RFC 3479
Fault Tolerance for the Label Distribution Protocol (LDP)
Fault Tolerance for the Label Distribution Protocol (LDP) 🎀
Part 1 of 10 🦋 buckle up, bestie, this one's a whole saga
Okay, let's start with the paperwork 📄 This is RFC 3479, and it's called Fault Tolerance for the Label Distribution Protocol (LDP). A. Farrel (the Ed. means editor) wrote it while at Movaz Networks, Inc., and it's dated February 2003. It's on the Standards Track, and the header doesn't list anything it obsoletes or updates, so it's standing on its own ✨
Status of this Memo 📬
This document specifies an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 💖 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌸
Copyright Notice 💜
Copyright (C) The Internet Society (2003). All Rights Reserved.
IESG Note 🚨
Okay bestie, this part is serious, read it twice 🙈
This specification has procedures for failure detection and failover for a TCP connection that carries MPLS LDP control traffic, so that traffic can be switched over to a new TCP connection. It does not give a general approach to using multiple TCP connections for this kind of fault tolerance 💅 The spec also doesn't have enough guidance for picking timer and retry values for the TCP connection fault tolerance procedures. So it should not be used as a model for TCP connection fault tolerance design in any future document 🫶 And users are advised to test configurations based on this specification very carefully for problems like premature failovers 😭
Abstract 🌈
Multiprotocol Label Switching (MPLS) systems are going to be used in core networks, where system downtime has to be kept to an absolute minimum. Lots of MPLS Label Switching Routers (LSRs) may therefore use Fault Tolerant (FT) hardware or software to keep core networks highly available ✨
How FT gets achieved for the different parts of an FT LSR is implementation specific. That covers the Label Distribution Protocol (LDP), the switching hardware, and TCP 🧚 This document points out issues in the LDP specification in RFC 3036, "LDP Specification", that make it hard to implement an FT LSR with the current LDP protocols. It also defines enhancements to the LDP specification to make FT LSR implementations easier 🔥
The issues and extensions described here apply equally to RFC 3212, "Constraint-Based LSP Setup Using LDP" (CR-LDP) 👑
Table of Contents 🍓
1. Conventions and Terminology used in this document..........3
2. Contributing Authors.......................................4
3. Introduction...............................................4
3.1. Fault Tolerance for MPLS..............................4
3.2. Issues with LDP.......................................5
4. Overview of LDP FT Enhancements............................7
4.1. Establishing an FT LDP Session........................8
4.1.1 Interoperation with Non-FT LSRs.................8
4.2. TCP Connection Failure................................9
4.2.1 Detecting TCP Connection Failures...............9
4.2.2 LDP Processing after Connection Failure.........9
4.3. Data Forwarding During TCP Connection Failure........10
4.4. FT LDP Session Reconnection..........................10
4.5. Operations on FT Labels..............................11
4.6. Check-Pointing.......................................11
4.6.1 Graceful Termination...........................12
4.7. Label Space Depletion and Replenishment..............13
4.8. Tunneled LSPs........................................13
5. FT Operations.............................................14
5.1. FT LDP Messages......................................14
5.1.1 Sequence Numbered FT Label Messages............14
5.1.2 FT Address Messages............................15
5.1.3 Label Resources Available Notifications........15
5.2. FT Operation ACKs....................................17
5.3. Preservation of FT State.............................17
5.4. FT Procedure After TCP Failure.......................19
5.4.1 FT LDP Operations During TCP Failure...........20
5.5. FT Procedure After TCP Re-connection.................21
5.5.1 Re-Issuing FT Messages.........................22
6. Check-Pointing Procedures.................................22
6.1 Check-Pointing with the Keepalive Message.............23
6.2 Quiesce and Keepalive.................................23
7. Changes to Existing Messages..............................24
7.1. LDP Initialization Message...........................24
7.2. LDP Keepalive Messages...............................25
7.3. All Other LDP Session Messages.......................25
8. New Fields and Values.....................................26
8.1. Status Codes.........................................26
8.2. FT Session TLV.......................................27
8.3. FT Protection TLV....................................29
8.4. FT ACK TLV...........................................32
8.5. FT Cork TLV..........................................33
9. Example Use...............................................34
9.1. Session Failure and Recovery - FT Procedures.........34
9.2. Use of Check-Pointing With FT Procedures.............37
9.3. Temporary Shutdown With FT Procedures................38
9.4. Temporary Shutdown With FT Procedures
and Check-Pointing...................................40
9.5. Check-Pointing Without FT Procedures.................42
9.6. Graceful Shutdown With Check-Pointing
But No FT Procedures.................................44
10. Security Considerations..................................45
11. Implementation Notes.....................................47
11.1. FT Recovery Support on Non-FT LSRs..................47
11.2. ACK generation logic................................47
11.2.1 Ack Generation Logic When Using
Check-Pointing...............................47
11.3 Interactions With Other Label Distribution
Mechanisms...........................................48
12. Acknowledgments..........................................48
13. Intellectual Property Consideration......................49
14. References...............................................49
14.1. Normative References................................49
14.2. Informative References..............................50
15. Authors' Addresses.......................................50
16. Full Copyright Statement.................................521. Conventions and Terminology used in this document ✨
Okay so the definitions of key words and terms that apply to LDP and CR-LDP are inherited from [RFC3212] and [RFC3036] 💅
This document introduces the term "FT Label" for a label where some fault tolerant operation is used 🦋 A "non-FT Label" isn't fault tolerant, and it's handled the way [RFC3036] says ✨
A "Sequence Numbered FT Label" is an FT label that's secured using the sequence number in the FT Protection TLV described in this document 🔢
A "Check-Pointable FT Label" is an FT label that's secured by using the check-pointing techniques described in this document 🛡️
The extensions to LDP specified in this document are collectively called the "LDP FT enhancements" 🌸
Within this document, "Check-Pointing" means a process of message exchanges that confirm receipt and processing (or secure storage) of specific protocol messages. Literally the group chat confirming "got it" 💬
When we talk about the individual bits in the 16-bit FT Flag Field, the words "bit" and "flag" mean the same thing 🧚
In the examples, we use this notation: Ln is an LSP (for example L1), and Pn is an LDP peer (for example P1) 🍓
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [RFC2119]. These are the official rule words, so they stay exactly as they are 👑
2. Contributing Authors 💖
This document was the collective work of several individuals over a period of several years 🫶 The text and content were contributed by the editor and the co-authors listed in section 15, "Authors' Addresses" 🎀
3. Introduction 🌈
High Availability (HA) is typically claimed by equipment vendors when their hardware reaches availability levels of at least 99.999% (five 9s) 😭 To pull that off, the equipment has to be able to recover from local hardware and software failures through a process called fault tolerance (FT) 💪
The usual approach to FT involves setting up backup copies of hardware and/or software 🧸 When a primary copy fails, processing gets switched over to the backup copy. This process, called failover, should result in minimal disruption to the Data Plane ✨
In an FT system, backup resources are sometimes set up on a one-to-one basis (1:1), sometimes as one-to-many (1:n), and occasionally as many-to-many (m:n) 🦋 Whatever backup setup is chosen, the system must switch to the backup automatically when the primary fails. The software and hardware state in the backup also has to copy the state in the primary at the point of failure 🔥
3.1. Fault Tolerance for MPLS 🌸
MPLS is a technology that's going to be used in core networks, where system downtime has to be kept to an absolute minimum 🚀 So lots of MPLS LSRs may use FT hardware or software to keep core networks highly available 💜
To provide HA, an MPLS system needs to survive a variety of faults with minimal disruption to the Data Plane. That includes these fault types:
- failure/hot-swap of a physical connection between LSRs. 🔌
- failure/hot-swap of the switching fabric in an LSR. 🧠
- failure of the TCP or LDP stack in an LSR. 💀
- software upgrade to the TCP or LDP stacks in an LSR. 🛠️
The first two faults on that list are confined to the Data Plane. You can handle those by adding redundancy in the Data Plane, and it's transparent to LDP running in the Control Plane 🙌 The last two need action in the Control Plane to recover without disrupting traffic in the Data Plane. This works because lots of recent router architectures separate the Control and Data Planes, so forwarding can keep going unaffected by recovery action in the Control Plane 🌈 main character architecture 🌈
3.2. Issues with LDP ✨
okay so LDP uses TCP to keep its connections reliable between LSRs 💅 The LSRs use those connections to swap protocol messages, which is how they hand out labels and build LSPs. When a pair of LSRs has one of these connections, they're called LDP peers 🫶
Because TCP is doing the reliable delivery, LDP can just assume messages arrive safely 🦋 That means some messages don't need an acknowledgement at all. Label Release is one example.
LDP is designed so that if the TCP connection dies, the LSR should immediately tear down the LSPs tied to that session between the LDP peers 💀 It also has to release any labels and resources given to those LSPs.
Making a Fault Tolerant version of TCP is notoriously hard 😭 You'd potentially have to keep copies of all the data sent and received. Implementers of other TCP apps, like BGP, already know this pain.
During failover that touches the TCP or LDP stacks, the TCP connection can get lost 🙈 It gets worse because LDP control messages might be lost right along with it. Those messages were never confirmed, so LSP or label state information could disappear 💔
This document describes a solution with these parts:
- negotiation between LDP peers of the intent to support extensions to LDP that facilitate recovery from failover without loss of LSPs.
- selection of FT survival on a per LSP/label basis.
- acknowledgement of LDP messages to ensure that a full handshake is performed on those messages either frequently (such as per message) or less frequently as in check-pointing.
- solicitation of up-to-date acknowledgement (check-pointing) of previous LDP messages to ensure the current state is flushed to disk/NVRAM, with an additional option that allows an LDP partner to request that state is flushed in both directions if graceful shutdown is required.
- re-issuing lost messages after failover to ensure that LSP/label state is correctly recovered after reconnection of the LDP session.
The issues and objectives above are just as applicable to CR-LDP 🌸
Other goals of this document are to:
- offer backward-compatibility with LSRs that do not implement these extensions to LDP.
- preserve existing protocol rules described in [RFC3036] for handling unexpected duplicate messages and for processing unexpected messages referring to unknown LSPs/labels.
- avoid full state refresh solutions (such as those present in RSVP: see [RFC2205], [RFC2961], [RFC3209] and [RFC3478]) whether they be continual, or limited to post-failover recovery.
Heads up: this document focuses on keeping label state alive for labels exchanged between two adjacent LSRs when the TCP connection between them is lost 🎀 That's a requirement for Fault Tolerant LSP operation, but full end-to-end protection for LSPs needs to be paired with other techniques that are outside the scope of this document.
Specifically, this document does not try to explain how to change the routing of an LSP or the resources allocated to a label or LSP. That's covered by [RFC3214] 🧚 It also doesn't explain how to do automatic layer 2 or layer 3 protection switching for a label or LSP, which is a separate area for study.
This specification doesn't stop an implementation from trying (or require it to try) to use the FT behavior described here to recover from a preemptive failure of a connection on a non-FT system. An example would be a partial system crash 👑 Fair warning though: there are potential issues too numerous to list here, not least the likelihood that the same crash will immediately happen again while processing the restored data 💀
4. Overview of LDP FT Enhancements ✨
The LDP FT enhancements have these main elements, which get more detail in the sections that follow 🌈
- The presence of an FT Session TLV on the LDP Initialization message indicates that an LSR supports some form of protection or recovery from session failure. A flag bit within this TLV (the S bit) indicates that the LSR supports the LDP FT enhancements on this session. Another flag (the C bit) indicates that the check-pointing procedures are to be used.
- An FT Reconnect Flag in the FT Session TLV (the R bit) indicates whether an LSR has preserved FT Label state across a failure of the TCP connection.
- An FT Reconnection Timeout, exchanged on the LDP Initialization message, that indicates the maximum time peer LSRs will preserve FT Label state after a failure of the TCP connection.
- An FT Protection TLV used to identify operations that affect LDP labels. All LDP messages carrying the FT Protection TLV need to be secured (e.g. to NVRAM) and ACKed to the sending LDP peer so that the state for Sequence Numbered FT Labels can be correctly recovered after LDP session reconnection.
Note that the implementation within an FT system is left open by this document. An implementation could choose to secure entire messages relating to Sequence Numbered FT Labels, or it could secure only the relevant state information.
- Address advertisement may also be secured by use of the FT Protection TLV. This enables recovery after LDP session reconnection without the need to re-advertise what may be a very large number of addresses 🍓
- The FT Protection TLV may also be used on the Keepalive message to flush acknowledgement of all previous FT operations. This enables a check-point for future recovery, either in mid-session or prior to graceful shutdown of an LDP session. This procedure may also be used to check-point all (that is both FT and non-FT) operations for future recovery 🔥
4.1. Establishing an FT LDP Session 🦋
So the extensions to LDP [RFC3036] in this document only work if both LDP peers have agreed to use them on the LDP session 🤝 The peers MUST negotiate that the LDP FT enhancements are to be used on the LDP session.
This happens during the LDP Initialization message exchange, using a new FT Session TLV. Having this TLV means the peer wants some form of protection or recovery processing. The S bit inside it says the peer wants the LDP FT enhancements on this LDP session. The C bit says the peer wants the check-pointing functions described in this document. The S and C bits can be set independently 💖
The relevant LDP FT enhancements MUST be supported on an LDP session if both LDP peers include an FT Session TLV on the LDP Initialization message and have the same setting of the S or C bit.
If either LDP peer doesn't include the FT Session TLV on the LDP Initialization message, or if the S and C bits don't match between the peers, the LDP FT enhancements MUST NOT be used during this LDP session. If a sending LDP peer uses LDP FT enhancements in these cases, the receiving LDP peer MUST interpret that as a serious protocol error causing the session to be terminated 🚨
An LSR MAY present different FT/non-FT behavior on different TCP connections, even if those connections are successive instantiations of the LDP session between the same LDP peers ✨
4.1.1 Interoperation with Non-FT LSRs 🌸
The FT Session TLV on the LDP Initialization message carries the U-bit. If an LSR doesn't support any protection or recovery mechanisms, it will ignore this TLV. Since those partners also don't include the FT Session TLV, all LDP sessions to such LSRs won't use the LDP FT enhancements 🙈
The rest of this document assumes that the LDP sessions under discussion are between LSRs that support the LDP FT enhancements, except where explicitly stated otherwise 🫶
4.2. TCP Connection Failure 💔
4.2.1 Detecting TCP Connection Failures 🔍
TCP connection failures can be detected and reported to the LDP component in a bunch of different ways. The LDP component should treat all of these the same way 👑
- Indication from the management component that a TCP connection or underlying resource is no longer active.
- Notification from a hardware management component of an interface failure.
- Sockets keepalive timeout.
- Sockets send failure.
- New (incoming) Socket opened.
- LDP protocol timeout.
4.2.2 LDP Processing after Connection Failure 🧠
If the LDP FT enhancements aren't in use on an LDP session, what the LDP peers do when the TCP connection fails is whatever [RFC3036] specifies 📖
All state information and resources associated with non-FT Labels MUST be released when the TCP connection fails. This includes deprogramming the non-FT Label from the switching hardware 🧹 It's equivalent to the behavior specified in [RFC3036].
If the LDP FT enhancements are in use on an LDP session, both LDP peers SHOULD preserve state information and resources associated with FT Labels exchanged on the LDP session 🥹 Both LDP peers SHOULD also use a timer to release that preserved state and those resources if the TCP connection isn't restored within a reasonable period. When this timer expires, the behavior is equivalent to the LDP session failure behavior described in [RFC3036] ⏰
The FT Reconnection Timeout each LDP peer intends to apply to the LDP session is carried in the FT Session TLV on the LDP Initialization messages. Both LDP peers MUST use the value that corresponds to the lesser timeout interval of the two proposed timeout values from the LDP Initialization exchange. A value of zero is treated as positive infinity ♾️
4.3. Data Forwarding During TCP Connection Failure 🚀
An LSR that implements the LDP FT enhancements SHOULD preserve the programming of the switching hardware across a failover. This means data forwarding is unaffected by the state of the TCP connection between LSRs 🌈
It's an integral part of FT failover processing in some hardware configurations that some data packets might be lost. If data loss isn't acceptable to the applications using the MPLS network, the LDP FT enhancements described in this document SHOULD NOT be used 🫠
4.4. FT LDP Session Reconnection
okay bestie, so whenever a brand new TCP connection gets set up, the LDP peers MUST swap LDP Initialization messages 💖 and if that connection is coming back after a failure, they MUST re-exchange Initialization messages all over again ✨
If an LDP peer includes the FT Session TLV with the S bit set in the Initialization message for the new session instance, it MUST also set the FT Reconnect Flag based on whether it managed to preserve label state 🫶. The FT Reconnect Flag rides along inside the FT Session TLV.
If a peer has preserved all the state from previous instances of the session, it SHOULD set the FT Reconnect Flag to 1 in the FT Session TLV. Otherwise, it MUST set it to 0.
If either peer sets the FT Reconnect Flag to 0, or leaves out the FT Session TLV, both peers MUST release any state and resources tied to the previous instance of the session between them, including FT Label state and Addresses. This is what keeps network resources from being permanently lost by one LSR when its peer has to cold start 😭.
If a peer changes any session parameters (like the label space bounds) from the previous instance, whatever it preserved might not mean the same thing anymore. Labels that were handed out before could now be out of range 💀. That's why session reconnection MUST use the same parameters that were in use on the session before the failure. If a peer notices the other side changed them, it SHOULD send a Notification message with the 'FT Session parameters changed' status code 🚨.
If both peers set the FT Reconnect Flag to 1, both peers MUST use the procedures in this document to finish any label operations on Sequence Numbered FT Labels that got interrupted by the session failure 🔥.
If a peer receives an Initialization message with the FT Reconnect Flag set before it has sent its own Initialization message, but it has kept no information about the previous version of the session, it MUST respond with an Initialization message with the FT Reconnect Flag clear. And if a peer receives an Initialization message with the FT Reconnect Flag set in response to one it sent with the flag clear, it MUST act as if no state was retained by either peer on the session 🙈.
4.5. Operations on FT Labels
ngl this part is so clean 🦋. Label operations on Sequence Numbered FT Labels get made Fault Tolerant by acknowledging every LDP message that affects them. Those acknowledgements happen through sequence numbers sitting on the LDP messages.
The message exchanges used to acknowledge label operations, and the procedures used to finish interrupted label operations, are detailed in section 5, "FT Operations" 📖.
Because of all that, the LDP peers don't need to do a full re-sync of every Sequence Numbered FT Label, either when the LDP session reconnects or on some timed schedule. Main character energy 👑.
4.6. Check-Pointing
okay check-pointing is so useful 🌸. It lets nodes do less processing when they acknowledge LDP messages. The C bit in the FT Session TLV is what signals that check-pointing is supported.
During normal operation on Sequence Numbered FT Labels, acknowledgments may be deferred during regular processing and only sent every so often. Check-pointing can be used to flush acknowledgement from a peer by putting a sequence number on a Keepalive message that requests acknowledgement of that message and all previous messages. When that happens, all Sequence Numbered FT Labels are Check-Pointable FT Labels.
If the S bit isn't agreed upon, check-pointing can still be used. In that case it acknowledges all messages exchanged between the peers, and all labels are Check-Pointable FT Labels.
This gives you an approach where acknowledgements don't have to go out for every single message, or even frequently. They only get sent as check-points, in response to requests carried on Keepalive messages 🦋. This is considered optimal in systems that don't change much over time (like targeted LDP sessions) and that are okay with risking loss of state for the most recent LDP exchanges. More dynamic systems (like LDP discovery sessions) are more likely to want to acknowledge state changes more often, so the maximum amount of state can be preserved over a failure 💅.
Note that an important consideration for this document is that nodes acknowledging messages one-for-one, nodes deferring acknowledgements, and nodes relying on check-pointing should all interoperate seamlessly, without any protocol negotiation beyond session initialization ✨.
Further discussion of this feature is provided in section 5, "FT Operations" 📖.
4.6.1 Graceful Termination
graceful termination is literally built on top of check-pointing 🧚.
In some cases, like a controlled failover or a software upgrade, a node can know in advance that it's about to terminate its session with a peer.
In those cases, the node that plans to terminate the session can flush acknowledgement using a check-point request, same as described above. The sender SHOULD not send any further label or address-related messages after requesting shutdown check-pointing, so its saved state stays intact 🔒.
Here's the catch: that only gives you acknowledgement in one direction. The node being terminated also needs to verify that it has secured all the state its peer sent. That's done with a three-way handshake of the check-point, requested by an additional TLV (the Cork TLV) in the Keepalive message 🤝.
Further discussion of this feature is provided in section 5, "FT Operations" 📖.
4.7. Label Space Depletion and Replenishment
so when an LDP peer can't satisfy a Label Request message because it has no labels left, it sends a Notification message carrying the status code 'No label resources' 🚫. That warns the requesting peer that later Label Request messages will probably fail for the same reason. This message doesn't need to be acknowledged for FT purposes, since Label Request messages sent after session recovery will just get the same response. However, the peer that gets a 'No label resources' Notification stops sending Label Request messages until it receives a 'Label resources available' Notification message. Since this unsolicited Notification might get lost during a session failure, it can be protected using the procedures described in this document 🛡️.
There's also an alternative approach: an implementation may always assume labels are available when a session is re-established. In that case it might throw away the 'No label resources' information from the previous incarnation of the session, and it may end up sending a batch of LDP messages on session re-establishment that fail, even though it could have known they would fail 😬.
Note that the sender of a 'Label resources available' Notification message may choose whether to add a sequence number requesting acknowledgement. On the flip side, the receiver of a 'Label resources available' Notification message may choose to acknowledge it without actually saving any state 💜.
This is an implementation choice, made possible by making the FT parameters on the Notification message optional. Implementations will interoperate fully even if they take opposite approaches, but extra LDP messages might get sent unnecessarily on session recovery 🌈.
4.8. Tunneled LSPs
okay tunnels inside tunnels, let's gooo 🎀. The procedures in this document can be applied to LSPs that are tunnels, and to LSPs that are carried by tunnels. Remember that tunneled LSPs are managed by a single LDP session that runs end to end, while the tunnel is managed by a different LDP session for each hop along the path. A break in one of the sessions that manages the tunnel is likely to line up with a break in the session that manages the tunneled LSP. That's definitely the case when the LDP exchanges share a failed link, but it doesn't have to be, if the LDP messages got routed along a different path from the tunnel, or if the tunnel failure was caused by an LDP software failure at a transit LSR 🤔.
To keep the forwarding path of a tunneled LSP preserved, the forwarding path of the tunnel itself has to be preserved too. That means the tunnel must not be torn down if there's any session failure along its path. To make that happen, the label exchanges between each pair of LDP peers along the tunnel's path must use one of the procedures in this document or in [RFC3478] 🔗.
It's perfectly fine to mix the restart procedures used for the tunnel and for the tunneled LSP. For example, the tunnel could be set up using just check-pointing because it's a stable LSP, while the tunneled LSPs might use full FT procedures so they can recover active state 💅.
Lastly, it's permissible to carry tunneled LSPs that don't have FT protection inside an LSP that does have FT protection 🧚.
5. FT Operations
okay this is the big section and it's giving serious energy ⭐. Once an FT LDP session has been established, using the S bit in the FT Session TLV on the Session Initialization message as described in section 4.1, "Establishing an FT LDP Session", both LDP peers MUST apply the procedures in this section for FT LDP message exchanges 🫶.
If the LDP session has been negotiated to not use the LDP FT enhancements, these procedures MUST NOT be used 🚫.
5.1. FT LDP Messages
5.1.1 Sequence Numbered FT Label Messages
A label counts as a Sequence Numbered FT Label if the initial Label Request or Label Mapping message for that label carries the FT Protection TLV 🎀.
It's a valid implementation option to flag all labels as Sequence Numbered FT Labels. Honestly this might be the preferred option for implementations that want to use Keepalive messages carrying the FT Protection TLV to get periodic saves of the complete label forwarding state 💖.
If a label is a Sequence Numbered FT Label, all LDP messages affecting that label MUST carry the FT Protection TLV, so the state of the label can be recovered after a failure of the LDP session 🔥.
A further valid option is for no labels to be Sequence Numbered FT Labels. In that case, check-pointing using the Keepalive message applies to all messages exchanged on the session 🦋.
5.1.1.1 Scope of FT Labels
the FT/non-FT status of a label is scoped to the LDP message exchanges between a pair of LDP peers 🧚. That's the whole vibe.
In Ordered Control, when the message is forwarded downstream or upstream, the TLV may be present or absent, depending on the requirements of the LSR sending the message 🌸.
If a platform-wide label space is used for FT Labels, an FT Label value MUST NOT be reused until all LDP FT peers that the label was passed to have acknowledged the withdrawal of the FT Label. That acknowledgement can be explicit, through a LABEL WITHDRAW/LABEL RELEASE exchange, or implicit, if the LDP session is reconnected after a failure without the FT Reconnect Flag set 🔒. If the session isn't re-established within the Reconnection Timeout, a label MAY become available for re-use, as long as it isn't still in use on some other session 💜.
5.1.2 FT Address Messages
okay so if an LDP session is using the LDP FT enhancements, both LDP peers MUST secure Address and Address Withdraw messages using FT Operation ACKs (more on those in a sec 💅). that way there's zero confusion about whether an Address is still valid after the session reconnects 🫶
if an LSR figures out that an Address message it sent on a previous instantiation of a recovered LDP session is no longer valid, it MUST explicitly issue an Address Withdraw for that address when the session is reconnected. no leaving the old address hanging, periodt 💀
if the FT Reconnect Flag isn't set by both LDP peers when the session reconnects (aka the state wasn't preserved), both LDP peers MUST consider all Addresses to have been withdrawn 😭. the LDP peers SHOULD issue new Address messages for all their valid addresses, as specified in [RFC3036] ✨
5.1.3 Label Resources Available Notifications
in LDP, it's totally possible that a downstream LSR doesn't have any labels free to answer a Label Request 🥺. in that case, as specified in RFC 3036, the downstream LSR must respond with a Notification - No Label Resources message. the upstream LSR then pauses asking for new labels until it gets a Notification - Label Resources Available message from the downstream LSR 🌸
when the FT extensions are used on a session, implementations get to pick whether or not they want to secure their peer's label resource state 🦋. this choice changes how many LDP messages get incorrectly routed to a peer with depleted resources on session re-establishment, but it doesn't mess with interoperability otherwise. iconic of it to be a choice, honestly ✨
for full preservation of state:
- the downstream LSR must preserve the label availability state across a failover so that it remembers to send
Notification - Label Resources Availablewhen the resources become available 🎀. - the upstream LSR must recall the label availability state across failover so that it can optimize by not sending Label Requests when it recovers 🧚.
- the downstream LSR must use sequence numbers on
Notification - Label Resources Availableso that it can check that LSR A has received the message and clear its secured state, or resend the message if LSR A recovers without having received it 💜.
however, the following options also exist:
- the downstream LSR may choose to not include a sequence number on
Notification - Label Resources Available. this means that on session re-establishment it doesn't know what its peer thinks the LSR's resource state is, because the Notification may or may not have been delivered 🙈. such an implementation MUST begin recovered sessions by sending an additionalNotification - Label Resources Availableto reset its peer. - the upstream node may choose not to secure information about its peer's resource state. it would acknowledge a
Notification - Label Resources Available, but wouldn't save the information 🍓. such an implementation MUST assume that its peer's resource state has been reset to Label Resources Available when the session is re-established.
if the FT Reconnect Flag isn't set by both LDP peers upon reconnection of an LDP session (aka the state wasn't preserved), both LDP peers MUST consider the label availability state to have been reset, as if the session had been set up for the first time 🌈.
5.2. FT Operation ACKs
handshaking of FT LDP messages happens through ACKs 🤝. matching up the original message with its ACK is done with the FT Sequence Number inside the FT Protection TLV, which gets passed back in the FT ACK TLV. the FT ACK TLV can ride along on any LDP message sent over the TCP connection between LDP peers 💖.
each LDP peer keeps its own FT sequence number for every LDP session it's part of 👑. the FT Sequence Number goes up by one for each FT LDP message (aka any message containing the FT Protection TLV) that this LSR sends on the FT LDP session that number belongs to 🔢.
when an LDP peer receives a message containing the FT Protection TLV, it MUST take steps to secure that message (or the state information it derived from processing the message) 🔐. once the message is secured, it MUST be ACKed. however, the LSR doesn't have to send that ACK right away ⏳.
ACKs can be accumulated to cut down on the message flow between LDP peers ✨. for example, if an LSR got FT LDP messages with sequence numbers 1, 2, 3, 4, it could send one single ACK with sequence number 4 to confirm receipt and securing of all of them 🦋. there's no protocol reason why the number of accumulated ACKs, or how long an ACK gets deferred, shouldn't be allowed to get relatively large 🌸.
ACKs MUST NOT be sent out of sequence, because that doesn't play nicely with accumulated ACKs 🙅♀️. duplicate ACKs (that is, two successive messages that acknowledge the same sequence number) are acceptable 🫶.
if an LDP peer finds that its sequence number space for a specific session is full of un-acknowledged sequence numbers (because its partner on the session hasn't acknowledged them in a timely way), it can't allocate a new sequence number for any further FT LPD message 😩. it SHOULD send a Notification message with the status code 'FT Seq Numbers Exhausted'.
5.3. Preservation of FT State
if the LDP FT enhancements are in use on an LDP session, each LDP peer SHOULD NOT release the state information and resources associated with FT Labels exchanged on that LDP session when the TCP connection fails 🧊. this goes against [RFC3036], but it lets label operations on FT Labels get finished after the TCP connection is back up 💅.
both LDP peers on an LDP session using the LDP FT enhancements SHOULD preserve the state information and resources they hold for that LDP session, as described below 👑.
- an upstream LDP peer SHOULD release the resources (especially bandwidth) associated with a Sequence Numbered FT Label when it initiates a Label Release or Label Abort message for the label. the upstream LDP peer MUST preserve state information for the Sequence Numbered FT Label, even if it releases the resources associated with the label, because it may need to reissue the label operation if the TCP connection gets interrupted 🎀.
- an upstream LDP peer MUST release the state information and resources associated with a Sequence Numbered FT Label when it receives an acknowledgement to a Label Release or Label Abort message it sent for the label, or when it sends a Label Release message in response to a Label Withdraw message received from the downstream LDP peer 🧹.
- a downstream LDP peer SHOULD NOT release the resources associated with a Sequence Numbered FT Label when it sends a Label Withdraw message for the label, since it hasn't received confirmation yet that the upstream LDP peer has stopped sending data using the label 🥹. the downstream LDP peer MUST NOT release the state information it holds for the label, because it may still have to reissue the label operation if the TCP connection gets interrupted 🙈.
- a downstream LDP peer MUST release the resources and state information associated with a Sequence Numbered FT Label when it receives an acknowledgement to a Label Withdraw message for the label 💜.
- when the FT Reconnection Timeout expires, an LSR SHOULD release all state information and resources from previous instantiations of the (permanently) failed LDP session 🌈.
- either LDP peer MAY elect to release state information based on its internal knowledge of the loss of integrity of the state information, or an inability to pend (or queue) LDP operations (as described in section 5.4.1, "LDP Operations During TCP Failure") during a TCP failure ⚡. that means the peer isn't required to wait out the whole FT Reconnection Timeout before releasing state. the timeout is just an upper limit on how long state can stick around 🕰️. however, if a peer releases state before the Reconnection Timeout expires, it MUST NOT re-use any label that was in use on the session until the Reconnection Timeout has expired 🚫.
- when an LSR receives a Status TLV with the E-bit set in the status code, which makes it close the TCP connection, the LSR MUST release all state information and resources associated with the session 💀. this is mandated because the LSR can't predict the precise state and future behavior of the partner LSR that set the E-bit without knowing how that partner LSR is implemented.
note that the 'Temporary Shutdown' status code does NOT have the E-bit set, and it MAY be used during maintenance or upgrade operations to show that the LSR intends to preserve state across a closure and re-establishment of the TCP session 🛠️✨.
- if an LSR decides it must release state for any single FT Label during a failure of the TCP connection that label was exchanged on, it MUST release all state for all labels on the LDP session 😤.
the release of state information and resources associated with non-FT labels works the way it does in [RFC3036] 🌸.
note that a Label Release and the acknowledgement to a Label Withdraw may arrive at a downstream LSR in any order 🔀. the downstream LSR MAY release its resources upon receiving the first message, and it MUST release its resources upon receiving the second message 💅.
5.4. FT Procedure After TCP Failure
when an LSR discovers or gets notified of a TCP connection failure, it SHOULD start an FT Reconnection Timer to give the TCP connection between the LDP peers some time to come back ⏰.
the RECOMMENDED default value for this timer is 5 seconds ⏱️. during this time, the failure has to be detected and reported, new hardware might need to be activated, software state has to be audited, and a new TCP session has to be set up. that's a LOT to do in 5 seconds, bestie 😭.
once the TCP connection between LDP peers has failed, the active LSR SHOULD attempt to re-establish it 🔁. the mechanisms, timers and retry counts for re-establishing the TCP connection are an implementation choice 🎀. it is RECOMMENDED that any attempt to re-establish the connection takes into account the failover processing needed on the peer LSR, the nature of the network between the LDP peers, and the FT Reconnection Timeout chosen on the previous instantiation of the TCP connection (if there was one) 🧠.
if the TCP connection can't be re-established within the FT Reconnection Timeout period, the LSR that detects this timeout SHOULD release all state preserved for the failed LDP session 🧹. if the TCP connection is re-established later (for example, after a further Hello exchange to set up a new LDP session), the LSR MUST set the FT Reconnect Flag to 0 if it released the preserved state information on this timeout event 🚩.
if the TCP connection is successfully re-established within the FT Reconnection Timeout, both peers MUST re-issue the LDP operations that were interrupted by (that is, un-acknowledged as a result of) the TCP connection failure 🔄. this procedure is described in section 5.5, "FT Procedure After TCP Re-connection" 📖.
the Hold Timer for an FT LDP Session (see [RFC3036] section 2.5.5) SHOULD be ignored while the FT Reconnection Timer is running ⏸️. the hold timer SHOULD be restarted when the TCP connection is re-established 💜.
5.4.1. FT LDP Operations During TCP Failure
okay so when the LDP FT enhancements are in use for a session, an LSR can figure out that it needs to send an LDP message to a peer, but the TCP connection to that peer is down rn 😭 these label ops change the FT Labels that were preserved for the failed TCP connection, so the state changes have to reach the LDP peer once TCP is back 💅
If an LSR decides it needs to issue a new FT LDP operation to an LDP peer whose TCP connection is failed, it MUST pend the operation (e.g. on a queue) and complete that operation with the LDP peer when the TCP connection is restored, unless a later extra operation during the TCP failure overrides it (see section 5.5, "FT Procedure After TCP Re-connection") 🦋
if, during TCP Failure, an LSR decides it can't pend an operation that it can't just fail (like a Label Withdraw, Release or Abort), it MUST NOT try to re-establish the previous LDP session 🙈 the LSR MUST act like the Reconnection Timer expired and release all state info about the LDP peer. an LSR might be unable (or unwilling) to pend ops 💀 for example, if a major routing transition happened while TCP was down between LDP peers, it could cause a huge pile of FT LDP Operations. an LSR that releases state before the Reconnection Timeout expires MUST NOT re-use any label that was in use on the session until the Reconnection Timeout has expired 🔒
in ordered operation, received FT LDP operations that can't be correctly forwarded because of a TCP connection failure MAY be processed right away (as long as enough state is kept to forward the label operation), or pended until the onward TCP connection is restored and the operation can be correctly forwarded upstream or downstream 🌸 operations on existing FT Labels SHOULD NOT be failed during TCP session failure, bestie 🫶
it is RECOMMENDED that Label Request operations for new FT Labels not be pended while waiting for the TCP connection to come back, the one that's being recovered when the LSR decides it needs to issue the Label Request message ✨ instead, those Label Request operations SHOULD be failed and, if needed, a notification message containing the 'No LDP Session' status code gets sent upstream 🍓
Label Requests for new non-FT Labels MUST be rejected during TCP connection failure, as specified in [RFC3036] 💅
5.5. FT Procedure After TCP Re-connection
the FT operation handshaking we talked about means that all state changes for Sequence Numbered FT Labels and Address messages are either confirmed or reproducible at each LSR 🎀
if the TCP connection between LDP peers fails but gets re-connected within the FT Reconnection Timeout, and both LSRs have indicated they will be re-establishing the previous LDP session, both LDP peers on the connection MUST finish any label operations for Sequence Numbered FT Labels that got interrupted by the failure and re-connection of the TCP connection 👑
the procedures for FT Reconnection Timeout MAY have been invoked because either LDP peer was unable (or unwilling) to pend operations that happened during the TCP Failure (as described in section 5.4.1, "LDP Operations During TCP Failure") 🌈
if, for any reason, an LSR couldn't pend operations with respect to an LDP peer, as described in section 5.4.1, "LDP Operations During TCP Failure", the LSR MUST set the FT Reconnect Flag to 0 on re-connection to that LDP peer, which means no FT state was preserved 😭
label operations get completed using the following procedure 💖
5.5.1. Re-Issuing FT Messages
okay so when the TCP connection between LDP peers is restored, any LDP messages for Sequence Numbered FT Labels that got lost because of the TCP connection failure get re-issued 🦋 the LDP peer that receives a re-issued message processes it as if it was received for the first time ✨
"Net-zero" combinations of messages don't need to be re-issued after the TCP connection between LDP peers is re-established 🙈 this leads to the following rules for re-issuing messages that the LDP peer didn't ACK in the LDP Initialization message exchange after the TCP session is re-connected:
- A Label Request message MUST be re-issued unless a Label Abort would be re-issued for the same Sequence Numbered FT Label. 💅
- A Label Mapping message MUST be re-issued unless a Label Withdraw message would be re-issued for the same Sequence Numbered FT Label. 🫶
- All other messages on the LDP session that were sent and carried the FT Protection TLV MUST be re-issued if an acknowledgement was not previously received. 🔥
any FT Label operations that were pended (see section 5.4.1, "LDP Operations During TCP Failure") during the TCP connection failure MUST also be issued when the LDP session is re-established, except where they're part of a "net-zero" combination of messages according to the rules above 🌸
figuring out "net-zero" FT Label operations using the rules above MAY be done on pended messages before the TCP connection is re-established, so queue resources get used well 🧚 but messages that were sent to the LDP peer before the TCP connection failure, or pended messages that were paired with them, MUST NOT be optimized this way until an FT ACK TLV is received from the LDP peer 🙈 that ACK lets the LSR tell which messages the LDP peer received before the TCP connection failure ✨
6. Check-Pointing Procedures ✨
Check-Pointing can be selected independently from the FT procedures above by using the C bit in the FT Session TLV on the Session Initialization message 🎀 but honestly, check-pointing is an integral part of the FT procedures. setting both the S and the C bit does the same thing as setting just the S bit 💅
if the C bit is set but the S bit isn't, no label is a Sequence Numbered FT Label. instead, all labels are Check-Pointable FT Labels 🦋 check-pointing is used to synchronize all label exchanges. no message, apart from the check-point request and acknowledgement, carries an active sequence number. (fyi the Session Initialization message may carry a sequence number to confirm that the check-point is still in place 🫶)
it's an implementation matter to decide the ordering of received messages and check-point requests, so that check-point acknowledgements are secured 🌈
if the S and C bits are both set, or only the S bit is set, check-pointing applies only to Sequence Numbered FT Labels and to address messages 👑 the set of all messages checkpointed this way is called the Check-Pointable Messages 💜
6.1 Check-Pointing with the Keepalive Message
if an LSR receives an FT Protection TLV on a Keepalive message, that's a request to flush the acknowledgements for all previously received Check-Pointable Messages on the session 🔥
as soon as the LSR has finished securing the Check-Pointable Messages (or the state changes that came from those messages) received before the Keepalive, it MUST send an acknowledgement to the sequence number of the Keepalive message 💖
if the FT procedures are in use and acknowledgements have been stored up, this might happen right when the Keepalive shows up ✨
an example message flow showing this use of the Keepalive message to do a periodic check-point of state is in section 9.2, "Use of Check-Pointing With FT Procedures" 🧚
an example message flow showing check-pointing without the FT procedures is in section 9.5, "Check-Pointing Without FT Procedures" 🌸
6.2 Quiesce and Keepalive
if the Keepalive Message also contains the FT Cork TLV, that means the peer LSR wants to quiesce the session before a graceful restart 😭
it is RECOMMENDED that, upon receiving a Keepalive with the FT CORK TLV, an LSR should stop sending any more label or address related messages on the session until it has been disconnected and reconnected, except for messages generated while processing and securing previously unacknowledged messages received from the peer that asked for the quiesce 🫶 it should also try to finish that processing and send back a Keepalive with the FT ACK TLV as soon as possible so the session can be quiesced 🎀
an example message flow showing this use of the FT Cork TLV for a three-way handshake of state synchronization between two LDP peers is in section 9.4, "Temporary Shutdown With FT Procedures and Check-Pointing" 👑
7. Changes to Existing Messages 💅
7.1. LDP Initialization Message
the LDP FT enhancements add the following optional parameters to an LDP Initialization message 🦋
Optional Parameter Length Value
FT Session TLV 4 See Below
FT ACK TLV 4 See Belowthe encoding for these TLVs is in Section 8, "New Fields and Values" ✨
FT Session TLV: if present, specifies the FT behavior of the LDP session 🧚
FT ACK TLV: if present, specifies the last FT message that the sending LDP peer was able to secure before the failure of the previous instantiation of the LDP session. this TLV is only present if the FT Reconnect flag is set in the FT Session TLV, and in that case this TLV MUST be present 🔥
7.2. LDP Keepalive Messages
the LDP FT enhancements add the following optional parameters to an LDP Keepalive message 🌈
Optional Parameter Length Value
FT Protection TLV 4 See below
FT Cork TLV 0 See below
FT ACK TLV 4 See belowthe encoding for these TLVs is in Section 8, "New Fields and Values" 🎀
FT Protection TLV: if present, specifies the FT Sequence Number for the LDP message. when it shows up on a Keepalive message, it means a solicited flush of the acknowledgements to all previous LDP messages that have sequence numbers and were issued by the sender of the Keepalive on the same session 💖
FT Cork TLV: means the remote LSR wants to quiesce the LDP session. check section 5, "FT Operations", for the recommended action in these cases 🫶
FT ACK TLV: if present, specifies the most recent FT message that the sending LDP peer has been able to secure 🌸
7.3. All Other LDP Session Messages
the LDP FT enhancements add the following optional parameters to all other message types that flow on an LDP session after the LDP Initialization message 💅
Optional Parameter Length Value
FT Protection TLV 4 See below
FT ACK TLV 4 See belowthe encoding for these TLVs is in section 8, "New Fields and Values" ✨
FT Protection TLV: if present, specifies the FT Sequence Number for the LDP message 🧚
FT ACK TLV: if present, identifies the most recent FT LDP message ACKed by the sending LDP peer 🦋
8. New Fields and Values 🌸
8.1. Status Codes ✨
okay bestie, these are the brand new status codes for the LDP FT enhancements 💅 They all ride along in the Status TLV of a Notification message 🫶
The E column is the setting the Status Code E-bit has to be, and the Status Data column is the 30-bit Status Data value in the Status Code TLV 🔥
Quick note on the F-bit: whoever is sending the Status TLV gets to decide it 🙈 BUT it is RECOMMENDED that the F-bit is not set on Notification messages with status codes other than 'No LDP Session', because duplicating messages SHOULD stay a per-hop behavior ✨
Status Code E Status Data
No LDP Session 0 0x0000001A
Zero FT seqnum 1 0x0000001B
Unexpected TLV / 1 0x0000001C
Session Not FT
Unexpected TLV / 1 0x0000001D
Label Not FT
Missing FT Protection TLV 1 0x0000001E
FT ACK sequence error 1 0x0000001F
Temporary Shutdown 0 0x00000020
FT Seq Numbers Exhausted 1 0x00000021
FT Session parameters / 1 0x00000022
changed
Unexpected FT Cork TLV 1 0x00000023The 'Temporary Shutdown' status code SHOULD be used instead of the 'Shutdown' status code (the one with the E-bit set) when the LSR going down wants to tell its LDP peer that it expects to preserve FT Label state and be back in service before the FT Reconnection Timer runs out. 🦋
8.2. FT Session TLV
okay so LDP peers can negotiate whether their session supports the FT extensions by using a new OPTIONAL parameter, the FT Session TLV, on LDP Initialization Messages 💜
Here's how the FT Session TLV is laid out 🎀
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|1|0| FT Session TLV (0x0503) | Length (= 12) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FT Flags | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FT Reconnect Timeout (in milliseconds) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Recovery Time (in milliseconds) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+FT Flags 🌸
The FT Flags field is a 16-bit field that shows the different FT attributes this LDP session supports 💖 It's formatted like this:
0 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|R| Reserved |S|A|C|L|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+R: FT Reconnect Flag. This gets set to 1 if the sending LSR has kept state and resources for every FT-label since the last LDP session between the same LDP peers. Otherwise it's 0 🔥 Check section 5.4, "FT Procedures After TCP Failure", for the full scoop on how this one is used.
Big deal, bestie: if the FT Reconnect Flag is set, the sending LSR MUST include an FT ACK TLV on the LDP Initialization message 🚨
S: Save State Flag. This gets set to 1 if the FT Protection TLV is supported on messages other than the KeepAlive message used for check-pointing (see the C bit) 💅 In other words, the S bit tells you some label on the session might be a Sequence Numbered FT Label ✨
A: All-Label Protection Required. This gets set to 1 if every label on the session MUST be treated as a Sequence Numbered FT Label 👑 It takes away the option of treating some labels as FT Labels and others as non-FT Labels.
Knowing this might help a peer make some optimizations in how it processes stuff 🧚
The A bit only means something if the S bit is set 🙈
C: Check-Pointing Flag. This gets set to 1 to show that the check-pointing procedures in this document are in use 🦋
If the S bit is also set to 1, then the C bit means check-pointing only applies to Sequence Numbered FT Labels 💜
If the S bit is set to 0 (zero), then the C bit means check-pointing applies to all labels. All labels are Check-Pointable FT Labels ✨
L: Learn From Network Flag. This gets set to 1 if the Fault Recovery procedures of [RFC3478] are going to be used to re-learn state from the network 🌈
It is not valid for all of the S, C and L bits to be zero 😭
It is not valid for both the L bit and either the S or C bit to be set to 1 😭
All other bits in this field are currently reserved and SHOULD be set to zero on transmission and ignored upon receipt. 🫶
Here's the cheat sheet for all those bit combos 🍓
S A C L Comments
=========================
0 x 0 0 Invalid
0 0 0 1 See [RFC3478]
0 1 0 1 Invalid
0 x 1 0 Check-Pointing of all labels
0 x 1 1 Invalid
1 0 0 0 Full FT on selected labels
1 1 0 0 Full FT on all labels
1 x 0 1 Invalid
1 x 1 0 Same as (S=1,A=x,C=0,L=0)
1 x 1 1 Invalid.FT Reconnection Timeout ⏰
If the S bit or the C bit in the FT Flags field is set, this tells you how long the sending LSR will keep state and resources for FT Labels exchanged on the previous instance of an FT LDP session that just failed 💖 The timeout is a 32-bit unsigned integer in milliseconds.
A value of zero here means the sending LSR keeps state and resources indefinitely ♾️
Check section 4.4 for how this field gets used 🎀
If the L bit is set to 1 in the FT Flags field, the meaning of this field is defined in [RFC3478] 🌸
Recovery Time 🌈
The Recovery Time only means something if the L bit is set in the FT Flags. The meaning is defined in [RFC3478] ✨
8.3. FT Protection TLV
LDP peers use the FT Protection TLV to say that an LDP message carries an FT label operation 💜
Here's the rule, bestie: the FT Protection TLV MUST NOT be used in messages flowing on an LDP session that doesn't support the LDP FT enhancements 🚫 If it shows up in one anyway, the receiving LDP peer SHALL treat it as a protocol error and SHOULD send a Notification message with the 'Unexpected TLV Session Not FT' status code 😭 LSRs that don't recognize this TLV SHOULD respond with a Notification message with the 'Unknown TLV' status code 💀
After the initial exchange of LDP Initialization messages, the FT Protection TLV MAY be carried on an LDP message sent over the LDP session 🦋 Specifically, this TLV MAY optionally be present on these messages:
- Label Request Messages in downstream on-demand distribution mode.
- Label Mapping messages in downstream unsolicited mode.
- Keepalive messages used to request flushing of acknowledgement of all previous messages that contained this TLV.
If a label is going to be a Sequence Numbered FT Label, then the Protection TLV MUST be present:
- on the Label Request message in downstream on-demand distribution mode.
- on the Label Mapping message in downstream unsolicited distribution mode.
- on all subsequent messages concerning this label.
"Subsequent messages concerning this label" just means any message whose Label TLV names this label, or whose Label Request Message ID TLV names the initial Label Request message 🧚
If a label is NOT going to be a Sequence Numbered FT Label, then the Protection TLV MUST NOT be present on any of the messages that relate to that label 🙅♀️ If the FT TLV shows up on a message about a non-FT Label, the receiving LDP peer SHALL treat it as a protocol error and SHOULD send a Notification message with the 'Unexpected TLV Label Not FT' status code 🔥
When a Label Withdraw or Label Release message has only an FEC TLV and doesn't point to one specific label, the FT TLV should be included if any label affected by the message is a Sequence Numbered FT Label 💅 If you're not sure whether an FT TLV should be there, it is RECOMMENDED that the sender adds the TLV 🫶
When an LDP peer gets a Label Withdraw Message or Label Release message that contains only a FEC, it SHALL accept the FT TLV if it's present, no matter the FT status of the labels it affects 🌈
If an LDP session is an FT session (figured out by the presence of the FT Session TLV, with the S bit set on the LDP Initialization messages), then the FT Protection TLV MUST be present on all Address messages on the session 👑
If the session is an FT session, the FT Protection TLV may also optionally be present:
- on Notification messages on the session that have the status code 'Label Resources Available'.
- on Keepalive messages.
Here's how the FT Protection TLV is laid out 🎀
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|0| FT Protection (0x0203) | Length (= 4) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FT Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+FT Sequence Number 🔢
This is the sequence number for this Sequence Numbered FT Label operation 💖 It's a 32-bit unsigned integer. On a brand new LDP session it starts at 0x00000001, and it goes up by one for every FT LDP message the sending LSR sends on this session ✨ It can wrap from 0xFFFFFFFF back to 0x00000001 🌀
Watch this one: this field MUST be reset to 0x00000001 if either LDP peer doesn't set the FT Reconnect Flag when the TCP connection is re-established 🚨
Check section 5.2, "FT Operation Acks", for how this field gets used 🦋
The special use of 0x00000000 is covered in section 8.4, "FT ACK TLV", below 🧚
If an LSR gets an FT Protection TLV on a session that doesn't support the FT LDP enhancements, it SHOULD send a Notification message to its LDP peer containing the 'Unexpected TLV, Session Not FT' status code 💀 LSRs that don't recognize this TLV SHOULD respond with a Notification message with the 'Unknown TLV' status code 🙈
If an LSR gets an FT Protection TLV on an operation affecting a label it believes is a non-FT Label, it SHOULD send a Notification message to its LDP peer containing the 'Unexpected TLV, Label Not FT' status code 🔥
If an LSR gets a message without the FT Protection TLV that affects a label it believes is a Sequence Numbered FT Label, it SHOULD send a Notification message to its LDP peer containing the 'Missing FT Protection TLV' status code 😭
Last one, bestie: if an LSR gets an FT Protection TLV containing a zero FT Sequence Number, it SHOULD send a Notification message to its LDP peer containing the 'Zero FT Seqnum' status code 💜
8.4. FT ACK TLV 💌
okay bestie, the FT ACK TLV is how LDP peers say "got it, and I've saved it safely" 🫶 It's giving receipt energy, and it's how the two peers keep track of what's been secured. 💅
The FT ACK TLV MUST NOT be used in messages flowing on an LDP session that does not support the LDP FT enhancements. If it shows up on one of those messages anyway, the receiving LDP peer SHALL treat it as a protocol error 🙈 not me putting an ACK on a session that can't even handle it!!
The FT ACK TLV MAY be present on any LDP message exchanged on an LDP session after the initial LDP Initialization messages. It is RECOMMENDED that you include the FT ACK TLV in all FT Keepalive messages, so the LDP peers don't build up a huge pile of unacknowledged state info 📦✨
The FT ACK TLV is encoded like this 👇
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|0| FT ACK (0x0504) | Length (= 4) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FT ACK Sequence Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+FT ACK Sequence Number 🔢
This is the sequence number for the most recent FT label message that the sending LDP peer got from the receiving LDP peer AND secured against LDP session failure. The sending peer doesn't have to fully process a message before ACKing it. For example, an LSR MAY ACK a Label Request message as soon as it has securely recorded it, without waiting until it can send the Label Mapping message in response. Efficient, no cap 🧚
ACKs are cumulative, so they stack up like a pile of receipts 🧾 Getting an LDP message with an FT ACK TLV whose FT ACK Sequence Number is 12 counts as acknowledging every message from 1 to 12 inclusive (assuming the LDP session started at sequence number 1).
This field MUST be set to 0 if the LSR sending the FT ACK TLV hasn't received any FT label operations on this LDP session. That goes for brand-new LDP sessions, new LDP peers, or after an LSR decides it has to drop all state for a failed TCP connection. Fresh start, fresh zero 🌸
For how this field gets used, check out section 5.2, "FT Operation Acks" 📖
If an LSR gets an FT ACK TLV whose FT ACK Sequence Number is less than the previously received FT ACK Sequence Number (remembering to account for wrapping), it SHOULD send a Notification message to its LDP peer containing the 'FT ACK Sequence Error' status code. That's a whole mess, bestie 😭
8.5. FT Cork TLV 🍾
LDP peers use the FT Cork TLV on FT Keepalive messages to say they want to quiesce the LDP session before a controlled shutdown and restart. An example would be during a control-plane software upgrade 🔧💖
The FT Cork TLV is encoded like this 👇
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|0| FT Cork (0x0505) | Length (= 0) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Once an LSR receives a Keepalive message with the FT Cork TLV and the FT Protection TLV, it SHOULD do the following:
- Process and secure any messages from the peer LSR that have sequence numbers less than (accounting for wrap) the one in the FT Protection TLV on that Keepalive message.
- Send a Keepalive message back to the peer with the FT Cork TLV and the FT ACK TLV. Set the FT ACK sequence number to match the original Keepalive message, which means ACKing everything up to that point 💌
- If this LSR still hasn't gotten an FT ACK for all the messages it sent containing the FT Protection TLV, then also include an FT Protection TLV on the Keepalive it sends to the peer LSR. That tells the remote peer "I've saved my state before quiescing, but I'm still waiting to hear that you've saved yours" 👀
- Stop sending any further state-changing messages on this LDP session until it has been disconnected and recovered. Radio silence, periodt 🤐
When an LSR gets a Keepalive message with the FT Cork TLV and an FT ACK TLV that acknowledges the Keepalive it sent earlier with the FT Cork TLV, it knows quiesce is complete ✨ If the Keepalive it just received also carries the FT Protection TLV, the LSR must respond with one more Keepalive to finish the 3-way handshake 🤝 After that, it SHOULD send a "Temporary Shutdown" Notification message, disconnect the TCP session, and handle whatever control-plane actions the session shutdown needs.
You can see an example of this 3-way handshake for controlled shutdown in section section 9.4, "Temporary Shutdown With FT Procedures and Check-Pointing" 🎀
If an LSR gets a message that should not carry the FT Cork TLV, or if the FT Cork TLV shows up on a Keepalive message without one of the FT Protection or FT ACK TLVs, it SHOULD send a Notification message to its LDP peer containing the 'Unexpected FT Cork TLV' status code. Gatekeeping, but make it cute 💅
9. Example Use 🦋
Okay, time for the fun part! ✨ Picture two LDP peers, P1 and P2, running LDP over a TCP connection between them, with the message flow shown below.
The parameters on each message are written like this:
message (label, senders FT sequence number, FT ACK number)A "-" for the FT ACK number means that message doesn't include an FT ACK TLV. "n/a" means that parameter doesn't apply to that message type 🧩
In the diagrams, time flows from top to bottom, and each message's position shows when it gets sent. The notes explain when each message is received, secured for FT, or processed, so read those too 📝
9.1. Session Failure and Recovery - FT Procedures 🌈
notes P1 P2
===== == ==
(1) Label Request(L1,27,-)
--------------------------->
Label Request(L2,28,-)
--------------------------->
(2) Label Request(L3,93,27)
<---------------------------
(3) Label Request(L1,123,-)
-------------------------->
Label Request(L2,124,-)
-------------------------->
(4) Label Mapping(L1,57,-)
<--------------------------
Label Mapping(L1,94,28)
<---------------------------
(5) Label Mapping(L2,58,-)
<--------------------------
Label Mapping(L2,95,-)
<---------------------------
(6) Address(n/a,29,-)
--------------------------->
(7) Label Request(L4,30,-)
--------------------------->
(8) Keepalive(n/a,-,94)
--------------------------->
(9) Label Abort(L3,96,-)
<---------------------------
(10) ===== TCP Session lost =====
:
(11) : Label Withdraw(L1,59,-)
: <--------------------------
:
(12) === TCP Session restored ===
LDP Init(n/a,n/a,94)
--------------------------->
LDP Init(n/a,n/a,29)
<---------------------------
(13) Label Request(L4,30,-)
--------------------------->
(14) Label Mapping(L2,95,-)
<---------------------------
Label Abort(L3,96,30)
<---------------------------
(15) Label Withdraw(L1,97,-)
<---------------------------Notes:
- P1 sends 2 new Label Requests, using the next sequence numbers. Assume the LDP session is already initialized 🌱
- P2 sends a Label Request to P1. When it sends this, P2 has already secured the Label Request for L1 from P1, so it includes an ACK for that message 💌
- P2 processes the Label Requests for L1 and L2 and forwards them downstream. The diagram doesn't show the details of that downstream processing 🫣
- P2 gets a Label Mapping from downstream for L1 and forwards it to P1. It also includes an ACK for the Label Request for L2, since that message has now been secured and processed ✨
- P2 gets the Label Mapping for L2 and forwards it to P1. This time there's no ACK, because P2 hasn't received any more messages from P1 🤷♀️
- Meanwhile, P1 sends a new Address Message to P2 📬
- P1 also sends a fourth Label Request to P2 🙌
- P1 sends a Keepalive message to P2. It includes an ACK for the Label Mapping for L1, which is the latest message P1 has received and secured at the time the Keepalive is sent 💖
- P2 issues a Label Abort for L3 🚫
- Now the TCP session goes down 😭
- While the TCP session is down, P2 gets a Label Withdraw message for L1 and queues it up 📥
- The TCP session comes back, and P1 and P2 exchange LDP Initialization messages on the recovered session. These include ACKs for the last message each peer received and secured before the failure 🎉
- From the LDP Init exchange, P1 figures out it needs to re-issue the Label Request for L4 🔁
- Similarly, P2 figures out it needs to re-issue the Label Mapping for L2 and the Label Abort 🔁
- P2 sends the queued Label Withdraw to P1 🎀
9.2. Use of Check-Pointing With FT Procedures ✨
okay so this one is the check-pointing example and it's giving sync, bestie 🫶 here's the whole flow:
notes P1 P2
===== == ==
(1) Label Request(L1,27,-)
--------------------------->
Label Request(L2,28,-)
--------------------------->
(2) Label Request(L3,93,-)
<---------------------------
(3) Label Request(L1,123,-)
-------------------------->
Label Request(L2,124,-)
-------------------------->
(4) Label Mapping(L1,57,-)
<--------------------------
Label Mapping(L1,94,-)
<---------------------------
(5) Label Mapping(L2,58,-)
<--------------------------
Label Mapping(L2,95,-)
<---------------------------
(6) Address(n/a,29,-)
--------------------------->
(7) Label Request(L4,30,-)
--------------------------->
(8) Keepalive(n/a,31,-)
--------------------------->
(9) Keepalive(n/a,-,31)
<---------------------------
(10) Keepalive(n/a,59,124)
<---------------------------
(11) Keepalive(n/a,-,59)
--------------------------->Notes:
Notes (1) through (7) are the same as in the previous example, except there are no acknowledgements piggy-backed on messages going the other way. So by note (8), both links have deferred acknowledgements sitting in both directions. literally so much pending 😭
(8) P1 wants to sync state with P2 🌸 so it sends a Keepalive carrying an FT Protection TLV with sequence number 31. It doesn't care what P2 thinks it has stored, so there's no FT ACK TLV in there.
(9) P2 replies right away with a Keepalive that acknowledges the sequence number from the Keepalive it just got. That's P2 telling P1 "yep, I've kept everything you've sent me on this session" ✨
(10) the downstream node wants to sync with P2 too 💅 so it sends a Keepalive with an FT Protection TLV at sequence number 59. P3 also uses the moment to catch up on its acknowledgements to P2, so it includes an FT ACK TLV acknowledging up to sequence number 124. multitasking queen 👑
(11) P2 answers immediately with a Keepalive acknowledging the sequence number from the Keepalive it received. ✔️
9.3. Temporary Shutdown With FT Procedures 🦋
notes P1 P2
===== == ==
(1) Label Request(L1,27,-)
--------------------------->
Label Request(L2,28,-)
--------------------------->
(2) Label Request(L3,93,27)
<---------------------------
(3) Label Request(L1,123,-)
-------------------------->
Label Request(L2,124,-)
-------------------------->
(4) Label Mapping(L1,57,-)
<--------------------------
Label Mapping(L1,94,28)
<---------------------------
(5) Label Mapping(L2,58,-)
<--------------------------
Label Mapping(L2,95,-)
<---------------------------
(6) Address(n/a,29,-)
--------------------------->
(7) Label Request(L4,30,-)
--------------------------->
(8) Keepalive(n/a,-,94)
--------------------------->
(9) Label Abort(L3,96,-)
<---------------------------
(10) Notification(Temporary shutdown)
--------------------------->
===== TCP Session shutdown =====
:
(11) : Label Withdraw(L1,59,-)
: <--------------------------
:
===== TCP Session restored =====
(12) LDP Init(n/a,n/a,94)
--------------------------->
LDP Init(n/a,n/a,29)
<---------------------------
(13) Label Request(L4,30,-)
--------------------------->
(14) Label Mapping(L2,95,-)
<---------------------------
Label Abort(L3,96,30)
<---------------------------
(15) Label Withdraw(L1,97,-)
<---------------------------Notes:
Notes are the same as in the previous example, except for this bit 👇
(10) P1 needs to upgrade its software or hardware 🛠️ so it sends a Notification to end the LDP session, but it sets the status code to 'Temporary shutdown'. That tells P2 this isn't a fatal error, and P2 should keep its FT state around. The TCP connection might also fail while the LDP session is down (in which case it has to be re-established), but it's also possible the TCP connection survives. no cap, both outcomes are on the table 🙈
9.4. Temporary Shutdown With FT Procedures and Check-Pointing 🧚
notes P1 P2
===== == ==
(1) Label Request(L1,27,-)
--------------------------->
Label Request(L2,28,-)
--------------------------->
(2) Label Request(L3,93,-)
<---------------------------
Label Request(L1,123,-)
-------------------------->
Label Request(L2,124,-)
-------------------------->
Label Mapping(L1,57,-)
<--------------------------
(3) Label Mapping(L1,94,-)
<---------------------------
Label Mapping(L2,58,-)
<--------------------------
Label Mapping(L2,95,-)
<---------------------------
(4) Address(n/a,29,-)
--------------------------->
(5) Label Request(L4,30,-)
--------------------------->
(6) Keepalive(n/a,31,95) * with FT Cork TLV *
--------------------------->
(7) Label Abort(L3,96,-)
<---------------------------
(8) Keepalive(n/a,97,31) * with FT Cork TLV *
<---------------------------
(9) Keepalive(n/a,-,97) * with FT Cork TLV *
--------------------------->
(10) Notification(Temporary shutdown)
--------------------------->
===== TCP Session shutdown =====
:
: Label Withdraw(L1,59,-)
: <--------------------------
:
===== TCP Session restored =====
(11) LDP Init(n/a,n/a,96)
--------------------------->
LDP Init(n/a,n/a,31)
<---------------------------
Label Withdraw(L1,97,-)
<---------------------------Notes:
This one runs pretty much like the last example, with a twist ✨ At (1), (2), (3), (4) and (5), nobody sends any acknowledgements.
At (6), P1 decides a graceful shutdown is needed 🌈 so it sends a Keepalive that acknowledges everything it has received so far, and that Keepalive also carries an FT Protection TLV number plus the FT Cork TLV.
The Label Abort at (7) crosses paths with that Keepalive, so at (8) P2 sends back a Keepalive that acknowledges every message received so far. It also includes the FT Protection and FT Cork TLVs, which signal that some messages are still waiting to be acknowledged. so many acks flying around 😭💜
P1 then gets to finish the 3-way handshake at (9) 🤝 and close the TCP session at (10).
When things recover at (11), there's nothing to re-send, because the KeepAlives already flushed out the acknowledgements 💅 The only message sent after recovery is the Label Withdraw that got held back while the TCP session was down. the way that's so clean 🫶
9.5. Check-Pointing Without FT Procedures ✨
okay so this one is about check-pointing when FT procedures are not in play 🦋 Both peers still talk, do label stuff, and send check-point requests, but the session just dies at one point and comes back. Here's the whole flow, bestie 💖
notes P1 P2
===== == ==
(1) Label Request(L1)
--------------------------->
(2) Label Request(L2)
<---------------------------
Label Request(L1)
-------------------------->
Label Mapping(L1)
<--------------------------
(3) Label Mapping(L1)
<---------------------------
(4) Keepalive(n/a,12,-)
--------------------------->
(5) Label Request(L3)
--------------------------->
(6) Keepalive(n/a,-,12)
<---------------------------
Label Request(L3)
-------------------------->
Label Mapping(L3)
<--------------------------
(7) Label Mapping(L3)
<---------------------------
===== TCP Session failure =====
:
:
:
===== TCP Session restored =====
(8) LDP Init(n/a,n/a,23)
--------------------------->
LDP Init(n/a,n/a,12)
<---------------------------
(9) Label Request(L3)
--------------------------->
Label Request(L3)
-------------------------->
Label Mapping(L3)
<--------------------------
(10) Label Mapping(L3)
<---------------------------
(11) Label Request(L2)
<---------------------------Notes, bestie 🎀
- (1), (2) and (3) show label distribution without FT sequence numbers. Basic vibes, no check-point drama yet 🌸
- (4) P1 sends a check-point request. It carries the sequence number of that check-point request 💅
- (5) P1 immediately starts a new label distribution request. No waiting around 🔥
- (6) P2 confirms that it has secured all the previous transactions ✨
- (7) The subsequent (un-acknowledged) label distribution completes 🦋
- (8) The session fails and gets restarted. The initialization messages confirm the sequence numbers of the secured check-points. Literally the reunion scene 🥹
- (9) P1 recommences the unacknowledged label distribution request 💜
- (10) P2 recommences an unacknowledged label distribution request too 🫶
9.6. Graceful Shutdown With Check-Pointing But No FT Procedures 🌈
this one is the planned version 💅 The session gets shut down on purpose, but the peers still check-point first so the state is secured before the goodbye. The Cork TLV is the thing that makes it quiet down, and it shows up on the Keepalives.
notes P1 P2
===== == ==
(1) Label Request(L1)
--------------------------->
(2) Label Request(L2)
<---------------------------
Label Request(L1)
-------------------------->
Label Mapping(L1)
<--------------------------
(3) Label Mapping(L1)
<---------------------------
(4) Keepalive(n/a,12,23) * With Cork TLV *
--------------------------->
(5) :
:
:
(6) Keepalive(n/a,24,12) * With Cork TLV *
<---------------------------
(7) Keepalive(n/a,-,24) * With Cork TLV *
--------------------------->
(8) Notification(Temporary shutdown)
--------------------------->
===== TCP Session failure =====
:
:
:
===== TCP Session restored =====
(9) LDP Init(n/a,n/a,24)
--------------------------->
LDP Init(n/a,n/a,12)
<---------------------------
(10) Label Request(L3)
--------------------------->
Label Request(L3)
-------------------------->
Label Mapping(L3)
<--------------------------
(11) Label Mapping(L3)
<---------------------------
(12) Label Mapping(L2)
--------------------------->Notes, bestie 🎀
- (1), (2) and (3) show label distribution without FT sequence numbers. Warm-up round 🌸
- (4) P1 sends a check-point request with its sequence number and a Cork TLV attached 💖
- (5) P1 has sent a Cork TLV, so it quiesces 🤫
- (6) P2 confirms the check-point and keeps the three-way handshake going by including a Cork TLV of its own 🦋
- (7) P1 completes the three-way handshake. Everything is check-pointed now and the session is quiesced. So clean 🧚
- (8) The session gets gracefully shut down 👋
- (9) The session recovers and the peers swap the sequence numbers of their last secured check-points 🥹
- (10) P1 starts a new label distribution request ✨
- (11) P1 keeps going with a label distribution request it got earlier 🫶
- (12) P2 sends a Label Mapping for L2 back to P1 🍓
10. Security Considerations 🔐
okay bestie, serious moment incoming 😭 the LDP FT enhancements inherit a bunch of the same security considerations as the ones discussed in [RFC3036]. No cap, that's the base layer you need to know.
Now, the FT stuff lets a TCP connection get re-established between LDP peers without a full re-exchange of the attributes of established labels. That's a huge vibe for uptime, but it also means LSRs that implement these extensions are open to some extra denial-of-service attacks, and here's how:
- An intruder could pretend to be an LDP peer so they force a failure and reconnection of the TCP connection, but they don't set the FT Reconnect Flag when it reconnects. Result: all FT labels get released 💀
- Similarly, an intruder could set the FT Reconnect Flag when the TCP session is re-established without keeping the state and resources for FT labels around 🙈
- An intruder could also sit between LDP peers, intercept the traffic, and override the FT Label Flag so it's set to 0 for all labels 😤
All of these attacks can be countered by using an authentication scheme between LDP peers, like the MD5-based scheme outlined in [RFC3036] 🔒
Alternative authentication schemes for LDP peers are outside the scope of this document. They could still be deployed to give implementations of LDP and the LDP FT enhancements extra security 🛡️
Here's the big one 👀 As with LDP, a security issue may exist if an LDP implementation keeps using labels after the session that first caused them to be used has expired. This can happen if the upstream LSR only detects the session failure after the downstream LSR has already released and re-used the label. It's most obvious with the platform-wide label space, and it could lead to data getting mis-forwarded to places it wasn't meant to go. It's also conceivable that someone could deliberately exploit this to get services without authorization or to deny services to others. Not it 😭
In this document, the validity of the session may be extended by the FT Reconnection Timeout, and the session may be re-established during that period. Once the Reconnection Timeout expires, the session has to be considered failed, and the same security issue described above applies 🕰️
However, the downstream LSR may declare the session failed before its Reconnection Timeout expires. That makes the window bigger for the downstream LSR to reallocate the label while the upstream LSR keeps sending data using the old usage of the label. To reduce this issue, this document requires that labels not be re-used until the Reconnection Timeout has expired 🙏
A further issue might apply if labels were re-used before the FT Reconnection Timeout expired, but this document forbids that 🚫
The label re-use issue also extends to labels managed through other mechanisms, including direct configuration through management applications and distribution through other label distribution protocols. Avoiding this problem may be seen as an implementation issue (see below), but if it isn't acknowledged, it could lead to mis-forwarding of data between LSPs set up using some other mechanism and those recovered using the methods in this document 🌸
11. Implementation Notes 🛠️
11.1. FT Recovery Support on Non-FT LSRs 🦋
okay so to get the full benefit of the FT capabilities across the network, an LSR that can't recover from its own local hardware or software faults may still need to support the LDP FT enhancements in this document 💖
Picture this: an LSR called P1 is an LDP peer of a fully Fault Tolerant LSR, P2. If P2 hits a fault in the hardware or software that serves the LDP session between P1 and P2, it may fail the TCP connection between the peers. When the connection comes back, the LSPs/labels between P1 and P2 can only be recovered if both LSRs were applying the FT recovery procedures to the LDP session. Teamwork makes the dream work 🫶
11.2. ACK generation logic 💌
FT ACKs SHOULD be returned to the sending LSR as soon as is practicable, so that a big pile of unacknowledged state changes doesn't build up at the LSR. However, immediate one-for-one acknowledgements would waste bandwidth for no reason 🙄
Here's a possible implementation strategy for sending ACKs to FT LDP messages:
- An LSR secures received messages in order and tracks the sequence number of the most recently secured message,
Sr. 🧠 - On each LDP KeepAlive that the LSR sends, it attaches an FT ACK TLV listing
Sr. ✨ - Optionally, the LSR may attach an FT ACK TLV to any other LDP message sent between Keepalive messages if, for example,
Srhas increased by more than a threshold value since the last ACK was sent. 🎀
This combo gets you the bandwidth benefits of accumulating ACKs while still keeping them timely. Galaxy brain energy 🌌
11.2.1 Ack Generation Logic When Using Check-Pointing 🌈
if check-pointing is in use, the LSRs don't need to worry about sending ACKs in such a timely manner 🥰
Check-points are solicitations for acknowledgements. They're conveyed as a sequence number in an FT Protection TLV on a Keepalive message. Check-point requests could be issued on a timer, after a significant amount of change, or before a session is shut down in a controlled way 🧚
Using check-pointing may considerably simplify an implementation, because it doesn't have to track the sequence numbers of every LDP message it receives. It must, however, still make sure that all received messages (or the state changes that come from them) are secured before it acknowledges the sequence number on the Keepalive 🔥
This approach may be considered optimal in systems that don't change much over time (like targeted LDP sessions) and that are okay with risking the loss of state for the most recent LDP exchanges. More dynamic systems (like LDP discovery sessions) are more likely to want to acknowledge state changes more often, so the maximum amount of state can be preserved through a failure 💜
✨ That's the end of this part, bestie! ✨ 💅
11.3. Interactions With Other Label Distribution Mechanisms ✨
okay so LDP LSRs are lowkey never alone 💅 Lots of them also run other label distribution mechanisms too. That includes management interfaces for configuring static label mappings, other separate instances of LDP, and other label distribution protocols. The last one is the traffic engineering label distribution protocol, which is used to build the tunnels that LDP LSPs get set up through 🚇
Remember how we talked about LDP re-using individual labels inside a restarting LDP system? Same energy here 🚨 Care must be taken to stop labels that a restarting LDP session or protocol component needs to keep from being used by another label distribution mechanism, because that could compromise data security, amongst other things. Not okay 💀
It's up to implementations to dodge this one, using techniques like a common label management component or segmented label spaces 🧚
12. Acknowledgments 💜
The work in this document is based on the LDP ideas expressed by the authors of [RFC3036] 🫶
The ACK scheme used in this document was inspired by the proposal from David Ward and John Scudder for restarting BGP sessions, which is now included in [BGP-RESTART] 🌸
The authors also want to shout out the careful review and comments from Nick Weeds, Piers Finlayson, Tim Harrison, Duncan Archer, Peter Ashwood-Smith, Bob Thomas, S. Manikantan, Adam Sheppard, Alan Davey, Iftekhar Hussain and Loa Andersson. Thank you, queens 👑✨
13. Intellectual Property Consideration 🔥
ngl this part is a lot of legal stuff, but here's the gist. The IETF takes no position on whether any intellectual property or other rights that someone might claim over the technology in this document are valid or in scope 🧾 It also doesn't say it has tried to find those rights. Or whether any license under those rights might or might not be available. For info on how the IETF handles rights for standards-track and standards-related documents, check BCP-11 📖 Copies of any claims of rights that were made available for publication, plus any assurances of licenses that will be made available, or the result of an attempt to get a general license or permission for implementers or users to use those proprietary rights, can be obtained from the IETF Secretariat 📬
The IETF also invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that might cover technology that may be required to practice this standard. Send that info to the IETF Executive Director 🦋
The IETF has been notified of intellectual property rights claimed for some or all of the specification in this document. For more details, check out the online list of claimed rights 🔍
14. References 📚
14.1. Normative References
[RFC2026] Bradner, S., "The Internet Standards Process --
Revision 3", BCP 9, RFC 2026, October 1996.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3036] Andersson, L., Doolan, P., Feldman, N., Fredette, A.
and B. Thomas, "LDP Specification, RFC 3036, January
2001.
[RFC3478] Leelanivas, M., Rekhter, Y. and R. Aggrawal, "Graceful
Restart Mechanism for Label Distribution Protocol",
RFC 3478, February 2003.14.2. Informative References
[RFC2205] Braden, R., Zhang, L., Berson, S., Herzog, S. and S.
Jamin, "Resource ReSerVation Protocol (RSVP) --
Version 1, Functional Specification", RFC 2205,
September 1997.
[RFC2961] Berger, L., Gan, D., Swallow, G., Pan, P., Tomassi, F.
and S. Molendini, "RSVP Refresh Reduction Extensions",
RFC 2961, April 2001.
[RFC3209] Awduche, D., Berger, L., Gan, D., Li, T., Srinivasan,
V. and G. Swallow, "Extensions to RSVP for LSP
Tunnels", RFC 3209, December 2001.
[RFC3212] Jamoussi, B., Andersson, L., Callon, R., Dantu, R.,
Wu, L., Doolan, P., Worster, T., Feldman, N.,
Fredette, A., Girish, M., Gray, E., Heinanen, J.,
Kilty, T. and A. Malis, "Constraint-Based LSP Setup
using LDP", RFC 3212, January 2002.
[RFC3214] Ash, G., Lee, Y., Ashwood-Smith, P., Jamoussi, B.,
Fedyk, D., Skalecki, D. and L. Li, "LSP Modification
using CR-LDP", RFC 3214, January 2001.
[BGP-RESTART] Sangli, S., et al., Graceful Restart Mechanism for
BGP, Work in Progress.15. Authors' Addresses 🦋
Adrian Farrel (editor)
Movaz Networks, Inc.
7926 Jones Branch Drive, Suite 615
McLean, VA 22102
Phone: +1 703-847-1867
EMail: afarrel@movaz.com
Paul Brittain
Data Connection Ltd.
Windsor House, Pepper Street,
Chester, Cheshire
CH1 1DF, UK
Phone: +44-(0)20-8366-1177
EMail: pjb@dataconnection.com
Philip Matthews
Hyperchip
1800 Rene-Levesque Blvd W
Montreal, Quebec H3H 2H2
Canada
Phone: +1 514-906-4965
EMail: pmatthews@hyperchip.com
Eric Gray
EMail: ewgray@GraIyMage.com
Jack Shaio
Vivace Networks
2730 Orchard Parkway
San Jose, CA 95134
Phone: +1 408 432 7623
EMail: jack.shaio@vivacenetworks.com
Toby Smith
Laurel Networks, Inc.
1300 Omega Drive
Pittsburgh, PA 15205
EMail: tob@laurelnetworks.com
Andrew G. Malis
Vivace Networks
2730 Orchard Parkway
San Jose, CA 95134
Phone: +1 408 383 7223
EMail: andy.malis@vivacenetworks.com16. Full Copyright Statement ©️
Copyright (C) The Internet Society (2003). All Rights Reserved. 💖
This document and translations of it may be copied and given to others. Derivative works that comment on or explain it, or help with implementing it, may be made, copied, published and distributed, in whole or in part, with no restrictions of any kind, as long as the above copyright notice and this paragraph are included on all copies and derivative works 📝 But this document itself may not be modified in any way, like removing the copyright notice or the references to the Internet Society or other Internet organizations. The exception is when it's needed for developing Internet standards, in which case the copyright procedures in the Internet Standards process must be followed, or when it's needed to translate it into languages other than English 🌍
The limited permissions above are perpetual and will not be revoked by the Internet Society or its successors or assigns ♾️
This document and the information in it is provided on an "AS IS" basis, and:
THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🫠
Acknowledgement 🌈
Funding for the RFC Editor function is currently provided by the Internet Society. Thank you for reading the whole thing, bestie! 🎀
📦 where this page comes from
- ietf: rfc3479 2003-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms