PCEP Extension for SRv6 Flow Specification

defines extensions to the Path Computation Element Communication Protocol (PCEP) to support the dissemination of Flow Specification rules using PCEP messages. A PCEP FLOWSPEC object carries match conditions and filtering actions managed by a Path Computation Element (PCE) and enforced by a Path Computation Client (PCC). Segment Routing over IPv6 (SRv6) leverages the IPv6 data plane using a Segment Routing Header (SRH) to instantiate paths. The SRv6 Network Programming architecture defines standard SID structures (LOC:FUNCT:ARG). Furthermore, defines Compressed SRv6 SIDs (CSIDs), supporting NEXT-CSID and REPLACE-CSID flavors where multiple CSIDs are packed into a 128-bit IPv6 Destination Address (DA) container. While supports basic IP and IPv6 Flow Specification matching, it lacks mechanisms to parse and filter traffic based on the internal structure of SRv6 SIDs or dynamic CSID containers. This document extends by defining two new PCEP Flow Specification TLV types to be carried within the PCEP FLOWSPEC object: SRv6 Standard SID Structure Match TLV . SRv6 CSID Dynamic Structure Match TLV . The matching field is evaluated against the IPv6 Destination Address (or active SID within an SRH when present, as shown in ).

Loc | Func | Arg | | +-------------+ | +-------------------+ | | Segment[1] | | | +-------------+ | | | ... | | SR Header| +-------------+ | (RFC 8754)| | Segment[n] | | | +-------------+ | | +-------------+ | | ~ Option TLV ~ | | +-------------+ | +-----------------------------+]]>

This document uses terminology defined in , , , , and . CSID: Compressed Segment Identifier FS: Flow Specification NEXT-CSID: NEXT-CSID Flavor defined in PCEP FS: PCEP Flow Specification REPLACE-CSID: REPLACE-CSID Flavor defined in SID: Segment Identifier SR: Segment Routing SRH: SR Header SRv6: IPv6 Segment Routing, SRv6 is a method of forwarding IPv6 packets on the network based on the concept of source routing. In this document, the length parameters defining the constituent parts of a SID or CSID structure are defined as follows: LOC-Len: Locator Length in bits for a standard 128-bit SRv6 SID (Component Type TBD1). LB-Len: Locator-Block Length in bits for a CSID structure (Component Type TBD2). LN-Len: Locator-Node Length in bits for a CSID structure. F-Len: Function Length in bits for a SID or CSID structure. ARG-Len: Argument Length in bits for a standard 128-bit SRv6 SID. In addition, the sum of LN-Len and F-Len (LN-Len + F-Len) represents the total length of a single CSID (also referred to as the "CSID length").

A PCEP speaker (PCE or PCC) indicates its support for SRv6 Flow Specification extensions during the PCEP session establishment phase. defines the FLOWSPEC-CAPABILITY TLV carried in the OPEN object. This document defines a new flag bit in the Flags field of the FLOWSPEC-CAPABILITY TLV: Bit TBD (S-bit - SRv6 FlowSpec Support): Set to 1 by a PCEP speaker to indicate capability to process SRv6 Standard SID Structure and CSID Dynamic Structure Match TLVs. If both PCEP peers advertise the S-bit capability, SRv6 FlowSpec TLVs MAY be included in PCEP messages (e.g., PCUpd, PCInitiate, or PCRpt).

Flow Specification match conditions in PCEP are carried within the FLOWSPEC object . This document defines two new TLVs for inclusion in the FLOWSPEC object.

The SRv6 Standard SID Structure Match TLV allows a PCE to instruct a PCC to match packets against individual or combined fields (Locator, Function, and Argument) of a standard SRv6 SID . The format of the SRv6 Standard SID Structure Match TLV is as follows:

Where: Type (16 bits): TBD1, assigned for SRv6 Standard SID Structure Match TLV. Length (16 bits): Total length of the TLV in octets. LOC-Len (8 bits): Length of the Locator field in bits. FUNCT-Len (8 bits): Length of the Function field in bits. ARG-Len (8 bits): Length of the Argument field in bits. Reserved (8 bits): MUST be set to zero and ignored on receipt. [op, value]+: A sequence of one or more {operator, value} pairs specifying the matching logic applied to the SID sub-fields, following the operator encoding rules in and . Padding (variable): Padding octets (0-3) to align the TLV length to a 4-octet boundary.

The SRv6 CSID Dynamic Structure Match TLV allows matching against dynamic Compressed SID containers (NEXT-CSID and REPLACE-CSID flavors) . The format of the SRv6 CSID Dynamic Structure Match TLV is as follows:

Where: Type (16 bits): TBD2, assigned for SRv6 CSID Dynamic Structure Match TLV. Length (16 bits): Total length of the TLV in octets. LB-Len (8 bits): Locator-Block Length in bits. LN-Len (8 bits): Locator-Node Length in bits. F-Len (8 bits): Function Length in bits. Reserved (8 bits): MUST be set to zero and ignored on receipt. [op, value]+: A sequence of {operator, value} pairs evaluating Locator-Block, Active CSID, and Next CSID fields as defined in . Padding (variable): Padding octets (0-3) to align the TLV length to a 4-octet boundary.

Upon receiving an SRv6 FlowSpec TLV, the PCC MUST validate the structural lengths: For Standard SID Structure (Type TBD1): The sum of LOC-Len, FUNCT-Len, and ARG-Len MUST NOT exceed 128 bits. For CSID Dynamic Structure (Type TBD2): The sum of LB-Len, LN-Len, and F-Len MUST NOT exceed 128 bits. If a structural validation fails, the TLV MUST be considered malformed.

If a PCC receives an SRv6 FlowSpec TLV when the S-bit capability was not negotiated, or if the received TLV is malformed, the PCC MUST send a PCErr message with: Error-Type = 30 (FlowSpec Error) [RFC9168] Error-Value = TBD_EV (Unsupported or Malformed SRv6 FlowSpec Component)

The security considerations outlined in , , and apply to the extensions defined in this document. Appropriate transport security (e.g., TLS or TCP-AO) MUST be employed to prevent unauthorized insertion or modification of SRv6 FlowSpec rules.

IANA is requested to make the following allocations in the "PCEP Numbers" registry:

The authors would like to thank Joel Halpern, Jeffrey Haas, Ketan Talaulikar, Aijun Wang, Dhruv Dhody, Ming Shen and Rainsword Wang for their valuable suggestions and comments.