RFC 6720

The Generalized TTL Security Mechanism (GTSM) for the Label Distribution Protocol (LDP)

📅 published August 2012, from ietf

RFC 6720: The Generalized TTL Security Mechanism (GTSM) for the Label Distribution Protocol (LDP) 🎀

okay bestie, RFC 6720 is giving main character energy 💅 It's an IETF Standards Track document, dated August 2012 (ISSN 2070-1721), written by C. Pignataro and R. Asati at Cisco Systems. It updates RFC 5036, which is the LDP spec itself, so this doc is adding to it 🦋 This is part 1 of 2, so more is coming! 🧚

Abstract ✨

So the Generalized TTL Security Mechanism (GTSM) is a way of using a packet's Time to Live (TTL) on IPv4, or its Hop Limit on IPv6, to check that the packet came from a node on a directly connected link 🔒 That keeps a router's IP control plane safe from attacks that try to max out its CPU. It's a technique that's honestly iconic and lots of protocols use it. This document defines how GTSM works for the Label Distribution Protocol (LDP) 💖

It also uses a bit that RFC 5036 reserved, which is why it updates RFC 5036 🌸

Status of This Memo 📜

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 5741 🧐

Info about the current status of this document, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc6720 🫶

Copyright Notice ©️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled out of this document must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 💜

Table of Contents 📚

   1. Introduction ....................................................2
      1.1. Specification of Requirements ..............................3
      1.2. Scope ......................................................3
   2. GTSM Procedures for LDP .........................................4
      2.1. GTSM Flag in the Common Hello Parameter TLV ................4
      2.2. GTSM Sending and Receiving Procedures for LDP Link Hello ...5
      2.3. GTSM Sending and Receiving Procedures for LDP
           Initialization .............................................5
   3. LDP Peering Scenarios and GTSM Considerations ...................5
   4. Security Considerations .........................................6
   5. Acknowledgments .................................................7
   6. References ......................................................7
      6.1. Normative References .......................................7
      6.2. Informative References .....................................8

1. Introduction ✨

okay so LDP [RFC5036] has two peer discovery mechanisms, a Basic one and an Extended one, and both use UDP transport 🚀 Basic Discovery finds LDP peers that are directly connected at the link level. Extended Discovery finds Label Switching Router (LSR) neighbors that are not directly connected at the link level. Once they've been discovered, the LSR neighbors can set up the LDP peering session over a TCP transport connection 🤝

GTSM [RFC5082] works by checking the IPv4 Time To Live (TTL) or IPv6 Hop Limit value. That gives you a simple, pretty solid defense against infrastructure attacks that use forged protocol packets from outside the network 🛡️ GTSM can be applied to any protocol peering session between routers that are adjacent. So yes, GTSM can protect an LDP peering session that was set up with Basic Discovery 💅

This document adds LDP enhancements to support GTSM. Specifically, it covers these three areas:

The Common Hello Parameter TLV of LDP Link Hello message
Sending and Receiving procedures for LDP Link Hello message
Sending and Receiving procedures for LDP Initialization message

Here's the tea: GTSM says that "it SHOULD NOT be enabled by default in order to remain backward compatible with the unmodified protocol" (see Section 3 of [RFC5082]) 🙈 So this document adds a "built-in dynamic GTSM capability negotiation" for LDP, which suggests using GTSM. GTSM gets used as this document describes as long as both peers on an LDP session can detect each other's support for GTSM procedures and agree to use it. In other words, wanting to use GTSM (meaning its negotiation mechanics) is turned on by default, with zero configuration needed ✨

This specification uses a bit reserved in Section 3.5.2 of [RFC5036], so it updates [RFC5036] 🎀

1.1. Specification of Requirements 📝

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🤓

1.2. Scope 🗺️

This document covers LDP using IPv4 routing, but it does not cover LDP using IPv6 routing. The reason is that the latter already has GTSM built into the protocol definition [LDP-IPV6] 🧠

Also, the GTSM for LDP in this document applies only to single-hop LDP peering sessions, and not to multi-hop ones, which lines up with Section 5.5 of [RFC5082] 🚫 That means any LDP method or feature that depends on multi-hop peering sessions won't work with GTSM. Examples are LDP IGP Synchronization [RFC5443] and LDP Session Protection [LDP-SPROT]. Those will need GTSM capability disabled, either statically or dynamically. See Section 3 💔

2. GTSM Procedures for LDP 🔥

2.1. GTSM Flag in the Common Hello Parameter TLV 🩷

A new flag called the G flag (for GTSM) gets defined here, sitting in a previously reserved bit. An LSR says it can apply GTSM procedures (as defined in this document) to the LDP peering session that follows by setting the GTSM flag to 1. The Common Hello Parameters TLV, which is defined in Section 3.5.2 of [RFC5036], gets updated as shown in Figure 1 🦋

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |0|0| Common Hello Parms(0x0400)|      Length                   |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |      Hold Time                |T|R|G|   Reserved              |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 1: GTSM Flag in the Common Hello Parameter TLV

Here's what each bit means:

T, Targeted Hello: As specified in [RFC5036].
R, Request Send Targeted Hellos: As specified in [RFC5036].
G, GTSM: A value of 1 specifies that this LSR supports GTSM procedures, where a value of 0 specifies that this LSR does not support GTSM.
Reserved: This field is reserved. It MUST be set to zero on transmission and ignored on receipt.

The G flag only means something if the T flag is set to 0 (which must be the case for Basic Discovery). Otherwise, the G flag's value gets ignored on receipt 🙃

Any LSR that doesn't support GTSM for LDP as defined here (so, one that doesn't recognize the G flag) keeps ignoring the G flag, no matter what the T and R flags are, as per Section 3.5.2 of [RFC5036] 😌 Similarly, an LSR that does recognize the G flag but doesn't support GTSM (either because it's not implemented or because it's configured that way) won't set the G flag (so G=0) when sending LDP Link Hellos. It'll also effectively ignore the G flag when it receives LDP Link Hello messages 💀

2.2. GTSM Sending and Receiving Procedures for LDP Link Hello 📨

First up, LSRs using LDP Basic Discovery [RFC5036] send LDP Hello messages to the link-level multicast address 224.0.0.2 (or "all routers"). Those messages never get forwarded beyond one hop, and they're RECOMMENDED to have their IP TTL or Hop Count = 1 🌈

Unless it's configured otherwise, an LSR that supports GTSM procedures MUST set the G flag (for GTSM) to 1 in the Common Hello Parameter TLV in the LDP Link Hello message [RFC5036] ✅

If an LSR supports GTSM, is configured to use it, and sees the G flag (in the Common Hello Parameter TLV) with the value = 1 in a received LDP Link Hello message, then it MUST enforce GTSM for LDP in the subsequent TCP/LDP peering session with the neighbor that sent the Hello. That's done as specified in Section 2.3 of this document 🔐

If an LSR doesn't recognize the G flag (in the Common Hello Parameter TLV of the Link Hello message), or it recognizes the G flag with the value = 0, then the LSR MUST NOT enforce GTSM for LDP in the subsequent TCP/LDP peering session with the neighbor that sent the Hello. This keeps things backward compatible and turns GTSM off automatically 🫶

2.3. GTSM Sending and Receiving Procedures for LDP Initialization 🌸

If an LSR has both sent and received an LDP Link Hello with G flag = 1 from the directly connected neighbor, then the LSR MUST enforce GTSM procedures, as defined in Section 3 of [RFC5082], in the forthcoming TCP Transport Connection with that neighbor. This means the LSR MUST check that the incoming unicast packets' TTL or Hop Count is 255 for that particular LDP/TCP peering session, and then decide what to do next as per [RFC5082] 🧐

If an LSR has sent an LDP Link Hello with G flag = 1, but received an LDP Link Hello with G flag = 0 from the directly connected neighbor, then the LSR MUST NOT enforce GTSM procedures, as defined in Section 3 of [RFC5082], in the forthcoming TCP Transport Connection with that neighbor 🩵

Section 3 is coming up in part 2 🧚

3. LDP Peering Scenarios and GTSM Considerations ✨

okay so this section is all about the different ways LDP neighbors can actually be set up 🦋 like, are they single-hop or multi-hop, and are they using Basic Discovery or Extended Discovery? it's giving real-world messy 💅

the reason GTSM capability negotiation is turned on by default for Basic Discovery (aka G=1) but NOT for Extended Discovery is that Basic Discovery usually goes with a single-hop LDP peering session, while Extended Discovery usually goes with a multi-hop one 🌸 GTSM protection for multi-hop LDP sessions is outside the scope of this spec (check Section 1.2 if you forgot 🙈). BUT there are some exceptions you need to know about, bestie:

a. Two adjacent LSRs (aka back-to-back PE routers) end up in a single-hop LDP peering session after doing an Extended Discovery (for example, for Pseudowire signaling) 🧚
b. Two adjacent LSRs end up in a multi-hop LDP peering session after doing a Basic Discovery, because of how IP routing is set up between them (temporarily or permanently) 💀
c. Two adjacent LSRs (aka back-to-back PE routers) end up in a single-hop LDP peering session after doing BOTH Basic and Extended Discovery 👑

okay now the tea ☕ in case (a), GTSM is not enabled for the LDP peering session by default. in case (b), GTSM is actually enabled by default AND enforced for the session, so it can literally stop the session from getting established 😭 (heads up, this may impact stuff like LDP IGP Synchronization [RFC5443] or LDP Session Protection [LDP-SPROT]). in case (c), GTSM is enabled by default for Basic Discovery and enforced on the later LDP peering, and it is not for Extended Discovery. however, if each LSR uses the same IPv4 transport address object value in both Basic and Extended Discoveries, then you end up with ONE LDP peering session that gets GTSM enabled 🎀 otherwise, GTSM would not be enforced on the second LDP peering session (the Extended Discovery one) 🙃

and here's the slay part ✨ this document lets the implementation give you an option to statically (like through configuration) and/or dynamically override the default behavior and turn GTSM on or off on a per-peer basis. this addresses ALL the exceptions listed above 💖

4. Security Considerations 🔥

this part is SERIOUS bestie 😤 this document makes LDP more secure and more resilient to off-link attacks 🛡️ security considerations for GTSM are detailed in Section 5 of [RFC5082], so go read that too.

as we talked about in Section 3, a few things can go wrong:

GTSM for LDP may not always be enforced on a single-hop LDP peering session, and LDP may still be susceptible to forged/spoofed protocol packets, if a single-hop LDP peering session is set up using Extended Discovery 💅
GTSM for LDP may cause the LDP peering session to not get established (or may be torn down), if IP routing ever declares that the directly connected peer is more than one IP hop away. suffice to say, use of cryptographic integrity (e.g., [RFC5925]) is recommended as an alternate solution for detecting forged protocol packets (especially for the multi-hop case) 🔐

the GTSM specification [RFC5082] says that protocol messages used for dynamic negotiation of GTSM support MUST be authenticated. ⚠️ BUT, LDP discovery [RFC5036] uses UDP transport and does NOT have an authentication mechanism 😩 the GTSM spec also adds that GTSM is not a substitute for authentication and does not secure against insider on-the-wire attacks. 🙈 LDP Basic Discovery uses link-level multicast addresses (224.0.0.2 or "all routers") that are never forwarded beyond the link, and this acts as a basic protection against off-the-wire attacks 🧱

the vibe check: GTSM is a helpful layer, not a full security blanket, so don't treat it like one 💜

5. Acknowledgments 🫶

the authors don't claim any originality for the ideas in here 🌷 the concept of GTSM for LDP has been proposed a bunch of times and is documented in both the Experimental and Standards Track specs of GTSM. shoutout to Enke Chen and Albert Tian for their document "TTL-Based Security Option for the LDP Hello Message" 💕

the authors also wanna thank Loa Andersson, Bin Mo, Mach Chen, Vero Zheng, Adrian Farrel, Eric Rosen, Eric Gray, and Brian Weis for their thorough reviews and useful comments and suggestions 👑 the reviewers really ate this one up 🍓

6. References 📚

6.1. Normative References 🌈

[RFC2119]    Bradner, S., "Key words for use in RFCs to Indicate
             Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC5036]    Andersson, L., Minei, I., and B. Thomas, "LDP
             Specification", RFC 5036, October 2007.

[RFC5082]    Gill, V., Heasley, J., Meyer, D., Savola, P., and C.
             Pignataro, "The Generalized TTL Security Mechanism
             (GTSM)", RFC 5082, October 2007.

6.2. Informative References 🦋

[LDP-IPV6]   Asati, R., Manral, V., Papneja, R., and C. Pignataro,
             "Updates to LDP for IPv6", Work in Progress, June 2012.

[LDP-SPROT]  Cisco Systems, Inc., "MPLS LDP Session Protection",
             <http://www.cisco.com/en/US/docs/ios-xml/ios/mp_ldp/
             configuration/12-4m/mp-ldp-sessn-prot.html>.

[RFC5443]    Jork, M., Atlas, A., and L. Fang, "LDP IGP
             Synchronization", RFC 5443, March 2009.

[RFC5925]    Touch, J., Mankin, A., and R. Bonica, "The TCP
             Authentication Option", RFC 5925, June 2010.

Authors' Addresses 💌

Carlos Pignataro
Cisco Systems
7200-12 Kit Creek Road
Research Triangle Park, NC  27709
USA

EMail: cpignata@cisco.com


Rajiv Asati
Cisco Systems
7025-6 Kit Creek Road
Research Triangle Park, NC  27709
USA

EMail: rajiva@cisco.com

That's the whole spec, bestie! 🌈✨ Carlos and Rajiv really out here making GTSM for LDP make sense 💅🦋

📦 where this page comes from

ietf: rfc6720 2012-08
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms