<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>

<?rfc subcompact="no" ?>
<?rfc toc="yes" ?>
<?rfc symrefs="yes" ?>
<?rfc sortrefs="yes"?>
<?rfc strict="no" ?>

<rfc updates="4862" category="std"  ipr="trust200902"
docName="draft-gont-6man-lta-00">
  <front>
    <title abbrev="LTA Algorithm">Lifetime Avoidance Algorithm</title>


    <author fullname="Fernando Gont" initials="F." surname="Gont">

      <organization abbrev="SI6 Networks">SI6 Networks</organization>
      <address>
        <postal>
          <street>Segurola y Habana 4310, 7mo Piso</street>
<!--          <code>1706</code> -->
          <city>Villa Devoto</city>
          <region>Ciudad Autonoma de Buenos Aires</region>
          <country>Argentina</country>
        </postal>
<!--        <phone>+54 11 4650 8472</phone> -->
        <email>fgont@si6networks.com</email>
        <uri>https://www.si6networks.com</uri>
       </address>
    </author>


     <author fullname="Jan Zorz" initials="J." surname="Zorz">


      <organization abbrev="6connect">6connect</organization>

      <address>
      <!--
        <postal>
          <street>Frankovo naselje 165</street>
         <code>4220</code> 
          <city>Skofja Loka</city>

          <country>Slovenia</country>
        </postal> -->
        <email>jan@connect.com</email>
<!--        <uri>https://www.6connect.com/</uri> -->
      </address>
    </author>
    

<author initials="R." surname="Patterson" fullname="Richard Patterson">

      <organization>Sky UK</organization>

      <address>

        <email>richard.patterson@sky.uk</email>

      </address>

    </author>

 

    <date/>

    <area>Internet</area>
    <workgroup>IPv6 Maintenance (6man) Working Group</workgroup>

<!-- [rfced] Please insert any keywords (beyond those that appear in
the title) for use on http://www.rfc-editor.org/search.html. -->

<keyword></keyword>



    <abstract>
      <t><!--A very common IPv6 deployment scenario is that in which a CPE router employs DHCPv6 Prefix Delegation to obtain an IPv6 prefix, and at least one prefix from within the leased prefix is advertised on a local network via SLAAC. -->In renumbering scenarios where an IPv6 prefix suddenly becomes invalid, hosts on the local network will continue using stale prefixes for an unacceptably long period of time, thus resulting in connectivity problems. This document specifies an algorithm that allows host implementations to infer when configuraton information has changed, such that they can phase stale information out in a timelier manner.</t>
    </abstract>
  </front>
  <middle>
    <section anchor="intro" title="Introduction">
    <t>In scenarios where network configuration information becomes invalid without any explicit signaling of that condition, hosts on the local network will continue using stale SLAAC <xref target="RFC4862"/> information for an unacceptably long period of time, thus resulting in connectivity problems. This problem has been discussed in detail in <xref target="RFC8978"/>.</t>

<t>This document specifies and algorithm that allows SLAAC host implementations to infer when configuraton information has become stale, such that they can phase out stale information in a timelier manner.
</t>


</section>

<section title="Terminology" anchor="term">



<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
      "MAY", and "OPTIONAL" in this document are to be interpreted as
      described in BCP 14 <xref target='RFC2119' /> <xref target='RFC8174' /> when, and only when, they
      appear in all capitals, as shown here.
</t>

</section>


<section title="Lifetime Avoidance (LTA) Algorithm" anchor="stale-config">

<t>This section specifies an algorithm, "Lifetime Avoidance" (LTA) algorithm, that allows hosts to infer that previously-advertised configuration information (such as autoconfiguration prefixes) has become stale, such that the stale information can be deprecated in a timelier manner. Most of the value of this algorithm is in being able to mitigate the problem discussed in <xref target="RFC8978"/>  at hosts themselves, without relying on changes in SLAAC router implementations.</t>


<t>The algorithm consists of two conceptual building-blocks:
<list style="symbols">
<t>Detection of possible configuration change</t>
<t>Validation/Refresh of configuration information</t>
</list>
</t>


<t>Possible configuration changes can be inferred when a SLAAC router (as identified by its link-local address) ceases to advertise a previously-advertised information. Therefore, hosts can record what configuration information has been advertised by each local router, and infer a configuration change when a router ceases to advertise previously-advertises configuration information.</t>

<t>Inscenarios where possible configuration changes have been detected, hosts should poll the local router via unicasted Router Solicitations (RS) to verify that the router in question has indeed ceased to advertise the aforementioned information. If this condition is confirmed, the corresponding configuration information should be discarded.</t>

<t>In the context of multi-prefix/multi-router networks <xref target="RFC8028"/> <xref target="RFC8504"/>, SLAAC configuration information should be associated with each advertising router. Thus, when a router ceases to advertise some configuration information:
<list style="symbols">
<t>If this was the only router advertising the aforementioned information, the information should be discarded. </t>
<t>If other routers were advertising the aforementioned information, it should simply be dis-associated with the router that ceased to advertise it, and the fate of this information (and configured resources) should depend solely on the routers that continue advertising it.
</t>
</list>
</t>

<t>Implementation of this kind of heuristic allows a timelier reaction to network configuration changes even in scenarios where there is no explicit signaling from the network, thus improving robustness.
</t>

<t><xref target="RFC4861"/> does not require routers to convey all RA options in the same message. Therefore, the algorithm specified in this section is designed such that it can cope with this corner case that, while not found in the deployed Internet, is allowed by <xref target="RFC4861"/>.</t>

<section title="Target Neighbor Discovery Options" anchor="target-options">

<t>The LTA algorithm SHOULD be applied to the following Neighbor Discovery options:
<list style="symbols">
<t>Prefix Information Option <xref target="RFC4861"/></t>
<t>Route Information Option (RIO) <xref target="RFC4191"/></t>
<t>DNS Search Options (RDNSSO) <xref target="RFC8106"/></t>
<t>DNS Search List Options (DNSSLO) <xref target="RFC8106"/></t>
</list>
</t>

</section>


<section title="Local State Information and Configuration Variables" anchor="local-info">
<t>In the context of multi-prefix/multi-router networks <xref target="RFC8028"/> <xref target="RFC8504"/>, each option from <xref target="target-options"/> is associated with each advertising SLAAC router. Therefore, hosts should record what configuration information has been advertised by each local router.
<list style="hanging">
<t hangText="NOTE:"><vspace blankLines="0" />
Throughout this specification, each router is identified by its link-local address.</t>
</list>

Additionally, hosts associate with piece of configuration information received via SLAAC options a timestamp (INFO_LAST variable below) that records the time at which this information was last advertised by a particular router.
<list style="hanging">
<t hangText="NOTE:"><vspace blankLines="0" />
While not strictly required, we note that existing implementations may already record a timestamp representing when a piece of information was advertised by a given router as a possible implementation approach to be able to compute the remaining lifetime of that piece of information.</t>
</list>
</t>

<t>The algorithm specified in this document employs the following variables:
<list style="hanging">
<t hangText="LTA_MODE:">
<vspace blankLines="0" />
A boolean variable associated with each SLAAC advertising router that specifies whether the local host is currently performing the LTA algorithm for that router. It is initialized to FALSE.
</t>
<t hangText="LTA_LAST:">
<vspace blankLines="0" />
A variable associated with each SLAAC advertising router that stores the time (in seconds) when the local host last entered the LTA algorithm for this router. It is initialized to 0.
</t>

<t hangText="RS_LAST:">
<vspace blankLines="0" />
A variable associated with each SLAAC advertising router that stores the time (in seconds) when the local host last sent a unicasted Router Solicitation to the router in question. It is initialized to 0.
</t>

<t hangText="RS_COUNT:">
<vspace blankLines="0" />
A variable associated with each SLAAC advertising router that stores the number of unicasted Router Solicitations that have been sent to the corresponding router since the last time the LTA algorithm was executed. It is initialized to 0.
</t>

<t hangText="RS_COUNT_MAX:">
<vspace blankLines="0" />
A configuration variable specifying the maximum number of unicasted Router Solicitations that a host will send to a SLAAC advertising router as part of the LTA algorithm. It defaults to 1.
</t>


<t hangText="RS_RNDTIME:">
<vspace blankLines="0" />
A host-wide variable specifying a random amount of time that the host should wait before sending the first unicasted Router Solicitation message to a SLAAC router as part of the LTA algorithm. It should be initialized to a value in the range from 0 to 5 seconds when the system is bootstrapped.
</t>

<t hangText="RS_TIMEOUT:">
<vspace blankLines="0" />
A host-wide variable specifying the amount of time to wait for a response to a unicasted Router Solicitation sent as part of the LTA algorithm. It defaults to 3 seconds.
</t>

<t hangText="INFO_LAST:">
<vspace blankLines="0" />
A timestamp associated with each piece of SLAAC information (from <xref target="target-options"/>) received from each SLAAC advertising router. 

<list style="hanging">
<t hangText="NOTE:">
<vspace blankLines="0" />
In most cases (e.g., Prefix Information Options and Route Information Options) each neighbor discovery option carries one atomic piece of SLAAC information. In other cases (notably Recursive DNS Server Option <xref target="RFC8106"/> and DNS Search List Option <xref target="RFC8106"/>), a single neighbor discovery option carries multiple atomic pieces of information (i.e., a host might want to prune some recursive DNS server addresses, but not others). This is why this document refers to "piece of SLAAC information" rather than "Negihbor Discovery option" (since one option might carry multiple pieces of information).
</t>
</list>

</t>


<t hangText="RA_WIN:">
<vspace blankLines="0" />
A host-wide configuration variable specifying a time window over which a SLAAC advertising router may convey all SLAAC configuration information. It is meant to cope with the theoretical case where a router may spread SLAAC information over several RA messages. 
It defaults to 3 seconds.
</t>


<t hangText="LTA_CYCLE:">
<vspace blankLines="0" />
This variable accounts for the maximum time that may elapse for the entire LTA algorithm to complete. Its value is computed as: LTA_CYCLE=RA_WIN+RS_RNDTIME+RS_COUNT_MAX*RS_TIMEOUT. <!-- LTA_CYCLE=RA_WIN+RS_RNDTIME+RS_COUNT_MAX*RS_TIMEOUT. -->
</t>

</list>
</t>

</section>


<section title="Algorithm Specification">

<t>Initialization when a new SLAAC advertising router is learned:</t>

    <t>
    <figure><artwork>
    LTA_MODE=FALSE
    LTA_LAST=0
    RS_LAST=0
    RS_COUNT=0
    LTA_CYCLE=RA_WIN+RS_RNDTIME+RS_COUNT_MAX*RS_TIMEOUT
    </artwork>
    </figure>

    </t>


   
<t>Upon receipt of a Router Advertisement message, and after normal processing of the message, perform the following actions:</t>

    <t>
    <figure><artwork>
    TIME= time()
   
    For each piece of SLAAC configuration information advertised by
    this router in the received RA:
        INFO_LAST= TIME


    IF LTA_MODE==FALSE &amp;&amp; TIME &gt; (LTA_LAST+LTA_CYCLE)
        IF this RA is missing any previously-advertised information:
	    LTA_MODE=TRUE
	    LTA_LAST=TIME
    </artwork>
    </figure>

    </t>

<t>
<list style="hanging">
<t hangText="RATIONALE:">
<vspace blankLines="0" />
The goal of checking &quot;(LTA_LAST+LTA_CYCLE)&quot; is to prevent the host from re-entering the LTA_mode in a short period of time in the theoretical corner-case where:
<list style="numbers">
<t>The local router spreads information into multiple RA packets, and one of such packets gets lost, thus triggering the LTA mode.</t>
<t>The host sends a unicasted solicitation to the local router as part of the LTA mode.</t>
<t>The router spreads the response into multiple packets, and e.g. the first of such packets completes all the missing information, thus exiting the LTA mode.</t>
<t>One of the remaining RAs of this "batch" would otherwise trigger the LTA mode again.</t>
</list>
</t>
<t>Thus, the above check only allows the LTA mode to be triggered once every LTA_CYCLE seconds.</t>
</list>
</t>


<t>Time-driven events:</t>


    <t>
    <figure><artwork>
    IF LTA_MODE==TRUE:
        TIME=time()

        IF TIME &gt;  (LTA_LAST + LTA_CYCLE)
            Disaasociate any options for which INFO_LAST &lt; LTA_LAST
            LTA_MODE= FALSE
            RS_COUNT= 0
                    
        ELSE IF TIME > (LTA_LAST + RA_WIN + RS_RNDTIME) &amp;&amp; TIME &gt; 
                (RS_LAST + RS_TIMEOUT) &amp;&amp; RS_COUNT &lt; RS_COUNT_MAX:

            IF for all options INFO_LAST >= LTA_LAST
            	LTA_MODE= FALSE
            	RS_COUNT= 0
            ELSE
            	SendRS()
            	RS_LAST=TIME
            	RS_COUNT++
    </artwork>
    </figure>

    </t>
 

<t>NOTES:
<list style="symbols">
<t>time() is a monotonically-increasing counter that is incremented once per second, and is employed in this algorithm to measure time.</t>

<t>SendRS() is a function sends a unicasted Router Solicitation message to the target router (subject to sending rules in <xref target="RFC4861"/>).</t>
</list>

</t>


<t>
<list style="hanging">
<t hangText="RATIONALE:">
<vspace blankLines="0" />
After a whole LTA_CYCLE has elapsed (i.e., "TIME &gt; (LTA_LAST + LTA_CYCLE)"), SLAAC information that has not been refreshed since the LTA mode was entered should be disassociated with the router for which the LTA algorithm has been performed.
</t>
<t>
While in the LTA mode, before probing the local router with a unicasted RS, we double-check if all the missing information has been completed/refreshed since the LTA mode was entered. In such case, the LTA mode is exited and the algorithm finished, thus avoiding sending unnecessary RS packets to the local router. Otherwise, a unicasted RS is sent to the local router for which the LTA algorithm is being performed.
</t>
<t><xref target="IETF-6MAN-114"/> illustrates the most common scenarios.</t>
</list>
</t>

</section>

      </section>




    <section title="IANA Considerations">
      <t>
This document has no actions for IANA.
</t>
    </section>


    <section title="Security Considerations">

         <t>An attacker could for Router Advertisement messages wit missing Neighbor Discovery options (such as PIOs), to trigger the algorithm specified in this document, with te goal of illegitimatelly causing valid prefixes to be removed.
         
  In any case, and for all practical purposes,
         this attack vector does not really represent any greater risk
         than other ND attack vectors. In scenarios where RA-based attacks
         are of concern, proper
         mitigations such as RA-Guard <xref target="RFC6105"/> <xref target="RFC7113"/> or SEND <xref target="RFC3971"/> should be
         implemented. 
         </t>
    </section>



<section title="Acknowledgments">
<t>The authors would like to thank (in alphabetical order) [TBD], for providing valuable comments on earlier versions of this document.</t>


<t>Fernando would like to thank Alejandro D'Egidio and Sander Steffann for a discussion of these issues, which led to the publication of <xref target="RFC8978"/>, and eventually to this document.</t>
<t>Fernando would also like to thank Brian Carpenter who, over the years, has answered many questions and provided valuable comments that has benefited his protocol-related work.</t>
      
    </section>

  </middle>
  <back>

    <references title="Normative References">
	<?rfc include="reference.RFC.2119" ?>
 

<!--	<?rfc include="reference.RFC.4291" ?> -->
	<?rfc include="reference.RFC.8028" ?>
	<?rfc include="reference.RFC.4861" ?>
	<?rfc include="reference.RFC.4862" ?>
	<?rfc include="reference.RFC.8174" ?>

	<?rfc include="reference.RFC.8504" ?>

	</references>




    <references title="Informative References">
	
	<!-- SEND -->
	<?rfc include="reference.RFC.3971" ?>

	
	<?rfc include="reference.RFC.4191" ?>
	<?rfc include="reference.RFC.8106" ?>

	<?rfc include="reference.RFC.6105" ?>
<!--	<?rfc include="reference.RFC.7084" ?>  CPE -->
	<?rfc include="reference.RFC.7113" ?>
<!--
	<?rfc include="reference.I-D.linkova-6man-default-addr-selection-update" ?>
-->

	<?rfc include="reference.RFC.8978" ?>




	<reference anchor="IETF-6MAN-114" target="https://datatracker.ietf.org/meeting/114/materials/slides-114-6man-improving-the-robustness-of-stateless-address-autoconfiguration-slaac-to-flash-renumbering-events-00">
		<front>
			<title>Improving the Robustness of Stateless Address Autoconfiguration (SLAAC) to Flash Renumbering Events</title>
			<author initials="F." surname="Gont" fullname="Fernando Gont">
				<organization>SI6 Networks</organization>
			</author>
			<author initials="J." surname="Zorz" fullname="Jan Zorz">
				<organization>6connect</organization>
			</author>
			<author initials="R." surname="Patterson" fullname="Richard Patterson">
				<organization>6connect</organization>
			</author>
						
			<date year="2022"/>
		</front>
		<seriesInfo name="6man WG meeting" value="IETF 114"/>
	</reference>



    </references>

  </back>
</rfc>
<!--
Local Variables:
mode:xml
End:
=-->
