< draft-ietf-sfc-oam-framework-13.txt		draft-ietf-sfc-oam-framework-14.txt >
	Internet Engineering Task Force S. Aldrin		Internet Engineering Task Force S. Aldrin
	Internet-Draft Google		Internet-Draft Google
	Intended status: Informational C. Pignataro, Ed.		Intended status: Informational C. Pignataro, Ed.
	Expires: October 16, 2020 N. Kumar, Ed.		Expires: October 29, 2020 N. Kumar, Ed.
	Cisco		Cisco
	R. Krishnan		R. Krishnan
	VMware		VMware
	A. Ghanwani		A. Ghanwani
	Dell		Dell
	April 14, 2020		April 27, 2020
	Service Function Chaining (SFC)		Service Function Chaining (SFC)
	Operations, Administration and Maintenance (OAM) Framework		Operations, Administration and Maintenance (OAM) Framework
	draft-ietf-sfc-oam-framework-13		draft-ietf-sfc-oam-framework-14
	Abstract		Abstract
	This document provides a reference framework for Operations,		This document provides a reference framework for Operations,
	Administration and Maintenance (OAM) for Service Function Chaining		Administration and Maintenance (OAM) for Service Function Chaining
	(SFC).		(SFC).
	Requirements Language		Requirements Language
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",		The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	skipping to change at page 1, line 47 ¶		skipping to change at page 1, line 47 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.		Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on October 16, 2020.		This Internet-Draft will expire on October 29, 2020.
	Copyright Notice		Copyright Notice
	Copyright (c) 2020 IETF Trust and the persons identified as the		Copyright (c) 2020 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(https://trustee.ietf.org/license-info) in effect on the date of		(https://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 3, line 13 ¶		skipping to change at page 3, line 13 ¶
	6.4.1. ICMP . . . . . . . . . . . . . . . . . . . . . . . . 15		6.4.1. ICMP . . . . . . . . . . . . . . . . . . . . . . . . 15
	6.4.2. BFD/Seamless-BFD . . . . . . . . . . . . . . . . . . 15		6.4.2. BFD/Seamless-BFD . . . . . . . . . . . . . . . . . . 15
	6.4.3. In-Situ OAM . . . . . . . . . . . . . . . . . . . . . 16		6.4.3. In-Situ OAM . . . . . . . . . . . . . . . . . . . . . 16
	6.4.4. SFC Traceroute . . . . . . . . . . . . . . . . . . . 16		6.4.4. SFC Traceroute . . . . . . . . . . . . . . . . . . . 16
	7. Manageability Considerations . . . . . . . . . . . . . . . . 16		7. Manageability Considerations . . . . . . . . . . . . . . . . 16
	8. Security Considerations . . . . . . . . . . . . . . . . . . . 17		8. Security Considerations . . . . . . . . . . . . . . . . . . . 17
	9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18		9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18
	10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 18		10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 18
	11. Contributing Authors . . . . . . . . . . . . . . . . . . . . 18		11. Contributing Authors . . . . . . . . . . . . . . . . . . . . 18
	12. References . . . . . . . . . . . . . . . . . . . . . . . . . 18		12. References . . . . . . . . . . . . . . . . . . . . . . . . . 18
	12.1. Normative References . . . . . . . . . . . . . . . . . . 18		12.1. Normative References . . . . . . . . . . . . . . . . . . 19
	12.2. Informative References . . . . . . . . . . . . . . . . . 19		12.2. Informative References . . . . . . . . . . . . . . . . . 19
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 21		Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 21
	1. Introduction		1. Introduction
	Service Function Chaining (SFC) enables the creation of composite		Service Function Chaining (SFC) enables the creation of composite
	services that consist of an ordered set of Service Functions (SF)		services that consist of an ordered set of Service Functions (SF)
	that are to be applied to packets and/or frames selected as a result		that are to be applied to packets and/or frames selected as a result
	of classification [RFC7665]. SFC is a concept that provides for more		of classification [RFC7665]. SFC is a concept that provides for more
	than just the application of an ordered set of SFs to selected		than just the application of an ordered set of SFs to selected
	skipping to change at page 18, line 9 ¶		skipping to change at page 18, line 9 ¶
	information collected at an SFC component may reveal the SF		information collected at an SFC component may reveal the SF
	associated within each chain and this information together with		associated within each chain and this information together with
	classifier rules may be used to manipulate the header of synthetic		classifier rules may be used to manipulate the header of synthetic
	attack packets that may be used to bypass the SFC and trigger any		attack packets that may be used to bypass the SFC and trigger any
	internal attacks.		internal attacks.
	The SF information at the SF component may be used by a malicious		The SF information at the SF component may be used by a malicious
	user to trigger Denial of Service (DoS) attack by overloading any		user to trigger Denial of Service (DoS) attack by overloading any
	specific SF using rogue OAM traffic.		specific SF using rogue OAM traffic.
	To address the above concerns, SFC and SF OAM may provide mechanism		To address the above concerns, SFC and SF OAM should provide
	for:		mechanisms for:
	o Misuse of the OAM channel for denial-of-services,		o Misuse of the OAM channel for denial-of-services,
	o Leakage of OAM packets across SFC instances, and		o Leakage of OAM packets across SFC instances, and
	o Leakage of SFC information beyond the SFC domain.		o Leakage of SFC information beyond the SFC domain.
	The documents proposing the OAM solution for SF component should		The documents proposing the OAM solution for SF component should
	consider rate-limiting the OAM probes at a frequency guided by the		consider rate-limiting the OAM probes at a frequency guided by the
	implementation choice. Rate-limiting may be applied at the SFF or		implementation choice. Rate-limiting may be applied at the SFF or
	the SF . The OAM initiator may not receive a response for the probes		the SF . The OAM initiator may not receive a response for the probes
	that are rate-limited resulting in false negatives and the		that are rate-limited resulting in false negatives and the
	implementation should be aware of this.		implementation should be aware of this. To mitigate any attacks that
			leverage OAM packets, future documents proposing OAM solutions should
			describe the use of any technique to detect and mitigate anomalies
			and various security attacks.
	The documents proposing the OAM solution for any service layer		The documents proposing the OAM solution for any service layer
	components should consider some form of message filtering to prevent		components should consider some form of message filtering to prevent
	leaking any internal service layer information outside the		leaking any internal service layer information outside the
	administrative domain.		administrative domain.
	9. IANA Considerations		9. IANA Considerations
	No action is required by IANA for this document.		No action is required by IANA for this document.
End of changes. 7 change blocks.
	8 lines changed or deleted		11 lines changed or added
This html diff was produced by rfcdiff 1.47. The latest version is available from http://tools.ietf.org/tools/rfcdiff/