OSPF Tunnel Encap: OSPF Advertisement of Tunnel Encapsulations
How an OSPF router tells its neighbors which tunnel types it can receive, so senders pick one the far end understands.
Xu, X., Ed., Decraene, B., Ed., Raszuk, R., Contreras, L., and L. Jalil, "OSPF Advertisement of Tunnel Encapsulations", RFC 9013, DOI 10.17487/RFC9013, April 2021, <https://www.rfc-editor.org/info/rfc9013>.
@misc{rfc9013,
series = {Request for Comments},
number = 9013,
howpublished = {RFC 9013},
publisher = {RFC Editor},
doi = {10.17487/RFC9013},
url = {https://www.rfc-editor.org/info/rfc9013},
author = {X. Xu and B. Decraene and R. Raszuk and L. Contreras and L. Jalil},
title = {{OSPF Advertisement of Tunnel Encapsulations}},
pagetotal = 10,
year = 2021,
month = apr,
} RFC text
Contents
Internet Engineering Task Force (IETF) X. Xu, Ed.
Request for Comments: 9013 Capitalonline
Category: Standards Track B. Decraene, Ed.
ISSN: 2070-1721 Orange
R. Raszuk
NTT Network Innovations
L. Contreras
Telefonica I+D
L. Jalil
Verizon
April 2021
OSPF Advertisement of Tunnel Encapsulations
Abstract
Networks use tunnels for a variety of reasons. A large variety of
tunnel types are defined, and the tunnel encapsulator router needs to
select a type of tunnel that is supported by the tunnel decapsulator
router. This document defines how to advertise, in OSPF Router
Information Link State Advertisements (LSAs), the list of tunnel
encapsulations supported by the tunnel decapsulator.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 7841.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
https://www.rfc-editor.org/info/rfc9013.
Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction
2. Terminology
3. Tunnel Encapsulations TLV
4. Tunnel Sub-TLV
5. Tunnel Parameter Sub-TLVs
5.1. Encapsulation Sub-TLV
5.2. Protocol Type Sub-TLV
5.3. Tunnel Egress Endpoint Sub-TLV
5.4. Color Sub-TLV
5.5. Load-Balancing Block Sub-TLV
5.6. DS Field Sub-TLV
5.7. UDP Destination Port Sub-TLV
6. Operation
7. IANA Considerations
7.1. OSPF Router Information (RI) TLVs Registry
7.2. OSPF Tunnel Parameter Sub-TLVs Registry
8. Security Considerations
9. References
9.1. Normative References
9.2. Informative References
Acknowledgements
Contributors
Authors' Addresses
1. Introduction
Networks use tunnels for a variety of reasons, such as:
* Partial deployment of IPv6 in IPv4 networks or IPv4 in IPv6
networks, as described in [RFC5565], where IPvx tunnels are used
between IPvx-enabled routers so as to traverse non-IPvx routers.
* Remote Loop-Free Alternate (RLFA) repair tunnels as described in
[RFC7490], where tunnels are used between the Point of Local
Repair and the selected PQ node.
The tunnel encapsulator router needs to select a type of tunnel that
is supported by the tunnel decapsulator router. This document
defines how to advertise, in OSPF Router Information Link State
Advertisements (LSAs), the list of tunnel encapsulations supported by
the tunnel decapsulator. In this document, OSPF refers to both
OSPFv2 [RFC2328] and OSPFv3 [RFC5340].
2. Terminology
This memo makes use of the terms defined in [RFC7770].
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
3. Tunnel Encapsulations TLV
Routers advertise their supported tunnel encapsulation type(s) by
advertising a new TLV of the OSPF Router Information (RI) Opaque LSA
[RFC7770], referred to as the "Tunnel Encapsulations TLV". This TLV
is applicable to both OSPFv2 and OSPFv3.
The Type code of the Tunnel Encapsulations TLV is 13, the Length
value is variable, and the Value field contains one or more Tunnel
Sub-TLVs, as defined in Section 4. Each Tunnel Sub-TLV indicates a
particular encapsulation format that the advertising router supports,
along with the parameters corresponding to the tunnel type.
The Tunnel Encapsulations TLV MAY appear more than once within a
given OSPF Router Information (RI) Opaque LSA. If the Tunnel
Encapsulations TLV appears more than once in an OSPF Router
Information LSA, the set of all Tunnel Sub-TLVs from all Tunnel
Encapsulations TLVs SHOULD be considered. The scope of the
advertisement depends on the application, but it is recommended that
it SHOULD be domain wide.
4. Tunnel Sub-TLV
The Tunnel Sub-TLV is structured as shown in Figure 1.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Tunnel Type (2 octets) | Length (2 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
| Tunnel Parameter Sub-TLVs |
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1: Tunnel Sub-TLV
Tunnel Type (2 octets): Identifies the type of tunneling technology
signaled. Tunnel types are shared with the BGP extension
[RFC9012] and hence are defined in the IANA registry "BGP Tunnel
Encapsulation Attribute Tunnel Types". Unknown tunnel types are
to be ignored upon receipt.
Length (2 octets): Unsigned 16-bit integer indicating the total
number of octets of the Tunnel Parameter Sub-TLVs field.
Tunnel Parameter Sub-TLVs (variable): Zero or more Tunnel Parameter
Sub-TLVs, as defined in Section 5.
If a Tunnel Sub-TLV is invalid, it MUST be ignored and skipped.
However, other Tunnel Sub-TLVs MUST be considered.
5. Tunnel Parameter Sub-TLVs
A Tunnel Parameter Sub-TLV is structured as shown in Figure 2.
+---------------------------------------------+
| Tunnel Parameter Sub-Type (2 octets) |
+---------------------------------------------+
| Tunnel Parameter Length (2 octets) |
+---------------------------------------------+
| Tunnel Parameter Value (variable) |
| |
+---------------------------------------------+
Figure 2: Tunnel Parameter Sub-TLV
Tunnel Parameter Sub-Type (2 octets): Each sub-type defines a
parameter of the Tunnel Sub-TLV. Sub-types are registered in the
IANA registry "OSPF Tunnel Parameter Sub-TLVs" (see Section 7.2).
Tunnel Parameter Length (2 octets): Unsigned 16-bit integer
indicating the total number of octets of the Tunnel Parameter
Value field.
Tunnel Parameter Value (variable): Encodings of the Value field
depend on the sub-TLV type. The following subsections define the
encoding in detail.
Any unknown Tunnel Parameter sub-type MUST be ignored and skipped
upon receipt. When a reserved value (see Section 7.2) is seen in an
LSA, it MUST be treated as an invalid Tunnel Parameter Sub-TLV. When
a Tunnel Parameter Value has an incorrect syntax or semantics, it
MUST be treated as an invalid Tunnel Parameter Sub-TLV. If a Tunnel
Parameter Sub-TLV is invalid, its Tunnel Sub-TLV MUST be ignored.
However, other Tunnel Sub-TLVs MUST be considered.
5.1. Encapsulation Sub-TLV
This sub-TLV type is 1. The syntax, semantics, and usage of its
Value field are defined in Section 3.2 ("Encapsulation Sub-TLVs for
Particular Tunnel Types") of [RFC9012].
5.2. Protocol Type Sub-TLV
This sub-TLV type is 2. The syntax, semantics, and usage of its
Value field are defined in Section 3.4.1 ("Protocol Type Sub-TLV") of
[RFC9012].
5.3. Tunnel Egress Endpoint Sub-TLV
The Tunnel Egress Endpoint Sub-TLV specifies the address of the
egress endpoint of the tunnel -- that is, the address of the router
that will decapsulate the payload.
This sub-TLV type is 3. It MUST be present once and only once in a
given Tunnel Sub-TLV. The Value field contains two subfields:
* a two-octet Address Family subfield
* an Address subfield, whose length depends upon the Address Family
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Address Family | Address ~
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +
~ (variable length) ~
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3: Tunnel Egress Endpoint Sub-TLV
The Address Family subfield contains a value from IANA's "Address
Family Numbers" registry. In this document, we assume that the
Address Family is either IPv4 or IPv6; use of other address families
is outside the scope of this document.
If the Address Family subfield contains the value for IPv4, the
Address subfield MUST contain an IPv4 address (a /32 IPv4 prefix).
In this case, the Length field of the Tunnel Egress Endpoint Sub-TLV
MUST contain the value 6.
If the Address Family subfield contains the value for IPv6, the
address subfield MUST contain an IPv6 address (a /128 IPv6 prefix).
In this case, the Length field of the Tunnel Egress Endpoint Sub-TLV
MUST contain the value 18 (0x12). IPv6 link-local addresses are not
valid values of the IP address field.
5.4. Color Sub-TLV
This sub-TLV type is 4. It may appear zero or more times in a given
Tunnel Sub-TLV. The Value field is a 4-octet opaque unsigned
integer.
The color value is user-defined and configured locally on the
advertising routers. It may be used by service providers to define
policies on the tunnel encapsulator routers, for example, to control
the selection of the tunnel to use.
This color value can be referenced by BGP routes carrying the Color
Extended Community [RFC9012]. If the tunnel is used to reach the BGP
next hop of BGP routes, then attaching a Color Extended Community to
those routes expresses the willingness of the BGP speaker to use a
tunnel of the same color.
5.5. Load-Balancing Block Sub-TLV
This sub-TLV type is 5. The syntax, semantics, and usage of its
Value field are defined in [RFC5640].
5.6. DS Field Sub-TLV
This sub-TLV type is 6. The syntax, semantics, and usage of its
Value field are defined in Section 3.3.1 ("DS Field") of [RFC9012].
5.7. UDP Destination Port Sub-TLV
This sub-TLV type is 7. The syntax, semantics, and usage of its
Value field are defined in Section 3.3.2 ("UDP Destination Port") of
[RFC9012].
6. Operation
The advertisement of a Tunnel Encapsulations Sub-TLV indicates that
the advertising router supports a particular tunnel decapsulation
along with the parameters to be used for the tunnel. The decision to
use that tunnel is driven by the capability of the tunnel
encapsulator router to support the encapsulation type and the policy
on the tunnel encapsulator router. The Color Sub-TLV (see
Section 5.4) may be used as an input to this policy. Note that some
tunnel types may require the execution of an explicit tunnel setup
protocol before they can be used to transit data.
A tunnel MUST NOT be used if there is no route toward the IP address
specified in the Tunnel Egress Endpoint Sub-TLV (see Section 5.3) or
if the route is not advertised in the same OSPF domain.
7. IANA Considerations
7.1. OSPF Router Information (RI) TLVs Registry
IANA has allocated the following new code point in the "OSPF Router
Information (RI) TLVs" registry.
+=======+=======================+===========+
| Value | TLV Name | Reference |
+=======+=======================+===========+
| 13 | Tunnel Encapsulations | RFC 9013 |
+-------+-----------------------+-----------+
Table 1: Addition to OSPF Router
Information (RI) TLVs Registry
7.2. OSPF Tunnel Parameter Sub-TLVs Registry
IANA has created a new subregistry called the "OSPF Tunnel Parameter
Sub-TLVs" registry under the "Open Shortest Path First (OSPF)
Parameters" registry. The registration procedures are as follows:
* The values in the range 1-34999 are to be allocated using the
"Standards Action" registration procedure defined in [RFC8126].
* The values in the range 35000-65499 are to be allocated using the
"First Come First Served" registration procedure.
The initial contents of the registry are as follows:
+=============+======================+=====================+
| Value | TLV Name | Reference |
+=============+======================+=====================+
| 0 | Reserved | RFC 9013 |
+-------------+----------------------+---------------------+
| 1 | Encapsulation | RFC 9013 & RFC 9012 |
+-------------+----------------------+---------------------+
| 2 | Protocol Type | RFC 9013 & RFC 9012 |
+-------------+----------------------+---------------------+
| 3 | Endpoint | RFC 9013 |
+-------------+----------------------+---------------------+
| 4 | Color | RFC 9013 |
+-------------+----------------------+---------------------+
| 5 | Load-Balancing Block | RFC 9013 & RFC 5640 |
+-------------+----------------------+---------------------+
| 6 | DS Field | RFC 9013 & RFC 9012 |
+-------------+----------------------+---------------------+
| 7 | UDP Destination Port | RFC 9013 & RFC 9012 |
+-------------+----------------------+---------------------+
| 8-65499 | Unassigned | |
+-------------+----------------------+---------------------+
| 65500-65534 | Experimental | RFC 9013 |
+-------------+----------------------+---------------------+
| 65535 | Reserved | RFC 9013 |
+-------------+----------------------+---------------------+
Table 2: Initial Contents of OSPF Tunnel Parameter Sub-
TLVs Registry
8. Security Considerations
Security considerations applicable to softwires can be found in the
mesh framework [RFC5565]. In general, security issues of the tunnel
protocols signaled through this OSPF capability extension are
inherited.
If a third party is able to modify any of the information that is
used to form encapsulation headers, choose a tunnel type, or choose a
particular tunnel for a particular payload type, user data packets
may end up getting misrouted, misdelivered, and/or dropped. However,
since an OSPF routing domain is usually a well-controlled network
under a single administrative domain, the possibility of the above
attack is very low.
We note that the last paragraph of Section 6 forbids the
establishment of a tunnel toward arbitrary destinations. It
prohibits a destination outside of the OSPF domain. This prevents a
third party that has gained access to an OSPF router from being able
to send the traffic to other destinations, e.g., for inspection
purposes.
Security considerations for the base OSPF protocol are covered in
[RFC2328] and [RFC5340].
9. References
9.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC5640] Filsfils, C., Mohapatra, P., and C. Pignataro, "Load-
Balancing for Mesh Softwires", RFC 5640,
DOI 10.17487/RFC5640, August 2009,
<https://www.rfc-editor.org/info/rfc5640>.
[RFC7770] Lindem, A., Ed., Shen, N., Vasseur, JP., Aggarwal, R., and
S. Shaffer, "Extensions to OSPF for Advertising Optional
Router Capabilities", RFC 7770, DOI 10.17487/RFC7770,
February 2016, <https://www.rfc-editor.org/info/rfc7770>.
[RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for
Writing an IANA Considerations Section in RFCs", BCP 26,
RFC 8126, DOI 10.17487/RFC8126, June 2017,
<https://www.rfc-editor.org/info/rfc8126>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC9012] Patel, K., Van de Velde, G., Sangli, S., and J. Scudder,
"The BGP Tunnel Encapsulation Attribute", RFC 9012,
DOI 10.17487/RFC9012, April 2021,
<https://www.rfc-editor.org/info/rfc9012>.
9.2. Informative References
[RFC2328] Moy, J., "OSPF Version 2", STD 54, RFC 2328,
DOI 10.17487/RFC2328, April 1998,
<https://www.rfc-editor.org/info/rfc2328>.
[RFC5340] Coltun, R., Ferguson, D., Moy, J., and A. Lindem, "OSPF
for IPv6", RFC 5340, DOI 10.17487/RFC5340, July 2008,
<https://www.rfc-editor.org/info/rfc5340>.
[RFC5512] Mohapatra, P. and E. Rosen, "The BGP Encapsulation
Subsequent Address Family Identifier (SAFI) and the BGP
Tunnel Encapsulation Attribute", RFC 5512,
DOI 10.17487/RFC5512, April 2009,
<https://www.rfc-editor.org/info/rfc5512>.
[RFC5565] Wu, J., Cui, Y., Metz, C., and E. Rosen, "Softwire Mesh
Framework", RFC 5565, DOI 10.17487/RFC5565, June 2009,
<https://www.rfc-editor.org/info/rfc5565>.
[RFC7490] Bryant, S., Filsfils, C., Previdi, S., Shand, M., and N.
So, "Remote Loop-Free Alternate (LFA) Fast Reroute (FRR)",
RFC 7490, DOI 10.17487/RFC7490, April 2015,
<https://www.rfc-editor.org/info/rfc7490>.
Acknowledgements
This document is partially inspired by [RFC5512].
The authors would like to thank Greg Mirsky, John E. Drake, Carlos
Pignataro, and Karsten Thomann for their valuable comments on this
document. Special thanks should be given to Acee Lindem for his
multiple detailed reviews of this document and help. The authors
would like to thank Pete Resnick, Joe Touch, David Mandelberg,
Sabrina Tanamal, Tim Wicinski, and Amanda Baber for their Last Call
reviews. The authors also thank Spencer Dawkins, Mirja Kühlewind,
Ben Campbell, Benoit Claise, Alvaro Retana, Adam Roach, and Suresh
Krishnan for their AD reviews.
Contributors
Uma Chunduri
Huawei
Email: uma.chunduri@gmail.com
Authors' Addresses
Xiaohu Xu (editor)
Capitalonline
Email: xiaohu.xu@capitalonline.net
Bruno Decraene (editor)
Orange
Email: bruno.decraene@orange.com
Robert Raszuk
NTT Network Innovations
940 Stewart Dr
Sunnyvale, CA 94085
United States of America
Email: robert@raszuk.net
Luis M. Contreras
Telefonica I+D
Email: luismiguel.contrerasmurillo@telefonica.com
Luay Jalil
Verizon
Email: luay.jalil@verizon.com
AI ELI5
On this page
§1Why Advertise Tunnel Support
Networks use tunnels for many reasons. The RFC gives two examples: carrying IPv6 across IPv4 routers (or the reverse) as described in RFC 5565, and Remote Loop-Free Alternate repair tunnels as described in RFC 7490, where a tunnel runs between the Point of Local Repair and a selected PQ node.
Many tunnel types exist, and the tunnel encapsulator router must pick one that the tunnel decapsulator router supports. This document defines how the decapsulator lists its supported encapsulations in OSPF Router Information Link State Advertisements (LSAs). It covers both OSPFv2 (RFC 2328) and OSPFv3 (RFC 5340).
If you want to mail a parcel to a friend, you should use a box they can open. This document lets routers say which boxes they can open.
§3The Tunnel Encapsulations TLV
Routers advertise their supported tunnel types in a new TLV (a type, length, value item) of the OSPF Router Information (RI) Opaque LSA from RFC 7770. It is called the Tunnel Encapsulations TLV, its Type code is 13, its Length is variable, and it applies to both OSPFv2 and OSPFv3.
The Value field holds one or more Tunnel Sub-TLVs. Each one describes one encapsulation format the router supports, plus the parameters for that tunnel type. The TLV MAY appear more than once in a single RI Opaque LSA. If it does, the Tunnel Sub-TLVs from all of the TLVs SHOULD be considered together. The scope of the advertisement depends on the application, but it SHOULD be domain wide.
It is one labelled shelf on the router's sign. On the shelf are cards, one for each tunnel type the router can open.
§4The Tunnel Sub-TLV
Each Tunnel Sub-TLV starts with a 2-octet Tunnel Type and a 2-octet Length, followed by zero or more Tunnel Parameter Sub-TLVs. Tunnel types are shared with the BGP extension in RFC 9012, so they come from the IANA registry called "BGP Tunnel Encapsulation Attribute Tunnel Types". Unknown tunnel types are ignored on receipt.
Length counts the octets of the Tunnel Parameter Sub-TLVs field. If a Tunnel Sub-TLV is invalid, it MUST be ignored and skipped, but the other Tunnel Sub-TLVs MUST still be considered. One bad entry does not spoil the rest.
Each card says which kind of tunnel it is and how long the card is, so a reader who does not know that tunnel can skip to the next card.
| Field | Name | Size | Value | Description |
|---|---|---|---|---|
TUNNEL-TYPE | Tunnel Type | 2 bytes | Identifies the tunneling technology, using the BGP tunnel types registry. | |
LENGTH | Length | 2 bytes | Total octets of the Tunnel Parameter Sub-TLVs field. |
§5Tunnel Parameter Sub-TLVs
Inside a Tunnel Sub-TLV, each parameter has a 2-octet sub-type, a 2-octet length and a variable value. Several sub-types simply reuse definitions from other RFCs: Encapsulation (1), Protocol Type (2), DS Field (6) and UDP Destination Port (7) come from RFC 9012, and Load-Balancing Block (5) comes from RFC 5640.
Two are defined here. The Tunnel Egress Endpoint (type 3) carries the address of the router that will decapsulate the payload. It MUST appear once and only once per Tunnel Sub-TLV, holds a 2-octet Address Family and an address, and for IPv4 the Length MUST be 6, while for IPv6 it MUST be 18. IPv6 link-local addresses are not valid. The Color (type 4) is a 4-octet opaque unsigned integer, configured locally, that may appear zero or more times. Providers can use it in policy, and BGP routes carrying a Color Extended Community can express a wish to use a tunnel of the same color.
Any unknown sub-type MUST be ignored and skipped. A reserved value, or a value with bad syntax or semantics, makes that parameter invalid, and then its whole Tunnel Sub-TLV MUST be ignored while the others are still considered.
The details on each card say things like where the tunnel ends and a color label chosen by the network owner. Cards with details a router cannot understand are skipped.
- 1Encapsulation — Defined in RFC 9012.
- 2Protocol Type — Defined in RFC 9012.
- 3Tunnel Egress Endpoint — Address of the decapsulating router; exactly one per Tunnel Sub-TLV.
- 4Color — Opaque 4-octet value used in local policy.
- 5Load-Balancing Block — Defined in RFC 5640.
- 6DS Field — Defined in RFC 9012.
- 7UDP Destination Port — Defined in RFC 9012.
§6How the Advertisement Is Used
Advertising a Tunnel Encapsulations Sub-TLV says that the advertising router supports a particular decapsulation, with the given parameters. Whether a tunnel is actually used depends on whether the encapsulator supports that type and on the encapsulator's own policy. The Color Sub-TLV may be an input to that policy. Some tunnel types may need an explicit tunnel setup protocol to run before data can flow.
One firm rule applies: a tunnel MUST NOT be used if there is no route toward the IP address in the Tunnel Egress Endpoint Sub-TLV, or if that route is not advertised in the same OSPF domain.
The sign only says what a router can open. The sender still decides whether to use it, and it must not send parcels to an address outside the neighborhood.
§7IANA Registrations
IANA allocated value 13 for "Tunnel Encapsulations" in the "OSPF Router Information (RI) TLVs" registry. It also created the "OSPF Tunnel Parameter Sub-TLVs" registry. Values 1 to 34999 are allocated by Standards Action, and values 35000 to 65499 by First Come First Served. Values 65500 to 65534 are experimental, and 0 and 65535 are reserved.
A central office keeps the official list of numbers for each kind of card, so two groups never use the same number for different things.
§8Security Considerations
Security issues of the tunnel protocols themselves are inherited, and the softwire mesh framework (RFC 5565) covers them. If a third party could change the information used to build encapsulation headers or to choose a tunnel, user packets could be misrouted, misdelivered or dropped. The RFC argues that this is unlikely because an OSPF routing domain is usually a well-controlled network under one administration.
The rule in Section 6 also helps: since a tunnel to an address outside the OSPF domain is forbidden, someone who has taken over an OSPF router cannot use these advertisements to send traffic to outside destinations, for example for inspection.
If a stranger could change the sign, parcels could go to the wrong place. But the neighborhood is usually locked, and parcels may not be sent outside it.