Ciena Corporation

msiva282@gmail.com

Cisco Systems, Inc.

Pegasus Parc De Kleetlaan 6a Brabant 1831 Belgium cfilsfil@cisco.com

Nvidia

jefftant.ietf@gmail.com

Huawei Technologies

stefano@previdi.net

Huawei Technologies

Huawei Campus, No. 156 Beiqing Rd. Beijing 100095 China c.l@huawei.com

rtg pce PCEP BSID Binding Binding Label In order to provide greater scalability, network confidentiality, and service independence, Segment Routing (SR) utilizes a Binding Segment Identifier (BSID), as described in RFC 8402. It is possible to associate a BSID to an RSVP-TE-signaled Traffic Engineering (TE) Label Switched Path (LSP) or an SR TE path. The BSID can be used by an upstream node for steering traffic into the appropriate TE path to enforce SR policies. This document specifies the concept of binding value, which can be either an MPLS label or a Segment Identifier (SID). It further specifies an extension to Path Computation Element Communication Protocol (PCEP) for reporting the binding value by a Path Computation Client (PCC) to the Path Computation Element (PCE) to support PCE-based TE policies.

Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at .

Copyright Notice Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents () in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.

Table of Contents

• .  Introduction
  • .  Motivation and Example
  • .  Summary of the Extension
• .  Requirements Language
• .  Terminology
• .  Path Binding TLV
  • .  SRv6 Endpoint Behavior and SID Structure
• .  Operation
• .  Binding SID in SR-ERO
• .  Binding SID in SRv6-ERO
• .  PCE Allocation of Binding Label/SID
• .  Security Considerations
• . Manageability Considerations
  • .  Control of Function and Policy
  • .  Information and Data Models
  • .  Liveness Detection and Monitoring
  • .  Verify Correct Operations
  • .  Requirements on Other Protocols
  • .  Impact on Network Operations
• . IANA Considerations
  • .  PCEP TLV Type Indicators
    • .  TE-PATH-BINDING TLV
  • .  LSP Object
  • .  PCEP Error Type and Value
• . References
  • .  Normative References
  • .  Informative References
• Acknowledgements
• Contributors
• Authors' Addresses

Introduction A Path Computation Element (PCE) can compute Traffic Engineering (TE) paths through a network where those paths are subject to various constraints. Currently, TE paths are set up using either the RSVP-TE signaling protocol or Segment Routing (SR). We refer to such paths as "RSVP-TE paths" and "SR-TE paths", respectively, in this document. As per , SR allows a head-end node to steer a packet flow along a given path via an SR Policy. As per , an SR Policy is a framework that enables the instantiation of an ordered list of segments on a node for implementing a source routing policy with a specific intent for traffic steering from that node. As described in , a Binding SID (BSID) is bound to an SR Policy, instantiation of which may involve a list of Segment Identifiers (SIDs). Any packets received with an active segment equal to a BSID are steered onto the bound SR Policy. A BSID may be either a local (SR Local Block (SRLB)) or a global (SR Global Block (SRGB)) SID. As per , a BSID can also be associated with any type of interface or tunnel to enable the use of a non-SR interface or tunnel as a segment in a SID list. In this document, the term "binding label/SID" is used to generalize the allocation of a binding value for both SR and non-SR paths. describes the PCEP for communication between a Path Computation Client (PCC) and a PCE or between a pair of PCEs as per . specifies extensions to PCEP that allow a PCC to delegate its Label Switched Paths (LSPs) to a stateful PCE. A stateful PCE can then update the state of LSPs delegated to it. specifies a mechanism allowing a PCE to dynamically instantiate an LSP on a PCC by sending the path and characteristics. This document specifies an extension to PCEP to manage the binding of label/SID that can be applied to SR, RSVP-TE, and other path setup types. provides a mechanism for a PCE (acting as a network controller) to instantiate SR-TE paths (candidate paths) for an SR Policy onto a head-end node (acting as a PCC) using PCEP. For more information on the SR Policy Architecture, see .

Motivation and Example A binding label/SID has local significance to the ingress node of the corresponding TE path. When a stateful PCE is deployed for setting up TE paths, a binding label/SID reported from the PCC to the stateful PCE is useful for enforcing an end-to-end TE/SR policy. A sample Data Center (DC) and IP/MPLS WAN use case is illustrated in with a multi-domain PCE. In the IP/MPLS WAN, an SR-TE LSP is set up using the PCE. The list of SIDs of the SR-TE LSP is {A, B, C, D}. The gateway Node-1 (which is the PCC) allocates a binding SID X and reports it to the PCE. In the MPLS DC network, an end-to-end SR-TE LSP is established. In order for the access node to steer the traffic towards Node-1 and over the SR-TE path in WAN, the PCE passes the SID stack {Y, X} where Y is the node SID of the gateway Node-1 to the access node and X is the BSID. In the absence of the BSID X, the PCE would need to pass the SID stack {Y, A, B, C, D} to the access node. This example also illustrates the additional benefit of using the binding label/SID to reduce the number of SIDs imposed by the access nodes with a limited forwarding capacity.

A Sample Use Case of Binding SID SID stack {Y, X} +--------------+ | Multi-domain | _ _ _ _ _ _ _ _ _ _ _ _ _ _| PCE | | +--------------+ | ^ | | Binding | .-----. | SID (X) .-----. | ( ) | ( ) V .--( )--. | .--( )--. +------+ ( ) +-------+ ( ) +-------+ |Access|_( MPLS DC Network )_|Gateway|_( IP/MPLS WAN )_|Gateway| | Node | ( ==============> ) |Node-1 | ( ================> ) |Node-2 | +------+ ( SR-TE path ) +-------+ ( SR-TE path ) +-------+ '--( )--' Node '--( )--' ( ) SID of ( ) '-----' Node-1 '-----' is Y SIDs for SR-TE LSP: {A, B, C, D}

Using the extension defined in this document, a PCC could report to the stateful PCE the binding label/SID it allocated via a Path Computation LSP State Report (PCRpt) message. It is also possible for a stateful PCE to request a PCC to allocate a specific binding label/SID by sending a Path Computation LSP Update Request (PCUpd) message. If the PCC can successfully allocate the specified binding value, it reports the binding value to the PCE. Otherwise, the PCC sends an error message to the PCE indicating the cause of the failure. A local policy or configuration at the PCC SHOULD dictate if the binding label/SID needs to be assigned.

Summary of the Extension To implement the needed changes to PCEP, this document introduces a new OPTIONAL TLV that allows a PCC to report the binding label/SID associated with a TE LSP or a PCE to request a PCC to allocate any or a specific binding label/SID value. This TLV is intended for TE LSPs established using RSVP-TE, SR-TE, or any other future method. In the case of SR-TE LSPs, the TLV can carry a binding label (for SR-TE paths with the MPLS data plane) or a binding IPv6 SID (e.g., IPv6 address for SR-TE paths with the IPv6 data plane). Throughout this document, the term "binding value" means either an MPLS label or a SID. As another way to use the extension specified in this document, to support the PCE-based central controller operation where the PCE would take responsibility for managing some part of the MPLS label space for each of the routers that it controls, the PCE could directly make the binding label/SID allocation and inform the PCC. See for details. In addition to specifying a new TLV, this document specifies how and when a PCC and PCE can use this TLV, how they can allocate a binding label/SID, and the associated error handling.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Terminology The following terminologies are used in this document:

BSID:

Binding SID

binding label/SID:

a generic term used for the binding segment for both SR and non-SR paths

binding value:

a generic term used for the binding segment as it can be encoded in various formats (as per the Binding Type (BT))

LSP:

Label Switched Path

PCC:

Path Computation Client

PCEP:

Path Computation Element Communication Protocol

RSVP-TE:

Resource Reservation Protocol - Traffic Engineering

SID:

Segment Identifier

SR:

Segment Routing

Path Binding TLV The new optional TLV called "TE-PATH-BINDING TLV" (the format is shown in ) is defined to carry the binding label/SID for a TE path. This TLV is associated with the LSP object specified in . This TLV can also be carried in the PCEP-ERROR object in case of error. Multiple instances of TE-PATH-BINDING TLVs MAY be present in the LSP and PCEP-ERROR object. The type of this TLV is 55. The length is variable.

TE-PATH-BINDING TLV 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type = 55 | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | BT | Flags | Reserved | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ Binding Value (variable length) ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The TE-PATH-BINDING TLV is a generic TLV such that it is able to carry binding label/SID (i.e., MPLS label or SRv6 SID). It is formatted according to the rules specified in . The value portion of the TLV comprises:

• Binding Type (BT): A one-octet field that identifies the type of binding included in the TLV. This document specifies the following BT values:
  • BT = 0: The binding value is a 20-bit MPLS label value. The TLV is padded to 4-bytes alignment. The Length MUST be set to 7 (the padding is not included in the length, as per ), and the first 20 bits are used to encode the MPLS label value.
  • BT = 1: The binding value is a 32-bit MPLS Label Stack Entry as per with Label, Traffic Class (TC) , S, and TTL values encoded. Note that the receiver MAY choose to override TC, S, and TTL values according to its local policy. The Length MUST be set to 8.
  • BT = 2: The binding value is an SRv6 SID with the format of a 16-octet IPv6 address, representing the binding SID for SRv6. The Length MUST be set to 20.
  • BT = 3: The binding value is a 24-octet field, defined in , that contains the SRv6 SID as well as its Behavior and Structure. The Length MUST be set to 28.
  defines the IANA registry used to maintain these binding types as well as any future ones. Note that multiple TE-PATH-BINDING TLVs with the same or different binding types MAY be present for the same LSP. A PCEP speaker could allocate multiple TE-PATH-BINDING TLVs (of the same BT) and use different binding values in different domains or use cases based on a local policy.
• Flags: 1 octet of flags. The following flag is defined in the new "TE-PATH-BINDING TLV Flag field" registry as described in :

  Flags 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ |R| | +-+-+-+-+-+-+-+-+

  Where:
  • R (Removal - 1 bit): When set, the requesting PCEP peer requires the removal of the binding value for the LSP. When unset, the PCEP peer indicates that the binding value is added or retained for the LSP. This flag is used in the PCRpt and PCUpd messages. It is ignored in other PCEP messages.
  • The unassigned flags MUST be set to 0 while sending and ignored on receipt.
• Reserved: MUST be set to 0 while sending and ignored on receipt.
• Binding Value: A variable-length field, padded with trailing zeros to a 4-octet boundary. When the BT is 0, the 20 bits represent the MPLS label. When the BT is 1, the 32 bits represent the MPLS label stack entry as per . When the BT is 2, the 128 bits represent the SRv6 SID. When the BT is 3, the binding value also contains the SRv6 Endpoint Behavior and SID Structure, defined in . In this document, the TE-PATH-BINDING TLV is considered to be empty if no binding value is present. Note that the length of the TLV would be 4 in such a case.

SRv6 Endpoint Behavior and SID Structure This section specifies the format of the binding value in the TE-PATH-BINDING TLV when the BT is set to 3 for the SRv6 Binding SIDs . The format is shown in .

SRv6 Endpoint Behavior and SID Structure 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | | SRv6 Binding SID (16 octets) | | | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Reserved | Endpoint Behavior | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | LB Length | LN Length | Fun. Length | Arg. Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The Binding Value consists of:

• SRv6 Binding SID: 16 octets. The 128-bit IPv6 address, representing the binding SID for SRv6.
• Reserved: 2 octets. It MUST be set to 0 on transmit and ignored on receipt.
• Endpoint Behavior: 2 octets. The Endpoint Behavior code point for this SRv6 SID as defined by the "SRv6 Endpoint Behaviors" registry . When the field is set with the value 0, the Endpoint Behavior is considered unknown.
• defines an SRv6 SID as consisting of LOC:FUNCT:ARG, where a locator (LOC) is encoded in the L most significant bits of the SID, followed by F bits of function (FUNCT) and A bits of arguments (ARG). A locator may be represented as B:N, where B is the SRv6 SID locator block (IPv6 prefix allocated for SRv6 SIDs by the operator) and N is the identifier of the parent node instantiating the SID, called "locator node". The following fields are used to advertise the length of each individual part of the SRv6 SID:
  • LB Length: 1 octet. SRv6 SID Locator Block length in bits.
  • LN Length: 1 octet. SRv6 SID Locator Node length in bits.
  • Function Length: 1 octet. SRv6 SID Function length in bits.
  • Arguments Length: 1 octet. SRv6 SID Arguments length in bits.

The total of the locator block, locator node, function, and arguments lengths MUST be less than or equal to 128 bits. If this condition is not met, the corresponding TE-PATH-BINDING TLV is considered invalid. Also, if the Endpoint Behavior is found to be unknown or inconsistent, it is considered invalid. A PCErr message with Error-Type = 10 ("Reception of an invalid object") and Error-value = 37 ("Invalid SRv6 SID Structure") MUST be sent in such cases. The SRv6 SID Structure could be used by the PCE for ease of operations and monitoring. For example, this information could be used for validation of SRv6 SIDs being instantiated in the network and checked for conformance to the SRv6 SID allocation scheme chosen by the operator as described in . In the future, PCE could also be used for verification and for automatically securing the SRv6 domain by provisioning filtering rules at SR domain boundaries as described in . The details of these potential applications are outside the scope of this document.

Operation The binding value is usually allocated by the PCC and reported to a PCE via a PCRpt message (see where PCE performs the allocation). If a PCE does not recognize the TE-PATH-BINDING TLV, it would ignore the TLV in accordance with . If a PCE recognizes the TLV but does not support the TLV, it MUST send a PCErr with Error-Type = 2 ("Capability not supported"). Multiple TE-PATH-BINDING TLVs are allowed to be present in the same LSP object. This signifies the presence of multiple binding SIDs for the given LSP. In the case of multiple TE-PATH-BINDING TLVs, the existing instances of TE-PATH-BINDING TLVs MAY be included in the LSP object. In case of an error condition, the whole message is rejected, and the resulting PCErr message MAY include the offending TE-PATH-BINDING TLV in the PCEP-ERROR object. If a PCE recognizes an invalid binding value (e.g., label value from the reserved MPLS label space), it MUST send a PCErr message with Error-Type = 10 ("Reception of an invalid object") and Error-value = 2 ("Bad label value") as specified in . For SRv6 BSIDs, it is RECOMMENDED to always explicitly specify the SRv6 Endpoint Behavior and SID Structure in the TE-PATH-BINDING TLV by setting BT to 3. This can enable the sender to have control of the SRv6 Endpoint Behavior and SID Structure. A sender MAY choose to set the BT to 2, in which case the receiving implementation chooses how to interpret the SRv6 Endpoint Behavior and SID Structure according to local policy. If a PCC wishes to withdraw a previously reported binding value, it MUST send a PCRpt message with the specific TE-PATH-BINDING TLV with R flag set to 1. If a PCC wishes to modify a previously reported binding, it MUST withdraw the former binding value (with R flag set in the former TE-PATH-BINDING TLV) and include a new TE-PATH-BINDING TLV containing the new binding value. Note that other instances of TE-PATH-BINDING TLVs that are unchanged MAY also be included. If the unchanged instances are not included, they will remain associated with the LSP. If a PCE requires a PCC to allocate one (or several) specific binding value(s), it may do so by sending a PCUpd or PCInitiate message containing one or more TE-PATH-BINDING TLVs. If the values can be successfully allocated, the PCC reports the binding values to the PCE. If the PCC considers the binding value specified by the PCE invalid, it MUST send a PCErr message with Error-Type = 32 ("Binding label/SID failure") and Error-value = 1 ("Invalid SID"). If the binding value is valid but the PCC is unable to allocate the binding value, it MUST send a PCErr message with Error-Type = 32 ("Binding label/SID failure") and Error-value = 2 ("Unable to allocate the specified binding value"). Note that, in case of an error, the PCC rejects the PCUpd or PCInitiate message in its entirety and can include the offending TE-PATH-BINDING TLV in the PCEP-ERROR object. If a PCE wishes to request the withdrawal of a previously reported binding value, it MUST send a PCUpd message with the specific TE-PATH-BINDING TLV with R flag set to 1. If a PCE wishes to modify a previously requested binding value, it MUST request the withdrawal of the former binding value (with R flag set in the former TE-PATH-BINDING TLV) and include a new TE-PATH-BINDING TLV containing the new binding value. If a PCC receives a PCUpd message with TE-PATH-BINDING TLV where the R flag is set to 1, but either the binding value is missing (empty TE-PATH-BINDING TLV) or the binding value is incorrect, it MUST send a PCErr message with Error-Type = 32 ("Binding label/SID failure") and Error-value = 4 ("Unable to remove the binding value"). In some cases, a stateful PCE may want to request that the PCC allocate a binding value of the PCC's own choosing. It instructs the PCC by sending a PCUpd message containing an empty TE-PATH-BINDING TLV, i.e., no binding value is specified (bringing the Length field of the TLV to 4). A PCE can also request that a PCC allocate a binding value at the time of initiation by sending a PCInitiate message with an empty TE-PATH-BINDING TLV. Only one such instance of empty TE-PATH-BINDING TLV, per BT, SHOULD be included in the LSP object; others should be ignored on receipt. If the PCC is unable to allocate a new binding value as per the specified BT, it MUST send a PCErr message with Error-Type = 32 ("Binding label/SID failure") and Error-value = 3 ("Unable to allocate a new binding label/SID"). As previously noted, if a message contains an invalid TE-PATH-BINDING TLV that leads to an error condition, the whole message is rejected including any other valid instances of TE-PATH-BINDING TLVs, if any. The resulting error message MAY include the offending TE-PATH-BINDING TLV in the PCEP-ERROR object. If a PCC receives a TE-PATH-BINDING TLV in any message other than PCUpd or PCInitiate, it MUST close the corresponding PCEP session with the reason "Reception of a malformed PCEP message" (according to ). Similarly, if a PCE receives a TE-PATH-BINDING TLV in any message other than a PCRpt or if the TE-PATH-BINDING TLV is associated with any object other than an LSP or PCEP-ERROR object, the PCE MUST close the corresponding PCEP session with the reason "Reception of a malformed PCEP message" (according to ). If a TE-PATH-BINDING TLV is absent in the PCRpt message and no binding values were previously reported, the PCE MUST assume that the corresponding LSP does not have any binding. Similarly, if TE-PATH-BINDING TLV is absent in the PCUpd message and no binding values were previously reported, the PCC's local policy dictates how the binding allocations are made for a given LSP. Note that some binding types have similar information but different binding value formats. For example, BT=(2 or 3) is used for the SRv6 SID, and BT=(0 or 1) is used for the MPLS Label. In case a PCEP speaker receives multiple TE-PATH-BINDING TLVs with the same SRv6 SID or MPLS Label but different BT values, it MUST send a PCErr message with Error-Type = 32 ("Binding label/SID failure") and Error-value = 5 ("Inconsistent binding types").

Binding SID in SR-ERO In PCEP messages, LSP route information is carried in the Explicit Route Object (ERO), which consists of a sequence of subobjects. defines the "SR-ERO subobject" capable of carrying a SID as well as the identity of the Node or Adjacency Identifier (NAI) represented by the SID. The NAI Type (NT) field indicates the type and format of the NAI contained in the SR-ERO. In case of binding SID, the NAI MUST NOT be included and NT MUST be set to zero. specifies bit settings and error handling in the case when NT=0.

Binding SID in SRv6-ERO defines the "SRv6-ERO subobject" for an SRv6 SID. Similarly to SR-ERO (), the NAI MUST NOT be included and the NT MUST be set to zero. specifies bit settings and error handling in the case when NT=0.

PCE Allocation of Binding Label/SID already includes the scenario where a PCE requires a PCC to allocate a specified binding value by sending a PCUpd or PCInitiate message containing a TE-PATH-BINDING TLV. This section specifies an OPTIONAL feature for the PCE to allocate the binding label/SID of its own accord in the case where the PCE also controls the label space of the PCC and can make the label allocation on its own as described in . Note that the act of requesting a specific binding value () is different from the act of allocating a binding label/SID as described in this section. introduces the architecture for PCE as a central controller as an extension of the architecture described in and assumes the continued use of PCEP as the protocol used between PCE and PCC. specifies the procedures and PCEP extensions for using the PCE as the central controller. It assumes that the exclusive label range to be used by a PCE is known and set on both PCEP peers. A future extension could add the capability to advertise this range via a possible PCEP extension as well (see ). When PCE as a Central Controller (PCECC) operations are supported as per , the binding label/SID MAY also be allocated by the PCE itself. Both peers need to exchange the PCECC capability as described in before the PCE can allocate the binding label/SID on its own. A new P flag in the LSP object is introduced to indicate that the allocation needs to be made by the PCE. Note that the P flag could be used for other types of allocations (such as path segments ) in the future. P (PCE-allocation): If the bit is set to 1, it indicates that the PCC requests that the PCE make allocations for this LSP. The TE-PATH-BINDING TLV in the LSP object identifies that the allocation is for a binding label/SID. A PCC MUST set this bit to 1 and include a TE-PATH-BINDING TLV in the LSP object if it wishes to request an allocation for a binding label/SID by the PCE in the PCEP message. A PCE MUST also set this bit to 1 and include a TE-PATH-BINDING TLV to indicate that the binding label/SID is allocated by PCE and encoded in the PCEP message towards the PCC. Further, if the binding label/SID is allocated by the PCC, the PCE MUST set this bit to 0 and follow the procedure described in . Note that:

• A PCE could allocate the binding label/SID of its own accord for a PCE-initiated or PCE-delegated LSP and inform the PCC in the PCInitiate message or PCUpd message by setting P=1 and including TE-PATH-BINDING TLV in the LSP object.
• To let the PCC allocate the binding label/SID, a PCE MUST set P=0 and include an empty TE-PATH-BINDING TLV (i.e., no binding value is specified) in the LSP object in the PCInitiate/PCUpd message.
• To request that the PCE allocate the binding label/SID, a PCC MUST set P=1, D=1, and include an empty TE-PATH-BINDING TLV in the PCRpt message. The PCE will attempt to allocate it and respond to the PCC with a PCUpd message that includes the allocated binding label/SID in the TE-PATH-BINDING TLV and P=1 and D=1 in the LSP object. If the PCE is unable to allocate the binding label/SID, it MUST send a PCErr message with Error-Type = 32 ("Binding label/SID failure") and Error-value = 3 ("Unable to allocate a new binding label/SID").
• If one or both speakers (PCE and PCC) have not indicated support and willingness to use the PCEP extensions for the PCECC as per and a PCEP peer receives P=1 in the LSP object, they MUST:
  • send a PCErr message with Error-Type = 19 ("Invalid Operation") and Error-value = 16 ("Attempted PCECC operations when PCECC capability was not advertised") and
  • terminate the PCEP session.
• A legacy PCEP speaker that does not recognize the P flag in the LSP object would ignore it in accordance with .

It is assumed that the label range to be used by a PCE is known and set on both PCEP peers. The exact mechanism is out of the scope of and this document. Note that the specific BSID could be from the PCE-controlled or the PCC-controlled label space. The PCE can directly allocate the label from the PCE-controlled label space using P=1 as described above, whereas the PCE can request the allocation of a specific BSID from the PCC-controlled label space with P=0 as described in . Note that the P flag in the LSP object SHOULD NOT be set to 1 without the presence of TE-PATH-BINDING TLV or any other future TLV defined for PCE allocation. On receipt of such an LSP object, the P flag is ignored. The presence of TE-PATH-BINDING TLV with P=1 indicates the allocation is for the binding label/SID. In the future, some other TLV (such as one defined in ) could also be used alongside P=1 to indicate allocation of a different attribute. A future document should not attempt to assign semantics to P=1 without limiting the scope to one that both PCEP peers can agree on.

Security Considerations The security considerations described in , , , , and are applicable to this specification. No additional security measure is required. As described in and , SR intrinsically involves an entity (whether head-end or a central network controller) controlling and instantiating paths in the network without the involvement of (other) nodes along those paths. Binding SIDs are in effect shorthand aliases for longer path representations, and the alias expansion is in principle known only by the node that acts on it. In this document, the expansion of the alias is shared between PCC and PCE, and rogue actions by either PCC or PCE could result in shifting or misdirecting traffic in ways that are hard for other nodes to detect. In particular, when a PCE propagates paths of the form {A, B, BSID} to other entities, the BSID values are opaque, and a rogue PCE can substitute a BSID from a different LSP in such paths to move traffic without the recipient of the path knowing the ultimate destination. The case of BT=3 provides additional opportunities for malfeasance, as it purports to convey information about internal SRv6 SID Structure. There is no mechanism defined to validate this internal structure information, and mischaracterizing the division of bits into locator block, locator node, function, and argument can result in different interpretation of the bits by PCC and PCE. Most notably, shifting bits into or out of the "argument" is a direct vector for affecting processing, but other attacks are also possible. Thus, as per , it is RECOMMENDED that these PCEP extensions only be activated on authenticated and encrypted sessions across PCEs and PCCs belonging to the same administrative authority, using Transport Layer Security (TLS) , as per the recommendations and best current practices in RFC 9325 (unless explicitly set aside in ).

Manageability Considerations All manageability requirements and considerations listed in , , and apply to PCEP protocol extensions defined in this document. In addition, requirements and considerations listed in this section apply.

Control of Function and Policy A PCC implementation SHOULD allow the operator to configure the policy the PCC needs to apply when allocating the binding label/SID. If BT is set to 2, the operator needs to have local policy set to decide the SID structure and the SRv6 Endpoint Behavior of the BSID.

Information and Data Models The PCEP YANG module will be extended to include policy configuration for binding label/SID allocation.

Liveness Detection and Monitoring The mechanisms defined in this document do not imply any new liveness detection and monitoring requirements in addition to those already listed in .

Verify Correct Operations The mechanisms defined in this document do not imply any new operation verification requirements in addition to those already listed in , , and .

Requirements on Other Protocols The mechanisms defined in this document do not imply any new requirements on other protocols.

Impact on Network Operations The mechanisms defined in , , and also apply to the PCEP extensions defined in this document.

IANA Considerations IANA has allocated code points for the protocol elements described in this document in the "Path Computation Element Protocol (PCEP) Numbers" registry group.

PCEP TLV Type Indicators This document defines a new PCEP TLV. IANA has allocated the following in the "PCEP TLV Type Indicators" registry within the PCEP Numbers registry group:

Value	Description	Reference
55	TE-PATH-BINDING	RFC 9604

TE-PATH-BINDING TLV IANA has created the "TE-PATH-BINDING TLV BT Field" registry to manage the values of the binding type field in the TE-PATH-BINDING TLV. Initial values are shown below. New values are assigned by Standards Action .

Value	Description	Reference
0	MPLS Label	RFC 9604
1	MPLS Label Stack Entry	RFC 9604
2	SRv6 SID	RFC 9604
3	SRv6 SID with Behavior and Structure	RFC 9604
4-255	Unassigned

IANA has created a new "TE-PATH-BINDING TLV Flag Field" registry to manage the Flag field in the TE-PATH-BINDING TLV. New values are to be assigned by Standards Action . Each bit should be tracked with the following qualities:

• Bit number (count from 0 as the most significant bit)
• Description
• Reference

Bit	Description	Reference
0	R (Removal)	RFC 9604
1-7	Unassigned

LSP Object IANA has allocated a code point in the "LSP Object Flag Field" registry for the new P flag as follows:

Bit	Description	Reference
0	PCE-allocation	RFC 9604

PCEP Error Type and Value This document defines a new Error-Type and associated Error-values for the PCErr message. IANA has allocated a new Error-Type and Error-values within the "PCEP-ERROR Object Error Types and Values" registry of the PCEP Numbers registry group, as follows:

Error-Type	Meaning	Error-value
32	Binding label/SID failure	0: Unassigned
		1: Invalid SID
		2: Unable to allocate the specified binding value
		3: Unable to allocate a new binding label/SID
		4: Unable to remove the binding value
		5: Inconsistent binding types

References Normative References This document formally deprecates Transport Layer Security (TLS) versions 1.0 (RFC 2246) and 1.1 (RFC 4346). Accordingly, those documents have been moved to Historic status. These versions lack support for current and recommended cryptographic algorithms and mechanisms, and various government and industry profiles of applications using TLS now mandate avoiding these old TLS versions. TLS version 1.2 became the recommended version for IETF protocols in 2008 (subsequently being obsoleted by TLS version 1.3 in 2018), providing sufficient time to transition away from older versions. Removing support for older versions from implementations reduces the attack surface, reduces opportunity for misconfiguration, and streamlines library and product maintenance. This document also deprecates Datagram TLS (DTLS) version 1.0 (RFC 4347) but not DTLS version 1.2, and there is no DTLS version 1.1. This document updates many RFCs that normatively refer to TLS version 1.0 or TLS version 1.1, as described herein. This document also updates the best practices for TLS usage in RFC 7525; hence, it is part of BCP 195. Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) are used to protect data exchanged over a wide range of application protocols and can also form the basis for secure transport protocols. Over the years, the industry has witnessed several serious attacks on TLS and DTLS, including attacks on the most commonly used cipher suites and their modes of operation. This document provides the latest recommendations for ensuring the security of deployed services that use TLS and DTLS. These recommendations are applicable to the majority of use cases. RFC 7525, an earlier version of the TLS recommendations, was published when the industry was transitioning to TLS 1.2. Years later, this transition is largely complete, and TLS 1.3 is widely available. This document updates the guidance given the new environment and obsoletes RFC 7525. In addition, this document updates RFCs 5288 and 6066 in view of recent attacks. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This document specifies the encoding to be used by an LSR in order to transmit labeled packets on Point-to-Point Protocol (PPP) data links, on LAN data links, and possibly on other data links as well. This document also specifies rules and procedures for processing the various fields of the label stack encoding. [STANDARDS-TRACK] This document specifies the Path Computation Element (PCE) Communication Protocol (PCEP) for communications between a Path Computation Client (PCC) and a PCE, or between two PCEs. Such interactions include path computation requests and path computation replies as well as notifications of specific states related to the use of a PCE in the context of Multiprotocol Label Switching (MPLS) and Generalized MPLS (GMPLS) Traffic Engineering. PCEP is designed to be flexible and extensible so as to easily allow for the addition of further messages and objects, should further requirements be expressed in the future. [STANDARDS-TRACK] The early Multiprotocol Label Switching (MPLS) documents defined the form of the MPLS label stack entry. This includes a three-bit field called the "EXP field". The exact use of this field was not defined by these documents, except to state that it was to be "reserved for experimental use". Although the intended use of the EXP field was as a "Class of Service" (CoS) field, it was not named a CoS field by these early documents because the use of such a CoS field was not considered to be sufficiently defined. Today a number of standards documents define its usage as a CoS field. To avoid misunderstanding about how this field may be used, it has become increasingly necessary to rename this field. This document changes the name of the field to the "Traffic Class field" ("TC field"). In doing so, it also updates documents that define the current use of the EXP field. [STANDARDS-TRACK] Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA). To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry. This is the third edition of this document; it obsoletes RFC 5226. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. The Path Computation Element Communication Protocol (PCEP) provides mechanisms for Path Computation Elements (PCEs) to perform path computations in response to Path Computation Client (PCC) requests. Although PCEP explicitly makes no assumptions regarding the information available to the PCE, it also makes no provisions for PCE control of timing and sequence of path computations within and across PCEP sessions. This document describes a set of extensions to PCEP to enable stateful control of MPLS-TE and GMPLS Label Switched Paths (LSPs) via PCEP. The Path Computation Element Communication Protocol (PCEP) defines the mechanisms for the communication between a Path Computation Client (PCC) and a Path Computation Element (PCE), or among PCEs. This document describes PCEPS -- the usage of Transport Layer Security (TLS) to provide a secure transport for PCEP. The additional security mechanisms are provided by the transport protocol supporting PCEP; therefore, they do not affect the flexibility and extensibility of PCEP. This document updates RFC 5440 in regards to the PCEP initialization phase procedures. The Path Computation Element Communication Protocol (PCEP) provides mechanisms for Path Computation Elements (PCEs) to perform path computations in response to Path Computation Client (PCC) requests. The extensions for stateful PCE provide active control of Multiprotocol Label Switching (MPLS) Traffic Engineering Label Switched Paths (TE LSPs) via PCEP, for a model where the PCC delegates control over one or more locally configured LSPs to the PCE. This document describes the creation and deletion of PCE-initiated LSPs under the stateful PCE model. Segment Routing (SR) leverages the source routing paradigm. A node steers a packet through an ordered list of instructions, called "segments". A segment can represent any instruction, topological or service based. A segment can have a semantic local to an SR node or global within an SR domain. SR provides a mechanism that allows a flow to be restricted to a specific topological path, while maintaining per-flow state only at the ingress node(s) to the SR domain. SR can be directly applied to the MPLS architecture with no change to the forwarding plane. A segment is encoded as an MPLS label. An ordered list of segments is encoded as a stack of labels. The segment to process is on the top of the stack. Upon completion of a segment, the related label is popped from the stack. SR can be applied to the IPv6 architecture, with a new type of routing header. A segment is encoded as an IPv6 address. An ordered list of segments is encoded as an ordered list of IPv6 addresses in the routing header. The active segment is indicated by the Destination Address (DA) of the packet. The next active segment is indicated by a pointer in the new routing header. Segment Routing (SR) enables any head-end node to select any path without relying on a hop-by-hop signaling technique (e.g., LDP or RSVP-TE). It depends only on "segments" that are advertised by link-state Interior Gateway Protocols (IGPs). An SR path can be derived from a variety of mechanisms, including an IGP Shortest Path Tree (SPT), an explicit configuration, or a Path Computation Element (PCE). This document specifies extensions to the Path Computation Element Communication Protocol (PCEP) that allow a stateful PCE to compute and initiate Traffic-Engineering (TE) paths, as well as a Path Computation Client (PCC) to request a path subject to certain constraints and optimization criteria in SR networks. This document updates RFC 8408. The Segment Routing over IPv6 (SRv6) Network Programming framework enables a network operator or an application to specify a packet processing program by encoding a sequence of instructions in the IPv6 packet header. Each instruction is implemented on one or several nodes in the network and identified by an SRv6 Segment Identifier in the packet. This document defines the SRv6 Network Programming concept and specifies the base set of SRv6 behaviors that enables the creation of interoperable overlays with underlay optimization. The Path Computation Element (PCE) is a core component of Software-Defined Networking (SDN) systems. A PCE as a Central Controller (PCECC) can simplify the processing of a distributed control plane by blending it with elements of SDN and without necessarily completely replacing it. Thus, the Label Switched Path (LSP) can be calculated/set up/initiated and the label-forwarding entries can also be downloaded through a centralized PCE server to each network device along the path while leveraging the existing PCE technologies as much as possible. This document specifies the procedures and Path Computation Element Communication Protocol (PCEP) extensions for using the PCE as the central controller for provisioning labels along the path of the static LSP. Segment Routing (SR) can be used to steer packets through a network using the IPv6 or MPLS data plane, employing the source routing paradigm. An SR Path can be derived from a variety of mechanisms, including an IGP Shortest Path Tree (SPT), explicit configuration, or a Path Computation Element (PCE). Since SR can be applied to both MPLS and IPv6 data planes, a PCE should be able to compute an SR Path for both MPLS and IPv6 data planes. The Path Computation Element Communication Protocol (PCEP) extension and mechanisms to support SR-MPLS have been defined. This document outlines the necessary extensions to support SR for the IPv6 data plane within PCEP. Informative References Huawei Technologies Huawei Technologies China Telecom China Mobile HPE Work in Progress Huawei Technologies Huawei Technologies China Mobile Cisco Systems, Inc. ZTE Corporation The Path Computation Element (PCE) provides path computation functions in support of traffic engineering in Multiprotocol Label Switching (MPLS) and Generalized MPLS (GMPLS) networks. The Source Packet Routing in Networking (SPRING) architecture describes how Segment Routing (SR) can be used to steer packets through an IPv6 or MPLS network using the source routing paradigm. A Segment Routed Path can be derived from a variety of mechanisms, including an IGP Shortest Path Tree (SPT), explicit configuration, or a Path Computation Element (PCE). Path identification is needed for several use cases such as performance measurement in Segment Routing (SR) network. This document specifies extensions to the Path Computation Element Communication Protocol (PCEP) to support requesting, replying, reporting and updating the Path Segment ID (Path SID) between PCEP speakers. Work in Progress Huawei Juniper Networks Microsoft Nvidia Work in Progress Constraint-based path computation is a fundamental building block for traffic engineering systems such as Multiprotocol Label Switching (MPLS) and Generalized Multiprotocol Label Switching (GMPLS) networks. Path computation in large, multi-domain, multi-region, or multi-layer networks is complex and may require special computational components and cooperation between the different network domains. This document specifies the architecture for a Path Computation Element (PCE)-based model to address this problem space. This document does not attempt to provide a detailed description of all the architectural components, but rather it describes a set of building blocks for the PCE architecture from which solutions may be constructed. This memo provides information for the Internet community. The Path Computation Element (PCE) is a core component of Software- Defined Networking (SDN) systems. It can compute optimal paths for traffic across a network and can also update the paths to reflect changes in the network or traffic demands. PCE was developed to derive paths for MPLS Label Switched Paths (LSPs), which are supplied to the head end of the LSP using the Path Computation Element Communication Protocol (PCEP). SDN has a broader applicability than signaled MPLS traffic-engineered (TE) networks, and the PCE may be used to determine paths in a range of use cases including static LSPs, segment routing, Service Function Chaining (SFC), and most forms of a routed or switched network. It is, therefore, reasonable to consider PCEP as a control protocol for use in these environments to allow the PCE to be fully enabled as a central controller. This document briefly introduces the architecture for PCE as a central controller, examines the motivations and applicability for PCEP as a control protocol in this environment, and introduces the implications for the protocol. A PCE-based central controller can simplify the processing of a distributed control plane by blending it with elements of SDN and without necessarily completely replacing it. This document does not describe use cases in detail and does not define protocol extensions: that work is left for other documents. Segment Routing can be applied to the IPv6 data plane using a new type of Routing Extension Header called the Segment Routing Header (SRH). This document describes the SRH and how it is used by nodes that are Segment Routing (SR) capable. Segment Routing (SR) allows a node to steer a packet flow along any path. Intermediate per-path states are eliminated thanks to source routing. SR Policy is an ordered list of segments (i.e., instructions) that represent a source-routed policy. Packet flows are steered into an SR Policy on a node where it is instantiated called a headend node. The packets steered into an SR Policy carry an ordered list of segments associated with that SR Policy. This document updates RFC 8402 as it details the concepts of SR Policy and steering into an SR Policy.

Acknowledgements We would like to thank , , , , , , and for their valuable comments. Thanks to for shepherding. Thanks to for the AD review. Thanks to for the GENART review. Thanks to , , , , , and for the IESG reviews.

Contributors Microsoft

United Kingdom jonhardwick@microsoft.com

Huawei Technologies

Divyashree Techno Park, Whitefield Bangalore Karnataka India 560066 dhruv.ietf@gmail.com

RtBrick India

N-17L, Floor-1, 18th Cross Rd, HSR Layout Sector-3 Bangalore Karnataka India 560102 mahend.ietf@gmail.com

Cisco Systems, Inc.

2000 Innovation Drive Kanata Ontario K2K 3E8 Canada mkoldych@cisco.com

Cisco Systems, Inc.

zali@cisco.com

Authors' Addresses Ciena Corporation

msiva282@gmail.com

Cisco Systems, Inc.

Pegasus Parc De Kleetlaan 6a Brabant 1831 Belgium cfilsfil@cisco.com

Nvidia

jefftant.ietf@gmail.com

Huawei Technologies

stefano@previdi.net

Huawei Technologies

Huawei Campus, No. 156 Beiqing Rd. Beijing 100095 China c.l@huawei.com