignored.
If the BitString length is set to a value that does not match any of
the allowed values specified in [RFC8296], the BIER MPLS
Encapsulation Sub-TLV containing the error MUST be ignored.
If the same BitString length is repeated in multiple BIER MPLS
Encapsulation Sub-TLVs inside the same BIER Sub-TLV, the whole BIER
Sub-TLV containing the conflicts MUST be ignored.
Label ranges within all BIER MPLS Encapsulation Sub-TLVs advertised
by the same BFR MUST NOT overlap. If an overlap is detected, all
BIER sub-TLVs advertised by such a router MUST be ignored.
2.3. Flooding Scope of BIER Information
The flooding scope of the OSPFv2 Extended Prefix Opaque LSA [RFC7684]
that is used for advertising the BIER Sub-TLV is set to area-local.
To allow BIER deployment in a multi-area environment, OSPF must
propagate BIER information between areas.
( ) ( ) ( )
( ) ( ) ( )
R1 Area 1 R2 Area 0 R3 Area 2 R4
( ) ( ) ( )
( ) ( ) ( )
Figure 1: BIER Propagation between Areas
The following procedure is used in order to propagate BIER-related
information between areas:
When an OSPF Area Border Router (ABR) advertises a Type-3 Summary
LSA from an intra-area or inter-area prefix to all its attached
areas, it will also originate an OSPFv2 Extended Prefix Opaque
LSA, as described in [RFC7684]. The flooding scope of the OSPFv2
Extended Prefix Opaque LSA type will be set to area-local. The
route-type in the OSPFv2 Extended Prefix TLV is set to inter-area.
When determining whether a BIER Sub-TLV should be included in this
LSA, an OSPF ABR will:
* Examine its best path to the prefix in the source area and find
the advertising router associated with the best path to that
prefix.
* Determine if the advertising router advertised a BIER Sub-TLV
for the prefix. If yes, the ABR will copy the information from
that BIER Sub-TLV when advertising the BIER Sub-TLV to each
attached area.
In Figure 1, R1 advertises a prefix 192.0.2.1/32 in Area 1. It
also advertises an OSPFv2 Extended Prefix Opaque LSA for prefix
192.0.2.1/32 and includes a BIER Sub-TLV in it. ABR R2 calculates
the reachability for prefix 192.0.2.1/32 inside Area 1 and
propagates it to Area 0. When doing so, it copies the entire BIER
Sub-TLV (including all of its Sub-TLVs) that it received from R1
in Area 1 and includes it in the OSPFv2 Extended Prefix Opaque LSA
it generates for 192.0.2.1/32 in Area 0. ABR R3 calculates the
reachability for prefix 192.0.2.1/32 inside Area 0 and propagates
it to Area 2. When doing so, it copies the entire BIER Sub-TLV
(including all of its sub-TLVs) that it received from R2 in Area 0
and includes it in the OSPFv2 Extended Prefix Opaque LSA it
generates for 192.0.2.1/32 in Area 2.
3. Security Considerations
This document introduces new sub-TLVs for the existing OSPFv2
Extended Prefix TLV. It does not introduce any new security risks to
OSPF. Existing security extensions as described in [RFC2328] and
[RFC7684] apply.
It is assumed that both the BIER and OSPF layers are under a single
administrative domain. There can be deployments where potential
attackers have access to one or more networks in the OSPF routing
domain. In these deployments, stronger authentication mechanisms
such as those specified in [RFC7474] SHOULD be used.
The Security Considerations section of [RFC8279] discusses the
possibility of performing a Denial-of-Service (DoS) attack by setting
too many bits in the BitString of a BIER-encapsulated packet.
However, this sort of DoS attack cannot be initiated by modifying the
OSPF BIER advertisements specified in this document. A BFIR decides
which systems are to receive a BIER-encapsulated packet. In making
this decision, it is not influenced by the OSPF control messages.
When creating the encapsulation, the BFIR sets one bit in the
encapsulation for each destination system. The information in the
OSPF BIER advertisements is used to construct the forwarding tables
that map each bit in the encapsulation into a set of next hops for
the host that is identified by that bit, but the information is not
used by the BFIR to decide which bits to set. Hence, an attack on
the OSPF control plane cannot be used to cause this sort of DoS
attack.
While a BIER-encapsulated packet is traversing the network, a BFR
that receives a BIER-encapsulated packet with n bits set in its
BitString may have to replicate the packet and forward multiple
copies. However, a given bit will only be set in one copy of the
packet. This means that each transmitted replica of a received
packet has fewer bits set (i.e., is targeted to fewer destinations)
than the received packet. This is an essential property of the BIER
forwarding process as defined in [RFC8279]. While a failure of this
process might cause a DoS attack (as discussed in the Security
Considerations section of [RFC8279]), such a failure cannot be caused
by an attack on the OSPF control plane.
Implementations MUST ensure that malformed BIER and BIER MPLS
Encapsulation Sub-TLVs as defined in this document are detected and
that they do not provide a vulnerability for attackers to crash the
OSPF router or routing process. Reception of malformed TLVs or sub-
TLVs SHOULD be counted and/or logged for further analysis. Logging
of malformed TLVs and sub-TLVs SHOULD be rate-limited to prevent a
DoS attack (distributed or otherwise) from overloading the OSPF
control plane.
4. IANA Considerations
IANA has allocated the following from the "OSPFv2 Extended Prefix TLV
Sub-TLVs" registry defined in [RFC7684].
BIER Sub-TLV: 9
BIER MPLS Encapsulation Sub-TLV: 10
5. References
5.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC2328] Moy, J., "OSPF Version 2", STD 54, RFC 2328,
DOI 10.17487/RFC2328, April 1998,
<https://www.rfc-editor.org/info/rfc2328>.
[RFC4915] Psenak, P., Mirtorabi, S., Roy, A., Nguyen, L., and P.
Pillay-Esnault, "Multi-Topology (MT) Routing in OSPF",
RFC 4915, DOI 10.17487/RFC4915, June 2007,
<https://www.rfc-editor.org/info/rfc4915>.
[RFC7474] Bhatia, M., Hartman, S., Zhang, D., and A. Lindem, Ed.,
"Security Extension for OSPFv2 When Using Manual Key
Management", RFC 7474, DOI 10.17487/RFC7474, April 2015,
<https://www.rfc-editor.org/info/rfc7474>.
[RFC7684] Psenak, P., Gredler, H., Shakir, R., Henderickx, W.,
Tantsura, J., and A. Lindem, "OSPFv2 Prefix/Link Attribute
Advertisement", RFC 7684, DOI 10.17487/RFC7684, November
2015, <https://www.rfc-editor.org/info/rfc7684>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8279] Wijnands, IJ., Ed., Rosen, E., Ed., Dolganow, A.,
Przygienda, T., and S. Aldrin, "Multicast Using Bit Index
Explicit Replication (BIER)", RFC 8279,
DOI 10.17487/RFC8279, November 2017,
<https://www.rfc-editor.org/info/rfc8279>.
[RFC8296] Wijnands, IJ., Ed., Rosen, E., Ed., Dolganow, A.,
Tantsura, J., Aldrin, S., and I. Meilik, "Encapsulation
for Bit Index Explicit Replication (BIER) in MPLS and Non-
MPLS Networks", RFC 8296, DOI 10.17487/RFC8296, January
2018, <https://www.rfc-editor.org/info/rfc8296>.
[RFC8401] Ginsberg, L., Ed., Przygienda, T., Aldrin, S., and Z.
Zhang, "Bit Index Explicit Replication (BIER) Support via
IS-IS", RFC 8401, DOI 10.17487/RFC8401, June 2018,
<https://www.rfc-editor.org/info/rfc8401>.
5.2. Informative References
[IANA-IGP] IANA, "IGP Algorithm Types",
<https://www.iana.org/assignments/igp-parameters/>.
Acknowledgments
The authors would like to thank Rajiv Asati, Christian Martin, Greg
Shepherd, and Eric Rosen for their contributions.
Authors' Addresses
Peter Psenak (editor)
Cisco
Apollo Business Center
Mlynske nivy 43
Bratislava 821 09
Slovakia
Email: ppsenak@cisco.com
Nagendra Kumar
Cisco
7200 Kit Creek Road
Research Triangle Park, NC 27709
United States of America
Email: naikumar@cisco.com
IJsbrand Wijnands
Cisco
De Kleetlaan 6a
Diegem 1831
Belgium
Email: ice@cisco.com
Andrew Dolganow
Nokia
750 Chai Chee Rd
06-06 Viva Business Park
Singapore 469004
Singapore
Email: andrew.dolganow@nokia.com
Tony Przygienda
Juniper Networks, Inc.
10 Technology Park Drive
Westford, MA 01886
United States of America
Email: prz@juniper.net
Jeffrey Zhang
Juniper Networks, Inc.
10 Technology Park Drive
Westford, MA 01886
United States of America
Email: zzhang@juniper.net
Sam Aldrin
Google, Inc.
1600 Amphitheatre Parkway
Mountain View, CA
United States of America
Email: aldrin.ietf@gmail.com
ISO Plain Language
On this page
§1What BIER Changes
Bit Index Explicit Replication is an architecture that forwards multicast traffic optimally through a BIER domain without the intermediate routers keeping any multicast-related state per flow. It does not need a protocol that builds a forwarding tree either. A multicast data packet enters the domain at a Bit-Forwarding Ingress Router and leaves it at one or more Bit-Forwarding Egress Routers. The ingress router adds a BIER packet header, and that header holds a BitString in which each bit represents exactly one egress router to forward the packet to. The set of egress routers the packet must reach is expressed by the set of bits in that header.
BIER needs the routers taking part to exchange BIER-related information within a domain, and it allows a link-state routing protocol to distribute that information. This document describes the extensions to OSPF needed to advertise BIER-specific information when BIER uses MPLS encapsulation, as defined in RFC 8296. Other encapsulations, and the use of several at once, are out of scope.
Ordinary multicast forwarding needs a tree, and the routers in it keep a record of every flow passing through. BIER replaces that with a bit string in the packet header: bit 3 means deliver to this router, bit 4 means that one. The routers only need to know which bit belongs to which router, so they keep no per-flow state and need no tree-building protocol.
- Bit-Forwarding Ingress RouterThe router where a multicast packet enters the BIER domain. It adds the BIER packet header.
- BitStringThe bit string in the header, where each bit stands for exactly one Bit-Forwarding Egress Router.
- Bit-Forwarding Egress RouterOne or more of these receive the packet and take it out of the BIER domain.
- No per-flow stateThe routers in the middle keep no multicast-related state per flow, and BIER needs no protocol that builds a forwarding tree.
§2Where BIER Information Goes in OSPF
All the BIER-specific information a Bit-Forwarding Router needs to advertise to other such routers is associated with a BFR-prefix. A BFR-prefix is a unique routable IP address, unique within a given BIER domain, assigned to each BIER router as described in Section 2 of RFC 8279. Because the information has to hang off a BFR-prefix, the OSPFv2 Extended Prefix Opaque LSA of RFC 7684 is used to carry it.
Inside the Extended Prefix TLV there is a sub-TLV for distributing BIER information, called the BIER Sub-TLV, and several of them may be included in the same Extended Prefix TLV. The BIER Sub-TLV in turn may hold further sub-TLVs, one for each encapsulation the router uses.
Each BIER router has its own address in the routing protocol, and the BIER information is attached to that address. OSPF already has a way of attaching extra information to a prefix, and that is what is used here.
§2.1The BIER Sub-TLV
The BIER Sub-TLV has Type 9 and a variable Length, because its size depends on the sub-TLVs it carries. Its fields are:
- The sub-domain-id, a unique value identifying the BIER sub-domain within the BIER domain, as described in Section 1 of RFC 8279.
- The MT-ID, the Multi-Topology ID of RFC 4915, identifying the topology associated with the BIER sub-domain.
- The BFR-id, a 2-octet field encoding the identifier of the BIER router. If the router is not locally configured with a valid BFR-id, this field is set to 0, which RFC 8279 defines as illegal.
- The BAR, a single octet giving the BIER Algorithm used to calculate the underlay paths that reach other BIER routers. The values come from the BIER Algorithm registry of RFC 8401.
- The IPA, a single octet giving the IGP Algorithm used to modify, enhance or replace the calculation of those underlay paths, as defined by the BAR value. The values come from the IGP Algorithm Types registry.
Each BIER sub-domain MUST be associated with exactly one OSPF topology, identified by the MT-ID. If the association advertised by another router conflicts with the association configured locally on the receiving router, the BIER Sub-TLV for that conflicting sub-domain MUST be ignored, and the same is true if the MT-ID holds an invalid value. If a router advertises the same sub-domain-id in more than one BIER Sub-TLV, it MUST be treated as if it had advertised no BIER Sub-TLV for that sub-domain.
All BIER routers MUST detect the advertisement of duplicate valid BFR-ids for a given MT-ID and sub-domain-id, and when they do they MUST behave as described in Section 5 of RFC 8279.
The supported BAR and IPA algorithms MUST be the same on every router supporting a given BIER sub-domain. A router that receives a BIER Sub-TLV whose BAR or IPA field does not match its own local value for that sub-domain MUST report a misconfiguration and MUST ignore the sub-TLV containing the error. The use of non-zero values in either field is outside the scope of this document.
The sub-TLV names the sub-domain, the topology, the router's own identifier, and the two algorithms used to work out paths to the other routers. If two routers disagree about those algorithms, the receiver ignores the advertisement and reports a configuration error.
| Field | Name | Size | Value | Description |
|---|---|---|---|---|
TYPE | Type | 2 bytes | 9, the BIER Sub-TLV type. | |
LENGTH | Length | 2 bytes | Variable, depending on the sub-TLVs carried inside. | |
SUB-DOMAIN-ID | sub-domain-id | 1 byte | Identifies the BIER sub-domain within the BIER domain. | |
MT-ID | MT-ID | 1 byte | The Multi-Topology ID of the topology associated with the sub-domain. | |
BFR-ID | BFR-id | 2 bytes | The identifier of this BIER router. Zero means the router has no valid identifier configured. | |
BAR | BAR | 1 byte | The BIER Algorithm used to calculate the underlay paths to other BIER routers. | |
IPA | IPA | 1 byte | The IGP Algorithm used to modify, enhance or replace that path calculation. | |
RESERVED | Reserved | 2 bytes | Reserved for future use. |
§2.2The BIER MPLS Encapsulation Sub-TLV
The BIER MPLS Encapsulation Sub-TLV is a sub-TLV of the BIER Sub-TLV, and it carries the MPLS-specific information BIER needs. It MAY appear more than once in the BIER Sub-TLV. Its Type is 10 and its Length is 8 octets. Its fields are:
- Max SI, a 1-octet field encoding the maximum Set Identifier used in the encapsulation for this BIER sub-domain and this BitString length.
- Label, a 3-octet field whose 20 rightmost bits give the first label in the label range. The 4 leftmost bits MUST be ignored.
- BS Len, a 4-bit field encoding the supported BitString length associated with this BFR-prefix. The allowed values are specified in Section 2 of RFC 8296.
- Reserved, which SHOULD be set to 0 on transmission and MUST be ignored on reception.
The label range is the set of labels beginning with the Label and ending with Label plus Max SI. A unique label range is allocated for each BitString length and sub-domain-id, and these labels are used for BIER forwarding. The size of the range is set by the number of Set Identifiers used in the network, with each Set Identifier mapping to a single label: the first label is for SI 0, the second for SI 1, and so on.
If the label associated with the maximum Set Identifier exceeds the 20-bit range, the sub-TLV containing the error MUST be ignored. If the BitString length does not match any of the allowed values, the sub-TLV containing the error MUST be ignored. If the same BitString length appears in more than one of these sub-TLVs inside the same BIER Sub-TLV, the whole BIER Sub-TLV containing the conflict MUST be ignored. Label ranges within all the BIER MPLS Encapsulation Sub-TLVs advertised by the same router MUST NOT overlap, and if an overlap is detected all the BIER sub-TLVs advertised by that router MUST be ignored.
This sub-TLV tells the other routers which MPLS labels carry the BIER traffic for each bit-string size. The labels run in a range, one per Set Identifier, and the ranges of different routers must not overlap.
| Field | Name | Size | Value | Description |
|---|---|---|---|---|
TYPE | Type | 2 bytes | 10, the BIER MPLS Encapsulation Sub-TLV type. | |
LENGTH | Length | 2 bytes | 8 octets. | |
MAX-SI | Max SI | 1 byte | The maximum Set Identifier used in the encapsulation for this sub-domain and BitString length. | |
LABEL | Label | 3 bytes | A 3-octet field whose 20 rightmost bits give the first label of the label range. The 4 leftmost bits are ignored. | |
BS-LEN | BS Len | 4 bits | The supported BitString length associated with this BFR-prefix. | |
RESERVED | Reserved | 28 bits | Should be set to 0 on transmission and ignored on reception. |
§2.3Propagating BIER Information Between Areas
The flooding scope of the OSPFv2 Extended Prefix Opaque LSA used to carry the BIER Sub-TLV is area-local. To allow BIER to be deployed in a multi-area network, OSPF has to propagate BIER information between areas.
When an OSPF Area Border Router advertises a Type-3 Summary LSA for an intra-area or inter-area prefix to all its attached areas, it also originates an OSPFv2 Extended Prefix Opaque LSA whose flooding scope is area-local and whose route type in the Extended Prefix TLV is inter-area. In deciding whether to include a BIER Sub-TLV in that LSA, the area border router examines its best path to the prefix in the source area and finds the advertising router associated with that best path. If that router advertised a BIER Sub-TLV for the prefix, the area border router copies the information from it when advertising to each attached area.
The example in the document has R1 advertising the prefix 192.0.2.1/32 in Area 1, along with an Extended Prefix Opaque LSA that includes a BIER Sub-TLV. The area border router R2 computes reachability for that prefix inside Area 1 and propagates it to Area 0, copying the entire BIER Sub-TLV it received from R1, with all of its sub-TLVs, into the Extended Prefix Opaque LSA it generates for 192.0.2.1/32 in Area 0. The area border router R3 then does the same from Area 0 into Area 2.
BIER information normally stops at the edge of an OSPF area. To carry it further, each area border router copies the BIER information it learned in one area into the advertisement it sends to the next area.
- Extended Prefix Opaque LSA with BIER Sub-TLVFor prefix 192.0.2.1/32 in Area 1.
- Copied BIER Sub-TLV into Area 0The whole sub-TLV, with all of its sub-TLVs, is copied.
- Copied BIER Sub-TLV into Area 2The same copy is made again at the next area border router.
§3Security Considerations
The document introduces new sub-TLVs for the existing OSPFv2 Extended Prefix TLV and brings no new security risks to OSPF. The existing security extensions of RFC 2328 and RFC 7684 apply. It assumes that the BIER and OSPF layers are under a single administrative domain. Where potential attackers may have access to one or more networks in the OSPF routing domain, stronger authentication mechanisms such as those in RFC 7474 SHOULD be used.
The Security Considerations section of RFC 8279 discusses the possibility of a denial-of-service attack by setting too many bits in the BitString of a BIER-encapsulated packet. That attack cannot be started by modifying the OSPF BIER advertisements, because the ingress router decides which systems receive a BIER-encapsulated packet and that decision is not influenced by the OSPF control messages. The ingress router sets one bit for each destination system, and the OSPF advertisements are used only to build the forwarding tables that map each bit to a set of next hops, not to decide which bits to set. An attack on the OSPF control plane therefore cannot cause this kind of denial of service.
While a BIER-encapsulated packet traverses the network, a router that receives a packet with n bits set may have to replicate it and forward several copies. A given bit is set in only one copy, so each transmitted replica has fewer bits set, and so targets fewer destinations, than the packet that was received. This is an essential property of the BIER forwarding process. A failure of the process might cause a denial-of-service attack, but such a failure cannot be caused by an attack on the OSPF control plane.
Implementations MUST ensure that malformed BIER and BIER MPLS Encapsulation Sub-TLVs are detected and do not give an attacker a way to crash the OSPF router or routing process. Reception of malformed TLVs or sub-TLVs SHOULD be counted and logged for further analysis, and that logging SHOULD be rate-limited so that a denial-of-service attack cannot overload the OSPF control plane.
The new advertisements travel in the OSPF packets that already have their own security rules, so nothing new is needed. The one thing implementations must get right is rejecting malformed advertisements without crashing, and without logging so much that the logging itself becomes an attack.
§4IANA Considerations
IANA has allocated the following values from the OSPFv2 Extended Prefix TLV Sub-TLVs registry of RFC 7684: the BIER Sub-TLV is 9, and the BIER MPLS Encapsulation Sub-TLV is 10.
The document asks the registry for two numbers, 9 and 10, for the two new sub-TLVs.