wdiff draft-ietf-ospf-ospfv2-hbit-07.txt draft-ietf-ospf-ospfv2-hbit-08.txt

OSPF K. Patel
Internet-Draft Arrcus
Updates: 2328 2328,6987 (if approved) P. Pillay-Esnault
Intended status: Standards Track Huawei Technologies Futurewei
Expires: November 20, 2019 January 9, 2020 M. Bhardwaj
S. Bayraktar
Cisco Systems
May 19,
July 8, 2019

Host Router Support for OSPFv2
draft-ietf-ospf-ospfv2-hbit-07
draft-ietf-ospf-ospfv2-hbit-08

Abstract

The OSPFv2 specifies an SPF algorithm that identifies transit
vertices based on their adjacencies. Therefore, OSPFv2 does not have
a mechanism to prevent traffic transiting a participating node if it
is a transit vertex in the only existing or shortest path to the
destination. The use of metrics to make the node undesirable can
only help to repel traffic if an alternative better route exists.
This document defines the Host-bit functionality to prevent other
OSPFv2 routers from using the router for transit traffic in OSPFv2
routing domains. This document updates the [RFC2328] Open Shortest Path First
v2 specification (OSPFv2 rfc2328) by assigning a new bit (Host-bit)
in the OSPF Router-LSA bit registry. If In addition, if the Host-
bit Host-bit is
set, the calculation of the shortest-path tree for an area, as
described in [RFC2328], OSPFv2, is modified by including a new check to verify
that transit vertices have the Host-bit clear. In addition, this
document updates OSPF Stub Router Advertisement (rfc6987) to
advertise for type-2 External and NSSA LSAs with a high cost in order
to repel traffic effectively.

Status of This Memo

This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on November 20, 2019. January 9, 2020.

This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.

This document may contain material from IETF Documents or IETF
Contributions published or made publicly available before November
10, 2008. The person(s) controlling the copyright in some of this
material may not have granted the IETF Trust the right to allow
modifications of such material outside the IETF Standards Process.
Without obtaining an adequate license from the person(s) controlling
the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other
than English.

Table of Contents

1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Requirements Language . . . . . . . . . . . . . . . . . . . . 3
3. Host-bit Support . . . . . . . . . . . . . . . . . . . . . . 3
4. SPF Modifications . . . . . . . . . . . . . . . . . . . . . . 5
5. Auto Discovery and Backward Compatibility . . . . . . . . . . 6
6. OSPF AS-External-LSAs/NSSA LSAs with Type 2 Metrics . . . . . 6 7
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6 7
8. Security Considerations . . . . . . . . . . . . . . . . . . . 7 8
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7 8
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 7 8
10.1. Normative References . . . . . . . . . . . . . . . . . . 7 9
10.2. Informative References . . . . . . . . . . . . . . . . . 8 9
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 8 9

1. Introduction

This functionality is particularly useful for a number of use cases:

1. To isolate a router to avoid blackhole scenarios when there is a
reload and possible long reconvergence times.

2. Closet Switches are usually not used for transit traffic but need
to participate in the topology.

3. Overloaded routers could use such a capability to temporarily
repel traffic until they stabilize.

4. BGP Route reflectors known as virtual Route Reflectors (vRRs),
that are not in the forwarding path but are in central locations
such as data centers. Such Route Reflectors typically are used
for route distribution and are not capable of forwarding transit
traffic. However, they need to learn the OSPF topology to
perform spf computation for optimal routes and reachbility
resolution for its clients
[I-D.ietf-idr-bgp-optimal-route-reflection].

This document defines the Host-bit (H-Bit)functionality to prevent
other OSPFv2 routers from using the router for transit traffic in
OSPFv2 routing domains. This document updates the [RFC2328] by -
assigning the Host-bit in the OSPF Router-LSA bit registry OSPFv2 Router Properties Registry - if
the host-bit is set then the calculation of the shortest-path tree
for an area, as described in section 16.1 of [RFC2328], is modified
by including a new check to verify that transit vertices DO NOT have
the host-bit set.

2. Requirements Language

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.

3. Host-bit Support

This document defines a new router-LSA bit known as the Host Bit or
the H-bit. An OSPFv2 router advertising a router-LSA with the H-bit
set indicates to other OSPFv2 routers in the area supporting the
functionality that it MUST NOT be used as a transit router (see
section 4).

If the host-bit is NOT set routers MUST act transit routers as
described in [RFC2328] ensuring backward compatibility.

0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| LS age | Options | 1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Link State ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Advertising Router |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| LS sequence number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| LS checksum | length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|H|0|0|N|W|V|E|B| 0 | # links |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Link ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Link Data |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | # TOS | metric |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| TOS | 0 | TOS metric |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Link ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Link Data |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| ... |

Host Bit in router-LSA

0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|H|0|0|N|W|V|E|B|
+-+-+-+-+-+-+-+-+

Host Bit

Bit H is the high-order bit of the OSPF as shown above. When set, an
OSPFv2 router is a non-transit Host (non-transit) router and is incapable of
forwarding transit traffic.

An OSPFv2 router originating a router-LSA with the H-bit set MUST
advertise all its router links with a link cost of MaxLinkMetric
[RFC6987]. This is to increase the applicability of the H-bit to
partial deployments where it is the responsibility of the operator to
ensure that OSPFv2 routers not supporting the H-bit do not install
routes causing routing loops.

When the H-bit is set, an Area Border Router (ABR) MUST advertise a
consistent the
same H-bit setting in its self-originated router-LSAs for all
attached areas. The consistency of the setting will prevent inter-
area traffic transiting through the router by suppressing the
suppressing advertisement of prefixes from other routers in the area
in its summary LSAs. ONLY IPv4 prefixes associated with its local
interfaces MAY be advertised in summary LSAs. LSAs to provide reachability
to end hosts attached behind a router with the H-bit set.

When the H-bit is set cannot act as an AS Boundary Router (ASBR), as
ASBR are transit routers to prefixes that are typically imported
through redistribution of prefixes of other routing protocols.
Therefore, non-local IPv4 prefixes, e.g., those exported from other
routing protocols, MUST NOT be advertised in AS-external-LSAs. AS-external-LSAs for
routers acting permanly as a host. However, in use cases such as an
overloaded router or a router being gracefully isolated, these
routers are only temporarily acting as host routers and therefore
should continue to advertise their External LSAs but ensure they do
not attract traffic. In addition to the procedure described above,
temporary host routers advertising type 2-metric External LSAs MUST
set the metrics to LSInfinity to repel traffic.(see Section 6 of this
document).

4. SPF Modifications

The SPF calculation described in section 16.1 [RFC2328] will be
modified to ensure that the routers originating router-LSAs with the
H-bit set will not be used for transit traffic. Step 2 is modified
as follows:

2) Call the vertex just added to the
tree vertex V. Examine the LSA
associated with vertex V. This is
a lookup in the Area A's link state
database based on the Vertex ID. If
this is a router-LSA, and the H-bit
of the router-LSA is set, and
vertex V is not the root, then the
router should not be used for transit
and step (3) should be executed
immediately. If this is a router-LSA,
and bit V of the router-LSA (see
Section A.4.2) is set, set Area A's
TransitCapability to TRUE. In any case,
each link described by the LSA gives
the cost to an adjacent vertex. For
each described link, (say it joins
vertex V to vertex W):

5. Auto Discovery and Backward Compatibility

To avoid the possibility of any routing loops due to partial
deployment, this document defines a OSPF Router Information (RI) LSA
[RFC7770] with and area flooding scope and a Router Functional Capability TLV that includes new bit assigned in the following
OSPF Router Functional Informational Capability Bits Registry. Bit:

Bit Capabilities

7 Host Router Support capability

Auto Discovery via announcement of the Host Support Functional
Capability ensures that the H-bit functionality and its associated
SPF changes SHOULD MUST only take effect if all the routers in a given OSPF
area support this functionality.

Implementations are encouraged to provide a configuration parameter

In normal operations, there is no guarantee that the RI LSA will
reach all routers in an area in a timely manner which may result in
rooting loops in partial deployments. For example, in a new router
joins an area which previous had only H-bit capable routers with
H-bit set then it may take some time for the RI to propagate to all
routers.

The following recommendations will mitigate transient routing loops:

o Implementations are RECOMMENDED to provide a configuration
parameter to manually override enforcement of the H-bit
functionality in partial deployments where the topology guarantees
that OSPFv2 routers not supporting the H-bit do not compute routes
resulting in routing loops. More precisely,

o All routers, with the advertisement H-bit set, MUST advertise all of MaxLinkMetric for the
router's non-local links will prevent with a metric equal to MaxLinkMetric in
its LSAs in order to avoid OSPFv2 (unless last resort) routers not
supporting the H-bit from attempting to use it for transit
traffic.

o All routers supporting H-Bit MUST check all the RI LSAs of nodes
in the area before actively running the modified SPF to account
for the H-bit in order to verify that all routers are in routing
capability. If any router does not have the H-Bit support then
all routers in the areas MUST run the normal SPF.

o Any router not supporting the H-bit capability is detected (by
examination of RI- LSA or RTR LSA in the area database) then all
routers in the area MUST revert back to normal operations.

6. OSPF AS-External-LSAs/NSSA LSAs with Type 2 Metrics

When calculating the path to an OSPF AS-External-LSA or NSSA-LSA with
a Type-2 metric, the advertised Type-2 metric is taken as more
significant than the OSPF intra-area or inter-area path. Hence,
advertising the links with MaxLinkMetric as specified in [RFC6987]
does not discourage transit traffic when calculating AS external or
NSSA routes. routes with Type-2 metrics.

Consequently, OSPF routers implementing [RFC6987] or
this specification should and required to be
the last resort transit then they MUST advertise a Type-2 metric of LSInfinity
LSInfinity-1 for any self-originated type 2 AS-External-LSAs or NSSA-LSAs NSSA-
LSAs. However, in situations when situations, the OSPF router is acting needs to repel traffic and
acts as a stub host router [RFC6987] or implementing then, in addition of the host bit procedure
described in this specification. document they MUST advertise a Type-2 metric of
LSInfinity for any self-originated type 2 AS-External-LSAs or NSSA-
LSAs.

7. IANA Considerations

This document requests the IANA is requested to create assign the OSPF Router-LSA bit registry with 0x80 value to the
following assignments: Host-
Bit (H-bit)in the OSPFv2 Router Properties Registry

Value Description Reference
0x01 Area Border Router (B-bit) [RFC2328]
0x02 AS Boundary Router (E-bit) [RFC2328]
0x04 Virtual Link Endpoint (V-bit) [RFC2328]
0x08 Historic (W-bit) [RFC1584]
0x10 Unconditional NSSA Translator (Nt-bit) [RFC3101]
0x20 Unassigned
0x40 Unassigned

0x80 Host (H-bit) This Document

This document also defines a new Router Functional Capability
[RFC7770] known as the Host Router Support Functional Capability.
This document requests the IANA to allocate assign the Bit Number value of this capability
from 7
to the Host Router Functional Support Capability in the OSPF Router
Informational Capability Bits TLV. Registry. [RFC7770]

Bit Number Capability Name Reference

7 OSPF Host Router This Document

8. Security Considerations

This document introduces no the H-bit which is a capability that
restricts the use of a router for transit except for its local
destinations. This is a subset of the operations of a normal router
and therefore should not introduce new security considerations beyond
those already specified known in [RFC6987], [RFC2328], OSPF. The feature however does introduce the
flooding of a capability information that allows discovery and
verification that all routers in an area are capable before turning
on the feature. In case. a rogue or buggy router advertise
incorrectly its capability there are two possible cases:

o The router does not have the capability but send H-Bit set in its
LSAs: In this case, there is a possibility of a routing loop.
However this is mitigated by the fact that this router should be
avoided anyway. Moreover, the link metrics cost of this router
should be MaxLinkMetric and will mitigate this situation. In any
case a router advertising the H-bit capability without its links
cost equal to MaxLinkMetric may be an indicator that this is a
rogue router.

o The router has the capability but sends the H-Bit clear in its
LSAs: In this case, the router merely prevents support of other
H-bit routers in the area and [RFC5340]. all the routers to run the modified
SPF. The impact is also mitigated as other H-Bit routers in the
area also advertise MaxLinkMetric cost so they will still be
avoided unless they are the last resort path.

9. Acknowledgements

The authors would like to acknowledge Hasmit Grover for discovery of
the limitation in [RFC6987], Acee Lindem, Abhay Roy, David Ward,
Burjiz Pithawala and Michael Barnes for their comments.

10. References
10.1. Normative References

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.

[RFC2328] Moy, J., "OSPF Version 2", STD 54, RFC 2328,
DOI 10.17487/RFC2328, April 1998,
<https://www.rfc-editor.org/info/rfc2328>.

[RFC3101] Murphy, P., "The OSPF Not-So-Stubby Area (NSSA) Option",
RFC 3101, DOI 10.17487/RFC3101, January 2003,
<https://www.rfc-editor.org/info/rfc3101>.

[RFC5340] Coltun, R., Ferguson, D., Moy, J., and A. Lindem, "OSPF
for IPv6", RFC 5340, DOI 10.17487/RFC5340, July 2008,
<https://www.rfc-editor.org/info/rfc5340>.

[RFC7770] Lindem, A., Ed., Shen, N., Vasseur, JP., Aggarwal, R., and
S. Shaffer, "Extensions to OSPF for Advertising Optional
Router Capabilities", RFC 7770, DOI 10.17487/RFC7770,
February 2016, <https://www.rfc-editor.org/info/rfc7770>.

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.

10.2. Informative References

[I-D.ietf-idr-bgp-optimal-route-reflection]
Raszuk, R., Cassar, C., Aman, E., Decraene, B., and K.
Wang, "BGP Optimal Route Reflection (BGP-ORR)", draft-
ietf-idr-bgp-optimal-route-reflection-18 (work in
progress), April 2019.

[RFC1584] Moy, J., "Multicast Extensions to OSPF", RFC 1584,
DOI 10.17487/RFC1584, March 1994,
<https://www.rfc-editor.org/info/rfc1584>.

[RFC6987] Retana, A., Nguyen, L., Zinin, A., White, R., and D.
McPherson, "OSPF Stub Router Advertisement", RFC 6987,
DOI 10.17487/RFC6987, September 2013,
<https://www.rfc-editor.org/info/rfc6987>.

Authors' Addresses

Keyur Patel
Arrcus

Email: keyur@arrcus.com

Padma Pillay-Esnault
Huawei Technologies
Futurewei
2330 Central Expressway
Santa Clara, CA 95050
USA

Email: padma@huawei.com padma.ietf@gmail.com
Manish Bhardwaj
Cisco Systems
170 W. Tasman Drive
San Jose, CA 95134
USA

Email: manbhard@cisco.com

Serpil Bayraktar
Cisco Systems
170 W. Tasman Drive
San Jose, CA 95134
USA

Email: serpil@cisco.com