IPv6 Stateless Address Autoconfiguration
Extracted elements (27)
Dividing valid addresses into preferred and deprecated categories gives upper layers advance warning that an address may soon become invalid, allowing applications to migrate to a new preferred address before the old one expires. This supports graceful site renumbering without breaking existing TCP connections.
Hosts generate their link-local address and verify its uniqueness in parallel with waiting for a Router Advertisement, rather than serially, because a router may delay responding to a Router Solicitation for several seconds; parallel execution significantly reduces total autoconfiguration time.
The 2-hour floor on valid lifetime updates (Section 5.5.3) was introduced to counter a DoS attack in which a single unauthenticated Router Advertisement with very short Valid Lifetimes could prematurely expire all of a node's addresses. Legitimate periodic RAs will refresh the lifetime before it falls dangerously low.
The preferred lifetime is always reset to the advertised value even when the valid lifetime update is ignored, because shortening the preferred lifetime is a much less severe attack. Blocking preferred lifetime updates would also prevent legitimate administrators from deprecating an address by advertising a short preferred lifetime.
Link-layer implementations that discard received packets whose source link-layer address equals the receiving interface's address (e.g., per IEEE 802.11) will cause DAD to fail silently: the node performing DAD will discard the Neighbor Advertisement or Solicitation from another node using the same link-layer address, resulting in a non-unique address being configured.
Some deployed implementations only perform DAD for the link-local address and skip DAD for global addresses that share the same interface identifier. This document does not invalidate such implementations but explicitly labels this optimization NOT RECOMMENDED and prohibits it in new implementations, because RFC 4941 and RFC 3972 introduce address types with distinct per-address interface identifiers.
Stateless address autoconfiguration and DHCPv6 may be used simultaneously on the same interface. If configuration parameters (e.g., MTU, hop limit) are received inconsistently from multiple sources, it is not a fatal error; hosts accept the union, and more recently obtained values SHOULD take precedence. Securely obtained information SHOULD take precedence over unsecured information.
A deprecated address SHOULD continue to be used as source in existing communications but SHOULD NOT initiate new communications if a preferred address of sufficient scope is available. IP and higher layers (TCP, UDP) MUST continue to accept and process datagrams destined to a deprecated address.
A node MUST allow the DupAddrDetectTransmits variable to be configured by system management for each multicast-capable interface. A value of zero disables DAD; the default is 1.
A node MUST NOT respond to a Neighbor Solicitation for a tentative address. If the NS source is the unspecified address and the solicitation is from another node (not a loopback), the tentative address is a duplicate and MUST NOT be assigned to the interface.
A node MUST silently discard any Neighbor Solicitation or Advertisement message that does not pass the validity checks specified in RFC 4861.
A tentative address determined to be a duplicate MUST NOT be assigned to an interface, and the node SHOULD log a system management error. If the duplicate link-local address was derived from a hardware address expected to be unique (e.g., EUI-64 Ethernet), IP operation on the interface SHOULD be disabled entirely.
An implementation MAY prevent new communication from using a deprecated address, but system management MUST have the ability to disable such a facility, and the facility MUST be disabled by default.
An invalid address (valid lifetime expired) MUST NOT be used as a source address in outgoing communications and MUST NOT be recognized as a destination on a receiving interface.
Before sending a Neighbor Solicitation for DAD, an interface MUST join the all-nodes multicast address and the solicited-node multicast address of the tentative address. The first message after interface initialization SHOULD be delayed by a random interval between 0 and MAX_RTR_SOLICITATION_DELAY to reduce congestion at startup.
Creation of global addresses via stateless autoconfiguration SHOULD be locally configurable, but the processing described in Section 5.5.3 MUST be enabled by default. If the sum of the advertised prefix length and the interface identifier length does not equal 128 bits, the Prefix Information option MUST be ignored.
Duplicate Address Detection MUST be performed on all unicast addresses prior to assigning them to an interface, regardless of whether obtained via stateless autoconfiguration, DHCPv6, or manual configuration. DAD MUST NOT be performed on anycast addresses.
Each individual unicast address SHOULD be tested for uniqueness. The optimization of skipping DAD for a global address that shares an interface identifier with a link-local address is NOT RECOMMENDED, and new implementations MUST NOT perform that optimization, because new address types (RFC 4941, RFC 3972) may have different interface identifiers per address.
When a Router Advertisement carries a prefix already in the address list, the valid lifetime update follows a 2-hour floor rule: if the advertised Valid Lifetime is greater than 2 hours or greater than RemainingLifetime, set to the advertised value; if RemainingLifetime is ≤ 2 hours, ignore unless the RA was authenticated (e.g., via SEND); otherwise reset to 2 hours.
A tentative address is one undergoing Duplicate Address Detection. The interface must accept Neighbor Solicitation and Advertisement messages targeting the tentative address but must silently discard all other packets addressed to it.
DupAddrDetectTransmits is the per-interface configuration variable controlling how many consecutive Neighbor Solicitations are sent during DAD. The default is 1; a value of 0 disables DAD. RetransTimer (from RFC 4861) governs the delay between consecutive solicitations.
The Prefix Information option's Autonomous flag indicates whether the prefix applies to stateless autoconfiguration. The link-local prefix and any prefix whose preferred lifetime exceeds valid lifetime must be silently ignored during Router Advertisement processing.
Any node on a link can respond to a Neighbor Solicitation for another node's tentative address, causing the legitimate node to treat that address as a duplicate and refuse to use it — a denial-of-service attack against address assignment. The Secure Neighbor Discovery protocol (RFC 3971) can mitigate this; RFC 3756 discusses the full threat model.
Stateless address autoconfiguration requires no authentication of a host before it connects to and uses a network. The document acknowledges this threat is inherent in the Internet architecture and cannot be fully addressed within the autoconfiguration mechanism itself.
IPv6 addresses transition through four states on an interface: tentative (undergoing DAD, not yet assigned), preferred (unrestricted use), deprecated (discouraged for new communications but still valid), and invalid (lifetime expired, must not be used). Transitions are triggered by DAD completion, preferred lifetime expiry, and valid lifetime expiry.
A global address is formed as: (128−N) bits of link prefix followed by N bits of interface identifier, for a total of exactly 128 bits. The prefix comes from the Prefix Information option in a Router Advertisement; if prefix length + IID length ≠ 128, the option MUST be ignored.
A link-local address is formed by taking the well-known prefix FE80::0, zeroing all bits to the right of the prefix, and replacing the rightmost N bits with the interface identifier. If the sum of link-local prefix length and N exceeds 128, autoconfiguration fails.