Fault Tolerance for the Label Distribution Protocol (LDP)
Extracted elements (31)
FT protection is applied on a per-label basis rather than globally, allowing implementations to protect only high-priority LSPs. The A bit in the FT Session TLV allows a peer to mandate that all labels on the session be treated as Sequence Numbered FT Labels, enabling an optimization hint without requiring protocol renegotiation.
The LDP FT design deliberately avoids full state refresh solutions (as used in RSVP's soft-state/refresh mechanism) whether continual or limited to post-failover recovery. Instead, per-message ACKs and sequence numbers identify only lost messages that must be re-issued, minimizing convergence overhead after reconnection.
The 'Temporary Shutdown' status code (E-bit=0) was introduced as an alternative to 'Shutdown' (E-bit=1) so that a shutting-down LSR can inform its peer that it intends to preserve FT Label state and return to service before the Reconnection Timer expires, enabling graceful software upgrades without destroying LSP state.
The FT Session TLV is encoded with the U-bit set (type 0x0503), so LSRs that do not recognize it silently ignore it. Since non-FT peers also omit the TLV, all sessions to non-FT LSRs naturally fall back to standard RFC 3036 behavior with no special handling required.
All state information and resources associated with non-FT Labels MUST be released on TCP connection failure, including deprogramming from switching hardware, equivalent to the behavior specified in RFC 3036.
An upstream LDP peer MUST preserve state for a Sequence Numbered FT Label even after releasing bandwidth resources, and MUST release state only upon receiving an ACK to its Label Release or Label Abort, or upon sending a Label Release in response to a Label Withdraw from the downstream peer.
Both LDP peers MUST use the lesser of the two FT Reconnection Timeout values proposed in the Initialization exchange; a value of zero is treated as positive infinity.
If a label is a Sequence Numbered FT Label, all LDP messages affecting that label MUST carry the FT Protection TLV. On an FT session with the S bit set, the FT Protection TLV MUST be present on all Address and Address Withdraw messages.
If a platform-wide label space is used for FT Labels, a label value MUST NOT be reused until all LDP FT peers have acknowledged the label's withdrawal. An LSR that releases state before the Reconnection Timeout expires MUST NOT reuse any label that was in use on the session until the Reconnection Timeout has expired.
If an LSR cannot pend a mandatory operation (Label Withdraw, Release, or Abort) during TCP failure, it MUST NOT attempt to re-establish the previous LDP session and MUST release all state as if the Reconnection Timer expired.
If both LDP peers set the FT Reconnect Flag to 1, both MUST complete any label operations on Sequence Numbered FT Labels that were interrupted by the failure. If either peer could not pend operations during TCP failure, it MUST set the FT Reconnect Flag to 0 on reconnection.
If either LDP peer sets the FT Reconnect Flag to 0 or omits the FT Session TLV on reconnection, both peers MUST release all state information and resources from the previous session instantiation, including FT Label state and Addresses.
LDP FT enhancements MUST be negotiated via the FT Session TLV on LDP Initialization messages. If either peer omits the TLV or the S/C bits do not match, the LDP FT enhancements MUST NOT be used. Use of FT enhancements without prior negotiation MUST be treated as a serious protocol error causing session termination.
On session reconnection, LDP peers MUST re-exchange LDP Initialization messages and MUST use the same session parameters as the previous instantiation. If parameters changed, the peer SHOULD send a Notification with the 'FT Session parameters changed' status code.
The FT ACK TLV MUST be present on the LDP Initialization message if and only if the FT Reconnect Flag is set in the accompanying FT Session TLV. It reports the last FT message successfully secured before the previous session failure.
The FT Protection TLV MUST NOT be used on sessions that do not support LDP FT enhancements. Its presence on such sessions SHALL be treated as a protocol error; the receiver SHOULD send a Notification with 'Unexpected TLV Session Not FT'. The FT ACK TLV similarly MUST NOT appear on non-FT sessions.
Upon TCP restoration, a Label Request MUST be re-issued unless a Label Abort would be re-issued for the same label; a Label Mapping MUST be re-issued unless a Label Withdraw would be re-issued for the same label. All other unacknowledged FT messages MUST be re-issued.
When an LDP peer receives a message with the FT Protection TLV, it MUST secure the message (or derived state) and MUST subsequently ACK it. ACKs MUST NOT be sent out of sequence, as this is incompatible with accumulated ACKs.
When an LSR receives a Status TLV with the E-bit set (causing TCP closure), it MUST release all state information and resources for the session. The 'Temporary Shutdown' status code has E-bit clear and MAY be used to indicate intent to preserve state across a planned closure.
Check-pointing defers acknowledgment of LDP messages until a Keepalive carrying the FT Protection TLV is sent, which requests a flush of all pending acknowledgments. The C bit in the FT Session TLV enables check-pointing; when C is set without S, all labels become Check-Pointable FT Labels.
FT Operation ACKs are cumulative: an FT ACK TLV with sequence number N acknowledges all FT messages from 1 to N. ACKs may be piggybacked on any LDP message. If the 32-bit FT sequence number space is exhausted (peer not ACKing), the LSR SHOULD send a Notification with status 'FT Seq Numbers Exhausted'.
Graceful termination uses the FT Cork TLV in a Keepalive to quiesce a session before controlled shutdown or software upgrade. It triggers a three-way handshake: the initiating peer requests a flush, the remote peer ACKs and optionally piggybacks its own Protection TLV, and upon full acknowledgment the 'Temporary Shutdown' Notification is sent before disconnecting.
The FT Session TLV (type 0x0503) negotiates FT capabilities on LDP Initialization. The FT Flags field contains: R (FT Reconnect Flag), S (Save State), A (All-Label Protection Required), C (Check-Pointing), and L (Learn From Network per RFC 3478). Invalid combinations include all of S/C/L zero, and L set together with S or C.
RFC 3479 defines ten new LDP status codes carried in the Status TLV of Notification messages: 'No LDP Session' (0x1A, E=0), 'Zero FT seqnum' (0x1B, E=1), 'Unexpected TLV/Session Not FT' (0x1C, E=1), 'Unexpected TLV/Label Not FT' (0x1D, E=1), 'Missing FT Protection TLV' (0x1E, E=1), 'FT ACK sequence error' (0x1F, E=1), 'Temporary Shutdown' (0x20, E=0), 'FT Seq Numbers Exhausted' (0x21, E=1), 'FT Session parameters changed' (0x22, E=1), 'Unexpected FT Cork TLV' (0x23, E=1).
RFC 3479 introduces four new LDP TLV type codes: FT Session TLV (0x0503), FT Protection TLV (0x0203), FT ACK TLV (0x0504), and FT Cork TLV (0x0505), all allocated in the LDP TLV type namespace.
The IESG noted that this specification lacks adequate guidance for timer and retry value choices for TCP connection fault tolerance, and users are advised to test configurations carefully for problems such as premature failovers. This specification should not serve as a model for TCP connection fault tolerance design in future documents.
The LDP FT enhancements do not introduce new security vulnerabilities beyond those in RFC 3036. Security relies on the same TCP-level mechanisms (e.g., MD5 authentication per RFC 2385) as base LDP. An attacker able to disrupt the TCP session can trigger the FT reconnection procedures, potentially causing brief forwarding disruption during state recovery.
The FT ACK TLV (type 0x0504, U=0, F=0, length=4) carries a 32-bit cumulative FT ACK Sequence Number. A value of 0 indicates no FT label operations have been received on this session. It is recommended to include this TLV in all FT Keepalive messages to prevent backlogs.
The FT Cork TLV (type 0x0505, U=0, F=0, length=0) has a zero-length value field. It appears only on Keepalive messages alongside either an FT Protection TLV or FT ACK TLV; use on other messages or without those TLVs SHOULD generate an 'Unexpected FT Cork TLV' Notification.
The FT Protection TLV (type 0x0203, U=0, F=0, length=4) carries a 32-bit FT Sequence Number. The initial value on a new session is 0x00000001, incrementing by one per FT message, wrapping from 0xFFFFFFFF to 0x00000001. Value 0x00000000 is reserved to mean 'no messages received' in the FT ACK TLV context.
The FT Session TLV (type 0x0503, U=1, F=0, length=12) contains: a 16-bit FT Flags field, 16-bit Reserved, a 32-bit FT Reconnection Timeout in milliseconds (0 = preserve indefinitely), and a 32-bit Recovery Time in milliseconds (meaningful only when the L bit is set).