Failure Detection and Locator Pair Exploration Protocol for IPv6 Multihoming
Extracted elements (27)
Failure detection is made lightweight by observing payload traffic in both directions. Keepalives are only generated when there is traffic in one direction but not the other, avoiding any packets when communication is idle or bidirectional.
REAP exploration is not permitted during Shim6 connection establishment because doing so would create an amplification vulnerability; Shim6 contexts are only created after a relatively large number of packets have been exchanged, raising the cost of exploitation.
Shim6 does not employ multiple paths simultaneously because congestion control in commonly used transport protocols is based on a single path. Effective congestion control over multiple paths is considered a research topic.
Shim6 uses the same header for signaling and payload encapsulation so that fate is shared: either all Shim6 packets (keepalives, probes, and payload) get through or none do, preventing the pathological case where probes succeed but payload fails.
SCTP and future multipath transport protocols are likely to require interaction with Shim6 to ensure they do not employ Shim6 unexpectedly, since Shim6 restricts traffic to a single current address pair for congestion control reasons.
All nodes MUST perform locator pair exploration sequentially and with exponential back-off to avoid a signaling storm when an outage occurs, particularly for a complete site.
If a node is using a non-default Send Timeout value, it MUST communicate this value as a Keepalive Timeout value to the peer using the Keepalive Timeout Option.
It is RECOMMENDED that an alternate Send Timeout value not be under 10 seconds and that Send Timeout be at most 100 seconds (the default TCP R2 timeout), so Shim6 detects and repairs problems before upper layers give up.
Nodes SHOULD attempt to test through all candidate address pairs until an operational pair is found, and retry the process as necessary.
REAP Keepalive messages SHOULD continue to be sent at the Keepalive Interval until either a payload packet in the Shim6 context has been received from the peer or the Keepalive Timeout expires.
Shim6 implementations MUST be able to employ information provided from Neighbor Unreachability Detection to discover and monitor locally operational addresses.
Shim6 implementations MUST support the discovery of operational address pairs through the use of explicit reachability tests and Forced Bidirectional Communication (FBD).
The Probe Nonce field is RECOMMENDED to be at least moderately hard to guess so that even on-path attackers cannot deduce the next nonce value, and SHOULD be generated using a random number generator with good randomness properties as outlined in RFC 4086.
The Type field in the Keepalive message MUST be set to 66 (Keepalive).
When sending a Probe message, the State field MUST be set to a value that matches the conceptual state of the sender after sending the Probe.
While the Keepalive Timer is running, the node SHOULD send Keepalive messages to the peer with an interval of Keepalive Interval seconds.
Default protocol constants: Send Timeout = 15 seconds, Keepalive Timeout = peer's Send Timeout (or 15 seconds if not communicated), Keepalive Interval = one-third to one-half of Keepalive Timeout, Initial Probe Timeout = 0.5 seconds, Number of Initial Probes = 4, Max Probe Timeout = 60 seconds.
REAP (REAchability Protocol) is the failure detection and locator pair exploration component of Shim6. It detects failures on the current address pair and explores alternative address pairs when a failure is detected.
The Sta (State) field in the Probe message is a 2-bit field with three legal values: 0 (Operational) — sender believes both sides can communicate; 1 (Exploring) — sender has not seen traffic from recipient; 2 (InboundOk) — sender sees packets from recipient but recipient may not yet see packets from sender.
Attackers may spoof ICMP error messages, Router Discovery, and address assignment indications to confuse peers about which addresses are operational, potentially causing use of non-preferred addresses or denial of service. Unprotected indications SHOULD NOT be taken as proof of connectivity problems, but REAP performs its own reachability tests before switching address pairs.
The exploration phase is vulnerable to on-path attackers who can cause denial-of-service, move communications to less-preferred address pairs, or prevent exploration from completing. Off-path attackers cannot easily guess both the context tag and correct probe nonces. IPsec cannot protect exploration because it operates above the Shim6 layer.
The exploration process can cause packet amplification in flooding attacks. Shim6 mitigates this by only creating contexts after many packets have been exchanged and by not supporting REAP during connection establishment.
The keepalive mechanism is vulnerable to spoofing: on-path attackers that know a Shim6 context tag can send spoofed Keepalives to suppress legitimate keepalives, forcing nodes into unnecessary exploration. Off-path attackers are deterred by 47-bit random context tags.
REAP defines three states per Shim6 context: Operational (address pairs assumed working), Exploring (no traffic received from peer beyond Send Timeout), and InboundOK (traffic received from peer but peer may not be receiving from this node). Transitions are triggered by incoming/outgoing payload packets, Keepalive/Probe message reception, and timer expirations.
The Keepalive message (Type=66) contains a 47-bit Receiver Context Tag, a 1-bit R field, a 7-bit Reserved1 field, a 32-bit Reserved2 field, and an optional Options field. It is a Shim6 control message with Next Header, Hdr Ext Len, and Checksum fields.
The Keepalive Timeout Option (Type=10, Length=4) carries a 16-bit Keepalive Timeout value in seconds and a 16-bit Reserved field. It is sent in I2, I2bis, R2, or UPDATE messages to communicate the sender's preferred Keepalive Timeout to the peer.
The Probe message (Type=67) contains a 47-bit Receiver Context Tag, a 4-bit Psent field (number of sent probes), a 4-bit Precvd field (number of received probes), a 2-bit Sta (State) field, and repeated sets of 128-bit Probe Source Address, 128-bit Probe Destination Address, 32-bit Probe Nonce, and 32-bit Probe Data fields.