FD.io VPP
v21.01
Vector Packet Processing
|
In-band OAM (iOAM) is an implementation study to record operational information in the packet while the packet traverses a path between two points in the network.
Overview of iOAM can be found in iOAM-Devnet page. The following IETF drafts detail the motivation and mechanism for recording operational information:
In-band OAM is expected to be deployed in a specific domain rather than on the overall Internet. The part of the network which employs in-band OAM is referred to as **"in-band OAM-domain"**.
In-band OAM data is added to a packet on entering the in-band OAM-domain and is removed from the packet when exiting the domain. Within the in-band OAM-domain, network nodes that the packet traverses may update the in-band OAM data records.
VPP can function as in-band OAM encapsulating, transit and decapsulating node. In this version of VPP in-band OAM data is transported as options in an IPv6 hop-by-hop extension header. Hence in-band OAM can be enabled for IPv6 traffic.
The following iOAM features are supported:
Configuring iOAM involves:
The CLI for configuring iOAM is explained here followed by detailed steps and examples to deploy iOAM on VPP as an encapsulating, transit or decapsulating iOAM node in the subsequent sub-sections.
VPP iOAM configuration for enabling trace and POT is as follows:
set ioam rewrite trace-type <0x1f|0x7|0x9|0x11|0x19> trace-elts <number of trace elements> trace-tsp <0|1|2|3> node-id <node ID in hex> app-data <application data in hex> [pot]
A description of each of the options of the CLI follows:
Configure classifier and apply ACL to select packets for iOAM data insertion
vpp# classify table miss-next node ip6-lookup mask l3 ip6 dst
vpp# classify session acl-hit-next node ip6-add-hop-by-hop table-index 0 match l3 ip6 dst db06::06
vpp# set int input acl intfc GigabitEthernet0/0/0 ip6-table 0
vpp# set ioam rewrite trace-type 0x1f trace-elts 4 trace-tsp 1 node-id 0x1 app-data 0x1234
Example:
vpp# set ioam rewrite trace-type 0x1f trace-elts 4 trace-tsp 1 node-id 0x2 app-data 0x1234
vpp# classify table miss-next node ip6-lookup mask l3 ip6 dst vpp# classify session acl-hit-next node ip6-lookup table-index 0 match l3 ip6 dst db06::06 opaque-index 100 vpp# set int input acl intfc GigabitEthernet0/0/0 ip6-table 0
Example:
vpp# set ioam rewrite trace-type 0x1f trace-elts 4 trace-tsp 1 node-id 0x3 app-data 0x1234
For details on proof-of-transit, see the IETF draft iOAM-ietf-proof-of-transit. To enable Proof of Transit all the nodes that participate and hence are verified for transit need a proof of transit profile. A script to generate a proof of transit profile as per the mechanism described in iOAM-ietf-proof-of-transit will be available at iOAM-Devnet.
The Proof of transit mechanism implemented here is based on Shamir's Secret Sharing algorithm. The overall algorithm uses two polynomials POLY-1 and POLY-2. The degree of polynomials depends on number of nodes to be verified for transit. POLY-1 is secret and constant. Each node gets a point on POLY-1 at setup-time and keeps it secret. POLY-2 is public, random and per packet. Each node is assigned a point on POLY-1 and POLY-2 with the same x index. Each node derives its point on POLY-2 each time a packet arrives at it. A node then contributes its points on POLY-1 and POLY-2 to construct POLY-3 (POLY-3 = POLY-1 + POLY-2) using lagrange extrapolation and forwards it towards the verifier by updating POT data in the packet. The verifier constructs POLY-3 from the accumulated value from all the nodes and its own points on POLY-1 and POLY-2 and verifies whether POLY-3 = POLY-1 + POLY-2. Only the verifier knows POLY-1. The solution leverages finite field arithmetic in a field of size "prime number" for reasons explained in description of Shamir's secret sharing algorithm.
Here is an explanation of POT profile list and profile configuration CLI to realize the above mechanism. It is best to use the script provided at iOAM-Devnet to generate this configuration.
vpp# classify table miss-next node ip6-lookup mask l3 ip6 dst vpp# classify session acl-hit-next node ip6-add-hop-by-hop table-index 0 match l3 ip6 dst db06::06 vpp# set int input acl intfc GigabitEthernet0/0/0 ip6-table 0
vpp# set pot profile name example id 0 prime-number 0x7fff0000fa884685 secret_share 0x6c22eff0f45ec56d lpc 0x7fff0000fa884682 polynomial2 0xffb543d4a9c bits-in-random 63
Example enable profile ID 0 from profile list example configured above:
vpp# set pot profile-active name example ID 0
vpp# set ioam rewrite pot
vpp# set pot profile name example id 0 prime-number 0x7fff0000fa884685 secret_share 0x564cdbdec4eb625d lpc 0x1 polynomial2 0x23f3a227186a bits-in-random 63
vpp# classify table miss-next node ip6-lookup mask l3 ip6 dst vpp# classify session acl-hit-next node ip6-lookup table-index 0 match l3 ip6 dst db06::06 opaque-index 100 vpp# set int input acl intfc GigabitEthernet0/0/0 ip6-table 0
To update and verify the proof of transit, POT profile list should be configured.
vpp# set pot profile name example id 0 validate-key 0x7fff0000fa88465d prime-number 0x7fff0000fa884685 secret_share 0x7a08fbfc5b93116d lpc 0x3 polynomial2 0x3ff738597ce bits-in-random 63
Following CLIs are available to check iOAM operation:
Example:
vpp# show ioam summary REWRITE FLOW CONFIGS - Not configured HOP BY HOP OPTIONS - TRACE CONFIG - Trace Type : 0x1f (31) Trace timestamp precision : 1 (Milliseconds) Num of trace nodes : 4 Node-id : 0x2 (2) App Data : 0x1234 (4660) POT OPTION - 1 (Enabled) Try 'show ioam pot and show pot profile' for more information
Example on encapsulating node:
vpp# show error Count Node Reason 1208804706 ip6-inacl input ACL hits 1208804706 ip6-add-hop-by-hop Pkts w/ added ip6 hop-by-hop options
Example on decapsulating node:
vpp# show error Count Node Reason 69508569 ip6-inacl input ACL hits 69508569 ip6-pop-hop-by-hop Pkts w/ removed ip6 hop-by-hop options
Example:
vpp# show pot profile Profile list in use : example POT Profile at index: 0 ID : 0 Validator : False (0) Secret share : 0x564cdbdec4eb625d (6218586935324795485) Prime number : 0x7fff0000fa884685 (9223090566081300101) 2nd polynomial(eval) : 0x23f3a227186a (39529304496234) LPC : 0x1 (1) Bit mask : 0x7fffffffffffffff (9223372036854775807) Profile index in use: 0 Pkts passed : 0x36 (54)
Example at encapsulating or transit node:
vpp# show ioam pot Pkts with ip6 hop-by-hop POT options - 54 Pkts with ip6 hop-by-hop POT options but no profile set - 0 Pkts with POT in Policy - 0 Pkts with POT out of Policy - 0
Example at decapsulating/verification node:
vpp# show ioam pot Pkts with ip6 hop-by-hop POT options - 54 Pkts with ip6 hop-by-hop POT options but no profile set - 0 Pkts with POT in Policy - 54 Pkts with POT out of Policy - 0
Example when the nodes are receiving data over a DPDK interface: Enable tracing using "trace add dpdk-input 20" and execute "show trace" to view the iOAM data collected:
vpp# trace add dpdk-input 20 vpp# show trace ------------------- Start of thread 0 vpp_main ------------------- Packet 1 00:00:19:294697: dpdk-input GigabitEthernetb/0/0 rx queue 0 buffer 0x10e6b: current data 0, length 214, free-list 0, totlen-nifb 0, trace 0x0 PKT MBUF: port 0, nb_segs 1, pkt_len 214 buf_len 2176, data_len 214, ol_flags 0x0, data_off 128, phys_addr 0xe9a35a00 packet_type 0x0 IP6: 00:50:56:9c:df:72 -> 00:50:56:9c:be:55 IP6_HOP_BY_HOP_OPTIONS: db05::2 -> db06::6 tos 0x00, flow label 0x0, hop limit 63, payload length 160 00:00:19:294737: ethernet-input IP6: 00:50:56:9c:df:72 -> 00:50:56:9c:be:55 00:00:19:294753: ip6-input IP6_HOP_BY_HOP_OPTIONS: db05::2 -> db06::6 tos 0x00, flow label 0x0, hop limit 63, payload length 160 00:00:19:294757: ip6-lookup fib 0 adj-idx 15 : indirect via db05::2 flow hash: 0x00000000 IP6_HOP_BY_HOP_OPTIONS: db05::2 -> db06::6 tos 0x00, flow label 0x0, hop limit 63, payload length 160 00:00:19:294802: ip6-hop-by-hop IP6_HOP_BY_HOP: next index 5 len 96 traced 96 Trace Type 0x1f , 1 elts left [0] ttl 0x0 node ID 0x0 ingress 0x0 egress 0x0 ts 0x0 app 0x0 [1] ttl 0x3e node ID 0x3 ingress 0x1 egress 0x2 ts 0xb68c2213 app 0x1234 [2] ttl 0x3f node ID 0x2 ingress 0x1 egress 0x2 ts 0xb68c2204 app 0x1234 [3] ttl 0x40 node ID 0x1 ingress 0x5 egress 0x6 ts 0xb68c2200 app 0x1234 POT opt present random = 0x577a916946071950, Cumulative = 0x10b46e78a35a392d, Index = 0x0 00:00:19:294810: ip6-rewrite tx_sw_if_index 1 adj-idx 14 : GigabitEthernetb/0/0 IP6: 00:50:56:9c:be:55 -> 00:50:56:9c:df:72 flow hash: 0x00000000 IP6: 00:50:56:9c:be:55 -> 00:50:56:9c:df:72 IP6_HOP_BY_HOP_OPTIONS: db05::2 -> db06::6 tos 0x00, flow label 0x0, hop limit 62, payload length 160 00:00:19:294814: GigabitEthernetb/0/0-output GigabitEthernetb/0/0 IP6: 00:50:56:9c:be:55 -> 00:50:56:9c:df:72 IP6_HOP_BY_HOP_OPTIONS: db05::2 -> db06::6 tos 0x00, flow label 0x0, hop limit 62, payload length 160 00:00:19:294820: GigabitEthernetb/0/0-tx GigabitEthernetb/0/0 tx queue 0 buffer 0x10e6b: current data 0, length 214, free-list 0, totlen-nifb 0, trace 0x0 IP6: 00:50:56:9c:be:55 -> 00:50:56:9c:df:72 IP6_HOP_BY_HOP_OPTIONS: db05::2 -> db06::6 tos 0x00, flow label 0x0, hop limit 62, payload length 160