[Docs] [txt|pdf] [Tracker] [WG] [Email] [Diff1] [Diff2] [Nits]

Versions: (draft-krishnan-dna-simple) 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 RFC 6059

Network Working Group                                        S. Krishnan
Internet-Draft                                                  Ericsson
Intended status: Standards Track                                G. Daley
Expires: February 26, 2011                              NetStar Networks
                                                         August 25, 2010


       Simple procedures for Detecting Network Attachment in IPv6
                        draft-ietf-dna-simple-17

Abstract

   Detecting Network Attachment allows hosts to assess if its existing
   addressing or routing configuration is valid for a newly connected
   network.  This document provides simple procedures for detecting
   network attachment in IPv6 hosts, and procedures for routers to
   support such services.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on February 26, 2011.

Copyright Notice

   Copyright (c) 2010 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as



Krishnan & Daley        Expires February 26, 2011               [Page 1]

Internet-Draft                 Simple DNA                    August 2010


   described in the Simplified BSD License.


Table of Contents

   1.  Requirements notation  . . . . . . . . . . . . . . . . . . . .  3
   2.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
     2.1.  Goals  . . . . . . . . . . . . . . . . . . . . . . . . . .  3
     2.2.  Applicability  . . . . . . . . . . . . . . . . . . . . . .  4
     2.3.  Link Identification model  . . . . . . . . . . . . . . . .  4
     2.4.  DNA Overview . . . . . . . . . . . . . . . . . . . . . . .  4
     2.5.  Working Assumptions  . . . . . . . . . . . . . . . . . . .  5
   3.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  6
   4.  The Simple DNA Address Table (SDAT)  . . . . . . . . . . . . .  7
   5.  Host Operations  . . . . . . . . . . . . . . . . . . . . . . .  7
     5.1.  On receipt of a Router Advertisement . . . . . . . . . . .  7
     5.2.  After assignment of a DHCPv6 address . . . . . . . . . . .  8
     5.3.  Steps involved in detecting link change  . . . . . . . . .  8
     5.4.  Link-Layer Indication  . . . . . . . . . . . . . . . . . .  8
     5.5.  Sending Neighbor Discovery probes  . . . . . . . . . . . .  9
       5.5.1.  Sending Router Solicitations . . . . . . . . . . . . .  9
       5.5.2.  Sending Neighbor Solicitations . . . . . . . . . . . .  9
       5.5.3.  Concurrent sending of RS and NS probes . . . . . . . .  9
       5.5.4.  Initiating DHCPv6 exchange . . . . . . . . . . . . . .  9
     5.6.  Contents of the Neighbor Discovery messages  . . . . . . . 11
       5.6.1.  Neighbor Solicitation messages . . . . . . . . . . . . 11
       5.6.2.  Router Solicitation messages . . . . . . . . . . . . . 11
     5.7.  Response Gathering . . . . . . . . . . . . . . . . . . . . 12
       5.7.1.  Receiving Neighbor Advertisements  . . . . . . . . . . 12
       5.7.2.  Receiving Router Advertisements  . . . . . . . . . . . 12
       5.7.3.  Conflicting results  . . . . . . . . . . . . . . . . . 12
     5.8.  Further Host Operations  . . . . . . . . . . . . . . . . . 12
     5.9.  On connecting to a new point of attachment . . . . . . . . 13
     5.10. Periodic Maintenance of the SDAT . . . . . . . . . . . . . 13
     5.11. Recommended retransmission behavior  . . . . . . . . . . . 13
   6.  Pseudocode for Simple DNA  . . . . . . . . . . . . . . . . . . 15
   7.  Constants  . . . . . . . . . . . . . . . . . . . . . . . . . . 16
   8.  Relationship to DNAv4  . . . . . . . . . . . . . . . . . . . . 17
   9.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 17
   10. Security Considerations  . . . . . . . . . . . . . . . . . . . 17
   11. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 18
   12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 18
     12.1. Normative References . . . . . . . . . . . . . . . . . . . 18
     12.2. Informative References . . . . . . . . . . . . . . . . . . 19
   Appendix A.  Issues with confirming manually assigned addresses  . 19
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 20





Krishnan & Daley        Expires February 26, 2011               [Page 2]

Internet-Draft                 Simple DNA                    August 2010


1.  Requirements notation

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].


2.  Introduction

   Hosts require procedures to simply and reliably identify if they have
   moved to a network to which they had been recently connected.  In
   order to detect reconnection to a previously visited network, router
   and neighbor discovery messages are used to collect reachability and
   configuration information.  This information is used to detect if the
   host has attached to a link for which it may still have valid address
   and other configuration information, and which it can use until it
   receives confirmation through either through the Neighbor Discovery
   protocol or DHCPv6.

   This document incorporates feedback from host and router operating
   systems implementors, which seeks to make implementation and adoption
   of IPv6 change detection procedures simple for general use.

2.1.  Goals

   The goal of this document is to specify a simple procedure for
   detecting network attachment (Simple DNA) that has the following
   characteristics.

   o  Routers do not have to be modified to support this scheme.

   o  The most common use cases are optimized.

   o  In the worst case, detection latency is equal to that of standard
      neighbor discovery so that performance is never degraded.

   o  False positives are not acceptable.  A host must not wrongly
      conclude that it has reattached to a previouly visited network.

   o  False negatives are acceptable.  A host may fail to identify a
      previously visited link correctly and attempt to acquire fresh
      addressing and configuration information.









Krishnan & Daley        Expires February 26, 2011               [Page 3]

Internet-Draft                 Simple DNA                    August 2010


2.2.  Applicability

   The Simple DNA protocol provides substantial benefits over standard
   neighbor discovery procedures [RFC4861] in some scenarios and does
   not provide any benefit at all in certain other scenarios.  This is
   intentional as Simple DNA was designed for simplicity rather than
   completeness.  In particular, the Simple DNA protocol provides
   maximum benefits when a host moves between a small set of known
   links.  When a host moves to a completely new link that is previously
   unknown, the performance of the Simple DNA protocol will be identical
   to that using standard neighbor discovery procedures [RFC4861].  In
   this case the main benefit of the Simple DNA protocol is to
   immediately flush out the inoperable addresses and configuration
   instead of timing them out.  The Simple DNA procedure provides
   support for addresses configured using either IPv6 Stateless Address
   Autoconfiguration [RFC4862] or DHCPv6 [RFC3315].  It does not support
   manually configured addresses since they are not widely used and can
   cause unpredictable results and/or aggressive probing behavior
   [Appendix A].

2.3.  Link Identification model

   Earlier methods of detecting network attachment, e.g. the procedure
   defined in [I-D.ietf-dna-protocol], relied on detecting whether the
   host was still connected to the same link.  If the host was attached
   to the same link, all information related to the link such as the
   routers, prefixes and configuration parameters was considered to be
   valid.  The Simple DNA protocol follows an alternate approach where
   it relies on probing each previously known router to determine
   whether to use information learnt from THAT router.  This allows
   simple DNA to probe routers learnt from multiple earlier attachments
   to optimize movement between a known set of links.

2.4.  DNA Overview

   Detecting Network Attachment is performed by hosts after detecting a
   link-layer "up" indication.  The host uses a combination of unicast
   Neighbor Solicitations (NSs) and multicast Router Solicitations (RSs)
   in order to determine whether previously encountered routers are
   present on the link, in which case an existing configuration can be
   reused.  If previously encountered routers are not present then
   either IPv6 Stateless Address Autoconfiguration and/or DHCPv6 is used
   for configuration.

   Hosts implementing simple DNA may also send DHCPv6 packets, as
   described in Section 5.5.4.  Since simple DNA does not modify the
   DHCPv6 protocol or state machine, the operation of DHCPv6 is
   unchanged.



Krishnan & Daley        Expires February 26, 2011               [Page 4]

Internet-Draft                 Simple DNA                    August 2010


   Routers that follow the standard neighbor discovery procedure
   described in [RFC4861] will delay the router advertisement by a
   random period between 0 and MAX_RA_DELAY_TIME (defined to be 500ms)
   as described in Section 6.2.6 of [RFC4861].  In addition, consecutive
   RAs sent to the all-nodes multicast address are rate limited to no
   more than one advertisement every MIN_DELAY_BETWEEN_RAS (defined to
   be 3 seconds).  This will result in a worst-case delay of 3.5 seconds
   in the absence of any packet loss.

   Hosts implementing simple DNA can detect the presence of a previously
   encountered router using unicast Neighbor Solicitations.  As a
   result, where the host with a valid configuration is returning to a
   previously encountered link, delays in the sending of a Router
   Advertisement (RA) will not delay configuration as long as NS probing
   is successful.  However in situations where the host is attaching to
   a link for the first time, or where it does not have a valid IP
   address on the link, it will be dependent on the receipt of an RA for
   stateless auto-configuration.  In these situations delays in the
   receipt of an RA can be significant and may result in service
   disruption.

2.5.  Working Assumptions

   There are a series of assumptions about the network environment which
   underpin these procedures.

   o  The combination of the link layer address and the link local IPv6
      address of a router is unique across links.

   o  Hosts receive indications when a link-layer comes up.  Without
      this, they would not know when to commence the DNA procedure.

   If these assumptions do not hold, host change detection systems will
   not function optimally.  In that case, they may occasionally detect
   change spuriously, or experience some delay in detecting network
   attachment.  The delays so experienced will be no longer than those
   caused by following the standard neighbor discovery procedure
   described in [RFC4861].













Krishnan & Daley        Expires February 26, 2011               [Page 5]

Internet-Draft                 Simple DNA                    August 2010


3.  Terminology

   +---------------------+---------------------------------------------+
   |         Term        |                  Definition                 |
   +---------------------+---------------------------------------------+
   |  Valid IPv6 address | An IPv6 address configured on the node that |
   |                     |   has a valid lifetime greater than zero.   |
   |                     |                                             |
   |    Operable IPv6    | An IPv6 address configured on the node that |
   |       address       |   can be used safely on the current link.   |
   |                     |                                             |
   |  Router identifier  |    Identifier formed using the link-local   |
   |                     |      address of a router along with its     |
   |                     |             link-layer address.             |
   |                     |                                             |
   |        D-Flag       |   Flag indicating whether the address was   |
   |                     |   obtained using SLAAC or DHCPv6. If it is  |
   |                     |  set to 0, then SLAAC was used to configure |
   |                     | the address. If it is set to 1, then DHCPv6 |
   |                     |      was used to configure the address.     |
   |                     |                                             |
   |        O-Flag       |    Flag indicating whether the address is   |
   |                     | operable. If it is set to 0, the address is |
   |                     |  inoperable. If it is set to 1, the address |
   |                     |                 is operable.                |
   |                     |                                             |
   |        S-Flag       |  Flag indicating whether SEND [RFC3971] was |
   |                     |    used in the Router Advertisement that    |
   |                     |   resulted in the creation/modification of  |
   |                     |   this SDAT entry. If it is set to 0, then  |
   |                     |  SEND was not used. If it is set to 1, then |
   |                     |                SEND was used.               |
   |                     |                                             |
   |   Candidate Router  |     A router address in the SDAT that is    |
   |       Address       | associated with at least one valid address. |
   |                     |                                             |
   |   Candidate Router  |   A set of router addresses that has been   |
   |         Set         |       identified for NS based probing.      |
   +---------------------+---------------------------------------------+

                      Table 1: Simple DNA Terminology










Krishnan & Daley        Expires February 26, 2011               [Page 6]

Internet-Draft                 Simple DNA                    August 2010


4.  The Simple DNA Address Table (SDAT)

   In order to correctly perform the procedure described in this
   document the host needs to maintain a data structure called the
   Simple DNA address table (SDAT).  The host needs to maintain this
   data structure for each interface on which it performs Simple DNA.
   Each entry in the SDAT table will be indexed by the router identifier
   (link-local + link layer address of the router) and consists of at
   least the following parameters.  Fields tagged as [S] are used for
   addresses configured using SLAAC.  Fields tagged as [D] are used for
   addresses obtained using DHCPv6.  Fields tagged as [S+D] are used in
   both cases.

   o  [S+D]Link-local IPv6 address of the router(s)

   o  [S+D]Link-layer (MAC) address of the router(s)

   o  [S+D]Flag indicating whether the address was obtained using SLAAC
      or DHCPv6.(The D-Flag)

   o  [S+D]IPv6 address and its related parameters like valid lifetime,
      preferred lifetime etc.

   o  [S]Prefix from which the address was formed.

   o  [S]Flag indicating whether SEND was used.(The S-Flag)

   o  [D]DHCP specific information in case DHCPv6 [RFC3315] was used to
      acquire the address.  This information includes DUID, IA_ID, a
      flag indicating IA_NA/IA_TA, configuration information such as DNS
      server address, NTP server address etc.

   o  [S+D]Flag indicating whether the address is operable.(The O-Flag)


5.  Host Operations

   On connecting to a new point of attachment, the host performs the
   detecting network attachment procedure in order to determine whether
   the existing addressing and configuration information are still
   valid.

5.1.  On receipt of a Router Advertisement

   When the host receives a Router Advertisement and the router
   identifier of the sending router is not present in the SDAT, the host
   processes the Router Advertisement as specified in Section 6.3.4. of
   [RFC4861].  Additionally, the host performs the following operations.



Krishnan & Daley        Expires February 26, 2011               [Page 7]

Internet-Draft                 Simple DNA                    August 2010


   If the Router Advertisement is protected by SEND the S-Flag MUST be
   set to 1 in the SDAT entries created/modified by this RA.

   o  The host configures addresses out of the autoconfigurable prefixes
      advertised in the RA, as specified in [RFC4862].  The host MUST
      add an SDAT entry (indexed by this router identifier) for each
      such address the host configures.

   o  The host might have already configured addresses out of the
      autoconfigurable prefixes advertised in the RA.  This could be a
      result of receiving the prefix in an RA from another router on the
      same link.  The host MUST add an SDAT entry (indexed by this
      router identifier) for each such address the host had already
      configured.

   o  The host might have DHCPv6 assigned addresses that are known to be
      operable on the link.  The host MUST add an SDAT entry (indexed by
      this router identifier) for each such DHCPv6 address.

5.2.  After assignment of a DHCPv6 address

   After the host is assigned an address by a DHCPv6 server, it needs to
   associate the address with the routers on link.  The host MUST create
   one SDAT entry for each of the on-link routers associated with the
   DHCPv6 assigned address.

5.3.  Steps involved in detecting link change

   The steps involved in basic detection of network attachment are:

   o  Link-Layer Indication

   o  Sending of neighbor discovery probes

   o  Response gathering and assessment

   These steps are described below.

5.4.  Link-Layer Indication

   In order to start Detection of network attachment procedures, a host
   typically requires a link-layer indication that the medium has become
   available [RFC4957].

   After the indication is received, the host MUST mark all currently
   configured (non-tentative) IP addresses as inoperable until the
   change detection process completes.  It MUST also set all Neighbor
   Cache entries for the routers on its Default Router List to STALE.



Krishnan & Daley        Expires February 26, 2011               [Page 8]

Internet-Draft                 Simple DNA                    August 2010


   This is done to speed up the acquisition of a new default router in
   case the host attaches to a previously unvisited link.

5.5.  Sending Neighbor Discovery probes

5.5.1.  Sending Router Solicitations

   When a host receives a link-layer "up" indication, it SHOULD
   immediately send a Router Solicitation (as specified in as specified
   in section 6.3.7 of [RFC4861]).  The Router Solicitation is sent to
   the All-routers multicast address using a link-local address as the
   source address [RFC4861].  Even if the host is in possession of more
   than one valid IPv6 address, it MUST send only one router
   solicitation using a valid link-local address as the source address.

5.5.2.  Sending Neighbor Solicitations

   The host iterates through the SDAT to identify a set of candidate
   routers for NS based probing.  Each router in the SDAT that is
   associated with at least one valid address is added to the candidate
   router set exactly once.  For each router in the candidate router set
   the host MUST send an unicast Neighbor Solicitation to the router's
   link-local address it obtained from the lookup on the SDAT.  The host
   MUST set link-layer destination address in each of these neighbor
   solicitations to the link-layer address of the router stored in the
   SDAT.  The host MUST NOT send unicast Neighbor Solicitations to a
   router that is not associated to a valid address in the SDAT.  If at
   least one entry in the SDAT for a given router had the S-Flag set,
   the host SHOULD use SEND to secure the NS probe being sent to the
   router.

5.5.3.  Concurrent sending of RS and NS probes

   The host SHOULD send the Neighbor Solicitation based unicast probes
   in parallel with the multicast Router Solicitation.  Since sending
   NSs is just an optimization, doing the NSs and the RS in parallel
   ensures that the procedure does not run slower than it would if it
   only used an Router Solicitation.

   NOTE: A Simple DNA implementation SHOULD limit its NS based probing
   to at most six previously seen routers

5.5.4.  Initiating DHCPv6 exchange

   On receiving a link-layer "up" indication, the host will initiate a
   DHCPv6 exchange when and as specified in [RFC3315] in order to verify
   whether the addresses and configuration obtained using DHCPv6 are
   still usable on the link.  Note that DHCPv6, as specified today, only



Krishnan & Daley        Expires February 26, 2011               [Page 9]

Internet-Draft                 Simple DNA                    August 2010


   attempts to confirm addresses obtained on the most recently attached
   link.

















































Krishnan & Daley        Expires February 26, 2011              [Page 10]

Internet-Draft                 Simple DNA                    August 2010


5.6.  Contents of the Neighbor Discovery messages

5.6.1.  Neighbor Solicitation messages

   This section describes the contents of the neighbor solicitation
   probe messages sent during the probing procedure.

   Source Address:           A link-local address assigned to the
                             probing host.

   Destination Address:      The link-local address of the router being
                             probed as learned from the SDAT.

   Hop Limit:                255

   ND Options:

   Target Address:           The link-local address of the router being
                             probed as learnt from the SDAT.

   Link Layer Header:

   Destination Address:      The link-layer (MAC) address of the router
                             being probed as learnt from the SDAT.

   The probing node SHOULD include the Source link-layer address option
   in the probe messages.

5.6.2.  Router Solicitation messages

   This section describes the contents of the router solicitation probe
   message sent during the probing procedure.

   Source Address:           A link-local address assigned to the
                             probing host.

   Destination Address:      The all-routers multicast address.

   Hop Limit:                255

   The probing node SHOULD NOT include the Source link-layer address
   option in the probe messages.









Krishnan & Daley        Expires February 26, 2011              [Page 11]

Internet-Draft                 Simple DNA                    August 2010


5.7.  Response Gathering

5.7.1.  Receiving Neighbor Advertisements

   When a Neighbor Advertisement is received from a router in response
   to a NS probe, the host MUST verify that both the IPv6 and link layer
   (MAC) addresses of the router match the expected values before
   utilizing the configuration associated with the detected network
   (prefixes, MTU etc.).  The host MUST then go through the SDAT and
   mark the addresses (both SLAAC and DHCPv6 acquired) associated with
   the router as operable.

5.7.2.  Receiving Router Advertisements

   On reception of a Router Advertisement the host MUST go through the
   SDAT and mark all the addresses associated with the router (both
   SLAAC and DHCPv6 acquired) as inoperable.  The host MUST then process
   the Router Advertisement as specified in Section 6.3.4. of [RFC4861].

5.7.3.  Conflicting results

5.7.3.1.  Conflicting results between RS and NS probes

   Where the conclusions obtained from the Neighbor Solicitation/
   Advertisement from a given router and the RS/RA exchange with the
   same router differ, the results obtained from the RS/RA will be
   considered definitive.  In case the Neighbor Advertisement was
   secured using SEND and the Router Advertisement was not, the host
   MUST wait for SEND_NA_GRACE_TIME to see if a SEND-secured RA is
   received.  If a SEND-secured RA is not received, the conclusions
   obtained from the NS/NA exchange will be considered definitive.

5.7.3.2.  Conflicting results between DHCPv6 and NS probes

   Where the conclusions obtained from the Neighbor Solicitation/
   Advertisement for a given DHCPv6-assigned address and the conclusions
   obtained from the DHCPv6 exchange differ, the results obtained from
   the DHCPv6 exchange will be considered definitive.

5.8.  Further Host Operations

   Operations subsequent to detecting network attachment depend upon
   whether or not the host has reconnected to a previously visited
   network.

   After confirming the reachability of the associated router using an
   NS/NA pair, the host performs the following steps.




Krishnan & Daley        Expires February 26, 2011              [Page 12]

Internet-Draft                 Simple DNA                    August 2010


   o  The host SHOULD rejoin any solicited nodes' multicast groups for
      addresses it continues to use.

   o  The host SHOULD select a default router as described in Section
      6.3.6 of [RFC4861].

   If the host has determined that it has reattached to a previously
   visited link, it SHOULD NOT perform duplicate address detection on
   the addresses that have been confirmed to be operable.

   If the NS based probe with a router did not complete or if the RS
   based probe on the same router completed with different prefixes than
   the ones in the SDAT the host MUST begin address configuration
   techniques, as indicated in a received Router Advertisement
   [RFC4861][RFC4862].

5.9.  On connecting to a new point of attachment

   A host usually maintains SDAT entries from some number of previously
   visited networks.  When the host attaches to a previously unknown
   network it MAY need to discard some older SDAT entries.

5.10.  Periodic Maintenance of the SDAT

   The host SHOULD maintain the SDAT table by removing entries when the
   valid lifetime for the prefix and address expires, that is, at the
   same as as the prefix is removed from the Prefix List in [RFC4861].
   The host SHOULD also remove a router from a SDAT entry when that
   router stops advertising a particular prefix.  When three consequtive
   RAs from a particular router have not included a prefix, then the
   router should be removed from the corresponding SDAT entry.
   Likewise, if a router starts advertising a prefix for which there
   already exists a SDAT entry then that router should be added to the
   SDAT entry.

5.11.  Recommended retransmission behavior

   Where the NS probe does not complete successfully, it usually implies
   that the host is not attached to the network whose configuration is
   being tested.  In such circumstances, there is typically little value
   in aggressively retransmitting unicast neighbor solicitations that do
   not elicit a response.

   Where unicast Neighbor Solicitations and Router Solicitations are
   sent in parallel, one strategy is to forsake retransmission of
   Neighbor Solicitations and to allow retransmission only of Router
   Solicitations or DHCPv6.  In order to reduce competition between
   unicast Neighbor Solicitations and Router Solicitations and DHCPv6



Krishnan & Daley        Expires February 26, 2011              [Page 13]

Internet-Draft                 Simple DNA                    August 2010


   retransmissions, a DNAv6 implementation that retransmits may utilize
   the retransmission strategy described in the DHCPv6 specification
   [RFC3315], scheduling DNAv6 retransmissions between Router
   Solicitations or DHCPv6 retransmissions.

   If a response is received to any unicast Neighbor Solicitation,
   pending retransmissions of the same MUST be canceled.  A Simple DNA
   implementation SHOULD NOT retransmit a Neighbor Solicitation more
   than twice.  To provide damping in the case of spurious Link Up
   indications, the host SHOULD NOT perform the Simple DNA procedure
   more than once a second.








































Krishnan & Daley        Expires February 26, 2011              [Page 14]

Internet-Draft                 Simple DNA                    August 2010


6.  Pseudocode for Simple DNA

    /* Link up indication received on INTERFACE */
    /* Start Simple DNA process */

    /* Mark All Addresses as inoperable */
    Configured_Address_List=Get_Address_List(INTERFACE);
    foreach Configured_Address in Configured_Address_List
    {
      if (Get_Address_State(Configured_Address)!=AS_TENTATIVE)
      {
        Set_Address_State(Configured_Address,AS_INOPERABLE);
      }
    }

    /* Mark all routers' NC entries as STALE to speed up */
    /* acquisition of new router if link change has occurred */
    foreach Router_Address in DEFAULT_ROUTER_LIST
    {
      NCEntry=Get_Neighbor_Cache_Entry(Router_Address);
      Set_Neighbor_Cache_Entry_State(NCEntry,NCS_STALE);
    }

    /* Thread A : Send Router Solicitation */
    RS_Target_Address=FF02::2;
    RS_Source_Address=Get_Any_Link_Local_Address(INTERFACE);
    Send_Router_Solicitation(RS_Source_Address,RS_Target_Address);

    /* Thread B : Send Neighbor Solicitation(s) */
    Previously_Known_Router_List=Get_Router_List_from_SDAT();
    NS_Source_Address=Get_Any_Link_Local_Address(INTERFACE);

    foreach Router_Address in Previously_Known_Router_List
    {
      if (Get_Any_Valid_Address_from_SDAT(Router_Address))
      {
        Send_Neighbor_Solicitation(NS_Source_Address,Router_Address.L3_Address,
                                   Router_Address.L2_Address);
      }
    }

    /* Thread C : Response collection of RAs */

    /* Received Router Advertisement processing */
    /* Only for RAs received from routers in the SDAT */

    L3_Source=Get_L3_Source(RECEIVED_MESSAGE);
    L2_Source=Get_L2_Source(RECEIVED_MESSAGE);



Krishnan & Daley        Expires February 26, 2011              [Page 15]

Internet-Draft                 Simple DNA                    August 2010


    SDAT_Entry_List=Get_Entries_from_SDAT_L2L3(L3_Source,L2_Source));

    /* Mark all the addresses associated with the router as inoperable */
    foreach SDAT_Entry in SDAT_Entry_List
    {
        Set_Address_State(SDAT_Entry,AS_INOPERABLE);
    }

    /* Ignore further NAs from this router */
    /* after delaying for x milliseconds */
    Add_Router_to_NA_Ignore_List(L3_Source,SEND_NA_GRACE_PERIOD);

    /* Perform Standard RA processing as per RFC4861/RFC4862 */


    /* Thread D : Response collection of NAs */

    /* Received Neighbor Advertisement processing */
    /* Only for NAs received as response to DNA NSs */

    L3_Source=Get_L3_Source(RECEIVED_MESSAGE);
    L2_Source=Get_L2_Source(RECEIVED_MESSAGE);

    if (Is_Router_on_NA_Ignore_List(L3_Source)) {
      /* Ignore message and wait for next message */
      continue;
    }

    SDAT_Entry_List=Get_Entries_from_SDAT_L2L3(L3_Source,L2_Source));

    foreach SDAT_Entry in SDAT_Entry_List
    {
        /* Address is operable. */
        Set_Address_State(SDAT_Entry,AS_OPERABLE);
        /* Configure on Interface */
    }


                    Figure 1: Pseudocode for Simple DNA

   NOTE: This section does not include any pseudo-code for sending of
   the DHCPv6 packets since the DHCPv6 exchange is orthogonal to the
   simple DNA process.


7.  Constants





Krishnan & Daley        Expires February 26, 2011              [Page 16]

Internet-Draft                 Simple DNA                    August 2010


      SEND_NA_GRACE_TIME

         Definition: An optional period to wait after Neighbor
         Solicitation before adopting a non-SEND RA's link change
         information.

         Value: 40 milliseconds


8.  Relationship to DNAv4

   DNAv4 [RFC4436] specifies a set of steps that optimize the (common)
   case of re-attachment to an IPv4 network that one has been connected
   to previously by attempting to re-use a previous (but still valid)
   configuration.  This document shares the same goal as DNAv4 (that of
   minimizing the handover latency in moving between points of
   attachment) but differs in the steps it performs to achieve this
   goal.  Another difference is that this document also supports
   stateless autoconfiguration of addresses in addition to addresses
   configured using DHCPv6.


9.  IANA Considerations

   There are no changes to IANA registries required in this document.


10.  Security Considerations

   A host may receive Router Advertisements from non-SEND devices, after
   receiving a link-layer indications.  While it is necessary to assess
   quickly whether a host has moved to another network, it is important
   that the host's current secured SEND [RFC3971] router information is
   not replaced by an attacker which spoofs an RA and purports to change
   the link.

   As such, the host SHOULD send a Neighbor Solicitation to the existing
   SEND router upon link-up indication as described above in
   Section 5.4.  The host SHOULD then ensure that unsecured router
   information does not cause deletion of existing SEND state, within
   MIN_DELAY_BETWEEN_RAS, in order to allow for a present SEND router to
   respond.

   If the current default router is a SEND-secured router, the host
   SHOULD wait SEND_NA_GRACE_TIME after transmission before adopting a
   new default router.

   Even if SEND signatures on RAs are used, it may not be immediately



Krishnan & Daley        Expires February 26, 2011              [Page 17]

Internet-Draft                 Simple DNA                    August 2010


   clear if the router is authorized to make such advertisements.  As
   such, a host SHOULD NOT treat such devices as secure until and unless
   authorization delegation discovery is successful.

   Unless SEND or other form of secure address configuration is used,
   the DNA procedure does not in itself provide positive, secure
   authentication of the router(s) on the network, or authentication of
   the network itself, as e.g. would be provided by mutual
   authentication at the link layer.  Therefore when such assurance is
   not available, the host MUST NOT make any security-sensitive
   decisions based on the DNA procedure alone.  In particular, it MUST
   NOT decide that it has moved from an untrusted to a trusted network,
   and MUST NOT make any security decisions that depend on the
   determination that such a transition has occurred.


11.  Acknowledgments

   This document is the product of a discussion the authors had with
   Bernard Aboba, Thomas Narten, Erik Nordmark and Dave Thaler at IETF
   69.  The authors would like to thank them for clearly detailing the
   requirements of the solution and the goals it needed to meet and for
   helping to explore the solution space.  The authors would like to
   thank the authors and editors of the complete DNA specification for
   detailing the overall problem space and solutions.  The authors would
   like to thank Jari Arkko for driving the evolution of a simple and
   probabilistic DNA solution.  The authors would like to thank Bernard
   Aboba, Thomas Narten, Jari Arkko, Sathya Narayan, Julien Laganier,
   Domagoj Premec, Jin Hyeock-Choi, Alfred Hoenes, Frederic Rossi, Ralph
   Droms, Ted Lemon, Erik Nordmark, Lars Eggert, Brian Carpenter and
   Yaron Sheffer for performing reviews on the document and providing
   valuable comments to drive the document forward.


12.  References

12.1.  Normative References

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC3736]  Droms, R., "Stateless Dynamic Host Configuration Protocol
              (DHCP) Service for IPv6", RFC 3736, April 2004.

   [RFC3315]  Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C.,
              and M. Carney, "Dynamic Host Configuration Protocol for
              IPv6 (DHCPv6)", RFC 3315, July 2003.




Krishnan & Daley        Expires February 26, 2011              [Page 18]

Internet-Draft                 Simple DNA                    August 2010


   [RFC3971]  Arkko, J., Kempf, J., Zill, B., and P. Nikander, "SEcure
              Neighbor Discovery (SEND)", RFC 3971, March 2005.

   [RFC4861]  Narten, T., Nordmark, E., Simpson, W., and H. Soliman,
              "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861,
              September 2007.

12.2.  Informative References

   [I-D.ietf-dna-protocol]
              Narayanan, S., "Detecting Network Attachment in IPv6
              Networks (DNAv6)", draft-ietf-dna-protocol (work in
              progress), June 2007.

   [RFC4957]  Krishnan, S., Montavont, N., Njedjou, E., Veerepalli, S.,
              and A. Yegin, "Link-Layer Event Notifications for
              Detecting Network Attachments", RFC 4957, August 2007.

   [RFC4862]  Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless
              Address Autoconfiguration", RFC 4862, September 2007.

   [RFC4436]  Aboba, B., Carlson, J., and S. Cheshire, "Detecting
              Network Attachment in IPv4 (DNAv4)", RFC 4436, March 2006.


Appendix A.  Issues with confirming manually assigned addresses

   Even though DNAv4 [RFC4436] supports verification of manually
   assigned addresses this feature of DNAv4 has not been widely
   implemented or used.  There are two major issues that come up with
   confirming manually assigned addresses using Simple DNA.

   o  When DHCPv6 or SLAAC addresses are used for probing, there is no
      need to aggressively retransmit lost probes.  This is because the
      address configuration falls back to vanilla DHCPv6 or SLAAC and
      the host will eventually obtain an address.  This is not the case
      with manually assigned addresses.  If the probes are lost, the
      host runs the risk of ending up with no addresses at all.  Hence
      agressive retransmissions are necessary.

   o  Another issue comes up when the host moves between two networks,
      one where manual addressing is being used (say NET1)and the other
      where dynamic addressing (stateless autoconfig or DHCPv6) is being
      used (say NET2).  Since the host can obtain a dynamic address in
      some situations, it will need to send simple DNA probes and may
      also engage in a DHCPv6 exchange.  In a situation where the host
      moves to NET1 and the NS probes are lost and in addition an RA is
      not received, the host will not be able to confirm that it



Krishnan & Daley        Expires February 26, 2011              [Page 19]

Internet-Draft                 Simple DNA                    August 2010


      attached to NET1, and therefore that it should use the manual
      configuration for that network.  As a result, if DHCPv6 is enabled
      on NET1, then the host could mistakenly obtain a dynamic address
      and configuration instead of using the manual configuration.  To
      prevent this problem, simple DNA probing needs to continue even
      after the DHCPv6 exchange has completed, and DNA probes need to
      take precedence over DHCPv6, contrary to the advice provided in
      Section 5.7.3

   Given these issues, it is NOT RECOMMENDED to use manual addressing
   with Simple DNA.


Authors' Addresses

   Suresh Krishnan
   Ericsson
   8400 Decarie Blvd.
   Town of Mount Royal, QC
   Canada

   Phone: +1 514 345 7900 x42871
   Email: suresh.krishnan@ericsson.com


   Greg Daley
   NetStar Networks
   Level 9/636 St Kilda Rd
   Melbourne, Victoria  3004
   Australia

   Phone: +61 3 8532 4042
   Email: gdaley@netstarnetworks.com


















Krishnan & Daley        Expires February 26, 2011              [Page 20]


Html markup produced by rfcmarkup 1.108, available from http://tools.ietf.org/tools/rfcmarkup/