Infrastructure-exclusive service forwarding

• US 10,084,703 B2
• Filed: 04/29/2016
• Issued: 09/25/2018
• Est. Priority Date: 12/04/2015
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Kumar, Surendra M., Bosch, Hendrikus G. P., Leung, Kent K., Patra, Abhijit
• Primary Examiner(s): Duffy, James P
• Application Number:
  US15/143,253
• Publication Number:
  US 20170163531A1
• Time in Patent Office: 879 Days
• Field of Search: None
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 45/7453 using hashing
• CPC Class Codes: H04L 49/3009 Header conversion, routing tables or routing tags

Abstract

A method is provided in one example embodiment and includes receiving at a network element a packet including a Network Services Header (“NSH”), in which the NSH includes an Infrastructure (“I”) flag and a service path header comprising a Service Index (“SI”), and a Service Path ID (“SPI”) and determining whether the I flag is set to a first value. The method further includes, if the I flag is set to the first value, setting the I flag to a second value and forwarding the packet to the service function that corresponds to the SI for processing. The method still further includes, if the I flag is not set to the first value, decrementing the SI and making a forwarding decision based on a new value of the SI and the SPI.

Claims

1. A method comprising:

receiving at a network element a packet including a Network Services Header (“

NSH”

), wherein the NSH includes an Infrastructure (“

I”

) flag and a service path header comprising a Service Index (“

SI”

), and a Service Path ID (“

SPI”

);

determining whether the I flag is set to a first value;

if the I flag is set to the first value;

setting the I flag to a second value; and

forwarding the packet to a service function that corresponds to the SI for processing;

if the I flag is not set to the first value;

decrementing the SI; and

making a forwarding decision based on a new value of the SI and the SPI;

wherein the I flag will be set to the first value when the packet is to be forwarded to a forwarding element and to the second value when the packet is to be forwarded to the service function.

2. The method of claim 1 further comprising, if the forwarding decision comprises forwarding the packet to a second service function anchored to the network element:

setting the I flag to the second value; and

forwarding the packet to the second service function anchored to the network element.

3. The method of claim 1 further comprising, if the forwarding decision comprises forwarding the packet to a second service function anchored at a different network element:

setting the I flag to the first value; and

forwarding the packet to the different network element.

4. The method of claim 1, wherein the network element comprises at least one of a forwarding element and a classifier.

5. The method of claim 1 further comprising performing an integrity check on the service header upon receipt of the packet from the service function.

6. The method of claim 5, wherein the integrity check comprises at least one of:

checking the packet against a three tuple programmed into the network element by a control plane for the service function;

computing a hash of an n-tuple or pseudo header and transporting the hash as opaque metadata in the NSH through the service function on a service path;

recording the SPI and the SI and validating them when the packet is received from the service function; and

applying a mask programmed by the control plane to the NSH to select bits against which to perform integrity checks.

7. The method claim 1, wherein the NSH includes a decrement value and wherein the decrementing comprises reducing the value of the SI by an amount equal to the decrement value.

8. The method of claim 1, wherein the service function does not alter the service path header.

9. The method of claim 1 further comprising:

receiving at the network element a second packet, wherein the second packet does not include an NSH;

classifying the second packet at the network element to select a service chain for processing the second packet;

adding to the second packet an NSH, wherein a service header of the NSH added to the second packet identifies the service chain;

setting an I bit of the NSH header added to the second packet to 1; and

making a forwarding decision based on the service chain of the NSH header added to the second packet.

10. One or more non-transitory tangible media having encoded thereon logic that includes code for execution and when executed by a processor is operable to perform operations comprising:

receiving at a network element a packet including a Network Services Header (“

NSH”

), wherein the NSH includes an Infrastructure (“

I”

) flag and a service path header comprising a Service Index (“

SI”

), and a Service Path ID (“

SPI”

);

determining whether the I flag is set to a first value;

if the I flag is set to the first value;

setting the I flag to a second value; and

forwarding the packet to a service function that corresponds to the SI for processing;

if the I flag is not set to the first value;

decrementing the SI; and

making a forwarding decision based on a new value of the SI and the SPI;

wherein the I flag will be set to the first value when the packet is to be forwarded to a forwarding element and to the second value when the packet is to be forwarded to a service function.

11. The media of claim 10 wherein the operations further comprise, if the forwarding decision comprises forwarding the packet to a second service function anchored to the network element:

setting the I flag to the second value; and

forwarding the packet to the second service function anchored to the network element.

12. The media of claim 10 wherein the operations further comprise, if the forwarding decision comprises forwarding the packet to a second service function anchored at a different network element:

setting the I flag to the first value; and

forwarding the packet to the different network element.

13. The media of claim 10 wherein the operations further comprise performing an integrity check on the service header upon receipt of the packet from the service function, wherein the integrity check comprises at least one of:

checking the packet against a three tuple programmed into the network element by a control plane for the service function;

computing a hash of an n-tuple or pseudo header and transporting the hash as opaque metadata in the NSH through the service function on a service path;

recording the SPI and the SI and validating them when the packet is received from the service function; and

applying a mask programmed by the control plane to the NSH to select bits against which to perform integrity checks.

14. The media of claim 10, wherein the service function does not alter the service path header.

15. The media of claim 10 wherein the instructions further comprise:

receiving at the network element a second packet, wherein the second packet does not include an NSH;

classifying the second packet at the network element to select a service chain for processing the second packet;

adding to the second packet an NSH, wherein a service header of the NSH added to the second packet identifies the service chain;

setting an I bit of the NSH header added to the second packet to 1; and

making a forwarding decision based on the service chain of the NSH header added to the second packet.

16. An apparatus comprising:

a memory element configured to store data;

a processor operable to execute instructions associated with the data; and

a service forwarding function module configured to;

receive at a network element a packet including a Network Services Header (“

NSH”

), wherein the NSH includes an Infrastructure (“

I”

) flag and a service path header comprising a Service Index (“

SI”

), and a Service Path ID (“

SPI”

);

determine whether the I flag is set to a first value;

if the I flag is set to the first value;

set the I flag to a second value; and

forward the packet to a service function that corresponds to the SI for processing;

if the I flag is not set to the first value;

decrement the SI; and

make a forwarding decision based on a new value of the SI and the SPI;

wherein the I flag will be set to the first value when the packet is to be forwarded to a forwarding element and to the second value when the packet is to be forwarded to a service function.

17. The apparatus of claim 16, wherein the service forwarding function module is further configured to:

if the forwarding decision comprises forwarding the packet to a second service function anchored to the network element;

set the I flag to the second value; and

forward the packet to the second service function anchored to the network element; and

if the forwarding decision comprises forwarding the packet to a second service function anchored at a different network element;

set the I flag to the first value; and

forward the packet to the different network element.

18. The apparatus of claim 16, wherein the service forwarding function module is further configured to, perform an integrity check on the service header upon receipt of the packet from the service function, wherein the integrity check comprises at least one of:

checking the packet against a three tuple programmed into the network element by a control plane for the service function;

computing a hash of an n-tuple or pseudo header and transporting the hash as opaque metadata in the NSH through the service function on a service path;

recording the SPI and the SI and validating them when the packet is received from the service function; and

applying a mask programmed by the control plane to the NSH to select bits against which to perform integrity checks.

19. The apparatus of claim 16, wherein the service function does not alter the service path header.

20. The apparatus of claim 16, wherein the service forwarding module is further configured to:

receive at the network element a second packet, wherein the second packet does not include an NSH;

classify the second packet at the network element to select a service chain for processing the second packet;

add to the second packet an NSH, wherein a service header of the NSH added to the second packet identifies the service chain;

set an I bit of the NSH header added to the second packet to 1; and

make a forwarding decision based on the service chain of the NSH header added to the second packet.