RFC 7552

Updates to LDP for IPv6

📅 published June 2015, from ietf

RFC 7552: Updates to LDP for IPv6 💖

okay bestie, RFC 7552 is a Standards Track doc from June 2015 🌸 It's written by R. Asati, C. Pignataro, and K. Raza (all Cisco), plus V. Manral (Ionos Networks) and R. Papneja (Huawei). It's published by the IETF and has ISSN 2070-1721. It updates RFC 5036 and RFC 6720, so it's basically a patch for LDP (Label Distribution Protocol) that makes IPv6 actually work properly 🦋

Abstract

okay so LDP has rules for swapping label bindings over IPv4, IPv6, or both at once ✨ This doc comes in and cleans up how LDP behaves when IPv6 is involved, whether or not IPv4 is running alongside it 💅 It updates RFCs 5036 and 6720.

Status of This Memo

this is an Internet Standards Track document 🎀

it's a product of the IETF, so it reflects what the IETF community agreed on. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG) 🫶 If you want more about Internet Standards, check Section 2 of RFC 5741.

info about the current status, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc7552 🔥

Copyright Notice

this doc is covered by BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were on the publication date. Read those carefully, because they spell out your rights and restrictions 🧚 Any code pulled from this doc has to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and it comes with no warranty, as the Simplified BSD License says 💀

also, some material in here came from IETF Documents or Contributions published before November 10, 2008. The folks who own the copyright on some of that may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process 🙈 So unless you get a proper license from those copyright holders, this doc can't be modified outside the IETF Standards Process, and you can't make derivative works outside it either. The one exceptions: formatting it for publication as an RFC, or translating it into languages other than English 🌈

   1. Introduction ....................................................4
      1.1. Topology Scenarios for Dual-Stack Environment ..............5
      1.2. Single-Hop vs. Multi-Hop LDP Peering .......................6
   2. Specification Language ..........................................6
   3. LSP Mapping .....................................................7
   4. LDP Identifiers .................................................8
   5. Neighbor Discovery ..............................................8
      5.1. Basic Discovery Mechanism ..................................8
           5.1.1. Maintaining Hello Adjacencies .......................9
      5.2. Extended Discovery Mechanism ..............................10
   6. LDP Session Establishment and Maintenance ......................10
      6.1. Transport Connection Establishment ........................10
           6.1.1. Dual-Stack: Transport Connection Preference
                  and Role of an LSR .................................12
      6.2. LDP Session Maintenance ...................................14
   7. Binding Distribution ...........................................15
      7.1. Address Distribution ......................................15
      7.2. Label Distribution ........................................16
   8. LDP Identifiers and Duplicate Next-Hop Addresses ...............17
   9. LDP TTL Security ...............................................18
   10. IANA Considerations ...........................................18
   11. Security Considerations .......................................19
   12. References ....................................................19
      12.1. Normative References .....................................19
      12.2. Informative References ...................................20
   Appendix A. Additional Considerations .............................21
     A.1. LDPv6 and LDPv4 Interoperability Safety Net ................21
     A.2. Accommodating Implementations Not Compliant with RFC 5036 ..21
     A.3. Why prohibit IPv4-mapped IPv6 addresses in LDP? ............22
     A.4. Why a 32-bit value even for the IPv6 LDP Router Id? ........22
   Acknowledgments ...................................................23
   Contributors ......................................................23
   Authors' Addresses.................................................24

1. Introduction ✨

the LDP spec [RFC5036] has the procedures and messages for swapping FEC-label bindings over IPv4, IPv6, or both (aka Dual-stack networks) 🦋

BUT ngl, RFC 5036 is kinda lacking when it comes to IPv6, with or without IPv4 🙈 Here's what's missing:

Label Switched Path (LSP) Mapping: there's no rule for mapping a particular packet to a particular LSP that has an Address Prefix Forwarding Equivalence Class (FEC) element containing the IPv6 address of the egress router
LDP Identifier: no IPv6-specific details
LDP Discovery: no details on which IPv6 destination (multicast) address to use, or which source address
LDP Session Establishment: no rule for handling both the IPv4 and IPv6 Transport Address optional objects in a Hello message, and then, as a result, two IPv4 and IPv6 transport connections
LDP Address Distribution: no rule for advertising IPv4 and/or IPv6 address bindings over an LDP session
LDP Label Distribution: no rule for advertising IPv4 and/or IPv6 FEC-label bindings over an LDP session, or for the coexistence of IPv4 and IPv6 FEC Elements in the same FEC TLV
Next-Hop Address Resolution: no rule for dealing with duplicate link-local IPv6 addresses
LDP Time to Live (TTL) Security: no rule for a built-in Generalized TTL Security Mechanism (GTSM) in LDP with IPv6 (this one's a deficiency in [RFC6720]) 😭

this doc is the fix 💅 It spells out the behavior, rules, and details for using LDP in IPv6-enabled networks (IPv6-only or Dual-stack). It also closes the IPv6 MPLS gap discussed in Sections 3.2.1, 3.2.2, and 3.3.1.1 of [RFC7439] 👑

and yes, this doc updates [RFC5036] and [RFC6720] 🌸

1.1. Topology Scenarios for Dual-Stack Environment

two Label Switching Routers (LSRs) might use Basic and/or Extended LDP Discovery over IPv6 and/or IPv4 address families, depending on the topology 🧚

this doc covers three topology scenarios where the LSRs connect through one or more Dual-stack LDP-enabled interfaces (Figure 1), or one or more Single-stack LDP-enabled interfaces (Figures 2 and 3):

                      R1------------------R2
                             IPv4+IPv6

            Figure 1: LSRs Connected via a Dual-Stack Interface



                              IPv4
                      R1=================R2
                              IPv6

         Figure 2: LSRs Connected via Two Single-Stack Interfaces



             R1------------------R2---------------R3
                    IPv4                 IPv6

           Figure 3: LSRs Connected via a Single-Stack Interface

Figure 1 also covers the case where a Single-stack LDP-enabled interface (say, IPv4) gets upgraded to a Dual-stack one (by turning on IPv6 routing and IPv6 LDP), even if the LDP-over-IPv4 (LDPoIPv4) session is already up between the LSRs 🌈

Figure 2 also covers two routers getting connected through an extra Single-stack LDP-enabled interface (IPv6 routing and IPv6 LDP), even if the LDPoIPv4 session is already up between the LSRs over the existing interface(s) 💜

this doc also covers the case where the LSRs do Extended Discovery over IPv6 and/or IPv4 address families:

                              IPv4
                     R1-------------------R2
                              IPv6

          Figure 4: LSRs Involving IPv4 and IPv6 Address Families

1.2. Single-Hop vs. Multi-Hop LDP Peering

the LDP TTL Security mechanism in this doc only applies to single-hop LDP peering sessions, not multi-hop ones, which lines up with Section 5.5 of [RFC5082] 🍓 [RFC5082] is where the Generalized TTL Security Mechanism (GTSM) is described.

so any LDP feature that depends on a multi-hop LDP peering session won't work with GTSM, and you'll need to turn GTSM off (statically or dynamically) for it to work 🙈 Check out Section 9 for more.

2. Specification Language ✨

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this doc are interpreted as described in [RFC2119] 🎀

abbreviations, bestie 💅

      LDP                Label Distribution Protocol

      LDPoIPv4           LDP-over-IPv4 transport connection

      LDPoIPv6           LDP-over-IPv6 transport connection

      FEC                Forwarding Equivalence Class

      TLV                Type Length Value

      LSR                Label Switching Router

      LSP                Label Switched Path

      LSPv4              IPv4-signaled Label Switched Path

      LSPv6              IPv6-signaled Label Switched Path

      AFI                Address Family Identifier
      LDP Id             LDP Identifier

      Single-stack LDP   LDP supporting just one address family
                         (for discovery, session setup, address/label
                         binding exchange, etc.)

      Dual-stack LDP     LDP supporting two address families
                         (for discovery, session setup, address/label
                         binding exchange, etc.)

      Dual-stack LSR     LSR supporting Dual-stack LDP for a peer

      Single-stack LSR   LSR supporting Single-stack LDP for a peer

an LSR can be a Dual-stack LSR and a Single-stack LSR at the same time, just for different peers 🦋 Also, this doc loosely uses "address family" to mean "IP address family" ✨

3. LSP Mapping ✨

Okay so Section 2.1 of [RFC5036] explains how to map a packet onto a particular LSP, and it does it with three rules 🦋. Here's the third one, quoted straight from [RFC5036]:

If it is known that a packet must traverse a particular egress router, and there is an LSP that has an Address Prefix FEC element that is a /32 address of that router, then the packet is mapped to that LSP.

This rule slays for IPv4 (it's how you set up LSPv4) 💅 but it's giving wrong for IPv6 (setting up LSPv6), because an IPv6 router can totally have a /64, /96, or /128 address (or whatever prefix length it wants) 🙈. So this document updates the rule to talk about IPv4 or IPv6 addresses instead of /32 or /128 addresses, like so:

If it is known that a packet must traverse a particular egress router, and there is an LSP that has an Address Prefix FEC element that is an IPv4 or IPv6 address of that router, then the packet is mapped to that LSP.

4. LDP Identifiers 🎀

Following Section 2.2.2 of [RFC5036], this document specifies the usage of a 32-bit (unsigned non-zero integer) LSR Id on an IPv6-enabled LSR, whether it's dual-stacking or not 🌈.

This document also qualifies the first sentence of the last paragraph of Section 2.5.2 of [RFC5036] so that it's per address family 💜.

Here's what Section 2.5.2 of [RFC5036] says:

An LSR MUST advertise the same transport address in all Hellos that advertise the same label space.

And here's how this document updates it:

For a given address family, an LSR MUST advertise the same transport address in all Hellos that advertise the same label space.

This is the part I'm obsessed with 😭, because it rightly lets the per-platform label space be shared between IPv4 and IPv6. Iconic.

In summary, this document mandates a common LDP Identifier (the same LSR Id and label space id) for both IPv4 and IPv6 address families 👑.

5. Neighbor Discovery ✨

So if Dual-stack LDP is enabled (meaning LDP is turned on in both the IPv6 and IPv4 address families) on an interface or for a targeted neighbor, then the LSR MUST transmit both IPv6 and IPv4 LDP (Link or targeted) Hellos, and it has to put the same LDP Identifier in them (assuming per-platform label space usage) 🦋.

If Single-stack LDP is enabled (meaning LDP is turned on in either an IPv6 or IPv4 address family), then the LSR MUST transmit either IPv6 or IPv4 LDP (Link or targeted) Hellos, respectively 🌸.

5.1. Basic Discovery Mechanism 🔍

Section 2.4.1 of [RFC5036] defines the Basic Discovery mechanism for directly connected LSRs. Following this mechanism, LSRs periodically send LDP Link Hellos to the "all routers on this subnet" group multicast IP address 💖.

Interestingly enough, per the IPv6 addressing architecture [RFC4291], IPv6 has three "all routers on this subnet" multicast addresses 🤯:

ff01:0:0:0:0:0:0:2 = Interface-local scope
ff02:0:0:0:0:0:0:2 = Link-local scope
ff05:0:0:0:0:0:0:2 = Site-local scope

[RFC5036] doesn't say which of those IPv6 "all routers on this subnet" group multicast addresses LDP Link Hellos should use 🤷‍♀️.

This document says the answer is link-local scope, so the destination multicast IP address in IPv6 LDP Link Hellos is ff02:0:0:0:0:0:0:2 ✨. An LDP Link Hello packet received on any of the other destination addresses MUST be dropped 🗑️. On top of that, the link-local IPv6 address MUST be used as the source IP address in IPv6 LDP Link Hellos 💅.

Also, the LDP Link Hello packets MUST have their IPv6 Hop Limit set to 255 🔒, and that value MUST be checked on receipt (before any LDP-specific processing) and handled as specified in Section 3 of [RFC5082]. The built-in inclusion of GTSM automatically protects IPv6 LDP from off-link attacks, which is so protective of it, bestie 🛡️.

More importantly, if an interface is a Dual-stack LDP interface (meaning LDP is enabled in both IPv6 and IPv4 address families), then the LSR MUST periodically transmit both IPv6 and IPv4 LDP Link Hellos on that interface (using the same LDP Identifier per Section 4) and be able to receive them 📡. This is what lets it discover IPv6-only, IPv4-only, and Dual-stack peers on the interface's subnet, and it makes sure that later peering happens over the right (address family) transport on a multi-access or broadcast interface 🫶.

5.1.1. Maintaining Hello Adjacencies 🧚

For a Dual-stack LDP-enabled interface, the LSR SHOULD maintain Link Hello adjacencies for both IPv4 and IPv6 address families 🌈. This document, however, lets an LSR keep Receive-side Link Hello adjacencies only for the address family that was used to establish the LDP session (whether that's an LDPoIPv4 or an LDPoIPv6 session) 🍓.

5.2. Extended Discovery Mechanism 🎯

The Extended Discovery mechanism (defined in Section 2.4.2 of [RFC5036]) sends targeted LDP Hellos to a unicast IPv6 address destination 💫. It needs only one IPv6-specific consideration: the link-local IPv6 addresses MUST NOT be used as the targeted LDP Hello packet's source or destination addresses 🚫.

6. LDP Session Establishment and Maintenance 👑

Section 2.5.1 of [RFC5036] defines a two-step process for LDP session establishment, which kicks in once neighbor discovery is done (meaning LDP Hellos have been exchanged) ✨:

Transport connection establishment
Session initialization

Section 6.1 covers the LDP considerations for IPv6 and/or Dual-stacking when it comes to session establishment, and Section 6.2 covers them for session maintenance 🌸.

6.1. Transport Connection Establishment 🦋

Section 2.5.2 of [RFC5036] specifies the use of a Transport Address optional object (TLV) in LDP Hello messages to convey the transport (IP) address. It doesn't specify LDP's behavior if both IPv4 and IPv6 Transport Address objects (TLVs) are sent in one Hello message or in separate Hello messages 🤔. Even more importantly, it doesn't say whether both IPv4 and IPv6 transport connections should be allowed when both IPv4 and IPv6 Hello adjacencies existed before session establishment 😭.

This document specifies the following:

An LSR MUST NOT send a Hello message containing both IPv4 and IPv6 Transport Address optional objects. In other words, there MUST be at most one Transport Address optional object in a Hello message. An LSR MUST include only the transport address whose address family is the same as that of the IP packet carrying the Hello message 💅.
An LSR SHOULD accept the Hello message that contains both IPv4 and IPv6 Transport Address optional objects, but it MUST use only the transport address whose address family is the same as that of the IP packet carrying the Hello message. An LSR SHOULD accept only the first Transport Address optional object for a given address family in the received Hello message and ignore the rest, if the LSR receives more than one Transport Address optional object for a given address family 🫶.
An LSR MUST send separate Hello messages (each containing either an IPv4 or IPv6 Transport Address optional object) for each IP address family if Dual-stack LDP is enabled (for an interface or neighbor) 🌈.
An LSR MUST use a global unicast IPv6 address in an IPv6 Transport Address optional object of outgoing targeted Hellos, and it MUST check for the same in incoming targeted Hellos (meaning it MUST discard the targeted Hello if it fails the check) 🔒.
An LSR MUST prefer using a global unicast IPv6 address in an IPv6 Transport Address optional object of outgoing Link Hellos if it had to choose between a global unicast IPv6 address and a unique-local or link-local IPv6 address 💖.
A Single-stack LSR MUST establish either an LDPoIPv4 or LDPoIPv6 session with a remote LSR, depending on the enabled address family 🍓.
A Dual-stack LSR MUST NOT initiate or accept a TCP connection request for a new LDP session with a remote LSR if it already has an LDPoIPv4 or LDPoIPv6 session for the same LDP Identifier established with that remote LSR 🚫.

This means only one transport connection gets established, no matter how many IPv6 and/or IPv4 Hello adjacencies are present between two LSRs 🧚.

A Dual-stack LSR SHOULD prefer establishing an LDPoIPv6 session (instead of an LDPoIPv4 session) with a remote Dual-stack LSR by following the 'transport connection role' determination logic in Section 6.1.1 👑.

To make sure that preference holds when Dual-stack LDP is enabled on an interface, it would be desirable for IPv6 LDP Link Hellos to be transmitted before IPv4 LDP Link Hellos, especially when an interface is coming into service or being reconfigured 🎀.

6.1.1. Dual-Stack: Transport Connection Preference and Role of an LSR 💖

okay bestie, Section 2.5.2 of [RFC5036] is where the rules for who's active and who's passive when setting up a TCP connection live 🎀. Those rules are super clear for Single-stack LDP, but for Dual-stack LDP it gets messy, because an LSR can end up playing different roles for different address families 😭. Then the LDP session just doesn't get established 💀.

So to make the transport connection role (active/passive) deterministic for Dual-stack LDP, this doc says the Dual-stack LSR tells its peer its transport connection preference in every single LDP Hello message 🫶. That preference lives in a brand new TLV called the "Dual-Stack capability" TLV, and it looks like this:

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |1|0|  Dual-Stack capability    |        Length                 |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |TR     |        Reserved       |     MBZ                       |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Figure 5: Dual-Stack Capability TLV

Where the bits and fields are:

U and F bits: 1 and 0 (as specified by [RFC5036])
Dual-Stack capability: TLV code point (Ox0701)
TR: Transport Connection Preference. This document defines the following two values:
- 0100: LDPoIPv4 connection
- 0110: LDPoIPv6 connection (default)
Reserved: This field is reserved. It MUST be set to zero on transmission and ignored on receipt.

A Dual-stack LSR (i.e., an LSR supporting Dual-stack LDP for a peer) MUST include the Dual-Stack capability TLV in all of its LDP Hellos and MUST set the "TR" field to announce its preference for either an LDPoIPv4 or LDPoIPv6 transport connection for that peer. The default preference is LDPoIPv6 ✨.

A Dual-stack LSR MUST always check for the presence of the Dual-Stack capability TLV in the received Hello messages and take appropriate action, as follows:

If the Dual-Stack capability TLV is present and the remote preference does not match the local preference (or does not get recognized), then the LSR MUST discard the Hello message and log an error.

If an LDP session was already in place, then the LSR MUST send a fatal Notification message with status code of 'Transport Connection Mismatch' (0x00000032) and reset the session.

If the Dual-Stack capability TLV is present and the remote preference matches the local preference, then:
- a) If TR=0100 (LDPoIPv4), then determine the active/passive roles for the TCP connection using an IPv4 transport address as defined in Section 2.5.2 of RFC 5036.
- b) If TR=0110 (LDPoIPv6), then determine the active/passive roles for the TCP connection by using an IPv6 transport address as defined in Section 2.5.2 of RFC 5036.
If the Dual-Stack capability TLV is NOT present and:
- a) only IPv4 Hellos are received, then the neighbor is deemed as a legacy IPv4-only LSR (supporting Single-stack LDP); hence, an LDPoIPv4 session SHOULD be established (similar to that of 2a above).

However, if IPv6 Hellos are also received at any time during the life of the session from that neighbor, then the neighbor is deemed as a noncompliant Dual-stack LSR (similar to that of 3c below), resulting in any established LDPoIPv4 session being reset and a fatal Notification message being sent (with status code of 'Dual-Stack Noncompliance', 0x00000033).

b) only IPv6 Hellos are received, then the neighbor is deemed as an IPv6-only LSR (supporting Single-stack LDP) and an LDPoIPv6 session SHOULD be established (similar to that of 2b above).

However, if IPv4 Hellos are also received at any time during the life of the session from that neighbor, then the neighbor is deemed as a noncompliant Dual-stack LSR (similar to that of 3c below), resulting in any established LDPoIPv6 session being reset and a fatal Notification message being sent (with status code of 'Dual-Stack Noncompliance', 0x00000033).

c) both IPv4 and IPv6 Hellos are received, then the neighbor is deemed as a noncompliant Dual-stack neighbor and is not allowed to have any LDP session. A Notification message should be sent (with status code of 'Dual-Stack Noncompliance', 0x00000033).

A Dual-stack LSR MUST convey the same transport connection preference ("TR" field value) in all (link and targeted) Hellos that advertise the same label space to the same peer and/or on the same interface. This ensures that two LSRs linked by multiple Hello adjacencies using the same label spaces play the same connection establishment role for each adjacency 🦋.

A Dual-stack LSR MUST follow Section 2.5.5 of [RFC5036] and check for matching Hello messages from the peer (either all Hellos also include the Dual-Stack capability (with the same TR value) or none do).

A Single-stack LSR does not need to use the Dual-Stack capability in Hello messages and SHOULD ignore this capability if received.

An implementation may provide an option to favor one AFI (say, IPv4) over another AFI (say, IPv6) for the TCP transport connection, so as to use the favored IP version for the LDP session and force deterministic active/passive roles.

Note: An alternative to this new capability TLV could be a new Flag value in an LDP Hello message; however, it would be used even in Single-stack IPv6 LDP networks and linger on forever, even though Dual-stack will not. Hence, the idea of this alternative has been discarded. 🙈

6.2. LDP Session Maintenance 🌸

This document specifies that two LSRs maintain a single LDP session, regardless of the number of Link or targeted Hello adjacencies between them, as described in Section 6.1. This is independent of whether:

they are connected via a Dual-stack LDP-enabled interface(s) or via two (or more) Single-stack LDP-enabled interfaces;
a Single-stack LDP-enabled interface is converted to a Dual-stack LDP-enabled interface (see Figure 1) on either LSR;
an additional Single-stack or Dual-stack LDP-enabled interface is added or removed between two LSRs (see Figure 2).

If the last Hello adjacency for a given address family goes down (e.g., due to Dual-stack LDP-enabled interfaces being converted into Single-stack LDP-enabled interfaces on one LSR) and that address family is the same as the one used in the transport connection, then the transport connection (LDP session) MUST be reset. Otherwise, the LDP session MUST stay intact.

If the LDP session is torn down for whatever reason (LDP disabled for the corresponding transport, Hello adjacency expiry, preference mismatch, etc.), then the LSRs SHOULD initiate the establishment of a new LDP session as per the procedures described in Section 6.1 of this document 🔥.

7. Binding Distribution 👑

LSRs by definition can be enabled for Dual-stack LDP globally and/or per peer so as to exchange the address and label bindings for both IPv4 and IPv6 address families, independent of any LDPoIPv4 or LDPoIPv6 session between them.

However, there might be some legacy LSRs that are fully compliant with RFC 5036 for IPv4 but are noncompliant for IPv6 (for example, see Section 3.5.5.1 of RFC 5036), causing them to reset the session upon receiving IPv6 address bindings or IPv6 FEC (Prefix) label bindings from a peer compliant with this document. This is somewhat undesirable, as clarified further in Appendices A.1 and A.2 😬.

To help maintain backward compatibility (i.e., accommodate IPv4-only LDP implementations that may not be compliant with RFC 5036, Section 3.5.5.1), this specification requires that an LSR MUST NOT send any IPv6 bindings to a peer if the peer has been determined to be a legacy LSR.

The Dual-Stack capability TLV, which is defined in Section 6.1.1, is also used to determine whether or not a peer is a legacy (IPv4-only Single-stack) LSR.

7.1. Address Distribution 🦋

An LSR MUST NOT advertise (via an Address message) any IPv4-mapped IPv6 addresses (as defined in Section 2.5.5.2 of [RFC4291]) and MUST ignore such addresses if ever received. Please see Appendix A.3.

If an LSR is enabled with Single-stack LDP for any peer, then it MUST advertise (via an Address message) its local IP addresses as per the enabled address family to that peer and process received Address messages containing IP addresses as per the enabled address family from that peer.

If an LSR is enabled with Dual-stack LDP for a peer and:

does not find the Dual-Stack capability TLV in the incoming IPv4 LDP Hello messages from that peer, then the LSR MUST NOT advertise its local IPv6 addresses to the peer.
finds the Dual-Stack capability TLV in the incoming IPv4 (or IPv6) LDP Hello messages from that peer, then it MUST advertise (via an Address message) its local IPv4 and IPv6 addresses to that peer.
does not find the Dual-Stack capability TLV in the incoming IPv6 LDP Hello messages, then it MUST advertise (via an Address message) only its local IPv6 addresses to that peer.

This last point helps to maintain forward compatibility (no need to require this TLV in the case of IPv6 Single-stack LDP). 💅

7.2. Label Distribution 🌈

An LSR MUST NOT allocate and MUST NOT advertise FEC-label bindings for link-local or IPv4-mapped IPv6 addresses (defined in Section 2.5.5.2 of [RFC4291]), and it MUST ignore such bindings if ever received. Please see Appendix A.3.

If an LSR is enabled with Single-stack LDP for any peer, then it MUST advertise (via a Label Mapping message) FEC-label bindings for the enabled address family to that peer and process received FEC-label bindings for the enabled address family from that peer.

If an LSR is enabled with Dual-stack LDP for a peer and:

does not find the Dual-Stack capability TLV in the incoming IPv4 LDP Hello messages from that peer, then the LSR MUST NOT advertise IPv6 FEC-label bindings to the peer (even if IP capability negotiation for the IPv6 address family was done).
finds the Dual-Stack capability TLV in the incoming IPv4 (or IPv6) LDP Hello messages from that peer, then it MUST advertise FEC-label bindings for both IPv4 and IPv6 address families to that peer.
does not find the Dual-Stack capability TLV in the incoming IPv6 LDP Hello messages, then it MUST advertise FEC-label bindings for IPv6 address families to that peer.

This last point helps to maintain forward compatibility (no need to require this TLV for IPv6 Single-stack LDP).

An LSR MAY further constrain the advertisement of FEC-label bindings for a particular address family by negotiating the IP capability for a given address family, as specified in [RFC7473]. This allows an LSR pair to neither advertise nor receive the undesired FEC-label bindings on a per-address-family basis to a peer ✨.

If an LSR is configured to change an interface or peer from Single-stack LDP to Dual-stack LDP, then an LSR SHOULD use Typed Wildcard FEC procedures [RFC5918] to request the label bindings for the enabled address family. This helps to relearn the label bindings that may have been discarded before, without resetting the session 🫶.

8. LDP Identifiers and Duplicate Next-Hop Addresses ✨

Okay bestie, so RFC 5036, Section 2.7 explains how an LSR maps the IP routing next hop of a given FEC to an LDP peer 💅 so it can find the right label entry for that FEC. The move is to use the next-hop address as an index into the (peer address) database. That database gets filled by the Address message, which maps each peer's local addresses to its LDP Identifier 🔍

But ngl, that's not enough when two or more peers are using the same IPv6 link-local next-hop address 😭. The reason is that interior IPv6 routing protocols (can) use link-local IPv6 addresses as IP routing next hops, and "IP Version 6 Addressing Architecture" [RFC4291] lets a link-local IPv6 address be used on more than one link. Chaos, right? 💀

So this spec extends the logic. Now the LSR uses not only the IP routing next-hop address but also the IP routing next-hop interface to uniquely figure out the LDP peer(s) 🦋 Address-based peer mapping still happens through the LDP peer address database (filled by Address messages from the LDP peers). Interface-based peer mapping happens through the LDP Hello adjacency/interface database (filled by Hello messages from the LDP peers).

This extension fixes the problem of two or more peers using the same link-local IPv6 address (aka duplicate peer addresses) as IP routing next hops. Iconic, honestly 👑

Last thing, for better scale and optimization 🧚: an LSR may advertise only the link-local IPv6 addresses in the Address message, assuming that the peer uses only link-local IPv6 addresses as static and/or dynamic IP routing next hops.

9. LDP TTL Security 🎀

This document mandates the use of the Generalized TTL Security Mechanism (GTSM) [RFC6720] for LDP Link Hello packets over IPv6 (see Section 5.1). Main character energy, no notes 💜

This document further recommends enabling GTSM for the LDP/TCP transport connection over IPv6 (i.e., LDPoIPv6). The whole point of this GTSM inclusion is to automatically protect IPv6 LDP peering sessions from off-link attacks 🛡️

[RFC6720] allows for the implementation to statically (via configuration) and/or dynamically override the default behavior (enable/disable GTSM) on a per-peer basis 🌸 That option could be set on either LSR in a peering session, since GTSM negotiation would ultimately disable GTSM between the LSR and its peer(s).

LDP Link Hello packets MUST have their IPv6 Hop Limit set to 255 and be checked for the same upon receipt before any further processing, as per Section 3 of [RFC5082]. This is not optional, bestie 🚨

10. IANA Considerations 📋

This document defines a new optional parameter for the LDP Hello message and two new status codes for the LDP Notification message. Small list, big vibes ✨

The "Dual-Stack capability" parameter got a code point, 0x0701, from the "TLV Type Name Space" registry. IANA allocated this code point from the IETF Consensus range 0x0700-0x07ff for the Dual-Stack capability TLV 🍓

The 'Transport Connection Mismatch' status code got a code point, 0x00000032, from the "Status Code Name Space" registry. IANA allocated it from the IETF Consensus range and marked the E bit column with a '1' 💅

The 'Dual-Stack Noncompliance' status code got a code point, 0x00000033, from the "Status Code Name Space" registry. IANA allocated it from the IETF Consensus range and marked the E bit column with a '1'. Periodt 💖

11. Security Considerations 💀🔐

Okay, this part is seriously important, so pay attention bestie 🙈 The extensions defined in this document only clarify the behavior of LDP. They do not define any new protocol procedures. Hence, this document does not add any new security issues to LDP.

That said, the security issues relevant for [RFC5036] are still relevant for this document. This document does reduce the chances of off-link attacks when using an IPv6 transport connection, though, by including the use of GTSM procedures [RFC5082]. Please see Section 9 for LDP TTL Security details 🛡️

Moreover, this document allows the use of IPsec [RFC4301] for IPv6 protection. So LDP can benefit from the extra security specified in [RFC7321] as well as [RFC5920]. Level up, no cap 👑

12. References 📚

12.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC4291]  Hinden, R. and S. Deering, "IP Version 6 Addressing
           Architecture", RFC 4291, DOI 10.17487/RFC4291,
           February 2006, <http://www.rfc-editor.org/info/rfc4291>.

[RFC5036]  Andersson, L., Ed., Minei, I., Ed., and B. Thomas, Ed.,
           "LDP Specification", RFC 5036, DOI 10.17487/RFC5036,
           October 2007, <http://www.rfc-editor.org/info/rfc5036>.

[RFC5082]  Gill, V., Heasley, J., Meyer, D., Savola, P., Ed., and C.
           Pignataro, "The Generalized TTL Security Mechanism
           (GTSM)", RFC 5082, DOI 10.17487/RFC5082, October 2007,
           <http://www.rfc-editor.org/info/rfc5082>.

[RFC5918]  Asati, R., Minei, I., and B. Thomas, "Label Distribution
           Protocol (LDP) 'Typed Wildcard' Forward Equivalence Class
           (FEC)", RFC 5918, DOI 10.17487/RFC5918, August 2010,
           <http://www.rfc-editor.org/info/rfc5918>.

12.2. Informative References

[RFC4038]  Shin, M-K., Ed., Hong, Y-G., Hagino, J., Savola, P., and
           E. Castro, "Application Aspects of IPv6 Transition",
           RFC 4038, DOI 10.17487/RFC4038, March 2005,
           <http://www.rfc-editor.org/info/rfc4038>.

[RFC4301]  Kent, S. and K. Seo, "Security Architecture for the
           Internet Protocol", RFC 4301, DOI 10.17487/RFC4301,
           December 2005, <http://www.rfc-editor.org/info/rfc4301>.

[RFC5340]  Coltun, R., Ferguson, D., Moy, J., and A. Lindem, "OSPF
           for IPv6", RFC 5340, DOI 10.17487/RFC5340, July 2008,
           <http://www.rfc-editor.org/info/rfc5340>.

[RFC5920]  Fang, L., Ed., "Security Framework for MPLS and GMPLS
           Networks", RFC 5920, DOI 10.17487/RFC5920, July 2010,
           <http://www.rfc-editor.org/info/rfc5920>.

[RFC6286]  Chen, E. and J. Yuan, "Autonomous-System-Wide Unique BGP
           Identifier for BGP-4", RFC 6286, DOI 10.17487/RFC6286,
           June 2011, <http://www.rfc-editor.org/info/rfc6286>.

[RFC6720]  Pignataro, C. and R. Asati, "The Generalized TTL Security
           Mechanism (GTSM) for the Label Distribution Protocol
           (LDP)", RFC 6720, DOI 10.17487/RFC6720, August 2012,
           <http://www.rfc-editor.org/info/rfc6720>.

[RFC7321]  McGrew, D. and P. Hoffman, "Cryptographic Algorithm
           Implementation Requirements and Usage Guidance for
           Encapsulating Security Payload (ESP) and Authentication
           Header (AH)", RFC 7321, DOI 10.17487/RFC7321, August 2014,
           <http://www.rfc-editor.org/info/rfc7321>.

[RFC7439]  George, W., Ed., and C. Pignataro, Ed., "Gap Analysis for
           Operating IPv6-Only MPLS Networks", RFC 7439,
           DOI 10.17487/RFC7439, January 2015,
           <http://www.rfc-editor.org/info/rfc7439>.

[RFC7473]  Raza, K. and S. Boutros, "Controlling State Advertisements
           of Non-negotiated LDP Applications", RFC 7473,
           DOI 10.17487/RFC7473, March 2015,
           <http://www.rfc-editor.org/info/rfc7473>.

Appendix A. Additional Considerations 🧩

A.1. LDPv6 and LDPv4 Interoperability Safety Net

It is not safe to assume that implementations compliant with RFC 5036 have supported the handling of an IPv6 address family (IPv6 FEC-label) in a Label Mapping message all along. Not every router has been keeping up, bestie 😭

If a router upgraded per this specification advertised both IPv4 and IPv6 FECs in the same Label Mapping message, then an IPv4-only peer (not knowing how to process such a message) may abort processing the entire Label Mapping message. That means even the IPv4 FEC-labels get discarded, as per Section 3.4.1.1 of [RFC5036] 💔

This would result in LDPv6 being somewhat undeployable in existing production networks.

Section 7 of this document provides a good safety net 🫶 It makes LDPv6 incrementally deployable without assuming anything about the routers' support for IPv6 FEC processing in current production networks.

A.2. Accommodating Implementations Not Compliant with RFC 5036

It is not safe to assume that implementations have been [RFC5036] compliant in gracefully handling an IPv6 address family (IPv6 Address List TLV) in an Address message all along. Again, not everyone's been on the same page 🙈

If a router upgraded per this specification advertised IPv6 addresses (with or without IPv4 addresses) in an Address message, then an IPv4-only peer (not knowing how to process such a message) may not follow Section 3.5.5.1 of [RFC5036] and may tear down the LDP session. Yikes 💀

This would result in LDPv6 being somewhat undeployable in existing production networks.

Sections 6 and 7 of this document provide a good safety net 🌈 They make LDPv6 incrementally deployable without assuming anything about the routers' support for IPv6 FEC processing in current production networks.

A.3. Why prohibit IPv4-mapped IPv6 addresses in LDP?

Per discussion with the 6MAN and V6OPS working groups, the overwhelming consensus was to not promote IPv4-mapped IPv6 addresses appearing in the routing table, as well as in LDP (address and label) databases. The group chat was unanimous 🦋

Also, [RFC4038], Section 4.2 suggests that IPv4-mapped IPv6-addressed packets should never appear on the wire.

A.4. Why a 32-bit value even for the IPv6 LDP Router Id?

The first four octets of the LDP Identifier, the 32-bit LSR Id (i.e., LDP router Id), identify the LSR and provide a globally unique value within the MPLS network, regardless of the address family used for the LDP session. Globally unique, iconic 👑

Please note that the 32-bit LSR Id value would not map to any IPv4 address in an IPv6-only LSR (i.e., Single-stack). There would also be no expectation of it being IP routable or DNS resolvable. In IPv4 deployments, the LSR Id is typically derived from an IPv4 address, generally assigned to a loopback interface. In IPv6-only deployments, this 32-bit LSR Id must be derived by some other means that guarantees global uniqueness within the MPLS network, similar to that of the BGP Identifier [RFC6286] and the OSPF router Id [RFC5340] ✨

This document reserves 0.0.0.0 as the LSR Id and prohibits its usage with IPv6, in line with the OSPF router Id in OSPF version 3 [RFC5340]. No 0.0.0.0 shenanigans, bestie 🙅‍♀️

Acknowledgments 🫶

We acknowledge the authors of [RFC5036], since some text in this document is borrowed from [RFC5036]. Respect to them 👑

Thanks to Bob Thomas for providing critical feedback to improve this document early on 💜

Many thanks to Eric Rosen, Lizhong Jin, Bin Mo, Mach Chen, Shane Amante, Pranjal Dutta, Mustapha Aissaoui, Matthew Bocci, Mark Tinka, Tom Petch, Kishore Tiruveedhula, Manoj Dutta, Vividh Siddha, Qin Wu, Simon Perreault, Brian E. Carpenter, Santosh Esale, Danial Johari, and Loa Andersson for thoroughly reviewing this document and for providing insightful comments and multiple improvements. The whole squad showed up 🌟

Contributors 💅

The following individuals contributed to this document:

Nagendra Kumar
Cisco Systems, Inc.
7200 Kit Creek Road
Research Triangle Park, NC  27709, United States
EMail: naikumar@cisco.com

Andre Pelletier
Cisco Systems, Inc.
2000 Innovation Drive
Kanata, ON K2K-3E8, Canada
EMail: apelleti@cisco.com

Authors' Addresses ✨

Okay bestie, here's the squad that brought this RFC to life 🫶 Every one of them is a networking legend, and this is exactly where you can find them 💖

Rajiv Asati
Cisco Systems, Inc.
7025 Kit Creek Road
Research Triangle Park, NC  27709-4987
United States

EMail: rajiva@cisco.com

Carlos Pignataro
Cisco Systems, Inc.
7200 Kit Creek Road
Research Triangle Park, NC  27709-4987
United States

EMail: cpignata@cisco.com

Kamran Raza
Cisco Systems, Inc.
2000 Innovation Drive
Ottawa, ON  K2K-3E8
Canada

EMail: skraza@cisco.com

Vishwas Manral
Ionos Networks
4100 Moorpark Ave., Ste. #122
San Jose, CA  95117
United States
Phone: +1 408 447 1497

EMail: vishwas@ionosnetworks.com

Rajiv Papneja
Huawei Technologies
2330 Central Expressway
Santa Clara, CA  95050
United States
Phone: +1 571 926 8593

EMail: rajiv.papneja@huawei.com

📦 where this page comes from

ietf: rfc7552 2015-06
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms