Tech-invite  3GPPspace  IETFspace
96  95  94  93  92  91  90  89  88  87  86  85  84  83  82  81  80  79  78  77  76  75  74  73  72  71  70  69  68  67  66  65  64  63  62  61  60  59  58  57  56  55  54  53  52  51  50  49  48  47  46  45  44  43  42  41  40  39  38  37  36  35  34  33  32  31  30  29  28  27  26  25  24  23  22  21  20  19  18  17  16  15  14  13  12  11  10  09  08  07  06  05  04  03  02  01  00 
in Index   Prev   Next

RFC 9263

Network Service Header (NSH) Metadata Type 2 Variable-Length Context Headers

Pages: ~15
IETF/rtg/sfc/draft-ietf-sfc-nsh-tlv-15
Proposed Standard

 Top   ToC   RFCv3-9263
Y. Wei, Ed.
ZTE Corporation
U. Elzur
Intel
S. Majee
Individual Contributor
C. Pignataro
Cisco
D. Eastlake 3rd
Futurewei Technologies
August 2022

Network Service Header (NSH) Metadata Type 2 Variable-Length Context Headers

Abstract

Service Function Chaining (SFC) uses the Network Service Header (NSH) (RFC 8300) to steer and provide context metadata (MD) with each packet. Such metadata can be of various types, including MD Type 2, consisting of Variable-Length Context Headers. This document specifies several such Context Headers that can be used within a Service Function Path (SFP).

Status of This Memo

This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc9263.

Copyright Notice

Copyright (c) 2022 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.
 Top   ToC   RFCv3-9263

Table of Contents

 Top   ToC   RFCv3-9263

1.  Introduction

The Network Service Header (NSH) [RFC 8300] is the Service Function Chaining (SFC) encapsulation that supports the SFC architecture [RFC 7665]. As such, the NSH provides the following key elements:
  1. Service Function Path (SFP) identification
  2. indication of location within an SFP
  3. optional, per-packet metadata (fixed-length or variable-length)
[RFC 8300] further defines two metadata formats (MD Types): 1 and 2. MD Type 1 defines the fixed-length, 16-octet metadata, whereas MD Type 2 defines a variable-length context format for metadata. This document defines several common metadata Context Headers for use within NSH MD Type 2. These supplement the Subscriber Identifier and Performance Policy MD Type 2 metadata Context Headers specified in [RFC 8979].
This document does not address metadata usage, updating/chaining of metadata, or other SFP functions. Those topics are described in [RFC 8300].
 Top   ToC   RFCv3-9263

2.  Conventions Used in This Document

2.1.  Terminology

This document uses the terminology defined in the SFC architecture [RFC 7665] and the NSH [RFC 8300].

2.2.  Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC 2119] [RFC 8174] when, and only when, they appear in all capitals, as shown here.
 Top   ToC   RFCv3-9263

3.  NSH MD Type 2 Format

An NSH is composed of a 4-octet Base Header, a 4-octet Service Path Header, and optional Context Headers. The Base Header identifies the MD Type in use: 
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|Ver|O|U|    TTL    |   Length  |U|U|U|U|MD Type| Next Protocol |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Please refer to the NSH [RFC 8300] for a detailed header description.
When the Base Header specifies MD Type = 0x2, zero or more Variable-Length Context Headers MAY be added, immediately following the Service Path Header. Figure 2 below depicts the format of the Context Header as defined in Section 2.5.1 of RFC 8300. 
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Metadata Class       |      Type     |U|    Length   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                   Variable-Length Metadata                    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 Top   ToC   RFCv3-9263

4.  NSH MD Type 2 Context Headers

[RFC 8300] specifies Metadata Class 0x0000 as IETF Base NSH MD Class. In this document, metadata types are defined for the IETF Base NSH MD Class. The Context Headers specified in the subsections below are as follows:
  1. Forwarding Context
  2. Tenant ID
  3. Ingress Network Node Information
  4. Ingress Node Source Interface
  5. Flow ID
  6. Source and/or Destination Groups
  7. Policy ID

4.1.  Forwarding Context

This metadata context carries a network forwarding context, used for segregation and forwarding scope. Forwarding context can take several forms depending on the network environment, for example, Virtual eXtensible Local Area Network (VXLAN) / Generic Protocol Extension for VXLAN (VXLAN-GPE) Virtual Network Identifier (VNID), VPN Routing and Forwarding (VRF) identification, or VLAN. 
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x04  |U|  Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|CT=0x0 |             Reserved          |        VLAN ID        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x04  |U|  Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|CT=0x1 |Resv   |     Service VLAN ID   |    Customer VLAN ID   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x04  |U|  Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|CT=0x2 |   Reserved    |              MPLS VPN Label           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x04  |U|  Length = 4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|CT=0x3 | Resv  |            Virtual Network Identifier         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x04  |U|  Length = 8 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|CT=0x4 |             Reserved                                  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                            Session ID                         |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are described as follows:
Context Type (CT):
This 4-bit field that defines the interpretation of the Forwarding Context field. Please see the IANA considerations in Section 6.2. This document defines these CT values:
0x0:
12-bit VLAN identifier [IEEE.802.1Q_2018]. See Figure 3.
0x1:
24-bit double tagging identifiers. A service VLAN tag followed by a customer VLAN tag [IEEE.802.1Q_2018]. The two VLAN IDs are concatenated and appear in the same order that they appeared in the payload. See Figure 4.
0x2:
20-bit MPLS VPN label [RFC 3032] [RFC 4364]. See Figure 5.
0x3:
24-bit virtual network identifier (VNI) [RFC 8926]. See Figure 6.
0x4:
32-bit Session ID [RFC 3931]. This is called Key in GRE [RFC 2890]. See Figure 7.
Reserved (Resv):
These bits in the context fields MUST be sent as zero and ignored on receipt.

4.2.  Tenant ID

Tenant identification is often used for segregation within a multi-tenant environment. Orchestration system-generated Tenant IDs are an example of such data. This Context Header carries the value of the Tenant ID. Virtual Tenant Network (VTN) [OpenDaylight-VTN] is an application that provides multi-tenant virtual networks on a Software-Defined Networking (SDN) controller. 
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x05  |U|    Length   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~                         Tenant ID                             ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are described as follows:
Length:
Indicates the length of the Tenant ID in octets (see Section 2.5.1 of RFC 8300).
Tenant ID:
Represents an opaque value pointing to orchestration system-generated Tenant ID. The structure and semantics of this field are specific to the operator's deployment across its operational domain and are specified and assigned by an orchestration function. The specifics of that orchestration-based assignment are outside the scope of this document.

4.3.  Ingress Network Node Information

This Context Header carries a Node ID of the network node at which the packet entered the SFC-enabled domain. This node will necessarily be a classifier [RFC 7665]. In cases where the Service Path Identifier (SPI) identifies the ingress node, this Context Header is superfluous. 
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x06  |U|   Length    |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~                        Node ID                                ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are described as follows:
Length:
Indicates the length of the Node ID in octets (see Section 2.5.1 of RFC 8300).
Node ID:
Represents an opaque value of the ingress network Node ID. The structure and semantics of this field are deployment specific. For example, Node ID may be a 4-octet IPv4 address Node ID, a 16-octet IPv6 address Node ID, a 6-octet MAC address, an 8-octet MAC address (64-bit Extended Unique Identifier (EUI-64)), etc.

4.4.  Ingress Network Source Interface

This context identifies the ingress interface of the ingress network node. The l2vlan (135), l3ipvlan (136), ipForward (142), and mpls (166) in [IANAifType] are examples of source interfaces. 
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x07  |U|    Length   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~                     Source Interface                          ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are described as follows:
Length:
Indicates the length of the Source Interface in octets (see Section 2.5.1 of RFC 8300).
Source Interface:
Represents an opaque value of the identifier of the ingress interface of the ingress network node.

4.5.  Flow ID

Flow ID provides a field in NSH MD Type 2 to label packets belonging to the same flow. For example, [RFC 8200] defines IPv6 Flow Label as Flow ID. Another example of Flow ID is how [RFC 6790] defines an entropy label that is generated based on flow information in the MPLS network. Absence of this field or a value of zero denotes that packets have not been labeled with a Flow ID. 
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x08  |U| Length = 4  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|CT=0x0 |   Reserved    |           IPv6 Flow ID                |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x08  |U| Length = 4  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|CT=0x1 |   Reserved    |        MPLS entropy label             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are described as follows:
Length:
Indicates the length of the Flow ID in octets (see Section 2.5.1 of RFC 8300). For example, the IPv6 Flow Label in [RFC 8200] is 20 bits long. An entropy label in the MPLS network in [RFC 6790] is also 20 bits long.
Context Type (CT):
This 4-bit field that defines the interpretation of the Flow ID field. Please see the IANA considerations in Section 6.3. This document defines these CT values:
0x0:
20-bit IPv6 Flow Label in [RFC 8200]. See Figure 11.
0x1:
20-bit entropy label in the MPLS network in [RFC 6790]. See Figure 12.
Reserved:
These bits in the context fields MUST be sent as zero and ignored on receipt.

4.6.  Source and/or Destination Groups

Intent-based systems can use this data to express the logical grouping of source and/or destination objects. [OpenStack] and [OpenDaylight] provide examples of such a system. Each is expressed as a 32-bit opaque object. 
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x09  |U|  Length=8   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Source Group                           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                      Destination Group                        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
If there is no group information specified for the Source Group or Destination Group field, the field MUST be sent as zero and ignored on receipt.

4.7.  Policy ID

Traffic handling policies are often referred to by a system-generated identifier, which is then used by the devices to look up the policy's content locally. For example, this identifier could be an index to an array, a lookup key, or a database ID. The identifier allows enforcement agents or services to look up the content of their part of the policy. 
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|    Metadata Class = 0x0000    |  Type = 0x0A  |U|    Length   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
~                           Policy ID                           ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The fields are described as follows:
Length:
Indicates the length of the Policy ID in octets (see Section 2.5.1 of RFC 8300).
Policy ID:
Represents an opaque value of the Policy ID.
This Policy ID is a general Policy ID, essentially a key to allow Service Functions (SFs) to know which policies to apply to packets. Those policies generally will not have much to do with performance but rather with what specific treatment to apply. It may, for example, select a URL filter data set for a URL filter or select a video transcoding policy in a transcoding SF. The Performance Policy ID in [RFC 8979] is described there as having very specific use and, for example, says that fully controlled SFPs would not use it. The Policy ID in this document is for cases not covered by [RFC 8979].
 Top   ToC   RFCv3-9263

5.  Security Considerations

A misbehaving node from within the SFC-enabled domain may alter the content of the Context Headers, which may lead to service disruption. Such an attack is not unique to the Context Headers defined in this document. Measures discussed in Section 8 of RFC 8300 describes the general security considerations for protecting the NSH. [RFC 9145] specifies methods of protecting the integrity of the NSH metadata. If the NSH includes the Message Authentication Code (MAC) and Encrypted Metadata Context Header [RFC 9145], the authentication of the packet MUST be verified before using any data. If the verification fails, the receiver MUST stop processing the Variable-Length Context Headers and notify an operator.
The security and privacy considerations for the 7 types of Context Headers specified above are discussed below. Since NSH-ignorant SFs will never see the NSH, then even if they are malign, they cannot compromise security or privacy based on the NSH or any of these Context Headers; however, they could cause compromise based on the rest of the packet. To the extent that any of these headers are included when they would be unneeded or have no effect, they provide a covert channel for the entity adding the Context Header to communicate a limited amount of arbitrary information to downstream entities within the SFC-enabled domain.

5.1.  Forwarding Context

All of the Forwarding Context variants specified in this document (those with CT values between 0 and 4) merely repeat a field that is available in the packet encapsulated by the NSH. These variants repeat that field in the NSH for convenience. Thus, there are no special security or privacy considerations in these cases. Any future new values of CT for the Forwarding Context must specify the security and privacy considerations for those extensions.

5.2.  Tenant ID

The Tenant ID indicates the tenant to which traffic belongs and might be used to tie together and correlate packets for a tenant that some monitoring function could not otherwise group, especially if other possible identifiers were being randomized. As such, it may reduce security by facilitating traffic analysis but only within the SFC-enabled domain where this Context Header is present in packets.

5.3.  Ingress Network Node Information

The SFC-enabled domain manager normally operates the initial ingress/classifier node and is thus potentially aware of the information provided by this Context Header. Furthermore, in many cases, the SPI that will be present in the NSH identifies or closely constrains the ingress node. Also, in most cases, it is anticipated that many entities will be sending packets into an SFC-enabled domain through the same ingress node. Thus, under most circumstances, this Context Header is expected to weaken security and privacy to only a minor extent and only within the SFC-enabled domain.

5.4.  Ingress Node Source Interface

This Context Header is likely to be meaningless unless the Ingress Network Node Information Context Header is also present. When that node information header is present, this source interface header provides a more fine-grained view of the source by identifying not just the initial ingress/classifier node but also the port of that node on which the data arrived. Thus, it is more likely to identify a specific source entity or at least to more tightly constrain the set of possible source entities than just the node information header. As a result, inclusion of this Context Header with the node information Context Header is potentially a greater threat to security and privacy than the node information header alone, but this threat is still constrained to the SFC-enabled domain.

5.5.  Flow ID

The variations of this Context Header specified in this document simply repeat fields already available in the packet and thus have no special security or privacy considerations. Any future new values of CT for the Flow ID must specify the security and privacy considerations for those extensions.

5.6.  Source and/or Destination Groups

This Context Header provides additional information that might help identify the source and/or destination of packets. Depending on the granularity of the groups, it could either (1) distinguish packets as part of flows from and/or to objects where those flows could not otherwise be easily distinguished but appear to be part of one or fewer flows or (2) group packet flows that are from and/or to an object where those flows could not otherwise be easily grouped for analysis or another purpose. Thus, the presence of this Context Header with non-zero source and/or destination groups can, within the SFC-enabled domain, erode security and privacy to an extent that depends on the details of the grouping.

5.7.  Policy ID

This Context Header carries an identifier that nodes in the SFC-enabled domain can use to look up policy to potentially influence their actions with regard to the packet carrying this header. If there are no such decisions regarding their actions, then the header should not be included. If there are such decisions, the information on which they are to be based needs to be included somewhere in the packet. There is no reason for inclusion in this Context Header to have any security or privacy considerations that would not apply to any other plaintext way of including such information. It may provide additional information to help identify a flow of data for analysis.
 Top   ToC   RFCv3-9263

6.  IANA Considerations

6.1.  MD Type 2 Context Types

IANA has assigned the following types (Table 1) from the "NSH IETF-Assigned Optional Variable-Length Metadata Types" registry available at [IANA-NSH-MD2].
Value Description Reference
0x04 Forwarding Context RFC 9263
0x05 Tenant ID RFC 9263
0x06 Ingress Network Node ID RFC 9263
0x07 Ingress Network Interface RFC 9263
0x08 Flow ID RFC 9263
0x09 Source and/or Destination Groups RFC 9263
0x0A Policy ID RFC 9263
Table 1: Type Values

6.2.  Forwarding Context Types

IANA has created a new subregistry for "Forwarding Context Types" at [IANA-NSH-MD2] as follows.
The registration policy is IETF Review.
Value Description Reference
0x0 12-bit VLAN identifier RFC 9263
0x1 24-bit double tagging identifiers RFC 9263
0x2 20-bit MPLS VPN label RFC 9263
0x3 24-bit virtual network identifier (VNI) RFC 9263
0x4 32-bit Session ID RFC 9263
0x5-0xE Unassigned
0xF Reserved RFC 9263
Table 2: Forwarding Context Types

6.3.  Flow ID Context Types

IANA has created a new subregistry for "Flow ID Context Types" at [IANA-NSH-MD2] as follows.
The registration policy is IETF Review.
Value Description Reference
0x0 20-bit IPv6 Flow Label RFC 9263
0x1 20-bit entropy label in the MPLS network RFC 9263
0x2-0xE Unassigned
0xF Reserved RFC 9263
Table 3: Flow ID Context Types
 Top   ToC   RFCv3-9263

7.  References

7.1.  Normative References

[IANA-NSH-MD2]
IANA, "Network Service Header (NSH) Parameters",
<https://www.iana.org/assignments/nsh>.
[IEEE.802.1Q_2018]
IEEE, "IEEE Standard for Local and Metropolitan Area Network -- Bridges and Bridged Networks", July 2018,
<https://ieeexplore.ieee.org/document/8403927>.
[RFC2119]
S Bradner, "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC3931]
J Lau, M Townsley, and I Goyret, "Layer Two Tunneling Protocol - Version 3 (L2TPv3)", RFC 3931, DOI 10.17487/RFC3931, March 2005,
<https://www.rfc-editor.org/info/rfc3931>.
[RFC8174]
B Leiba, "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017,
<https://www.rfc-editor.org/info/rfc8174>.
[RFC8300]
P Quinn, U Elzur, and C Pignataro, "Network Service Header (NSH)", RFC 8300, DOI 10.17487/RFC8300, January 2018,
<https://www.rfc-editor.org/info/rfc8300>.
[RFC9145]
M Boucadair, T Reddy.K, and D Wing, "Integrity Protection for the Network Service Header (NSH) and Encryption of Sensitive Context Headers", RFC 9145, DOI 10.17487/RFC9145, December 2021,
<https://www.rfc-editor.org/info/rfc9145>.

7.2.  Informative References

[IANAifType]
IANA, "IANAifType-MIB DEFINITIONS", 2021,
<https://www.iana.org/assignments/ianaiftype-mib>.
[OpenDaylight]
OpenDaylight, "Group Based Policy User Guide", 2021,
<https://docs.opendaylight.org/en/stable-fluorine/user-guide/group-based-policy-user-guide.html?highlight=group%20policy#>.
[OpenDaylight-VTN]
OpenDaylight, "OpenDaylight VTN", 2021,
<https://nexus.opendaylight.org/content/sites/site/org.opendaylight.docs/master/userguide/manuals/userguide/bk-user-guide/content/_vtn.html>.
[OpenStack]
OpenStack, "GroupBasedPolicy", 2021,
<https://wiki.openstack.org/wiki/GroupBasedPolicy>.
[RFC2890]
G Dommety, "Key and Sequence Number Extensions to GRE", RFC 2890, DOI 10.17487/RFC2890, September 2000,
<https://www.rfc-editor.org/info/rfc2890>.
[RFC3032]
E Rosen, D Tappan, G Fedorkow, Y Rekhter, D Farinacci, T Li, and A Conta, "MPLS Label Stack Encoding", RFC 3032, DOI 10.17487/RFC3032, January 2001,
<https://www.rfc-editor.org/info/rfc3032>.
[RFC4364]
E Rosen, and Y Rekhter, "BGP/MPLS IP Virtual Private Networks (VPNs)", RFC 4364, DOI 10.17487/RFC4364, February 2006,
<https://www.rfc-editor.org/info/rfc4364>.
[RFC6790]
K Kompella, J Drake, S Amante, W Henderickx, and L Yong, "The Use of Entropy Labels in MPLS Forwarding", RFC 6790, DOI 10.17487/RFC6790, November 2012,
<https://www.rfc-editor.org/info/rfc6790>.
[RFC7665]
J Halpern, and C Pignataro, "Service Function Chaining (SFC) Architecture", RFC 7665, DOI 10.17487/RFC7665, October 2015,
<https://www.rfc-editor.org/info/rfc7665>.
[RFC8200]
S Deering, and R Hinden, "Internet Protocol, Version 6 (IPv6) Specification", STD 86, RFC 8200, DOI 10.17487/RFC8200, July 2017,
<https://www.rfc-editor.org/info/rfc8200>.
[RFC8926]
J Gross, I Ganga, and T Sridhar, "Geneve: Generic Network Virtualization Encapsulation", RFC 8926, DOI 10.17487/RFC8926, November 2020,
<https://www.rfc-editor.org/info/rfc8926>.
[RFC8979]
B Sarikaya, D von Hugo, and M Boucadair, "Subscriber and Performance Policy Identifier Context Headers in the Network Service Header (NSH)", RFC 8979, DOI 10.17487/RFC8979, February 2021,
<https://www.rfc-editor.org/info/rfc8979>.
 Top   ToC   RFCv3-9263

Acknowledgments

The authors would like to thank Paul Quinn, Behcet Sarikaya, Dirk von Hugo, Mohamed Boucadair, Gregory Mirsky, and Joel Halpern for providing invaluable concepts and content for this document.
 Top   ToC   RFCv3-9263

Authors' Addresses

Yuehua Wei

ZTE Corporation
No.50, Software Avenue
Nanjing   210012
China

Uri Elzur

Intel

Sumandra Majee

Individual Contributor

Carlos Pignataro

Cisco

Donald E. Eastlake, 3rd

Futurewei Technologies
2386 Panoramic Circle
Apopka   FL   32703
United States of America
 Top   ToC