idnits 2.17.00 (12 Aug 2021) /tmp/idnits51818/draft-ietf-roll-rpl-10.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (Jun 28, 2010) is 4345 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: draft-ietf-manet-nhdp has been published as RFC 6130 == Outdated reference: draft-ietf-roll-of0 has been published as RFC 6552 == Outdated reference: draft-ietf-roll-routing-metrics has been published as RFC 6551 == Outdated reference: draft-ietf-roll-terminology has been published as RFC 7102 == Outdated reference: draft-ietf-roll-trickle has been published as RFC 6206 Summary: 0 errors (**), 0 flaws (~~), 6 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 ROLL T. Winter, Ed. 3 Internet-Draft 4 Intended status: Standards Track P. Thubert, Ed. 5 Expires: December 30, 2010 Cisco Systems 6 RPL Author Team 7 IETF ROLL WG 8 Jun 28, 2010 10 RPL: IPv6 Routing Protocol for Low power and Lossy Networks 11 draft-ietf-roll-rpl-10 13 Abstract 15 Low power and Lossy Networks (LLNs) are a class of network in which 16 both the routers and their interconnect are constrained: LLN routers 17 typically operate with constraints on (any subset of) processing 18 power, memory and energy (battery), and their interconnects are 19 characterized by (any subset of) high loss rates, low data rates and 20 instability. LLNs are comprised of anything from a few dozen and up 21 to thousands of routers, and support point-to-point traffic (between 22 devices inside the LLN), point-to-multipoint traffic (from a central 23 control point to a subset of devices inside the LLN) and multipoint- 24 to-point traffic (from devices inside the LLN towards a central 25 control point). This document specifies the IPv6 Routing Protocol 26 for LLNs (RPL), which provides a mechanism whereby multipoint-to- 27 point traffic from devices inside the LLN towards a central control 28 point, as well as point-to-multipoint traffic from the central 29 control point to the devices inside the LLN, is supported. Support 30 for point-to-point traffic is also available. 32 Status of this Memo 34 This Internet-Draft is submitted in full conformance with the 35 provisions of BCP 78 and BCP 79. 37 Internet-Drafts are working documents of the Internet Engineering 38 Task Force (IETF). Note that other groups may also distribute 39 working documents as Internet-Drafts. The list of current Internet- 40 Drafts is at http://datatracker.ietf.org/drafts/current/. 42 Internet-Drafts are draft documents valid for a maximum of six months 43 and may be updated, replaced, or obsoleted by other documents at any 44 time. It is inappropriate to use Internet-Drafts as reference 45 material or to cite them other than as "work in progress." 47 This Internet-Draft will expire on December 30, 2010. 49 Copyright Notice 51 Copyright (c) 2010 IETF Trust and the persons identified as the 52 document authors. All rights reserved. 54 This document is subject to BCP 78 and the IETF Trust's Legal 55 Provisions Relating to IETF Documents 56 (http://trustee.ietf.org/license-info) in effect on the date of 57 publication of this document. Please review these documents 58 carefully, as they describe your rights and restrictions with respect 59 to this document. Code Components extracted from this document must 60 include Simplified BSD License text as described in Section 4.e of 61 the Trust Legal Provisions and are provided without warranty as 62 described in the Simplified BSD License. 64 Table of Contents 66 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 6 67 1.1. Design Principles . . . . . . . . . . . . . . . . . . . 6 68 1.2. Expectations of Link Layer Type . . . . . . . . . . . . 7 69 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 8 70 3. Protocol Overview . . . . . . . . . . . . . . . . . . . . . . 11 71 3.1. Topology . . . . . . . . . . . . . . . . . . . . . . . . 11 72 3.1.1. Topology Identifiers . . . . . . . . . . . . . . . . 11 73 3.2. Instances, DODAGs, and DODAG Versions . . . . . . . . . 11 74 3.3. Upward Routes and DODAG Construction . . . . . . . . . . 13 75 3.3.1. Objective Function (OF) . . . . . . . . . . . . . . . 14 76 3.3.2. DODAG Repair . . . . . . . . . . . . . . . . . . . . 14 77 3.3.3. Security . . . . . . . . . . . . . . . . . . . . . . 14 78 3.3.4. Grounded and Floating DODAGs . . . . . . . . . . . . 14 79 3.3.5. Local DODAGs . . . . . . . . . . . . . . . . . . . . 14 80 3.3.6. Administrative Preference . . . . . . . . . . . . . . 15 81 3.3.7. Datapath Validation and Loop Detection . . . . . . . 15 82 3.3.8. Distributed Algorithm Operation . . . . . . . . . . . 15 83 3.4. Downward Routes and Destination Advertisement . . . . . 15 84 3.5. Local DODAGs Route Discovery . . . . . . . . . . . . . . 16 85 3.6. Routing Metrics and Constraints Used By RPL . . . . . . 16 86 3.6.1. Loop Avoidance . . . . . . . . . . . . . . . . . . . 17 87 3.6.2. Rank Properties . . . . . . . . . . . . . . . . . . . 18 88 3.7. Traffic Flows Supported by RPL . . . . . . . . . . . . . 20 89 3.7.1. Multipoint-to-Point Traffic . . . . . . . . . . . . . 21 90 3.7.2. Point-to-Multipoint Traffic . . . . . . . . . . . . . 21 91 3.7.3. Point-to-Point Traffic . . . . . . . . . . . . . . . 21 92 4. RPL Instance . . . . . . . . . . . . . . . . . . . . . . . . 22 93 4.1. RPL Instance ID . . . . . . . . . . . . . . . . . . . . 22 94 5. ICMPv6 RPL Control Message . . . . . . . . . . . . . . . . . 24 95 5.1. RPL Security Fields . . . . . . . . . . . . . . . . . . 25 96 5.2. DODAG Information Solicitation (DIS) . . . . . . . . . . 30 97 5.2.1. Format of the DIS Base Object . . . . . . . . . . . . 30 98 5.2.2. Secure DIS . . . . . . . . . . . . . . . . . . . . . 31 99 5.2.3. DIS Options . . . . . . . . . . . . . . . . . . . . . 31 100 5.3. DODAG Information Object (DIO) . . . . . . . . . . . . . 31 101 5.3.1. Format of the DIO Base Object . . . . . . . . . . . . 31 102 5.3.2. Secure DIO . . . . . . . . . . . . . . . . . . . . . 33 103 5.3.3. DIO Options . . . . . . . . . . . . . . . . . . . . . 33 104 5.4. Destination Advertisement Object (DAO) . . . . . . . . . 33 105 5.4.1. Format of the DAO Base Object . . . . . . . . . . . . 34 106 5.4.2. Secure DAO . . . . . . . . . . . . . . . . . . . . . 34 107 5.4.3. DAO Options . . . . . . . . . . . . . . . . . . . . . 35 108 5.5. Destination Advertisement Object Acknowledgement 109 (DAO-ACK) . . . . . . . . . . . . . . . . . . . . . . . 35 110 5.5.1. Format of the DAO-ACK Base Object . . . . . . . . . . 35 111 5.5.2. Secure DAO-ACK . . . . . . . . . . . . . . . . . . . 36 112 5.5.3. DAO-ACK Options . . . . . . . . . . . . . . . . . . . 36 113 5.6. Consistency Check (CC) . . . . . . . . . . . . . . . . . 36 114 5.6.1. Format of the CC Base Object . . . . . . . . . . . . 36 115 5.6.2. CC Options . . . . . . . . . . . . . . . . . . . . . 38 116 5.7. RPL Control Message Options . . . . . . . . . . . . . . 38 117 5.7.1. RPL Control Message Option Generic Format . . . . . . 38 118 5.7.2. Pad1 . . . . . . . . . . . . . . . . . . . . . . . . 39 119 5.7.3. PadN . . . . . . . . . . . . . . . . . . . . . . . . 39 120 5.7.4. Metric Container . . . . . . . . . . . . . . . . . . 40 121 5.7.5. Route Information . . . . . . . . . . . . . . . . . . 40 122 5.7.6. DODAG Configuration . . . . . . . . . . . . . . . . . 42 123 5.7.7. RPL Target . . . . . . . . . . . . . . . . . . . . . 43 124 5.7.8. Transit Information . . . . . . . . . . . . . . . . . 45 125 5.7.9. Solicited Information . . . . . . . . . . . . . . . . 46 126 5.7.10. Prefix Information . . . . . . . . . . . . . . . . . 48 127 6. Sequence Counters . . . . . . . . . . . . . . . . . . . . . . 51 128 7. Upward Routes . . . . . . . . . . . . . . . . . . . . . . . . 53 129 7.1. DIO Base Rules . . . . . . . . . . . . . . . . . . . . . 53 130 7.2. Upward Route Discovery and Maintenance . . . . . . . . . 53 131 7.2.1. Neighbors and Parents within a DODAG Version . . . . 53 132 7.2.2. Neighbors and Parents across DODAG Versions . . . . . 54 133 7.2.3. DIO Message Communication . . . . . . . . . . . . . . 58 134 7.3. DIO Transmission . . . . . . . . . . . . . . . . . . . . 59 135 7.3.1. Trickle Parameters . . . . . . . . . . . . . . . . . 60 136 7.4. DODAG Selection . . . . . . . . . . . . . . . . . . . . 60 137 7.5. Operation as a Leaf Node . . . . . . . . . . . . . . . . 60 138 7.6. Administrative Rank . . . . . . . . . . . . . . . . . . 61 139 8. Downward Routes . . . . . . . . . . . . . . . . . . . . . . . 62 140 8.1. Destination Advertisement Parents . . . . . . . . . . . 62 141 8.2. Downward Route Discovery and Maintenance . . . . . . . . 62 142 8.3. DAO Base Rules . . . . . . . . . . . . . . . . . . . . . 63 143 8.4. DAO Transmission Scheduling . . . . . . . . . . . . . . 64 144 8.5. Triggering DAO Messages . . . . . . . . . . . . . . . . 64 145 8.6. Structure of DAO Messages . . . . . . . . . . . . . . . 65 146 8.7. Non-storing Mode . . . . . . . . . . . . . . . . . . . . 65 147 8.8. Storing Mode . . . . . . . . . . . . . . . . . . . . . . 66 148 8.9. Path Control . . . . . . . . . . . . . . . . . . . . . . 67 149 8.10. Multicast Destination Advertisement Messages . . . . . . 68 150 9. Security Mechanisms . . . . . . . . . . . . . . . . . . . . . 69 151 9.1. Security Overview . . . . . . . . . . . . . . . . . . . 69 152 9.2. Installing Keys . . . . . . . . . . . . . . . . . . . . 70 153 9.3. Joining a Secure Network . . . . . . . . . . . . . . . . 70 154 9.4. Counter and Counter Compression . . . . . . . . . . . . 71 155 9.4.1. Timestamp Counters . . . . . . . . . . . . . . . . . 72 156 9.5. Functional Description of Packet Protection . . . . . . 72 157 9.5.1. Transmission of Outgoing Packets . . . . . . . . . . 72 158 9.5.2. Reception of Incoming Packets . . . . . . . . . . . . 74 159 9.5.3. Cryptographic Mode of Operation . . . . . . . . . . . 76 160 9.6. Coverage of Integrity and Confidentiality . . . . . . . 77 161 10. Packet Forwarding and Loop Avoidance/Detection . . . . . . . 78 162 10.1. Suggestions for Packet Forwarding . . . . . . . . . . . 78 163 10.2. Loop Avoidance and Detection . . . . . . . . . . . . . . 79 164 10.2.1. Source Node Operation . . . . . . . . . . . . . . . . 80 165 10.2.2. Router Operation . . . . . . . . . . . . . . . . . . 80 166 11. Multicast Operation . . . . . . . . . . . . . . . . . . . . . 83 167 12. Maintenance of Routing Adjacency . . . . . . . . . . . . . . 85 168 13. Guidelines for Objective Functions . . . . . . . . . . . . . 86 169 13.1. Objective Function Behavior . . . . . . . . . . . . . . 86 170 14. Suggestions for Interoperation with Neighbor Discovery . . . 88 171 15. RPL Constants and Variables . . . . . . . . . . . . . . . . . 89 172 16. Manageability Considerations . . . . . . . . . . . . . . . . 91 173 16.1. Introduction . . . . . . . . . . . . . . . . . . . . . . 91 174 16.2. Configuration Management . . . . . . . . . . . . . . . . 92 175 16.2.1. Initialization Mode . . . . . . . . . . . . . . . . . 92 176 16.2.2. DIO and DAO Base Message and Options Configuration . 92 177 16.2.3. Protocol Parameters to be configured on every 178 router in the LLN . . . . . . . . . . . . . . . . . . 93 179 16.2.4. Protocol Parameters to be configured on every 180 non-root router in the LLN . . . . . . . . . . . . . 93 181 16.2.5. Parameters to be configured on the DODAG root . . . . 94 182 16.2.6. Configuration of RPL Parameters related to 183 DAO-based mechanisms . . . . . . . . . . . . . . . . 95 184 16.2.7. Default Values . . . . . . . . . . . . . . . . . . . 96 185 16.3. Monitoring of RPL Operation . . . . . . . . . . . . . . 96 186 16.3.1. Monitoring a DODAG parameters . . . . . . . . . . . . 96 187 16.3.2. Monitoring a DODAG inconsistencies and loop 188 detection . . . . . . . . . . . . . . . . . . . . . . 97 189 16.4. Monitoring of the RPL data structures . . . . . . . . . 98 190 16.4.1. Candidate Neighbor Data Structure . . . . . . . . . . 98 191 16.4.2. Destination Oriented Directed Acyclic Graph (DAG) 192 Table . . . . . . . . . . . . . . . . . . . . . . . . 98 193 16.4.3. Routing Table and DAO Routing Entries . . . . . . . . 99 194 16.5. Fault Management . . . . . . . . . . . . . . . . . . . . 100 195 16.6. Policy . . . . . . . . . . . . . . . . . . . . . . . . . 100 196 16.7. Liveness Detection and Monitoring . . . . . . . . . . . 101 197 16.8. Fault Isolation . . . . . . . . . . . . . . . . . . . . 102 198 16.9. Impact on Other Protocols . . . . . . . . . . . . . . . 102 199 16.10. Performance Management . . . . . . . . . . . . . . . . . 102 200 17. Security Considerations . . . . . . . . . . . . . . . . . . . 104 201 17.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 104 202 18. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 106 203 18.1. RPL Control Message . . . . . . . . . . . . . . . . . . 106 204 18.2. New Registry for RPL Control Codes . . . . . . . . . . . 106 205 18.3. New Registry for the Mode of Operation (MOP) DIO 206 Control Field . . . . . . . . . . . . . . . . . . . . . 107 207 18.4. RPL Control Message Option . . . . . . . . . . . . . . . 107 208 18.5. Objective Code Point (OCP) Registry . . . . . . . . . . 108 209 18.6. ICMPv6: Error in Source Routing Header . . . . . . . . . 108 210 18.7. Link-Local Scope multicast address . . . . . . . . . . . 108 211 19. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 110 212 20. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 111 213 21. References . . . . . . . . . . . . . . . . . . . . . . . . . 113 214 21.1. Normative References . . . . . . . . . . . . . . . . . . 113 215 21.2. Informative References . . . . . . . . . . . . . . . . . 113 216 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 117 218 1. Introduction 220 Low power and Lossy Networks (LLNs) consist of largely of constrained 221 nodes (with limited processing power, memory, and sometimes energy 222 when they are battery operated). These routers are interconnected by 223 lossy links, typically supporting only low data rates, that are 224 usually unstable with relatively low packet delivery rates. Another 225 characteristic of such networks is that the traffic patterns are not 226 simply point-to-point, but in many cases point-to-multipoint or 227 multipoint-to-point. Furthermore such networks may potentially 228 comprise up to thousands of nodes. These characteristics offer 229 unique challenges to a routing solution: the IETF ROLL Working Group 230 has defined application-specific routing requirements for a Low power 231 and Lossy Network (LLN) routing protocol, specified in [RFC5867], 232 [RFC5826], [RFC5673], and [RFC5548]. 234 This document specifies the IPv6 Routing Protocol for Low power and 235 lossy networks (RPL). Note that although RPL was specified according 236 to the requirements set forth in the aforementioned requirement 237 documents, its use is in no way limited to these applications. 239 1.1. Design Principles 241 RPL was designed with the objective to meet the requirements spelled 242 out in [RFC5867], [RFC5826], [RFC5673], and [RFC5548]. 244 A network may run multiple instances of RPL concurrently. Each such 245 instance may serve different and potentially antagonistic constraints 246 or performance criteria. This document defines how a single instance 247 operates. 249 In order to be useful in a wide range of LLN application domains, RPL 250 separates packet processing and forwarding from the routing 251 optimization objective. Examples of such objectives include 252 minimizing energy, minimizing latency, or satisfying constraints. 253 This document describes the mode of operation of RPL. Other 254 companion documents specify routing objective functions. A RPL 255 implementation, in support of a particular LLN application, will 256 include the necessary objective function(s) as required by the 257 application. 259 A set of companion documents to this specification will provide 260 further guidance in the form of applicability statements specifying a 261 set of operating points appropriate to the Building Automation, Home 262 Automation, Industrial, and Urban application scenarios. 264 1.2. Expectations of Link Layer Type 266 In compliance with the layered architecture of IP, RPL does not rely 267 on any particular features of a specific link layer technology. RPL 268 is designed to be able to operate over a variety of different link 269 layers, including but not limited to, low power wireless or PLC 270 (Power Line Communication) technologies. 272 Implementers may find [RFC3819] a useful reference when designing a 273 link layer interface between RPL and a particular link layer 274 technology. 276 2. Terminology 278 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 279 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 280 "OPTIONAL" in this document are to be interpreted as described in RFC 281 2119 [RFC2119]. 283 Additionally, this document uses terminology from 284 [I-D.ietf-roll-terminology], and introduces the following 285 terminology: 287 DAG: Directed Acyclic Graph. A directed graph having the property 288 that all edges are oriented in such a way that no cycles exist. 289 All edges are contained in paths oriented toward and 290 terminating at one or more root nodes. 292 DAG root: A DAG root is a node within the DAG that has no outgoing 293 edge. Because the graph is acyclic, by definition all DAGs 294 must have at least one DAG root and all paths terminate at a 295 DAG root. 297 Destination Oriented DAG (DODAG): A DAG rooted at a single 298 destination, i.e. at a single DAG root (the DODAG root) with no 299 outgoing edges. 301 DODAG root: A DODAG root is the DAG root of a DODAG. 303 Up: Up refers to the direction from leaf nodes towards DODAG roots, 304 following DODAG edges. This follows the common terminology 305 used in graphs and depth-first-search, where vertices further 306 from the root are "deeper," or "down," and vertices closer to 307 the root are "shallower," or "up." 309 Down: Down refers to the direction from DODAG roots towards leaf 310 nodes, in the reverse direction of DODAG edges. This follows 311 the common terminology used in graphs and depth-first-search, 312 where vertices further from the root are "deeper," or "down," 313 and vertices closer to the root are "shallower," or "up." 315 Rank: A node's Rank defines the node's individual position relative 316 to other nodes with respect to a DODAG root. Rank strictly 317 increases in the down direction and strictly decreases in the 318 up direction. The exact way Rank is computed depends on the 319 DAG's Objective Function (OF). The Rank may analogously track 320 a simple topological distance, may be calculated as a function 321 of link metrics, and may consider other properties such as 322 constraints. 324 Objective Function (OF): Defines which routing metrics, optimization 325 objectives, and related functions a DAG uses to compute Rank. 327 Objective Code Point (OCP): An identifier that indicates which 328 Objective Function the DODAG uses. 330 RPLInstanceID: A unique identifier within a network. Two DODAGs 331 with the same RPLInstanceID share the same Objective Function. 333 RPL Instance: A set of one or more DODAGs that share a 334 RPLInstanceID. A RPL node can belong to at most one DODAG in a 335 RPL Instance. Each RPL Instance operates independently of 336 other RPL Instances. This document describes operation within 337 a single RPL Instance. 339 DODAGID: The identifier of a DODAG root. The DODAGID must be unique 340 within the scope of a RPL Instance in the LLN. The tuple 341 (RPLInstanceID, DODAGID) uniquely identifies a DODAG. 343 DODAG Version: A specific sequence number iteration ("version") of a 344 DODAG with a given DODAGID. 346 DODAGVersionNumber: A sequential counter that is incremented by the 347 root to form a new Version of a DODAG. A DODAG Version is 348 identified uniquely by the (RPLInstanceID, DODAGID, 349 DODAGVersionNumber) tuple. 351 Goal: The Goal is a application specific goal that is defined outside 352 the scope of RPL. Any node that roots a DODAG will need to 353 know about this Goal to decide if the Goal can be satisfied or 354 not. A typical Goal is to construct the DODAG according to a 355 specific objective function and to keep connectivity to a set 356 of hosts (e.g. to use an objective function that minimizes ETX 357 and to be connected to a specific database host to store the 358 collected data). 360 Grounded: A DODAG is grounded when the DODAG root can satisfy the 361 Goal. 363 Floating: A DODAG is floating if is not Grounded. A floating DODAG 364 is not expected to have the properties required to satisfy the 365 goal. It may, however, provide connectivity to other nodes 366 within the DODAG. 368 DODAG parent: A parent of a node within a DODAG is one of the 369 immediate successors of the node on a path towards the DODAG 370 root. A DODAG parent's Rank is lower than the node's. (See 371 Section 3.6.2.1). 373 Sub-DODAG The sub-DODAG of a node is the set of other nodes whose 374 paths to the DODAG root pass through that node. Nodes in the 375 sub-DODAG of a node have a greater Rank than that node itself. 376 (See Section 3.6.2.1) 378 As they form networks, LLN devices often mix the roles of 'host' and 379 'router' when compared to traditional IP networks. In this document, 380 'host' refers to an LLN device that can generate but does not forward 381 RPL traffic, 'router' refers to an LLN device that can forward as 382 well as generate RPL traffic, and 'node' refers to any RPL device, 383 either a host or a router. 385 3. Protocol Overview 387 The aim of this section is to describe RPL in the spirit of 388 [RFC4101]. Protocol details can be found in further sections. 390 3.1. Topology 392 This section describes how the basic RPL topologies, and the rules by 393 which these are constructed, i.e. the rules governing DODAG 394 formation. 396 3.1.1. Topology Identifiers 398 RPL uses four identifiers to maintain the topology: 400 o The first is a RPLInstanceID. A RPLInstanceID identifies a set of 401 one or more DODAGs. All DODAGs in the same RPL Instance use the 402 same Objective Function. A network may have multiple 403 RPLInstanceIDs, each of which defines an independent set of 404 DODAGs, which may be optimized for different OFs and/or 405 applications. The set of DODAGs identified by a RPLInstanceID is 406 called a RPL Instance. 408 o The second is a DODAGID. The scope of a DODAGID is a RPL 409 Instance. The combination of RPLInstanceID and DODAGID uniquely 410 identifies a single DODAG in the network. A RPL Instance may have 411 multiple DODAGs, each of which has an unique DODAGID. 413 o The third is a DODAGVersionNumber. The scope of a 414 DODAGVersionNumber is a DODAG. A DODAG is sometimes reconstructed 415 from the DODAG root, by incrementing the DODAGVersionNumber. The 416 combination of RPLInstanceID, DODAGID, and DODAGVersionNumber 417 uniquely identifies a DODAG Version. 419 o The fourth is Rank. The scope of Rank is a DODAG Version. Rank 420 establishes a partial order over a DODAG Version, defining 421 individual node positions with respect to the DODAG root. 423 3.2. Instances, DODAGs, and DODAG Versions 425 A RPL Instance contains one or more Destination Oriented DAG (DODAG) 426 roots. A RPL Instance may provide routes to certain destination 427 prefixes, reachable via the DODAG roots or alternate paths within the 428 DODAG. These roots may operate independently, or may coordinate over 429 a non-LLN backchannel. 431 A RPL Instance may comprise: 433 o a single DODAG with a single root 435 * For example, a DODAG optimized to minimize latency rooted at a 436 single centralized lighting controller in a home automation 437 application. 439 o multiple uncoordinated DODAGs with independent roots (differing 440 DODAGIDs) 442 * For example, multiple data collection points in an urban data 443 collection application that do not have an always-on backbone 444 suitable to coordinate to form a single DODAG, and further use 445 the formation of multiple DODAGs as a means to dynamically and 446 autonomously partition the network. 448 o a single DODAG with a single virtual root coordinating LLN sinks 449 (with the same DODAGID) over some non-LLN backbone 451 * For example, multiple border routers operating with a reliable 452 backbone, e.g. in support of a 6LowPAN application, that are 453 capable to act as logically equivalent sinks to the same DODAG. 455 o a combination of the above as suited to some application scenario. 457 Each RPL packet has meta-data that associates it with a particular 458 RPLInstanceID and therefore RPL Instance.(Section 4). The 459 provisioning or automated discovery of a mapping between a 460 RPLInstanceID and a type or service of application traffic is beyond 461 the scope of this specification. 463 Figure 1 depicts an example of a RPL Instance comprising three DODAGs 464 with DODAG Roots R1, R2, and R3. Figure 2 depicts how a DODAG 465 version number increment leads to a new DODAG Version. 467 +----------------------------------------------------------------+ 468 | | 469 | +--------------+ | 470 | | | | 471 | | (R1) | (R2) (R3) | 472 | | / \ | /| \ / | \ | 473 | | / \ | / | \ / | \ | 474 | | (A) (B) | (C) | (D) ... (F) (G) (H) | 475 | | /|\ |\ | / | |\ | | | | 476 | | : : : : : | : (E) : : : : : | 477 | | | / \ | 478 | +--------------+ : : | 479 | DODAG | 480 | | 481 +----------------------------------------------------------------+ 482 RPL Instance 484 Figure 1: RPL Instance 486 +----------------+ +----------------+ 487 | | | | 488 | (R1) | | (R1) | 489 | / \ | | / | 490 | / \ | | / | 491 | (A) (B) | \ | (A) | 492 | /|\ |\ | ------\ | /|\ | 493 | : : (C) : : | \ | : : (C) | 494 | | / | \ | 495 | | ------/ | \ | 496 | | / | (B) | 497 | | | |\ | 498 | | | : : | 499 | | | | 500 +----------------+ +----------------+ 501 Version N Version N+1 503 Figure 2: DODAG Version 505 3.3. Upward Routes and DODAG Construction 507 RPL provisions routes up towards DODAG roots, forming a DODAG 508 optimized according to an Objective Function (OF). RPL nodes 509 construct and maintain these DODAGs through DODAG Information Object 510 (DIO) messages. 512 3.3.1. Objective Function (OF) 514 The Objective Function (OF) defines how RPL nodes select and optimize 515 routes within a RPL Instance. The OF is identified by an Objective 516 Code Point (OCP) within the DIO Configuration option. An OF defines 517 how nodes translate one or more metrics and constraints, which are 518 themselves defined in [I-D.ietf-roll-routing-metrics], into a value 519 called Rank, which approximates the node's distance from a DODAG 520 root. An OF also defines how nodes select parents. Further details 521 may be found in Section 13, [I-D.ietf-roll-routing-metrics], 522 [I-D.ietf-roll-of0], and related companion specifications. 524 3.3.2. DODAG Repair 526 A DODAG Root institutes a global repair operation by incrementing the 527 DODAG Version Number. This initiates a new DODAG version. Nodes in 528 the new DODAG version can choose a new position whose Rank is not 529 constrained by their Rank within the old DODAG Version. 531 RPL also supports mechanisms which may be used for local repair 532 within the DODAG version. The DIO message specifies the necessary 533 parameters as configured from the DODAG root, as controlled by policy 534 at the root. 536 3.3.3. Security 538 RPL supports message confidentiality and integrity. It is designed 539 such that link-layer mechanisms can be used when available and 540 appropriate, yet in their absence RPL can use its own mechanisms. 542 3.3.4. Grounded and Floating DODAGs 544 DODAGs can be grounded or floating: the DODAG root advertises which 545 is the case. A grounded DODAG offers connectivity to hosts that are 546 required for satisfying the application-defined goal. A floating 547 DODAG is not expected to satisfy the goal and in most cases only 548 provides routes to nodes within the DODAG. Floating DODAGs may be 549 used, for example, to preserve inner connectivity during repair. 551 3.3.5. Local DODAGs 553 RPL nodes can optimize routes to a destination within an LLN by 554 forming a local DODAG whose DODAG Root is the desired destination. 555 Unlike global DAGs, which can consist of multiple DODAGs, local DAGs 556 have one and only one DODAG and therefore one DODAG Root. Local 557 DODAGs can be constructed on-demand. 559 3.3.6. Administrative Preference 561 An implementation/deployment may specify that some DODAG roots should 562 be used over others through an administrative preference. 563 Administrative preference offers a way to control traffic and 564 engineer DODAG formation in order to better support application 565 requirements or needs. 567 3.3.7. Datapath Validation and Loop Detection 569 RPL uses a hop-by-hop IPv6 header to detect possible loops within a 570 DODAG. Each data packet includes the Rank of the transmitter. An 571 inconsistency between the routing decision for a packet (upward or 572 downward) and the Rank relationship between the two nodes indicates a 573 possible loop. On receiving such a packet, a node institutes a local 574 repair operation. 576 3.3.8. Distributed Algorithm Operation 578 A high level overview of the distributed algorithm, which constructs 579 the DODAG, is as follows: 581 o Some nodes are configured to be DODAG roots, with associated DODAG 582 configurations. 584 o Nodes advertise their presence, affiliation with a DODAG, routing 585 cost, and related metrics by sending link-local multicast DIO 586 messages. 588 o Nodes listen for DIOs and use their information to join a new 589 DODAG, or to maintain an existing DODAG, as according to the 590 specified Objective Function and Rank of their neighbors. 592 o Nodes provision routing table entries, for the destinations 593 specified by the DIO, via their DODAG parents in the DODAG 594 version. Nodes MUST provision a DODAG parent as a default route 595 for the associated instance. It is up to the end-to-end 596 application to select the RPL instance to be associated to its 597 traffic (should there be more than one instance) and thus the 598 default route upwards when no longer-match exists. 600 3.4. Downward Routes and Destination Advertisement 602 RPL uses Destination Advertisement Object (DAO) messages to establish 603 downward routes from DODAG roots. DAO messages are an optional 604 feature for applications that require P2MP or P2P traffic. RPL 605 supports two modes of downward traffic: storing (fully stateful) or 606 non-storing (fully source routed). Any given RPL Instance is either 607 storing or non-storing. In both cases, P2P packets travel up to a 608 DODAG Root then down to the final destination (unless the destination 609 is on the upward route). 611 3.5. Local DODAGs Route Discovery 613 A RPL network can optionally support on-demand discovery of DODAGs to 614 specific destinations within an LLN. Such local DODAGs behave 615 slightly differently than global DODAGs. 617 3.6. Routing Metrics and Constraints Used By RPL 619 Routing metrics are used by routing protocols to compute shortest 620 paths. Interior Gateway Protocols (IGPs) such as IS-IS ([RFC5120]) 621 and OSPF ([RFC4915]) use static link metrics. Such link metrics can 622 simply reflect the bandwidth or can also be computed according to a 623 polynomial function of several metrics defining different link 624 characteristics. Some routing protocols support more than one 625 metric: in the vast majority of the cases, one metric is used per 626 (sub)topology. Less often, a second metric may be used as a tie- 627 breaker in the presence of Equal Cost Multiple Paths (ECMP). The 628 optimization of multiple metrics is known as an NP complete problem 629 and is sometimes supported by some centralized path computation 630 engine. 632 In contrast, LLNs do require the support of both static and dynamic 633 metrics. Furthermore, both link and node metrics are required. In 634 the case of RPL, it is virtually impossible to define one metric, or 635 even a composite metric, that will satisfy all use cases. 637 In addition, RPL supports constrained-based routing where constraints 638 may be applied to both link and nodes. If a link or a node does not 639 satisfy a required constraint, it is 'pruned' from the candidate 640 list, thus leading to a constrained shortest path. 642 An Objective Function specifies the objectives used to compute the 643 (constrained) path. Upstream and Downstream metrics may be merged or 644 advertised separately depending on the OF and the metrics. When they 645 are advertised separately, it may happen that the set of DIO parents 646 is different from the set of DAO parents (a DAO parent is a node to 647 which unicast DAO messages are sent). Yet, all are DODAG parents 648 with regards to the rules for Rank computation. 650 The Objective Function itself is decoupled from the routing metrics 651 and constraints used by RPL. Indeed, whereas the OF dictates rules 652 such as DODAG parents selection, load balancing and so on, the set of 653 metrics and/or constraints used to select a DODAG parent and thus 654 determine the preferred path are based on the information carried 655 within the DAG container option in DIO messages. 657 The set of supported link/node constraints and metrics is specified 658 in [I-D.ietf-roll-routing-metrics]. 660 Example 1: Shortest path: path offering the shortest end-to-end delay 662 Example 2: Constrained shortest path: the path that does not traverse 663 any battery-operated node and that optimizes the path 664 reliability 666 3.6.1. Loop Avoidance 668 RPL guarantees neither loop free path selection nor tight delay 669 convergence times. In order to reduce control overhead, however, 670 such as the cost of the count-to-infinity problem, RPL avoids 671 creating loops when undergoing topology changes. Furthermore, RPL 672 includes rank-based datapath validation mechanisms for detecting 673 loops when they do occur. RPL uses this loop detection to ensure 674 that packets make forward progress within the DODAG version and 675 trigger repairs when necessary. 677 3.6.1.1. Greediness and Rank-based Instabilities 679 A node is greedy if it attempts to move deeper in the DODAG version, 680 in order to increase the size of the parent set or improve some other 681 metric. Moving deeper in within a DODAG version in this manner could 682 result in instability and be detrimental to other nodes. 684 Once a node has joined a DODAG version, RPL disallows certain 685 behaviors, including greediness, in order to prevent resulting 686 instabilities in the DODAG version. 688 Suppose a node is willing to receive and process a DIO messages from 689 a node in its own sub-DODAG, and in general a node deeper than 690 itself. In this case, a possibility exists that a feedback loop is 691 created, wherein two or more nodes continue to try and move in the 692 DODAG version while attempting to optimize against each other. In 693 some cases, this will result in instability. It is for this reason 694 that RPL limits the cases where a node may process DIO messages from 695 deeper nodes to some forms of local repair. This approach creates an 696 'event horizon', whereby a node cannot be influenced beyond some 697 limit into an instability by the action of nodes that may be in its 698 own sub-DODAG. 700 3.6.1.2. DODAG Loops 702 A DODAG loop may occur when a node detaches from the DODAG and 703 reattaches to a device in its prior sub-DODAG. This may happen in 704 particular when DIO messages are missed. Strict use of the DODAG 705 Version Number can eliminate this type of loop, but this type of loop 706 may possibly be encountered when using some local repair mechanisms. 708 3.6.1.3. DAO Loops 710 A DAO loop may occur when the parent has a route installed upon 711 receiving and processing a DAO message from a child, but the child 712 has subsequently cleaned up the related DAO state. This loop happens 713 when a No-Path (a DAO message that invalidates a previously announced 714 prefix) was missed and persists until all state has been cleaned up. 715 RPL includes an optional mechanism to acknowledge DAO messages, which 716 may mitigate the impact of a single DAO message being missed. RPL 717 includes loop detection mechanisms that may mitigate the impact of 718 DAO loops and trigger their repair. 720 3.6.2. Rank Properties 722 The rank of a node is a scalar representation of the location of that 723 node within a DODAG version. The rank is used to avoid and detect 724 loops, and as such must demonstrate certain properties. The exact 725 calculation of the rank is left to the Objective Function, and may 726 depend on parents, link metrics, and the node configuration and 727 policies. 729 The rank is not a cost metric, although its value can be derived from 730 and influenced by metrics. The rank has properties of its own that 731 are not necessarily those of all metrics: 733 Type: The rank is an abstract numeric value. 735 Function: The rank is the expression of a relative position within a 736 DODAG version with regard to neighbors and is not necessarily 737 a good indication or a proper expression of a distance or a 738 cost to the root. 740 Stability: The stability of the rank determines the stability of the 741 routing topology. Some dampening or filtering might be 742 applied to keep the topology stable, and thus the rank does 743 not necessarily change as fast as some physical metrics 744 would. A new DODAG version would be a good opportunity to 745 reconcile the discrepancies that might form over time between 746 metrics and ranks within a DODAG version. 748 Properties: The rank is strictly monotonic, and can be used to 749 validate a progression from or towards the root. A metric, 750 like bandwidth or jitter, does not necessarily exhibit this 751 property. 753 Abstract: The rank does not have a physical unit, but rather a range 754 of increment per hop, where the assignment of each increment 755 is to be determined by the Objective Function. 757 The rank value feeds into DODAG parent selection, according to the 758 RPL loop-avoidance strategy. Once a parent has been added, and a 759 rank value for the node within the DODAG has been advertised, the 760 nodes further options with regard to DODAG parent selection and 761 movement within the DODAG are restricted in favor of loop avoidance. 763 3.6.2.1. Rank Comparison (DAGRank()) 765 Rank may be thought of as a fixed point number, where the position of 766 the radix point between the integer part and the fractional part is 767 determined by MinHopRankIncrease. MinHopRankIncrease is the minimum 768 increase in rank between a node and any of its DODAG parents. When 769 an objective function computes rank, the objective function operates 770 on the entire (i.e. 16-bit) rank quantity. When rank is compared, 771 e.g. for determination of parent relationships or loop detection, the 772 integer portion of the rank is to be used. The integer portion of 773 the Rank is computed by the DAGRank() macro as follows, where 774 floor(x) is the function that evaluates to the greatest integer less 775 than or equal to x: 777 DAGRank(rank) = floor(rank/MinHopRankIncrease) 779 MinHopRankIncrease is provisioned at the DODAG Root and propagated in 780 the DIO message. The default value of MinHopRankIncrease is 781 DEFAULT_MIN_HOP_RANK_INCREASE. For efficient implementation the 782 MinHopRankIncrease MUST be a power of 2. An implementation may 783 configure a value MinHopRankIncrease as appropriate to balance 784 between the loop avoidance logic of RPL (i.e. selection of eligible 785 parents) and the metrics in use. A further effect of 786 MinHopRankIncrease is to impact the number increments that are 787 allowed before INFINITE_RANK is reached, i.e. to control how long it 788 may take to count-to-infinity. 790 By convention in this document, using the macro DAGRank(node) may be 791 interpreted as DAGRank(node.rank), where node.rank is the rank value 792 as maintained by the node. 794 A node A has a rank less than the rank of a node B if DAGRank(A) is 795 less than DAGRank(B). 797 A node A has a rank equal to the rank of a node B if DAGRank(A) is 798 equal to DAGRank(B). 800 A node A has a rank greater than the rank of a node B if DAGRank(A) 801 is greater than DAGRank(B). 803 3.6.2.2. Rank Relationships 805 The computation of the rank MUST be done in such a way so as to 806 maintain the following properties for any nodes M and N that are 807 neighbors in the LLN: 809 DAGRank(M) is less than DAGRank(N): In this case, the position of M 810 is closer to the DODAG root than the position of N. Node M 811 may safely be a DODAG parent for Node N without risk of 812 creating a loop. Further, for a node N, all parents in the 813 DODAG parent set must be of rank less than DAGRank(N). In 814 other words, the rank presented by a node N MUST be greater 815 than that presented by any of its parents. 817 DAGRank(M) equals DAGRank(N): In this case the positions of M and N 818 within the DODAG and with respect to the DODAG root are 819 similar (identical). In some cases, Node M may be used as a 820 successor by Node N, which however entails the chance of 821 creating a loop (which must be detected and resolved by some 822 other means). 824 DAGRank(M) is greater than DAGRank(N): In this case, the position of 825 M is farther from the DODAG root than the position of N. 826 Further, Node M may in fact be in the sub-DODAG of Node N. If 827 node N selects node M as DODAG parent there is a risk to 828 create a loop. 830 As an example, the rank could be computed in such a way so as to 831 closely track ETX (Expected Transmission Count, a fairly common 832 routing metric used in LLN and defined in 833 [I-D.ietf-roll-routing-metrics]) when the objective function is to 834 minimize ETX, or latency when the objective function is to minimize 835 latency, or in a more complicated way as appropriate to the objective 836 function being used within the DODAG. 838 3.7. Traffic Flows Supported by RPL 840 RPL supports three basic traffic flows: Multipoint-to-Point (MP2P), 841 Point-to-Multipoint (P2MP), and Point-to-Point (P2P). 843 3.7.1. Multipoint-to-Point Traffic 845 Multipoint-to-Point (MP2P) is a dominant traffic flow in many LLN 846 applications ([RFC5867], [RFC5826], [RFC5673], [RFC5548]). The 847 destinations of MP2P flows are designated nodes that have some 848 application significance, such as providing connectivity to the 849 larger Internet or core private IP network. RPL supports MP2P 850 traffic by allowing MP2P destinations to be reached via DODAG roots. 852 3.7.2. Point-to-Multipoint Traffic 854 Point-to-multipoint (P2MP) is a traffic pattern required by several 855 LLN applications ([RFC5867], [RFC5826], [RFC5673], [RFC5548]). RPL 856 supports P2MP traffic by using a destination advertisement mechanism 857 that provisions routes toward destinations (prefixes, addresses, or 858 multicast groups), and away from roots. Destination advertisements 859 can update routing tables as the underlying DODAG topology changes. 861 3.7.3. Point-to-Point Traffic 863 RPL DODAGs provide a basic structure for point-to-point (P2P) 864 traffic. For a RPL network to support P2P traffic, a root must be 865 able to route packets to a destination. Nodes within the network may 866 also have routing tables to destinations. A packet flows towards a 867 root until it reaches an ancestor that has a known route to the 868 destination. As pointed out later in this document, in the most 869 constrained case (when nodes cannot store routes), that common 870 ancestor may be the DODAG root. In other cases it may be a node 871 closer to both the source and destination. 873 RPL also supports the case where a P2P destination is a 'one-hop' 874 neighbor. 876 RPL neither specifies nor precludes additional mechanisms for 877 computing and installing potentially more optimal routes to support 878 arbitrary P2P traffic. 880 4. RPL Instance 882 Within a given LLN, there may be multiple, logically independent RPL 883 instances. A RPL node may belong to multiple RPL instances, and may 884 act as a router in some and as a leaf in others. This document 885 describes how a single instance behaves. 887 There are two types of RPL Instances: local and global. Local RPL 888 Instances are always a single DODAG whose singular root owns the 889 corresponding DODAGID. Local RPL Instances can be used for 890 constructing DODAGs that may be used by future on-demand routing 891 solutions that are outside of the scope of this document. Global RPL 892 Instances have one or more DODAGs and are typically long-lived. RPL 893 divides the RPLInstanceID space between global and local instances to 894 allow for both coordinated and unilateral allocation of 895 RPLInstanceIDs. 897 The definition and provisioning of RPL instances are beyond the scope 898 of this specification. Those operations are expected to be such that 899 data packets coming from the outside of the RPL network can 900 unambiguously be associated to at least one RPL instance, and be 901 safely routed over any instance that would match the packet. 902 Information used to match a packet to a RPL instance can typically be 903 taken from fields in the IPv6 header, like the flow label, TOS bits, 904 or destination address. 906 Control and data packets within RPL network are tagged to 907 unambiguously identify what RPL Instance they are part of. 909 Every RPL control message has a RPLInstanceID field. Some RPL 910 control messages, when referring to a local RPLInstanceID as defined 911 below, may also include a DODAGID. 913 For data packets, the RPLInstanceID may be indicated in the flow 914 label by the source of the packet. If it is not, then it is inferred 915 and added by the RPL network ingress router in the RPL Hop-by-hop 916 option ([I-D.hui-6man-rpl-option]) as further described in 917 Section 10.2 919 4.1. RPL Instance ID 921 A global RPLInstanceID MUST be unique to the whole LLN. Mechanisms 922 for allocating and provisioning global RPLInstanceID are out of scope 923 for this document. There can be up to 128 global instance in the 924 whole network, and up 64 local instances per DODAGID. 926 A global RPLinstanceID is encoded in a RPLinstanceID field as 927 follows: 929 0 1 2 3 4 5 6 7 930 +-+-+-+-+-+-+-+-+ 931 |0| ID | Global RPLinstanceID in 0..127 932 +-+-+-+-+-+-+-+-+ 934 Figure 3: RPL Instance ID field format for global instances 936 A local RPLInstanceID is autoconfigured by the node that owns the 937 DODAGID and it MUST be unique for that DODAGID. In that case, the 938 DODAGID MUST be a valid address of the root that is used as an 939 endpoint of all communications within that instance. 941 A local RPLinstanceID is encoded in a RPLinstanceID field as follows: 943 0 1 2 3 4 5 6 7 944 +-+-+-+-+-+-+-+-+ 945 |1|D| ID | Local RPLInstanceID in 0..63 946 +-+-+-+-+-+-+-+-+ 948 Figure 4: RPL Instance ID field format for local instances 950 The D flag in a Local RPLInstanceID is always set to 0 in RPL control 951 messages. It is used in data packets to indicate whether the DODAGID 952 is the source or the destination of the packet. If the D flag is set 953 to 1 then the destination address of the IPv6 packet MUST be the 954 DODAGID. If the D flag is clear then the source address of the IPv6 955 packet MUST be the DODAGID. 957 5. ICMPv6 RPL Control Message 959 This document defines the RPL Control Message, a new ICMPv6 message. 960 A RPL Control Message is identified by a code, and composed of a base 961 that depends on the code, and a series of options. 963 A RPL Control Message has the scope of a link. The source address is 964 a link local address. The destination address is either the RPL 965 routers multicast address or a link local address. The RPL routers 966 multicast address is a new address with a requested value of 967 FF02::1:A (to be confirmed by IANA). 969 In accordance with [RFC4443], the RPL Control Message consists of an 970 ICMPv6 header followed by a message body. The message body is 971 comprised of a message base and possibly a number of options as 972 illustrated in Figure 5. 974 0 1 2 3 975 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 976 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 977 | Type | Code | Checksum | 978 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 979 | | 980 . Base . 981 . . 982 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 983 | | 984 . Option(s) . 985 . . 986 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 988 Figure 5: RPL Control Message 990 The RPL Control message is an ICMPv6 information message with a 991 requested Type of 155 (to be confirmed by IANA). 993 The Code field identifies the type of RPL Control Message. This 994 document defines codes for the following RPL Control Message types 995 (all codes are to be confirmed by the IANA Section 18.2): 997 o 0x00: DODAG Information Solicitation (Section 5.2) 999 o 0x01: DODAG Information Object (Section 5.3) 1001 o 0x02: Destination Advertisement Object (Section 5.4) 1002 o 0x03: Destination Advertisement Object Acknowledgment 1003 (Section 5.5) 1005 o 0x80: Secure DODAG Information Solicitation (Section 5.2.2) 1007 o 0x81: Secure DODAG Information Object (Section 5.3.2) 1009 o 0x82: Secure Destination Advertisement Object (Section 5.4.2) 1011 o 0x83: Secure Destination Advertisement Object Acknowledgment 1012 (Section 5.5.2) 1014 o 0x8A: Consistency Check (Section 5.6) 1016 The high order bit (0x80) of the code denotes whether the RPL message 1017 has security enabled. Secure RPL messages have a format to support 1018 confidentiality and integrity, illustrated in Figure 6. 1020 0 1 2 3 1021 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1022 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1023 | Type | Code | Checksum | 1024 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1025 | | 1026 . Security . 1027 . . 1028 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1029 | | 1030 . Base . 1031 . . 1032 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1033 | | 1034 . Option(s) . 1035 . . 1036 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1038 Figure 6: Secure RPL Control Message 1040 The remainder of this section describes the currently defined RPL 1041 Control Message Base formats followed by the currently defined RPL 1042 Control Message Options. 1044 5.1. RPL Security Fields 1046 Each RPL message has a secure version. The secure versions provide 1047 integrity and replay protection as well as optional confidentiality 1048 and delay protection. Because security covers the base message as 1049 well as options, in secured messages the security information lies 1050 between the checksum and base, as shown in Figure Figure 6. 1052 The format of the security section is as follows: 1054 0 1 2 3 1055 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1056 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1057 |C|T| Rsrvd |Sec|KIM|Rsrvd| LVL | | 1058 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + 1059 | Counter | 1060 . . 1061 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1062 | | 1063 . Message Authentication Code . 1064 . . 1065 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1066 | | 1067 . Key Identifier . 1068 . . 1069 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1071 Figure 7: Security Section 1073 All fields are considered as packet payload from a security 1074 processing perspective. The exact placement and format of message 1075 integrity/authentication codes has not yet been determined. 1077 Use of the Security section is further detailed in Section 17. 1079 Security Control Field: The Security Control Field has one flag and 1080 three fields: 1082 Counter Compression (C): If the Counter Compression flag is 1083 set then the Counter field is compressed from 4 bytes 1084 into 1 byte. If the Counter Compression flag is clear 1085 then the Counter field is 4 bytes and uncompressed. 1087 Counter is Time (T): If the Counter is Time flag is set then 1088 the Counter field is a timestamp. If the flag is cleared 1089 then the Counter is an incrementing counter. Section 9.4 1090 describes the details of the 'T' flag and Counter field. 1092 Security Mode (Sec): The security algorithm field specifies 1093 what security mode and algorithms the network uses. 1094 Supported values of this field are as follows: 1096 +----+-----+-------------------+ 1097 | ID | Sec | Algorithm | 1098 +----+-----+-------------------+ 1099 | 0 | 00 | CCM* with AES-128 | 1100 | 1 | 01 | Reserved | 1101 | 2 | 10 | Reserved | 1102 | 3 | 11 | Reserved | 1103 +----+-----+-------------------+ 1105 Security Mode (Sec) Encoding 1107 Key Identifier Mode (KIM): The Key Identifier Mode field 1108 indicates whether the key used for packet protection is 1109 determined implicitly or explicitly and indicates the 1110 particular representation of the Key Identifier field. 1111 The Key Identifier Mode is set one of the non-reserved 1112 values from the table below: 1114 +------+-----+-----------------------------+------------+ 1115 | Mode | KIM | Meaning | Key | 1116 | | | | Identifier | 1117 | | | | Length | 1118 | | | | (octets) | 1119 +------+-----+-----------------------------+------------+ 1120 | 0 | 00 | Group key used. | 1 | 1121 | | | Key determined by Key Index | | 1122 | | | field. | | 1123 | | | | | 1124 | | | Key Source is not present. | | 1125 | | | Key Index is present. | | 1126 +------+-----+-----------------------------+------------+ 1127 | 1 | 01 | Per-pair key used. | 0 | 1128 | | | Key determined by source | | 1129 | | | and destination of packet. | | 1130 | | | | | 1131 | | | Key Source is not present. | | 1132 | | | Key Index is not present. | | 1133 +------+-----+-----------------------------+------------+ 1134 | 2 | 10 | Group key used. | 9 | 1135 | | | Key determined by Key Index | | 1136 | | | and Key Source Identifier. | | 1137 | | | | | 1138 | | | Key Source is present. | | 1139 | | | Key Index is present. | | 1140 +------+-----+-----------------------------+------------+ 1141 | 3 | 11 | Node's signature key used. | 0/9 | 1142 | | | If packet is encrypted, | 1143 | | | group key used. Group key | | 1144 | | | determined by Key Index and | | 1145 | | | Key Source Identifier. | | 1146 | | | | | 1147 | | | Key Source may be present. | | 1148 | | | Key Index may be present. | | 1149 +------+-----+-----------------------------+------------+ 1151 Key Identifier Mode (KIM) Encoding 1153 Security Level (LVL): The Security Level field indicates the 1154 provided packet protection. This value can be adapted on 1155 a per-packet basis and allows for varying levels of data 1156 authenticity and, optionally, for data confidentiality. 1157 The KIM field indicates whether signatures are used. The 1158 Security Level is set to one of the non-reserved values 1159 in the table below: 1161 +---------------------------+--------------------+ 1162 | Without Signatures | With Signatures | 1163 +----+-----+--------------------+------+--------------+-----+ 1164 | ID | LVL | Attributes | Auth | Attributes | Sig | 1165 | | | | Len | | Len | 1166 +----+-----+--------------------+------+--------------+-----+ 1167 | 0 | 000 | Reserved | N/A | Reserved | N/A | 1168 | 1 | 001 | MAC-32 | 4 | Sign-32 | 40 | 1169 | 2 | 010 | MAC-64 | 8 | Sign-64 | 44 | 1170 | 3 | 011 | Reserved | N/A | Sign-128 | 52 | 1171 | 4 | 100 | Reserved | N/A | Reserved | N/A | 1172 | 5 | 101 | ENC-MAC-32 | 4 | ENC-Sign-32 | 40 | 1173 | 6 | 110 | ENC-MAC-64 | 8 | ENC-Sign-64 | 44 | 1174 | 7 | 111 | Reserved | N/A | ENC-Sign-128 | 52 | 1175 +----+-----+--------------------+------+-------------+------+ 1177 Security Level (LVL) Encoding 1179 Counter: The Counter field indicates the non-repeating value (nonce) 1180 used with the cryptographic mechanism that implements packet 1181 protection and allows for the provision of semantic security. 1182 This value is compressed from 4 octets to 1 octet if the 1183 Counter Compression field of the Security Control Field is set 1184 to one. 1186 Message Authentication Code: The Message Authentication Code field 1187 contains a cryptographic MAC. The length of the MAC is defined 1188 by a combination of the LVL and Sec fields: it can be 0, 4, or 1189 8 octets long. In the case of Security Modes where the MAC is 1190 computed as part of the ciphertext (as in Security Mode 0, 1191 CCM*), the MAC field is zero bytes long. 1193 Key Identifier: The Key Identifier field indicates which key was 1194 used to protect the packet. This field provides various levels 1195 of granularity of packet protection, including peer-to-peer 1196 keys, group keys, and signature keys. This field is 1197 represented as indicated by the Key Identifier Mode field and 1198 is formatted as follows: 1200 0 1 2 3 1201 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1202 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1203 | | 1204 . Key Source . 1205 . . 1206 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1207 | | 1208 . Key Index . 1209 . . 1210 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1212 Figure 8: Key Identifier 1214 Key Source: The Key Source field, when present, indicates the 1215 logical identifier of the originator of a group key. 1216 When present this field is 8 bytes in length. 1218 Key Index: The Key Index field, when present, allows unique 1219 identification of different keys with the same 1220 originator. It is the responsibility of each key 1221 originator to make sure that actively used keys that it 1222 issues have distinct key indices and that all key indices 1223 have a value unequal to 0x00. Value 0x00 is reserved for 1224 a pre-installed, shared key. When present this field is 1225 1 byte in length. 1227 Unassigned bits of the Security section are reserved. They MUST be 1228 set to zero on transmission and MUST be ignored on reception. 1230 5.2. DODAG Information Solicitation (DIS) 1232 The DODAG Information Solicitation (DIS) message may be used to 1233 solicit a DODAG Information Object from a RPL node. Its use is 1234 analogous to that of a Router Solicitation as specified in IPv6 1235 Neighbor Discovery; a node may use DIS to probe its neighborhood for 1236 nearby DODAGs. Section 7.3 describes how nodes respond to a DIS. 1238 5.2.1. Format of the DIS Base Object 1240 0 1 2 1241 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 1242 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1243 | Reserved | Option(s)... 1244 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1245 Figure 9: The DIS Base Object 1247 Unassigned bits of the DIS Base are reserved. They MUST be set to 1248 zero on transmission and MUST be ignored on reception. 1250 5.2.2. Secure DIS 1252 A Secure DIS message follows the format in Figure Figure 6, where the 1253 base format is the DIS message shown in Figure Figure 9. 1255 5.2.3. DIS Options 1257 The DIS message MAY carry valid options. 1259 This specification allows for the DIS message to carry the following 1260 options: 1261 0x00 Pad1 1262 0x01 PadN 1263 0x07 Solicited Information 1265 5.3. DODAG Information Object (DIO) 1267 The DODAG Information Object carries information that allows a node 1268 to discover a RPL Instance, learn its configuration parameters, 1269 select a DODAG parent set, and maintain the upward routing topology. 1271 5.3.1. Format of the DIO Base Object 1273 0 1 2 3 1274 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1275 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1276 | RPLInstanceID | Version | Rank | 1277 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1278 |G|0| MOP | Prf | DTSN | Reserved | 1279 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1280 | | 1281 + + 1282 | | 1283 + DODAGID + 1284 | | 1285 + + 1286 | | 1287 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1288 | Option(s)... 1289 +-+-+-+-+-+-+-+-+ 1291 Figure 10: The DIO Base Object 1293 Control Field: The DAG Control Field has three flags and two fields: 1295 Grounded (G): The Grounded (G) flag indicates whether the 1296 DODAG advertised can satisfy the application-defined 1297 goal. If the flag is set, the DODAG is grounded. If the 1298 flag is cleared, the DODAG is floating. 1300 Mode of Operation (MOP): The Mode of Operation (MOP) field 1301 identifies the mode of operation of the RPL Instance as 1302 administratively provisioned at and distributed by the 1303 DODAG Root. All nodes who join the DODAG must be able to 1304 honor the MOP in order to fully participate as a router, 1305 or else they must only join as a leaf. MOP is encoded as 1306 in the table below: 1308 +-----+-------------------------------------------------+ 1309 | MOP | Meaning | 1310 +-----+-------------------------------------------------+ 1311 | 000 | No downward routes maintained by RPL | 1312 | 001 | Non storing mode | 1313 | 010 | Storing without multicast support | 1314 | 011 | Storing with multicast support | 1315 | | | 1316 | | All other values are reserved | 1317 +-----+-------------------------------------------------+ 1319 A value of 000 indicates that destination advertisement 1320 messages are disabled and the DODAG maintains only upward 1321 routes 1323 Mode of Operation (MOP) Encoding 1325 DODAGPreference (Prf): A 3-bit unsigned integer that defines 1326 how preferable the root of this DODAG is compared to 1327 other DODAG roots within the instance. DAGPreference 1328 ranges from 0x00 (least preferred) to 0x07 (most 1329 preferred). The default is 0 (least preferred). 1330 Section 7.2 describes how DAGPreference affects DIO 1331 processing. 1333 Version Number: 8-bit unsigned integer set by the DODAG root. 1334 Section 7.2 describes the rules for version numbers and how 1335 they affect DIO processing. 1337 Rank: 16-bit unsigned integer indicating the DODAG rank of the node 1338 sending the DIO message. Section 7.2 describes how Rank is set 1339 and how it affects DIO processing. 1341 RPLInstanceID: 8-bit field set by the DODAG root that indicates 1342 which RPL Instance the DODAG is part of. 1344 Destination Advertisement Trigger Sequence Number (DTSN): 8-bit 1345 unsigned integer set by the node issuing the DIO message. The 1346 Destination Advertisement Trigger Sequence Number (DTSN) flag 1347 is used as part of the procedure to maintain downward routes. 1348 The details of this process are described in Section 8. 1350 DODAGID: 128-bit unsigned integer set by a DODAG root which uniquely 1351 identifies a DODAG. Possibly derived from the IPv6 address of 1352 the DODAG root. 1354 Unassigned bits of the DIO Base are reserved. They MUST be set to 1355 zero on transmission and MUST be ignored on reception. 1357 5.3.2. Secure DIO 1359 A Secure DIO message follows the format in Figure Figure 6, where the 1360 base format is the DIS message shown in Figure Figure 10. 1362 5.3.3. DIO Options 1364 The DIO message MAY carry valid options. 1366 This specification allows for the DIO message to carry the following 1367 options: 1368 0x00 Pad1 1369 0x01 PadN 1370 0x02 Metric Container 1371 0x03 Routing Information 1372 0x04 DODAG Configuration 1373 0x08 Prefix Information 1375 5.4. Destination Advertisement Object (DAO) 1377 The Destination Advertisement Object (DAO) is used to propagate 1378 destination information upwards along the DODAG. The DAO message is 1379 unicast by the child to the selected parent(s). The DAO message may 1380 optionally, upon explicit request or error, be acknowledged by the 1381 parent with a Destination Advertisement Acknowledgement (DAO-ACK) 1382 message back to the child. 1384 5.4.1. Format of the DAO Base Object 1386 0 1 2 3 1387 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1388 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1389 | RPLInstanceID |K|D| Reserved | DAOSequence | 1390 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1391 | | 1392 + + 1393 | | 1394 + DODAGID* + 1395 | | 1396 + + 1397 | | 1398 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1399 | Option(s)... 1400 +-+-+-+-+-+-+-+-+ 1402 Figure 11: The DAO Base Object 1404 RPLInstanceID: 8-bit field indicating the topology instance 1405 associated with the DODAG, as learned from the DIO. 1407 K: The 'K' flag indicates that the parent is expected to send a 1408 DAO-ACK back. 1410 D: The 'D' flag indicates that the DODAGID field is present. This 1411 flag MUST be set when a local RPLInstanceID is used. 1413 DAOSequence: Incremented at each unique DAO message, echoed in the 1414 DAO-ACK message. 1416 DODAGID (optional): 128-bit unsigned integer set by a DODAG root 1417 which uniquely identifies a DODAG. This field is only present 1418 when the 'D' flag is set. This field is typically only present 1419 when a local RPLInstanceID is in use, in order to identify the 1420 DODAGID that is associated with the RPLInstanceID. When a 1421 global RPLInstanceID is in use this field need not be present. 1423 Unassigned bits of the DAO Base are reserved. They MUST be set to 1424 zero on transmission and MUST be ignored on reception. 1426 5.4.2. Secure DAO 1428 A Secure DAO message follows the format in Figure Figure 6, where the 1429 base format is the DAO message shown in Figure Figure 11. 1431 5.4.3. DAO Options 1433 The DAO message MAY carry valid options. 1435 This specification allows for the DAO message to carry the following 1436 options: 1437 0x00 Pad1 1438 0x01 PadN 1439 0x05 RPL Target 1440 0x06 Transit Information 1442 A special case of the DAO message, termed a No-Path, is used to clear 1443 downward routing state that has been provisioned through DAO 1444 operation. The No-Path carries a RPL Transit Information option, 1445 which identifies the destination to which the DAO is associated, with 1446 a lifetime of 0x00000000 to indicate a loss of reachability. 1448 5.5. Destination Advertisement Object Acknowledgement (DAO-ACK) 1450 The DAO-ACK message is sent as a unicast packet by a DAO parent in 1451 response to a unicast DAO message from a child. 1453 5.5.1. Format of the DAO-ACK Base Object 1455 0 1 2 3 1456 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1457 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1458 | RPLInstanceID |D| Reserved | DAOSequence | Status | 1459 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1460 | | 1461 + + 1462 | | 1463 + DODAGID* + 1464 | | 1465 + + 1466 | | 1467 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1468 | Option(s)... 1469 +-+-+-+-+-+-+-+-+ 1471 Figure 12: The DAO ACK Base Object 1473 RPLInstanceID: 8-bit field indicating the topology instance 1474 associated with the DODAG, as learned from the DIO. 1476 D: The 'D' flag indicates that the DODAGID field is present. This 1477 would typically only be set when a local RPLInstanceID is used. 1479 DAOSequence: Incremented at each DAO message from a given child, 1480 echoed in the DAO-ACK by the parent. The DAOSequence serves in 1481 the parent-child communication and is not to be confused with 1482 the Transit Information option Sequence that is associated to a 1483 given target down the DODAG. 1485 Status: Indicates the completion. 0 is unqualified acceptance, above 1486 128 are rejection code indicating that the node should select 1487 an alternate parent. 1489 DODAGID (optional): 128-bit unsigned integer set by a DODAG root 1490 which uniquely identifies a DODAG. This field is only present 1491 when the 'D' flag is set. This field is typically only present 1492 when a local RPLInstanceID is in use, in order to identify the 1493 DODAGID that is associated with the RPLInstanceID. When a 1494 global RPLInstanceID is in use this field need not be present. 1496 Unassigned bits of the DAO-ACK Base are reserved. They MUST be set 1497 to zero on transmission and MUST be ignored on reception. 1499 5.5.2. Secure DAO-ACK 1501 A Secure DAO-ACK message follows the format in Figure Figure 6, where 1502 the base format is the DAO-ACK message shown in Figure Figure 12. 1504 5.5.3. DAO-ACK Options 1506 This specification does not define any options to be carried by the 1507 DAO-ACK message. 1509 5.6. Consistency Check (CC) 1511 The CC message is used to check secure message counters and issue 1512 challenge/responses. A CC message MUST be sent as a secured RPL 1513 message. 1515 A CC message (request or response) MUST NOT set the 'C' bit of the 1516 security section: CC messages always have full counters. 1518 5.6.1. Format of the CC Base Object 1519 0 1 2 3 1520 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1521 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1522 | RPLInstanceID |R| Reserved | Nonce | 1523 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1524 | | 1525 + + 1526 | | 1527 + DODAGID + 1528 | | 1529 + + 1530 | | 1531 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1532 | Destination Counter | 1533 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1534 | Option(s)... 1535 +-+-+-+-+-+-+-+-+ 1537 Figure 13: The CC Base Object 1539 RPLInstanceID: 8-bit field indicating the topology instance 1540 associated with the DODAG, as learned from the DIO. 1542 R: The 'R' flag indicates whether the CC message is a response. A 1543 message with the 'R' flag cleared is a request; a message with 1544 the 'R' flag set is a response. A CC message with the R bit 1545 set MUST NOT compress the security Counter field: the C bit of 1546 the security section MUST be 0. 1548 Nonce: 16-bit unsigned integer set by a CC request. The 1549 corresponding CC response includes the same nonce value as the 1550 request. 1552 Destination Counter: 32-bit unsigned integer value indicating the 1553 sender's estimate of the destination's current security Counter 1554 value. If the sender does not have an estimate, it SHOULD set 1555 the Destination Counter field to zero. 1557 Unassigned bits of the CC Base are reserved. They MUST be set to 1558 zero on transmission and MUST be ignored on reception. 1560 The Destination Counter value allows new or recovered nodes to 1561 resynchronize through CC message exchanges. This is important to 1562 ensure that a Counter value is not repeated for a given security key 1563 even in the event of devices recovering from a failure that created a 1564 loss of Counter state. For example, where a CC request or other RPL 1565 message is received with an initialized Counter within the message 1566 security section, the provision of the Incoming Counter within the CC 1567 response message allows the requesting node to reset its Outgoing 1568 Counter to a value greater than the last value received by the 1569 responding node; the Incoming Counter will also be updated from the 1570 received CC response. 1572 5.6.2. CC Options 1574 The CC message MAY carry valid options. In the scope of this 1575 specification, there are no valid options for a CC message. 1577 This specification allows for the CC message to carry the following 1578 options: 1579 0x00 Pad1 1580 0x01 PadN 1582 5.7. RPL Control Message Options 1584 5.7.1. RPL Control Message Option Generic Format 1586 RPL Control Message Options all follow this format: 1588 0 1 2 1589 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 1590 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - 1591 | Option Type | Option Length | Option Data 1592 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - 1594 Figure 14: RPL Option Generic Format 1596 Option Type: 8-bit identifier of the type of option. The Option 1597 Type values are to be confirmed by the IANA Section 18.4. 1599 Option Length: 8-bit unsigned integer, representing the length in 1600 octets of the option, not including the Option Type and Length 1601 fields. 1603 Option Data: A variable length field that contains data specific to 1604 the option. 1606 When processing a RPL message containing an option for which the 1607 Option Type value is not recognized by the receiver, the receiver 1608 MUST silently ignore the unrecognized option and continue to process 1609 the following option, correctly handling any remaining options in the 1610 message. 1612 RPL message options may have alignment requirements. Following the 1613 convention in IPv6, options with alignment requirements are aligned 1614 in a packet such that multi-octet values within the Option Data field 1615 of each option fall on natural boundaries (i.e., fields of width n 1616 octets are placed at an integer multiple of n octets from the start 1617 of the header, for n = 1, 2, 4, or 8). 1619 5.7.2. Pad1 1621 The Pad1 option may be present in DIS, DIO, DAO, and DAO-ACK 1622 messages, and its format is as follows: 1624 0 1625 0 1 2 3 4 5 6 7 1626 +-+-+-+-+-+-+-+-+ 1627 | Type = 0 | 1628 +-+-+-+-+-+-+-+-+ 1630 Figure 15: Format of the Pad 1 Option 1632 The Pad1 option is used to insert one or two octets of padding into 1633 the message to enable options alignment. If more than one octet of 1634 padding is required, the PadN option should be used rather than 1635 multiple Pad1 options. 1637 NOTE! the format of the Pad1 option is a special case - it has 1638 neither Option Length nor Option Data fields. 1640 5.7.3. PadN 1642 The PadN option may be present in DIS, DIO, DAO, and DAO-ACK 1643 messages, and its format is as follows: 1645 0 1 2 1646 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 1647 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - 1648 | Type = 1 | Option Length | 0x00 Padding... 1649 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - 1651 Figure 16: Format of the Pad N Option 1653 The PadN option is used to insert two or more octets of padding into 1654 the message to enable options alignment. PadN Option data MUST be 1655 ignored by the receiver. 1657 Option Type: 0x01 (to be confirmed by IANA) 1659 Option Length: For N (N > 1) octets of padding, the Option Length 1660 field contains the value N-2. 1662 Option Data: For N (N > 1) octets of padding, the Option Data 1663 consists of N-2 zero-valued octets. 1665 5.7.4. Metric Container 1667 The Metric Container option may be present in DIO messages, and its 1668 format is as follows: 1670 0 1 2 1671 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 1672 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - 1673 | Type = 2 | Option Length | Metric Data 1674 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - 1676 Figure 17: Format of the Metric Container Option 1678 The Metric Container is used to report metrics along the DODAG. The 1679 Metric Container may contain a number of discrete node, link, and 1680 aggregate path metrics and constraints specified in 1681 [I-D.ietf-roll-routing-metrics] as chosen by the implementer. 1683 The Metric Container MAY appear more than once in the same RPL 1684 control message, for example to accommodate a use case where the 1685 Metric Data is longer than 256 bytes. More information is in 1686 [I-D.ietf-roll-routing-metrics] 1688 The processing and propagation of the Metric Container is governed by 1689 implementation specific policy functions. 1691 Option Type: 0x02 (to be confirmed by IANA) 1693 Option Length: The Option Length field contains the length in octets 1694 of the Metric Data. 1696 Metric Data: The order, content, and coding of the Metric Container 1697 data is as specified in [I-D.ietf-roll-routing-metrics]. 1699 5.7.5. Route Information 1701 The Route Information option may be present in DIO messages, and is 1702 equivalent in function to the IPv6 ND Route Information option as 1703 defined in [RFC4191]. The format of the option is modified slightly 1704 (Type, Length, Prefix) in order to be carried as a RPL option as 1705 follows: 1707 0 1 2 3 1708 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1709 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1710 | Type = 3 | Option Length | Prefix Length |Resvd|Prf|Resvd| 1711 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1712 | Route Lifetime | 1713 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1714 | | 1715 . Prefix (Variable Length) . 1716 . . 1717 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1719 Figure 18: Format of the Route Information Option 1721 The Route Information option is used to indicate that connectivity to 1722 the specified destination prefix is available from the DODAG root. 1724 In the event that a RPL Control Message may need to specify 1725 connectivity to more than one destination, the Route Information 1726 option may be repeated. 1728 [RFC4191] should be consulted as the authoritative reference with 1729 respect to the Route Information option. The field descriptions are 1730 transcribed here for convenience: 1732 Option Type: 0x03 (to be confirmed by IANA) 1734 Option Length: Variable, length of the option in octets excluding 1735 the Type and Length fields. Note that this length is expressed 1736 in units of single-octets, unlike in IPv6 ND. 1738 Prefix Length 8-bit unsigned integer. The number of leading bits in 1739 the Prefix that are valid. The value ranges from 0 to 128. 1740 The Prefix field has the number of bytes inferred from the 1741 Option Length field, that must be at least the Prefix Length. 1742 Note that in RPL this means that the Prefix field may have 1743 lengths other than 0, 8, or 16. 1745 Prf: 2-bit signed integer. The Route Preference indicates whether 1746 to prefer the router associated with this prefix over others, 1747 when multiple identical prefixes (for different routers) have 1748 been received. If the Reserved (10) value is received, the 1749 Route Information Option MUST be ignored. 1751 Resvd: Two 3-bit unused fields. They MUST be initialized to zero by 1752 the sender and MUST be ignored by the receiver. 1754 Route Lifetime 32-bit unsigned integer. The length of time in 1755 seconds (relative to the time the packet is sent) that the 1756 prefix is valid for route determination. A value of all one 1757 bits (0xffffffff) represents infinity. 1759 Prefix Variable-length field containing an IP address or a prefix of 1760 an IP address. The Prefix Length field contains the number of 1761 valid leading bits in the prefix. The bits in the prefix after 1762 the prefix length (if any) are reserved and MUST be initialized 1763 to zero by the sender and ignored by the receiver. Note that 1764 in RPL this field may have lengths other than 0, 8, or 16. 1766 Unassigned bits of the Route Information option are reserved. They 1767 MUST be set to zero on transmission and MUST be ignored on reception. 1769 5.7.6. DODAG Configuration 1771 The DODAG Configuration option may be present in DIO messages, and 1772 its format is as follows: 1774 0 1 2 3 1775 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1776 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1777 | Type = 4 | Option Length | Resrvd|A| PCS | DIOIntDoubl. | 1778 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1779 | DIOIntMin. | DIORedun. | MaxRankIncrease | 1780 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1781 | MinHopRankIncrease | OCP | 1782 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1784 Figure 19: Format of the DODAG Configuration Option 1786 The DODAG Configuration option is used to distribute configuration 1787 information for DODAG Operation through the DODAG. 1789 The information communicated in this option is generally static and 1790 unchanging within the DODAG, therefore it is not necessary to include 1791 in every DIO. This information is configured at the DODAG Root and 1792 distributed throughout the DODAG with the DODAG Configuration Option. 1793 Nodes other than the DODAG Root MUST NOT modify this information when 1794 propagating the DODAG Configuration option. This option MAY be 1795 included occasionally by the DODAG Root (as determined by the DODAG 1796 Root), and MUST be included in response to a unicast request, e.g. a 1797 unicast DODAG Information Solicitation (DIS) message. 1799 Option Type: 0x04 (to be confirmed by IANA) 1801 Option Length: 8 bytes 1803 Authentication Enabled (A): One bit describing the security mode of 1804 the network. The bit describe whether a node must authenticate 1805 with a key authority before joining the network as a router. 1806 If the DIO is not a secure DIO, the 'A' bit MUST be zero. 1808 Path Control Size (PCS): 3-bit unsigned integer used to configure 1809 the number of bits that may be allocated to the Path Control 1810 field (see Section 8.9). Note that as used a value of 1 is 1811 added to this field, i.e. a PCS value of 0 results in 1 active 1812 bit in the Path Control field. The default value of PCS is 1813 DEFAULT_PATH_CONTROL_SIZE. 1815 DIOIntervalDoublings: 8-bit unsigned integer used to configure Imax 1816 of the DIO trickle timer (see Section 7.3.1). 1818 DIOIntervalMin: 8-bit unsigned integer used to configure Imin of the 1819 DIO trickle timer (see Section 7.3.1). 1821 DIORedundancyConstant: 8-bit unsigned integer used to configure k of 1822 the DIO trickle timer (see Section 7.3.1). 1824 MaxRankIncrease: 16-bit unsigned integer used to configure 1825 DAGMaxRankIncrease, the allowable increase in rank in support 1826 of local repair. If DAGMaxRankIncrease is 0 then this 1827 mechanism is disabled. 1829 MinHopRankInc 16-bit unsigned integer used to configure 1830 MinHopRankIncrease as described in Section 3.6.2.1. 1832 Objective Code Point (OCP) 16-bit unsigned integer. The OCP field 1833 identifies the OF and is managed by the IANA. 1835 5.7.7. RPL Target 1837 The RPL Target option format is as follows: 1839 0 1 2 3 1840 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1841 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1842 | Type = 5 | Option Length | Reserved | Prefix Length | 1843 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1844 | | 1845 + + 1846 | Target Prefix (Variable Length) | 1847 . . 1848 . . 1849 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1851 Figure 20: Format of the RPL Target Option 1853 The RPL Target Option is used to indicate a target IPv6 address, 1854 prefix, or multicast group that is reachable or queried along the 1855 DODAG. In a DIO, the RPL Target Option identifies a resource that 1856 the root is trying to reach. In a DAO, the RPL Target option 1857 indicates reachability. 1859 A set of one or more Transit Information options MAY directly follow 1860 the Target option in a DAO message in support of constructing source 1861 routes in a non-storing mode of operation 1862 [I-D.hui-6man-rpl-routing-header]. When the same set of Transit 1863 Information options apply equally to a set of DODAG Target options, 1864 the group of Target options MUST appear first, followed by the 1865 Transit Information options which apply to those Targets. 1867 The RPL Target option may be repeated as necessary to indicate 1868 multiple targets. 1870 Option Type: 0x05 (to be confirmed by IANA) 1872 Option Length: Variable, length of the option in octets excluding 1873 the Type and Length fields. 1875 Prefix Length: 8-bit unsigned integer. Number of valid leading bits 1876 in the IPv6 Prefix. 1878 Target Prefix: Variable-length field identifying an IPv6 destination 1879 address, prefix, or multicast group. The Prefix Length field 1880 contains the number of valid leading bits in the prefix. The 1881 bits in the prefix after the prefix length (if any) are 1882 reserved and MUST be set to zero on transmission and MUST be 1883 ignored on receipt. 1885 5.7.8. Transit Information 1887 The Transit Information option may be present in DAO messages, and 1888 its format is as follows: 1890 0 1 2 3 1891 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1892 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1893 | Type = 6 | Option Length | Path Sequence | Path Control | 1894 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1895 | Path Lifetime | 1896 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1897 | | 1898 + + 1899 | | 1900 + Parent Address* + 1901 | | 1902 + + 1903 | | 1904 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1906 Figure 21: Format of the Transit Information option 1908 The Transit Information option is used for a node to indicate 1909 attributes for a path to one or more destinations. The destinations 1910 are indicated as by one or more Target options that immediately 1911 precede the Transit Information option(s). 1913 The Transit Information option can used for a node to indicate its 1914 DODAG parents to an ancestor that is collecting DODAG routing 1915 information, typically for the purpose of constructing source routes. 1916 In the non-storing mode of operation this ancestor will be the DODAG 1917 Root, and this option is carried by the DAO message. The option 1918 length is used to determine whether the Parent Address is present or 1919 not. 1921 A non-storing node that has more than one DAO parent MAY include a 1922 Transit Information option for each DAO parent as part of the non- 1923 storing Destination Advertisement operation. The node may code the 1924 Path Control field in order to signal a preference among parents. 1926 One or more Transit Information options MUST be preceded by one or 1927 more RPL Target options. In this manner the RPL Target option 1928 indicates the child node, and the Transit Information option(s) 1929 enumerate the DODAG parents. 1931 A typical non-storing node will use multiple Transit Information 1932 options, and it will send the DAO thus formed to only one parent that 1933 will forward it to the root. A typical storing node with use one 1934 Transit Information option with no parent field, and will send the 1935 DAO thus formed to multiple parents. 1937 Option Type: 0x06 (to be confirmed by IANA) 1939 Option Length: Variable, depending on whether or not Parent Address 1940 is present. 1942 Path-Sequence: 8-bit unsigned integer. When a RPL Target option is 1943 issued by the node that owns the Target Prefix (i.e. in a DAO 1944 message), that node sets the Path-Sequence and increments the 1945 Path-Sequence each time it issues a RPL Target option. 1947 Path Control: 8-bit bitfield. The Path Control field limits the 1948 number of DAO-Parents to which a DAO message advertising 1949 connectivity to a specific destination may be sent, as well as 1950 providing some indication of relative preference. The limit 1951 provides some bound on overall DAO fan-out in the LLN. The 1952 leftmost bit is associated with a path that contains a most- 1953 preferred link, and the subsequent bits are ordered down to the 1954 rightmost bit which is least preferred. 1956 Path Lifetime: 32-bit unsigned integer. The length of time in 1957 seconds (relative to the time the packet is sent) that the 1958 prefix is valid for route determination. A value of all one 1959 bits (0xFFFFFFFF) represents infinity. A value of all zero 1960 bits (0x00000000) indicates a loss of reachability. This is 1961 referred as a No-Path in this document. 1963 Parent Address (optional): IPv6 Address of the DODAG Parent of the 1964 node originally issuing the Transit Information Option. This 1965 field may not be present, as according to the DODAG Mode of 1966 Operation and indicated by the Transit Information option 1967 length. 1969 Unassigned bits of the Transit Information option are reserved. They 1970 MUST be set to zero on transmission and MUST be ignored on reception. 1972 5.7.9. Solicited Information 1974 The Solicited Information option may be present in DIS messages, and 1975 its format is as follows: 1977 0 1 2 3 1978 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 1979 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1980 | Type = 7 | Option Length | RPLInstanceID |V|I|D| Rsvd | 1981 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1982 | | 1983 + + 1984 | | 1985 + DODAGID + 1986 | | 1987 + + 1988 | | 1989 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1990 | Version | 1991 +-+-+-+-+-+-+-+-+ 1993 Figure 22: Format of the Solicited Information Option 1995 The Solicited Information option is used for a node to request DIO 1996 messages from a subset of neighboring nodes. The Solicited 1997 Information option may specify a number of predicate criteria to be 1998 matched by a receiving node. These predicates affect whether a node 1999 resets its DIO trickle timer, as described in Section 7.3 2001 Option Type: 0x07 (to be confirmed by IANA) 2003 Option Length: 19 bytes 2005 Control Field: The Solicited Information option Control Field has 2006 three flags: 2008 V: If the V flag is set then the Version field is valid and 2009 a node matches the predicate if its DODAGVersionNumber 2010 matches the requested version. If the V flag is clear 2011 then the Version field is not valid and the Version field 2012 MUST be set to zero on transmission and ignored upon 2013 receipt. 2015 I: If the I flag is set then the RPLInstanceID field is 2016 valid and a node matches the predicate if it matches the 2017 requested RPLInstanceID. If the I flag is clear then the 2018 RPLInstanceID field is not valid and the RPLInstanceID 2019 field MUST be set to zero on transmission and ignored 2020 upon receipt. 2022 D: If the D flag is set then the DODAGID field is valid and 2023 a node matches the predicate if it matches the requested 2024 DODAGID. If the D flag is clear then the DODAGID field 2025 is not valid and the DODAGID field MUST be set to zero on 2026 transmission and ignored upon receipt. 2028 Version: 8-bit unsigned integer containing the DODAG Version number 2029 that is being solicited when valid. 2031 RPLInstanceID: 8-bit unsigned integer containing the RPLInstanceID 2032 that is being solicited when valid. 2034 DODAGID: 128-bit unsigned integer containing the DODAGID that is 2035 being solicited when valid. 2037 Unassigned bits of the Solicited Information option are reserved. 2038 They MUST be set to zero on transmission and MUST be ignored on 2039 reception. 2041 5.7.10. Prefix Information 2043 The Prefix Information option may be present in DIO messages, and is 2044 equivalent in function to the IPv6 ND Prefix Information option as 2045 defined in [RFC4861]. The format of the option is modified slightly 2046 (Type, Length, Prefix) in order to be carried as a RPL option as 2047 follows: 2049 0 1 2 3 2050 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2051 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2052 | Type = 8 | Option Length | Prefix Length |L|A| Reserved1 | 2053 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2054 | Valid Lifetime | 2055 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2056 | Preferred Lifetime | 2057 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2058 | Reserved2 | 2059 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2060 | | 2061 + + 2062 | | 2063 + Prefix + 2064 | | 2065 + + 2066 | | 2067 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 2068 Figure 23: Format of the Prefix Information Option 2070 The Prefix Information option may be used to distribute the prefix in 2071 use inside the DODAG, e.g. for address autoconfiguration. 2073 [RFC4861] should be consulted as the authoritative reference with 2074 respect to the Prefix Information option. The field descriptions are 2075 transcribed here for convenience: 2077 Option Type: 0x08 (to be confirmed by IANA) 2079 Option Length: 30. Note that this length is expressed in units of 2080 single-octets, unlike in IPv6 ND. 2082 Prefix Length 8-bit unsigned integer. The number of leading bits in 2083 the Prefix that are valid. The value ranges from 0 to 128. 2084 The prefix length field provides necessary information for on- 2085 link determination (when combined with the L flag in the prefix 2086 information option). It also assists with address 2087 autoconfiguration as specified in [RFC4862], for which there 2088 may be more restrictions on the prefix length. 2090 L 1-bit on-link flag. When set, indicates that this prefix can 2091 be used for on-link determination. When not set the 2092 advertisement makes no statement about on-link or off-link 2093 properties of the prefix. In other words, if the L flag is not 2094 set a host MUST NOT conclude that an address derived from the 2095 prefix is off-link. That is, it MUST NOT update a previous 2096 indication that the address is on-link. 2098 A 1-bit autonomous address-configuration flag. When set 2099 indicates that this prefix can be used for stateless address 2100 configuration as specified in [RFC4862]. 2102 Reserved1 6-bit unused field. It MUST be initialized to zero by the 2103 sender and MUST be ignored by the receiver. 2105 Valid Lifetime 32-bit unsigned integer. The length of time in 2106 seconds (relative to the time the packet is sent) that the 2107 prefix is valid for the purpose of on-link determination. A 2108 value of all one bits (0xffffffff) represents infinity. The 2109 Valid Lifetime is also used by [RFC4862]. 2111 Preferred Lifetime 32-bit unsigned integer. The length of time in 2112 seconds (relative to the time the packet is sent) that 2113 addresses generated from the prefix via stateless address 2114 autoconfiguration remain preferred [RFC4862]. A value of all 2115 one bits (0xffffffff) represents infinity. See [RFC4862]. 2117 Note that the value of this field MUST NOT exceed the Valid 2118 Lifetime field to avoid preferring addresses that are no longer 2119 valid. 2121 Reserved2 This field is unused. It MUST be initialized to zero by 2122 the sender and MUST be ignored by the receiver. 2124 Prefix An IP address or a prefix of an IP address. The Prefix 2125 Length field contains the number of valid leading bits in the 2126 prefix. The bits in the prefix after the prefix length are 2127 reserved and MUST be initialized to zero by the sender and 2128 ignored by the receiver. A router SHOULD NOT send a prefix 2129 option for the link-local prefix and a host SHOULD ignore such 2130 a prefix option. A non-storing node SHOULD refrain from 2131 advertising a prefix till it owns an address of that prefix, 2132 and then it SHOULD advertise its full address in this field, to 2133 be used by its children in the Parent Address field of the 2134 Transit Information Option 2136 Unassigned bits of the Prefix Information option are reserved. They 2137 MUST be set to zero on transmission and MUST be ignored on reception. 2139 6. Sequence Counters 2141 This section describes the general scheme for bootstrap and operation 2142 of sequence counters in RPL, such as the DODAGVersionNumber in the 2143 DIO message, the DAOSequence in the DAO message, and the Path- 2144 Sequence in the Transit Information option. 2146 RPL sequence counters are subdivided in a 'lollipop' fashion 2147 ([Perlman83]), where the values from 128 and greater are used as a 2148 linear sequence to indicate a restart and bootstrap the counter, and 2149 the values less than or equal to 127 used as a circular sequence 2150 number space of size 128 as in [RFC1982]. Consideration is given to 2151 the mode of operation when transitioning from the linear region to 2152 the circular region. Finally, when operating in the circular region, 2153 if sequence numbers are detected to be too far apart then they are 2154 not comparable, as detailed below. 2156 A window of comparison, SEQUENCE_WINDOW = 16, is configured based on 2157 a value of 2^N, where N=4. 2159 For a given sequence counter, 2161 1. The sequence counter SHOULD be initialized to an implementation 2162 defined value which is 128 or greater prior to use. A 2163 recommended value is 240 (256 - SEQUENCE_WINDOW). 2165 2. When a sequence counter increment would cause the sequence 2166 counter to increment beyond its maximum value, the sequence 2167 counter MUST wrap back to zero. When incrementing a sequence 2168 counter greater than or equal to 128, the maximum value is 255. 2169 When incrementing a sequence counter less than 128, the maximum 2170 value is 127. 2172 3. When comparing two sequence counters, the following rules MUST be 2173 applied: 2175 1. When a first sequence counter A is in the interval [0..127] 2176 and a second sequence counter B is in [128..255]: 2178 1. If B-A is less than or equal to SEQUENCE_WINDOW, then B 2179 is greater than A, A is less than B, and the two are not 2180 equal. 2182 2. If B-A is greater than SEQUENCE_WINDOW, then A is greater 2183 than B, B is less than A, and the two are not equal. 2185 2. In the case where both sequence counters to be compared are 2186 less than or equal to 127, and in the case where both 2187 sequence counters to be compared are greater than or equal to 2188 128: 2190 1. If the absolute magnitude of difference between the two 2191 sequence counters is less than or equal to 2192 SEQUENCE_WINDOW, then a comparison as described in 2193 [RFC1982] is used to determine the relationships greater 2194 than, less than, and equal 2196 2. If the absolute magnitude of difference of the two 2197 sequence counters is greater than SEQUENCE_WINDOW, then a 2198 desynchronization has occurred and the two sequence 2199 numbers are not comparable. 2201 4. If two sequence numbers are determined to be not comparable, i.e. 2202 the results of the comparison are not defined, then a node should 2203 consider the comparison as if it has evaluated in such a way so 2204 as to give precedence to the sequence number that has most 2205 recently been observed to increment. Failing this, the node 2206 should consider the comparison as if it has evaluated in such a 2207 way so as to minimize the resulting changes to its own state. 2209 7. Upward Routes 2211 This section describes how RPL discovers and maintains upward routes. 2212 It describes the use of DODAG Information Objects (DIOs), the 2213 messages used to discover and maintain these routes. It specifies 2214 how RPL generates and responds to DIOs. It also describes DODAG 2215 Information Solicitation (DIS) messages, which are used to trigger 2216 DIO transmissions. 2218 7.1. DIO Base Rules 2220 1. For the following DIO Base fields, a node that is not a DODAG 2221 root MUST advertise the same values as its preferred DODAG parent 2222 (defined in Section 7.2.1). Therefore, if a DODAG root does not 2223 change these values, every node in a route to that DODAG root 2224 eventually advertises the same values for these fields. These 2225 fields are: 2226 1. Grounded (G) 2227 2. Mode of Operation (MOP) 2228 3. DAGPreference (Prf) 2229 4. Version 2230 5. RPLInstanceID 2231 6. DODAGID 2233 2. A node MAY update the following fields at each hop: 2234 1. Rank 2235 2. DTSN 2237 3. The DODAGID field each root sets MUST be unique within the RPL 2238 Instance. 2240 7.2. Upward Route Discovery and Maintenance 2242 Upward route discovery allows a node to join a DODAG by discovering 2243 neighbors that are members of the DODAG of interest and identifying a 2244 set of parents. The exact policies for selecting neighbors and 2245 parents is implementation-dependent and driven by the OF. This 2246 section specifies the set of rules those policies must follow for 2247 interoperability. 2249 7.2.1. Neighbors and Parents within a DODAG Version 2251 RPL's upward route discovery algorithms and processing are in terms 2252 of three logical sets of link-local nodes. First, the candidate 2253 neighbor set is a subset of the nodes that can be reached via link- 2254 local multicast. The selection of this set is implementation- 2255 dependent and OF-dependent. Second, the parent set is a restricted 2256 subset of the candidate neighbor set. Finally, the preferred parent, 2257 a set of size one, is an element of the parent set that is the 2258 preferred next hop in upward routes. 2260 More precisely: 2262 1. The DODAG parent set MUST be a subset of the candidate neighbor 2263 set. 2265 2. A DODAG root MUST have a DODAG parent set of size zero. 2267 3. A node that is not a DODAG root MAY maintain a DODAG parent set 2268 of size greater than or equal to one. 2270 4. A node's preferred DODAG parent MUST be a member of its DODAG 2271 parent set. 2273 5. A node's rank MUST be greater than all elements of its DODAG 2274 parent set. 2276 6. When Neighbor Unreachability Detection (NUD), or an equivalent 2277 mechanism, determines that a neighbor is no longer reachable, a 2278 RPL node MUST NOT consider this node in the candidate neighbor 2279 set when calculating and advertising routes until it determines 2280 that it is again reachable. Routes through an unreachable 2281 neighbor MUST be removed from the routing table. 2283 These rules ensure that there is a consistent partial order on nodes 2284 within the DODAG. As long as node ranks do not change, following the 2285 above rules ensures that every node's route to a DODAG root is loop- 2286 free, as rank decreases on each hop to the root. 2288 The OF can guide candidate neighbor set and parent set selection, as 2289 discussed in [I-D.ietf-roll-routing-metrics] and [I-D.ietf-roll-of0]. 2291 7.2.2. Neighbors and Parents across DODAG Versions 2293 The above rules govern a single DODAG version. The rules in this 2294 section define how RPL operates when there are multiple DODAG 2295 versions: 2297 7.2.2.1. DODAG Version 2299 1. The tuple (RPLInstanceID, DODAGID, DODAGVersionNumber) uniquely 2300 defines a DODAG Version. Every element of a node's DODAG parent 2301 set, as conveyed by the last heard DIO message from each DODAG 2302 parent, MUST belong to the same DODAG version. Elements of a 2303 node's candidate neighbor set MAY belong to different DODAG 2304 Versions. 2306 2. A node is a member of a DODAG version if every element of its 2307 DODAG parent set belongs to that DODAG version, or if that node 2308 is the root of the corresponding DODAG. 2310 3. A node MUST NOT send DIOs for DODAG versions of which it is not a 2311 member. 2313 4. DODAG roots MAY increment the DODAGVersionNumber that they 2314 advertise and thus move to a new DODAG version. When a DODAG 2315 root increments its DODAGVersionNumber, it MUST follow the 2316 conventions of Serial Number Arithmetic as described in 2317 Section 6. 2319 5. Within a given DODAG, a node that is a not a root MUST NOT 2320 advertise a DODAGVersionNumber higher than the highest 2321 DODAGVersionNumber it has heard. Higher is defined as the 2322 greater-than operator in Section 6. 2324 6. Once a node has advertised a DODAG version by sending a DIO, it 2325 MUST NOT be member of a previous DODAG version of the same DODAG 2326 (i.e. with the same RPLInstanceID, the same DODAGID, and a lower 2327 DODAGVersionNumber). Lower is defined as the less-than operator 2328 in Section 6. 2330 When the DODAG parent set becomes empty on a node that is not a root, 2331 (i.e. the last parent has been removed, causing the node to no longer 2332 be associated with that DODAG), then the DODAG information should not 2333 be suppressed until after the expiration of an implementation- 2334 specific local timer in order to observe if the DODAGVersionNumber 2335 has been incremented, should any new parents appear for the DODAG. 2336 This will help protect against the possibility of loops that may 2337 occur of that node were to inadvertently rejoin the old DODAG version 2338 in its own prior sub-DODAG. 2340 As the DODAGVersionNumber is incremented, a new DODAG Version spreads 2341 outward from the DODAG root. A parent that advertises the new 2342 DODAGVersionNumber cannot belong to the sub-DODAG of a node 2343 advertising an older DODAGVersionNumber. Therefore a node can safely 2344 add a parent of any Rank with a newer DODAGVersionNumber without 2345 forming a loop. 2347 Exactly when a DODAG Root increments the DODAGVersionNumber is 2348 implementation and application-dependent and outside the scope of 2349 this document. Examples include incrementing the DODAGVersionNumber 2350 periodically, upon administrative intervention, or on application- 2351 level detection of lost connectivity or DODAG inefficiency. 2353 After a node transitions to and advertises a new DODAG Version, the 2354 rules above make it unable to advertise the previous DODAG Version 2355 (prior DODAGVersionNumber) once it has committed to advertising the 2356 new DODAG Version. 2358 7.2.2.2. DODAG Roots 2360 1. A DODAG root without possibility to satisfy the application- 2361 defined goal MUST NOT set the Grounded bit. 2363 2. A DODAG root MUST advertise a rank of ROOT_RANK. 2365 3. A node whose DODAG parent set is empty MAY become the DODAG Root 2366 of a floating DODAG. It MAY also set its DAGPreference such that 2367 it is less preferred. 2369 In a deployment that uses a backbone link to federate a number of LLN 2370 roots, it is possible to run RPL over that backbone and use one 2371 router as a "backbone root". The backbone root is the virtual root 2372 of the DODAG, and exposes a rank of BASE_RANK over the backbone. All 2373 the LLN roots that are parented to that backbone root, including the 2374 backbone root if it also serves as LLN root itself, expose a rank of 2375 ROOT_RANK to the LLN. These virtual roots are part of the same DODAG 2376 and advertise the same DODAGID. They coordinate DODAGVersionNumbers 2377 and other DODAG parameters with the virtual root over the backbone. 2379 7.2.2.3. DODAG Selection 2381 The objective function of a DAG determines how a node selects its 2382 neighbor set, parent set, and preferred parents. This selection 2383 implicitly also decides the DODAG within a DAG. Such selection can 2384 include administrative preference (Prf) as well as metrics or other 2385 considerations. 2387 If a node has the option to join a more preferred DODAG while still 2388 meeting other optimization objectives, then the node will generally 2389 seek to join the more preferred DODAG as determined by the OF. All 2390 else being equal, it is left to the implementation to determine which 2391 DODAG is most preferred. 2393 7.2.2.4. Rank and Movement within a DODAG Version 2395 1. A node MUST NOT advertise a Rank less than or equal to any member 2396 of its parent set within the DODAG Version. 2398 2. A node MAY advertise a Rank lower than its prior advertisement 2399 within the DODAG Version. 2401 3. Let L be the lowest rank within a DODAG version that a given node 2402 has advertised. Within the same DODAG Version, that node MUST 2403 NOT advertise an effective rank higher than L + 2404 DAGMaxRankIncrease. INFINITE_RANK is an exception to this rule: 2405 a node MAY advertise an INFINITE_RANK within a DODAG version 2406 without restriction. If a node's Rank would be higher than 2407 allowed by L + DAGMaxRankIncrease, when it advertises Rank it 2408 MUST advertise its Rank as INFINITE_RANK. 2410 4. A node MAY, at any time, choose to join a different DODAG within 2411 a RPL Instance. Such a join has no rank restrictions, unless 2412 that different DODAG is a DODAG Version of which this node has 2413 previously been a member, in which case the rule of the previous 2414 bullet (3) must be observed. Until a node transmits a DIO 2415 indicating its new DODAG membership, it MUST forward packets 2416 along the previous DODAG. 2418 5. A node MAY, at any time after hearing the next DODAGVersionNumber 2419 advertised from suitable DODAG parents, choose to migrate to the 2420 next DODAG Version within the DODAG. 2422 Conceptually, an implementation is maintaining a DODAG parent set 2423 within the DODAG Version. Movement entails changes to the DODAG 2424 parent set. Moving up does not present the risk to create a loop but 2425 moving down might, so that operation is subject to additional 2426 constraints. 2428 When a node migrates to the next DODAG Version, the DODAG parent set 2429 needs to be rebuilt for the new version. An implementation could 2430 defer to migrate for some reasonable amount of time, to see if some 2431 other neighbors with potentially better metrics but higher rank 2432 announce themselves. Similarly, when a node jumps into a new DODAG 2433 it needs to construct new a DODAG parent set for this new DODAG. 2435 If a node needs to move down a DODAG that it is attached to, 2436 increasing its Rank, then it MAY poison its routes and delay before 2437 moving as described in Section 7.2.2.5. 2439 7.2.2.5. Poisoning 2441 1. A node poisons routes by advertising a Rank of INFINITE_RANK. 2443 2. A node MUST NOT have any nodes with a Rank of INFINITE_RANK in 2444 its parent set. 2446 Although an implementation may advertise INFINITE_RANK for the 2447 purposes of poisoning, doing so is not the same as setting Rank to 2448 INFINITE_RANK. For example, a node may continue to send data packets 2449 whose meta-data include a Rank that is not INFINITE_RANK yet still 2450 advertise INFINITE_RANK in its DIOs. 2452 7.2.2.6. Detaching 2454 1. A node unable to stay connected to a DODAG within a given DODAG 2455 version MAY detach from this DODAG version. A node that detaches 2456 becomes root of its own floating DODAG and SHOULD immediately 2457 advertise this new situation in a DIO as an alternate to 2458 poisoning. 2460 7.2.2.7. Following a Parent 2462 1. If a node receives a DIO from one of its DODAG parents, 2463 indicating that the parent has left the DODAG, that node SHOULD 2464 stay in its current DODAG through an alternative DODAG parent, if 2465 possible. It MAY follow the leaving parent. 2467 A DODAG parent may have moved, migrated to the next DODAG Version, or 2468 jumped to a different DODAG. A node should give some preference to 2469 remaining in the current DODAG, if possible via an alternate parent, 2470 but ought to follow the parent if there are no other options. 2472 7.2.3. DIO Message Communication 2474 When an DIO message is received, the receiving node must first 2475 determine whether or not the DIO message should be accepted for 2476 further processing, and subsequently present the DIO message for 2477 further processing if eligible. 2479 1. If the DIO message is malformed, then the DIO message is not 2480 eligible for further processing and a node MUST silently discard 2481 it. 2483 2. If the sender of the DIO message is a member of the candidate 2484 neighbor set and the DIO message is not malformed, the node MUST 2485 process the DIO. 2487 7.2.3.1. DIO Message Processing 2489 As DIO messages are received from candidate neighbors, the neighbors 2490 may be promoted to DODAG parents by following the rules of DODAG 2491 discovery as described in Section 7.2. When a node places a neighbor 2492 into the DODAG parent set, the node becomes attached to the DODAG 2493 through the new DODAG parent node. 2495 The most preferred parent should be used to restrict which other 2496 nodes may become DODAG parents. Some nodes in the DODAG parent set 2497 may be of a rank less than or equal to the most preferred DODAG 2498 parent. (This case may occur, for example, if an energy constrained 2499 device is at a lesser rank but should be avoided as per an 2500 optimization objective, resulting in a more preferred parent at a 2501 greater rank). 2503 7.3. DIO Transmission 2505 RPL nodes transmit DIOs using a Trickle timer 2506 ([I-D.ietf-roll-trickle]). A DIO from a sender with a lower DAGRank 2507 that causes no changes to the recipient's parent set, preferred 2508 parent, or Rank SHOULD be considered consistent with respect to the 2509 Trickle timer. 2511 The following packets and events MUST be considered inconsistencies 2512 with respect to the Trickle timer, and cause the Trickle timer to 2513 reset: 2515 o When a node detects an inconsistency when forwarding a packet, as 2516 detailed in Section 10.2. 2518 o When a node receives a multicast DIS message without a Solicited 2519 Information option. 2521 o When a node receives a multicast DIS with a Solicited Information 2522 option and the node matches all of the predicates in the Solicited 2523 Information option. 2525 o When a node joins a new DODAG Version (e.g. by updating its 2526 DODAGVersionNumber, joining a new RPL Instance, etc.) 2528 Note that this list is not exhaustive, and an implementation MAY 2529 consider other messages or events to be inconsistencies. 2531 A node SHOULD NOT reset its DIO trickle timer in response to unicast 2532 DIS messages. When a node receives a unicast DIS without a Solicited 2533 Information option, it MUST unicast a DIO to the sender in response. 2534 This DIO MUST include a DODAG Configuration option. When a node 2535 receives a unicast DIS message with a Solicited Information option, 2536 if it satisfies the predicates of the Solicited Information option it 2537 MUST unicast a DIO to the sender in response. This unicast DIO MUST 2538 include a DODAG Configuration Option. Thus a node may transmit a 2539 unicast DIS message to a potential DODAG parent in order to probe for 2540 DODAG Configuration and other parameters. 2542 7.3.1. Trickle Parameters 2544 The configuration parameters of the trickle timer are specified as 2545 follows: 2547 Imin: learned from the DIO message as (2^DIOIntervalMin)ms. The 2548 default value of DIOIntervalMin is DEFAULT_DIO_INTERVAL_MIN. 2550 Imax: learned from the DIO message as DIOIntervalDoublings. The 2551 default value of DIOIntervalDoublings is 2552 DEFAULT_DIO_INTERVAL_DOUBLINGS. 2554 k: learned from the DIO message as DIORedundancyConstant. The 2555 default value of DIORedundancyConstant is 2556 DEFAULT_DIO_REDUNDANCY_CONSTANT. In RPL, when k has the value 2557 of 0x00 this is to be treated as a redundancy constant of 2558 infinity in RPL, i.e. Trickle never suppresses messages. 2560 7.4. DODAG Selection 2562 The DODAG selection is implementation and OF dependent. Nodes SHOULD 2563 prefer to join DODAGs for RPLInstanceIDs advertising OCPs and 2564 destinations compatible with their implementation specific 2565 objectives. In order to limit erratic movements, and all metrics 2566 being equal, nodes SHOULD keep their previous selection. Also, nodes 2567 SHOULD provide a means to filter out a parent whose availability is 2568 detected as fluctuating, at least when more stable choices are 2569 available. 2571 When connection to a grounded DODAG is not possible or preferable for 2572 security or other reasons, scattered DODAGs MAY aggregate as much as 2573 possible into larger DODAGs in order to allow connectivity within the 2574 LLN. 2576 A node SHOULD verify that bidirectional connectivity and adequate 2577 link quality is available with a candidate neighbor before it 2578 considers that candidate as a DODAG parent. 2580 7.5. Operation as a Leaf Node 2582 In some cases a RPL node may attach to a DODAG as a leaf node only. 2583 One example of such a case is when a node does not understand the RPL 2584 Instance's OF or advertised metric/constraint. As specified in 2585 Section 16.6 related to policy function, the node may either join the 2586 DODAG as a leaf node or may not join the DODAG. As mentioned in 2587 Section 16.5, it is then recommended to log a fault. 2589 A leaf node does not extend DODAG connectivity but in some cases the 2590 leaf node may still need to transmit DIOs on occasion, in particular 2591 when the leaf node may not have always been acting as a leaf node and 2592 an inconsistency is detected. 2594 A node operating as a leaf node must obey the following rules: 2596 1. It MUST NOT transmit DIOs containing the DAG Metric Container. 2598 2. Its DIOs MUST advertise a DAGRank of INFINITE_RANK. 2600 3. It MAY suppress DIO transmission, except DIO transmission MUST 2601 NOT be suppressed when DIO transmission has been triggered due to 2602 detection of inconsistency when a packet is being forwarded or in 2603 response to a unicast DIS message. 2605 4. It MAY transmit unicast DAOs as described in Section 8.2. 2607 5. It MAY transmit multicast DAOs to the '1 hop' neighborhood as 2608 described in Section 8.10. 2610 A particular case that requires a leaf node to send a DIO is if that 2611 leaf node was a prior member of another DODAG and another node 2612 forwards a message assuming the old topology, triggering an 2613 inconsistency. The leaf node needs to transmit a DIO in order to 2614 repair the inconsistency. Note that due to the lossy nature of LLNs, 2615 even though the leaf node may have optimistically poisoned its routes 2616 by advertising a rank of INFINITE_RANK in the old DODAG prior to 2617 becoming a leaf node, that advertisement may have become lost and a 2618 leaf node must be capable to send a DIO later in order to repair the 2619 inconsistency. 2621 In general it is not expected that such a leaf node would advertise 2622 itself as a router. 2624 7.6. Administrative Rank 2626 In some cases it might be beneficial to adjust the rank advertised by 2627 a node beyond that computed by the OF based on some implementation 2628 specific policy and properties of the node. For example, a node that 2629 has limited battery should be a leaf unless there is no other choice, 2630 and may then augment the rank computation specified by the OF in 2631 order to expose an exaggerated rank. 2633 8. Downward Routes 2635 This section describes how RPL discovers and maintains downward 2636 routes. RPL constructs and maintains downward routes with 2637 Destination Advertisement Object (DAO) messages. Downward routes 2638 support of P2MP flows, from the DODAG roots toward the leaves. 2639 Downward routes also support P2P flows: P2P messages can flow to a 2640 DODAG Root through an upward route, then away from the DODAG Root to 2641 a destination through a downward route. 2643 This specification describes the two modes a RPL Instance may choose 2644 from for maintaining downward routes. In the first mode, call 2645 "storing," nodes store downward routing tables for their sub-DODAG. 2646 Each hop on a downward route in a storing network examines its 2647 routing table to decide on the next hop. In the second mode, called 2648 "non-storing," nodes do not store downward routing tables. Downward 2649 packets are routed with source routes populated by a DODAG Root. 2651 RPL allows a simple one-hop P2P optimization for both storing and 2652 non-storing networks. A node may send a P2P packet destined to a 2653 one-hop neighbor directly to that node. 2655 8.1. Destination Advertisement Parents 2657 To establish downward routes, RPL nodes send DAO messages upwards. 2658 The next hop destinations of these DAO messages are called DAO 2659 parents. The collection of a node's DAO parents is called the DAO 2660 parent set. 2662 o A node's DAO parent set MUST be a subset of its DODAG parent set. 2664 o A node MUST NOT unicast DAOs to nodes that are not DAO parents. 2666 o A node MAY link-local multicast DAO messages. 2668 o The IPv6 Source Address of a DAO message MUST be the link local 2669 address of the sending node. 2671 o If a node sends a DAO to one DAO parent, it MUST send a DAO with 2672 the same DAOSequence to all other DAO parents. 2674 The selection of DAO parents is implementation and objective function 2675 specific. 2677 8.2. Downward Route Discovery and Maintenance 2679 Destination Advertisement may be configured to be entirely disabled, 2680 or operate in either a storing or non-storing mode, as reported in 2681 the MOP in the DIO message. 2683 1. All nodes who join a DODAG MUST abide by the MOP setting from the 2684 root. Nodes that do not have the capability to fully participate 2685 as a router MAY join the DODAG as a leaf. 2687 2. If the MOP is 000, indicating no downward routing, nodes MUST NOT 2688 transmit DAO messages, and MAY ignore DAO messages. 2690 3. In non-storing mode, the DODAG Root MUST store source routing 2691 table entries for all destinations learned from DAOs. 2693 4. In storing mode, all non-root, non-leaf nodes MUST store routing 2694 table entries for all destinations learned from DAOs. 2696 A DODAG can have one of several possible modes of operation, as 2697 defined by the MOP field. Either it does not support downward 2698 routes, it supports downward routes through source routing from DODAG 2699 Roots, or it supports downward routes through in-network routing 2700 tables. When downward routes are supported through in-network 2701 routing tables, the multicast operation defined in this specification 2702 may or may not be supported, also as indicated by the MOP field. As 2703 of this specification RPL does not support mixed-mode operation, 2704 where some nodes source route and other store routing tables: future 2705 extensions to RPL may support this mode of operation. 2707 8.3. DAO Base Rules 2709 1. Each time a node generates a new DAO, the DAOSequence field MUST 2710 increment by at least one since the last generated DAO. 2712 2. Each time a node link-local multicasts a DAO, the DAOSequence 2713 field MUST increment by one since the last link local multicast 2714 DAO. 2716 3. The RPLInstanceID and DODAGID fields of a DAO MUST be the same 2717 value as the members of the node's parent set and the DIOs it 2718 transmits. 2720 4. A node MAY set the K flag in a unicast DAO message to solicit a 2721 unicast DAO-ACK in response in order to confirm the attempt. A 2722 node receiving a unicast DAO message with the K flag set SHOULD 2723 respond with a DAO-ACK. A node receiving a DAO message without 2724 the K flag set MAY respond with a DAO-ACK, especially to report 2725 an error condition. 2727 5. Nodes SHOULD ignore DAOs without newer sequence numbers and MUST 2728 NOT process them further. 2730 Unlike the Version field of a DIO, which is incremented only by a 2731 DODAG Root and repeated unchanged by other nodes, DAOSequence values 2732 are unique to each node. The sequence number space for unicast and 2733 multicast DAO messages can be either the same or distinct. 2735 8.4. DAO Transmission Scheduling 2737 Because DAOs flow upwards, receiving a unicast DAO can trigger 2738 sending a unicast DAO. 2740 1. On receiving a unicast DAO with a new DAOSequence, a node SHOULD 2741 send a DAO. It SHOULD NOT send this DAO immediately. It SHOULD 2742 delay sending the DAO in order to aggregate DAO information from 2743 other nodes for which it is a DAO parent. 2745 2. A node SHOULD delay sending a DAO with a timer (DelayDAO). 2746 Receiving a DAO starts the DelayDAO timer. DAOs received while 2747 the DelayDAO timer is active do not reset the timer. When the 2748 DelayDAO timer expires, the node sends a DAO. 2750 3. When a node adds a node to its DAO parent set, it SHOULD schedule 2751 a DAO transmission. 2753 DelayDAO's value and calculation is implementation-dependent. 2755 8.5. Triggering DAO Messages 2757 Nodes can trigger their sub-DODAG to send DAO messages. Each node 2758 maintains a DAO Trigger Sequence Number (DTSN), which it communicates 2759 through DIO messages. 2761 1. If a node hears one of its DAO parents increment its DTSN, the 2762 node MUST schedule a DAO transmission using rules in Section 8.3 2763 and Section 8.4. 2765 2. In non-storing mode, if a node hears one of its DAO parents 2766 increment its DTSN, the node MUST increment its own DTSN. 2768 In a storing mode of operation, a storing node MAY increment DTSN in 2769 order to reliably trigger a set of DAO updates from its immediate 2770 children, as part of routine routing table updates and maintenance. 2771 In a storing mode of operation it is not necessary to trigger DAO 2772 updates from the entire sub-DODAG, since that state information will 2773 percolate hop-by-hop up the DODAG in the storing mode of operation. 2775 In a non-storing mode of operation, a DTSN increment will also cause 2776 the immediate children of a node to increment their DTSN in turn, 2777 triggering a set of DAO updates from the entire sub-DODAG. In a non- 2778 storing mode of operation typically only the root would independently 2779 increment the DTSN when a DAO refresh is needed but a global repair 2780 (such as by incrementing DODAGVersionNumber) is not desired. In a 2781 non-storing mode of operation typically all non-root nodes would only 2782 increment their DTSN when their parent(s) are observed to do so. 2784 In the case of triggered DAOs, selecting a proper DAODelay can 2785 greatly reduce the number of DAOs transmitted. The trigger flows 2786 down the DODAG; in the best case the DAOs flow up the DODAG such that 2787 leaves send DAOs first, with each node sending a DAO only once. Such 2788 a scheduling could be approximated by setting DAODelay inversely 2789 proportional to Rank. Note that this suggestion is intended as an 2790 optimization to allow efficient aggregation -- it is not required for 2791 correct operation in the general case. 2793 8.6. Structure of DAO Messages 2795 DAOs follow a common structure in both storing and non-storing 2796 networks. Later sections describe further details for each mode of 2797 operation. 2799 1. RPL nodes MUST include one or more RPL Target Options in each DAO 2800 they transmit. One RPL Target Option MUST have a prefix that 2801 includes the node's IPv6 address if that node needs the DODAG to 2802 provision downward routes to that node. 2804 2. A RPL Target Option in a unicast DAO MUST be followed by a 2805 Transit Information Option. 2807 3. Multicast DAOs MUST NOT include Transit Information options. 2809 4. If a node receives a DAO that does not follow the above three 2810 rules, it MUST discard the DAO without further processing. 2812 8.7. Non-storing Mode 2814 In non-storing mode, RPL routes messages downward using source 2815 routing. The following rule applies to nodes that are in non-storing 2816 mode. Storing mode has a separate set of rules, described in 2817 Section 8.8. 2819 1. The Parent Address field of a Transit Information Option MUST 2820 contain one or more addresses. All of these addresses MUST be 2821 addresses of DAO parents of the sender. 2823 2. On receiving a unicast DAO, a node MUST forward the DAO upwards. 2824 This forwarding MAY use any parent in the parent set. Note that 2825 this forwarding may be delayed in support of aggregation as 2826 described below, but that such a delay is not required if a 2827 node's resources do not support it. 2829 3. When a node removes a node from its DAO parent set, it MAY 2830 generate a new DAO with an updated Transit Information option. 2832 In non-storing mode, a node uses DAOs to report its DAO parents to 2833 the DODAG Root. The DODAG Root can piece together a downward route 2834 to a node by using DAO parent sets from each node in the route. The 2835 purpose of this per-hop route calculation is to minimize traffic when 2836 DAO parents change. If nodes reported complete source routes, then 2837 on a DAO parent change the entire sub-DODAG would have to send new 2838 DAOs to the DODAG Root. Therefore, in non-storing mode, a node can 2839 send a a single DAO, although it might choose to send more than one 2840 DAO to each of multiple DAO parents. 2842 Nodes aggregate DAOs by sending a single DAO with multiple RPL Target 2843 Options. Each RPL Target Option has its own, immediately following, 2844 Transit Information options. 2846 8.8. Storing Mode 2848 In storing mode, RPL routes messages downward by the IPv6 destination 2849 address. The following rule apply to nodes that are in storing mode: 2851 1. The Parent Address field of a Transmit Information option MUST be 2852 empty. 2854 2. On receiving a unicast DAO, a node MUST compute if the DAO would 2855 change the set of prefixes that the node itself advertises. If 2856 so, the node MUST generate a new DAO and transmit it, following 2857 the rules in Section 8.4. Such a change includes receiving a No- 2858 Path DAO. 2860 3. When a node generates a new DAO, it SHOULD unicast it to each of 2861 its DAO parents. It MUST NOT unicast the DAO to nodes that are 2862 not DAO parents. 2864 4. When a node removes a node from its DAO parent set, it SHOULD 2865 send a No-Path DAO (Section 5.4.3) to that removed DAO parent to 2866 invalidate the existing route. 2868 5. If messages to an advertised downwards address suffer from a 2869 forwarding error, neighbor unreachable detected (NUD), or similar 2870 failure, a node MAY mark the address as unreachable and generate 2871 an appropriate No-Path DAO. 2873 DAOs advertise what destination addresses and prefixes a node has 2874 routes to. Unlike in non-storing mode, these DAOs do not communicate 2875 information about the routes themselves: that information is stored 2876 within the network and is implicit from the IPv6 source address. 2877 When a storing node generates a DAO, it uses the stored state of DAOs 2878 it has received to produce a set of RPL Target options and their 2879 associated Transmit Information options. 2881 Because this information is stored within a network, in storing mode 2882 DAOs are communicated directly to DAO parents, who store this 2883 information. 2885 8.9. Path Control 2887 A DAO message from a node contains one or more Target Options. Each 2888 Target Option specifies either the node's prefix, a prefix of 2889 addresses reachable outside the LLN, or a destination in the node's 2890 sub-DODAG. The Path Control field of the Transit Information option 2891 allows nodes to request multiple downward routes. A node constructs 2892 the Path Control field of a Transit Information option as follows: 2894 1. The bit width of the path control field MUST be equal to the 2895 value (PCS + 1), where PCS is specified in the control field of 2896 the DODAG Configuration Option. Bits greater than or equal to 2897 the value (PCS + 1) MUST be cleared on transmission and MUST be 2898 ignored on reception. Bits below that value are considered 2899 "active" bits. 2901 2. For a RPL Target option describing a node's own address or a 2902 prefix outside the LLN, at least one active bit of the Path 2903 Control field MUST be set. More active bits of the Path Control 2904 field MAY be set. 2906 3. If a node receives multiple DAOs with the same RPL Target option, 2907 it MUST bitwise-OR the Path Control fields it receives. This 2908 aggregated bitwise-OR represents the number of downward routes 2909 the prefix requests. 2911 4. When a node sends a DAO to one of its DAO parents, it MUST select 2912 one or more of the set, active bits in the aggregated Path 2913 Control field. The DAO it transmits to its parent MUST have 2914 these active bits set and all other active bits cleared. 2916 5. For the RPL Target option and DAOSequence number, the DAOs a node 2917 sends to different DAO parents MUST have disjoint sets of active 2918 Path Control bits. A node MUST NOT set the same active bit on 2919 DAOs to two different DAO parents. 2921 6. Path control bits SHOULD be allocated in order of preference, 2922 such that the most significant bits, or groupings of bits, are 2923 allocated to the most preferred DAO parents as determined by the 2924 node. 2926 7. In a non-storing mode of operation, a node MAY pass DAOs through 2927 without performing any further processing on the Path Control 2928 field. 2930 8. A node MUST NOT unicast a DAO that has no active bits in the Path 2931 Control field set. 2933 The Path Control field allows a node to bound how many downward 2934 routes will be generated to it. It sets a number of bits in the Path 2935 Control field equal to the maximum number of downward routes it 2936 prefers. Each bit is sent to at most one DAO parent; clusters of 2937 bits can be sent to a single DAO parent for it to divide among its 2938 own DAO parents. 2940 8.10. Multicast Destination Advertisement Messages 2942 A special case of DAO operation, distinct from unicast DAO operation, 2943 is multicast DAO operation which may be used to populate '1-hop' 2944 routing table entries. 2946 1. A node MAY multicast a DAO message to the link-local scope all- 2947 nodes multicast address FF02::1. 2949 2. A multicast DAO message MUST be used only to advertise 2950 information about self, i.e. prefixes directly connected to or 2951 owned by this node, such as a multicast group that the node is 2952 subscribed to or a global address owned by the node. 2954 3. A multicast DAO message MUST NOT be used to relay connectivity 2955 information learned (e.g. through unicast DAO) from another node. 2957 4. Information obtained from a multicast DAO MAY be installed in the 2958 routing table and MAY be propagated by a node in unicast DAOs. 2960 5. A node MUST NOT perform any other DAO related processing on a 2961 received multicast DAO, in particular a node MUST NOT perform the 2962 actions of a DAO parent upon receipt of a multicast DAO. 2964 o The multicast DAO may be used to enable direct P2P communication, 2965 without needing the RPL routing structure to relay the packets. 2967 o The multicast DAO does not presume any DODAG relationship between 2968 the emitter and the receiver. 2970 9. Security Mechanisms 2972 This section describes the generation and processing of secure RPL 2973 messages. The high order bit of the RPL message code identifies 2974 whether a RPL message is secure or not. In addition to secure 2975 versions of basic control messages (DIS, DIO, DAO, DAO-Ack), RPL has 2976 several messages which are relevant only in networks with security 2977 enabled. 2979 9.1. Security Overview 2981 RPL supports three security modes: 2983 o Insecure. In this security mode, RPL uses insecure DIS, DIO, DAO, 2984 and DAO-Ack messages. 2986 o Pre-installed. In this security mode, RPL uses secure messages. 2987 To join a RPL Instance, a node must have a pre-installed key. 2988 Nodes use this to provide message confidentiality, integrity, and 2989 authenticity. A node may, using this preinstalled key, join the 2990 RPL network as either a host or a router. 2992 o Authenticated. In this security mode, RPL uses secure messages. 2993 To join a RPL Instance, a node must have a pre-installed key. 2994 Node use this key to provide message confidentiality, integrity, 2995 and authenticity. Using this preinstalled key, a node may join 2996 the network as a host only. To join the network as a router, a 2997 node must obtain a second key from a key authority. This key 2998 authority can authenticate that the requester is allowed to be a 2999 router before providing it with the second key. 3001 Whether or not the RPL Instance uses insecure mode is signaled by 3002 whether it uses secure RPL messages. Whether a secured network uses 3003 the pre-installed or authenticated mode is signaled by the 'A' bit of 3004 the DAG Configuration option. 3006 RPL uses CCM* -- Counter with CBC-MAC (Cipher Block Chaining Message 3007 Authentication Code) -- as the cryptographic basis for its 3008 security[RFC3610]. In this specification, CCM uses AES-128 as its 3009 underlying cryptographic algorithm. There are bits reserved in the 3010 security section to specify other algorithms in the future. 3012 All secured RPL messages have a message authentication code (MAC). 3013 Secured RPL messages optionally also have encryption protection for 3014 confidentiality. Secured RPL message formats support both integrated 3015 encryption/authentication schemes (e.g., CCM*) as well as schemes 3016 that separately encrypt and authenticate packets. 3018 9.2. Installing Keys 3020 Authenticated mode requires a would-be router to dynamically install 3021 new keys once they have joined a network as a host. 3023 The exact message exchange to obtain such keys is TBD. It will 3024 involve communication with a key authority, possibly, using the pre- 3025 installed shared key. The key authority can apply a security policy 3026 to decide whether to grant the would-be-router a new key. These keys 3027 may have lifetimes (start and end times) associated with them, which 3028 nodes that support timestamps (described in Section 9.4.1) can use. 3030 9.3. Joining a Secure Network 3032 RPL security assumes that a node wishing to join a secured network 3033 has been preconfigured with a shared key for communicating with 3034 neighbors and the RPL root. To join a secure RPL network, a node 3035 either listens for secure DIOs or triggers secure DIOs by sending a 3036 secure DIS. In addition to the DIO/DIS rules in Section 7, secure 3037 DIO and DIS messages have these rules: 3039 1. If sent, this initial secure DIS MUST NOT set the C bit, MUST set 3040 the KIM field to 0 (00), and MUST set the LVL field to 1 (001). 3041 The key used MUST be the preconfigured group key (Key Index 3042 0x00). 3044 2. When a node resets its Trickle timer in response to a secure DIS 3045 (Section 7.3), the next DIO it transmits MUST be a secure DIO 3046 with the same security configuration as the secure DIS. If a 3047 node receives multiple secure DIS messages before it transmits a 3048 DIO, the secure DIO MUST have the same security configuration as 3049 the last DIS it is responding to. 3051 3. When a node sends a DIO in response to a unicast secure DIS 3052 (Section 7.3), the DIO MUST be a secure DIO. 3054 The above rules allow a node to join a secured RPL Instance using the 3055 preconfigured shared key. Once a node has joined the DODAG using the 3056 preconfigured shared key, the 'A' bit of the Configuration option 3057 determines its capabilities. If the 'A' bit of the Configuration is 3058 cleared, then nodes can use this preinstalled, shared key to exchange 3059 messages normally: it can issue DIOs, DAOs, etc. 3061 If the 'A' bit of the Configuration option is set: 3063 1. A node MUST NOT advertise a Rank besides INFINITE_RANK in secure 3064 DIOs secured with Key Index 0x00. If a node receives a secure 3065 DIO that advertises a Rank besides INFINITE_RANK and is secured 3066 with Key Index 0x00, it MUST discard the message without further 3067 processing. 3069 2. Secure DAOs using Key Index 0x00 MUST NOT have a RPL Target 3070 option with a prefix besides the node's address. If a node 3071 receives a secured DAO using the preinstalled, shared key where 3072 the RPL Target option does not match the IPv6 source address, it 3073 MUST discard the secured DAO without further processing. 3075 The above rules mean that in RPL Instances where the 'A' bit is set, 3076 using Key Index 0x00 a node can join the RPL Instance as a host but 3077 not a router. A node must communicate with a key authority to obtain 3078 a key that will enable it to act as a router. Obtaining this key 3079 might require authentication on one or both ends. This message 3080 exchange is TBD. 3082 9.4. Counter and Counter Compression 3084 Every secured RPL packet has a Counter field. Depending on whether 3085 the 'C' bit is set, this Counter field can be 1 or 4 bits. RPL nodes 3086 send CC messages to force uncompressed Counter values, protect 3087 against replay attacks and synchronize counters. 3089 1. If a node is sending a secured RPL packet, and the Counter value 3090 of the packet is more than 255 greater than the last secured 3091 packet to the destination address, the node MUST NOT set the 'C' 3092 bit of the security section of the packet. 3094 2. If a node receives a secure RPL message with the C bit set and is 3095 uncertain of the 32-bit counter value, it MAY send a CC message 3096 with the R bit cleared to obtain an uncompressed counter value. 3097 The Nonce field of the CC message SHOULD be a random or 3098 pseudorandom number. 3100 3. If a node receives a unicast CC message with the R bit cleared, 3101 and it is a member of or is in the process of joining the 3102 associated DODAG, it SHOULD respond with a unicast CC message to 3103 the sender. This response MUST have the C bit of the security 3104 section cleared, MUST have the R bit set, and MUST have the same 3105 Nonce, RPLInstanceID and DODAGID fields as the message it 3106 received. 3108 4. If a node receives a multicast CC message, it MUST discard the 3109 message with no further processing. 3111 These rules allow nodes to compress the Counter when destinations who 3112 received the prior packet can determine the full counter value. If a 3113 node cannot determine the full counter value, it can request the full 3114 counter with a CC message. 3116 9.4.1. Timestamp Counters 3118 In the simplest case, the Counter value is an unsigned integer that a 3119 node increments by one or more on each secured RPL transmission. The 3120 Counter MAY represent a timestamp that has the following properties: 3122 1. The timestamp MUST be at least six octets long. 3124 2. The timestamp MUST be in 1kHz (millisecond) granularity. 3126 3. The timestamp start time MUST be January 1, 2010, 12:00:00AM UTC. 3128 4. If the Counter represents such as timestamp, the Counter value 3129 MUST be a value computed as follows. Let T be the timestamp, S 3130 be the start time of the key in use, and E be the end time of the 3131 key in use. Both S and E are represented using the same 3 rules 3132 as the timestamp described above. If E > T < S, then the Counter 3133 is invalid and a node MUST NOT generate a packet. Otherwise, the 3134 Counter value is equal to T-S. 3136 5. If the Counter represents such a timestamp, a node MAY set the 3137 'T' flag of the security section of secured RPL packets. 3139 6. If the Counter field does not present such a timestamp, then a 3140 node MUST NOT set the 'T' flag. 3142 7. If a node does not have a local timestamp that satisfies the 3143 above requirements, it MUST ignore the 'T' flag. 3145 If a node supports such timestamps and it receives a message with the 3146 'T' flag set, it MAY apply the temporal check on the received message 3147 described in Section 9.5.2.1. If a node receives a message without 3148 the 'T' flag set, it MUST NOT apply this temporal check. A node's 3149 security policy MAY, for application reasons, include rejecting all 3150 messages without the 'T' flag set. 3152 9.5. Functional Description of Packet Protection 3154 9.5.1. Transmission of Outgoing Packets 3156 Given an outgoing RPL control packet and required security 3157 protection, this section describes how RPL generates the secured 3158 packet to transmit. It also describes the order of cryptographic 3159 operations to provide the required protection. 3161 The requirement for security protection and the level of security to 3162 be applied to an outgoing RPL packet shall be determined by the 3163 node's security policy database. The configuration of this security 3164 policy database for outgoing packet processing is TBD (it may, for 3165 example, be defined through DIO Configuration or through out-of-band 3166 administrative router configuration). 3168 Where secured RPL messages are to be transmitted, a RPL node MUST set 3169 the security section (C, T, Sec, KIM, and LVL) in the outgoing RPL 3170 packet to describe the protection level and security settings that 3171 are applied (see Section 5.1). The Security subfield bit of the RPL 3172 message Code field MUST be set to indicate the secure RPL message. 3174 The Counter value used in constructing the Nonce to secure the 3175 outgoing packet MUST be an increment of the last Counter transmitted 3176 to the particular destination address. Where a Counter for the 3177 intended destination address has not been established, the Counter 3178 value MUST be initialized to zero and sent as a Full Counter for the 3179 initial RPL message transmission. 3181 Where a Counter is currently maintained for outgoing messages to the 3182 intended destination address, the Compressed Counter (indicated with 3183 the 'C' bit set) MUST be transmitted within the secured RPL message, 3184 provided the message is not a RPL Consistency Check message. The 3185 current Full Counter (indicated with the 'C' bit cleared) for the 3186 given destination address SHALL always be used when the outgoing 3187 packet is a Consistency Check (challenge or response) message. Where 3188 a Counter for the intended destination address does not exist, the 3189 initialized (zero-value), Full Counter MUST be transmitted within the 3190 initial RPL control message. Where security policy specifies the 3191 application of delay protection, the Timestamp Counter used in 3192 constructing the Nonce to secure the outgoing packet MUST be 3193 incremented according to the rules in Section 9.4.1. Where a 3194 Timestamp Counter is applied (indicated with the 'T' flag set) the 3195 locally maintained Time Counter MUST be included as part of the 3196 transmitted secured RPL message. 3198 The cryptographic algorithm used in securing the outgoing packet 3199 shall be specified by the node's security policy database and MUST be 3200 indicated in the value of the Sec field set within the outgoing 3201 message. 3203 The security policy for the outgoing packet shall determine the 3204 applicable Key Identifier Mode (KIM) and Key Identifier specifying 3205 the security key to be used for the cryptographic packet processing, 3206 including the optional use of signature keys (see Section 5.1). The 3207 security policy will also specify the level of protection (LVL) in 3208 the form of authentication or authentication and encryption, and 3209 potential use of signatures that shall apply to the outgoing packet. 3211 Where encryption is applied, a node MUST replace the original packet 3212 payload with that payload encrypted using the security protection, 3213 key, and nonce specified in the security section of the packet. 3215 All secured RPL messages include integrity protection. In 3216 conjunction with the security algorithm processing, a node derives a 3217 Message Authentication Code (MAC) that MUST be included as part of 3218 the outgoing secured RPL packet. 3220 9.5.2. Reception of Incoming Packets 3222 This section describes the reception and processing of a secured RPL 3223 packet. Given an incoming secured RPL packet, where the Security 3224 subfield bit of the RPL message Code field is set, this section 3225 describes how RPL generates an unencrypted version of the packet and 3226 validates its integrity. 3228 The receiver uses the RPL security control fields to determine the 3229 necessary packet security processing. If the described level of 3230 security for the message type and originator does not meet locally 3231 maintained security policies, a node MAY discard the packet without 3232 further processing. These policies can include security levels, keys 3233 used, source identifiers, or the lack of timestamp-based counters (as 3234 indicated by the 'T' flag). The configuration of the security policy 3235 database for incoming packet processing is TBD (it may, for example, 3236 be defined through DIO Configuration or through out-of-band 3237 administrative router configuration). 3239 Where the message security level (LVL) indicates an encrypted RPL 3240 message, the node uses the key information identified through the KIM 3241 field as well as the Nonce as input to the message payload decryption 3242 processing. The Nonce shall be derived from the message Counter 3243 field and other received and locally maintained information (see 3244 Section 9.5.3.1). The plaintext message contents shall be obtained 3245 by invoking the inverse cryptographic mode of operation specified by 3246 the Sec field of the received packet. 3248 The receiver shall use the Nonce and identified key information to 3249 check the integrity of the incoming packet. If the integrity check 3250 fails against the received message authentication code (MAC), a node 3251 MUST discard the packet. 3253 If a Compressed Counter is received and the node does not currently 3254 have an incoming Counter currently maintained for the originator of 3255 the message, the node MUST send a Consistency Check request to the 3256 message source to update the Counters. 3258 If an initialized (zero value) Full Counter is received in a secured 3259 RPL message and the receiving node currently has an incoming Counter 3260 currently maintained for the originator of the message, the node MUST 3261 initiate a Counter resynchronization by sending a Consistency Check 3262 response message (see Section 5.6.1) to the message source. The 3263 Consistency Check response message shall be protected with the 3264 current full outgoing Counter maintained for the particular node 3265 address. That outgoing Counter will be included within the security 3266 section of the message while the incoming Counter will be included 3267 within the Consistency Check message payload. 3269 Based on the specified security policy a node MAY apply replay 3270 protection for a received RPL message. The replay check MUST be 3271 performed following the authentication of the received packet. The 3272 full Counter, as obtained from the incoming packet or as derived from 3273 the received Compressed Counter shall be compared against the 3274 watermark of the incoming Counter maintained for the given 3275 origination node address. If the received message Counter value is 3276 non-zero and less than the maintained incoming Counter watermark a 3277 potential packet replay is indicated and the node MUST discard the 3278 incoming packet. 3280 If delay protection is specified as part of the incoming packet 3281 security policy checks, the Timestamp Counter is used to validate the 3282 timeliness of the received RPL message. If the incoming message 3283 Timestamp Counter value indicates a message transmission time prior 3284 to the locally maintained transmission time Counter for the 3285 originator address, a replay violation is indicated and the node MUST 3286 discard the incoming packet. If the received Timestamp Counter value 3287 indicates a message transmission time that is earlier than the 3288 Current time less the acceptable packet delay, a delay violation is 3289 indicated and the node MUST discard the incoming packet. 3291 Once a message has been decrypted, where applicable, and has 3292 successfully passed its integrity check, replay, and optionally delay 3293 protection checks, the node can update its local security 3294 information, such as the source's expected Counter value for counter 3295 compression and replay comparison. 3297 A node MUST NOT update its security information on receipt of a 3298 message that fails security policy checks or other applied integrity, 3299 replay, or delay checks. 3301 9.5.2.1. Timestamp Key Checks 3303 If the 'T' flag of a message is set and a node has a local timestamp 3304 that follows the requirements in Section 9.4.1, then a node MAY check 3305 the temporal consistency of the message. The node computes the 3306 transmit time of the message by adding the Counter value to the start 3307 time of the associated key. If this transmit time is past the end 3308 time of the key, the node MAY discard the message without further 3309 processing. If the transmit time is too far in the past or future 3310 compared to the local time on the receiver, it MAY discard the 3311 message without further processing. 3313 9.5.3. Cryptographic Mode of Operation 3315 The cryptographic mode of operation used is based on the CCM mode of 3316 operation and the block-cipher AES-128[RFC3610]. This mode of 3317 operation is widely supported by existing implementations and 3318 coincides with the CCM* mode of operation[CCMStar]. CCM mode 3319 requires a nonce. 3321 9.5.3.1. Nonce 3323 A RPL node constructs a CCM nonce as follows: 3325 0 1 2 3 3326 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 3327 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3328 | | 3329 + Source Identifier + 3330 | | 3331 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3332 | Counter | 3333 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3334 |Reserved | LVL | 3335 +-+-+-+-+-+-+-+-+ 3337 Figure 24: CCM* Nonce 3339 Source Identifier: 8 bytes. Source Identifier is set to the logical 3340 identifier of the originator of the protected packet. 3342 Counter: 4 bytes. Counter is set to the (uncompressed) value of the 3343 corresponding field in the Security option of the RPL control 3344 message. 3346 Security Level (LVL): 3 bits. Security Level is set to the value of 3347 the corresponding field in the Security option of the RPL 3348 control message. 3350 Unassigned bits of the nonce are reserved. They MUST be set to zero 3351 when constructing the nonce. 3353 All fields of the nonce shall be represented is most-significant- 3354 octet and most-significant-bit first order. 3356 9.5.3.2. Signatures 3358 If the Key Identification Mode (KIM) mode indicates the use of 3359 signatures (a value of 3), then a node appends a signature to the 3360 data payload of the packet. The Security Level (LVL) field describes 3361 the length of this signature. 3363 The signature scheme in RPL for Security Mode 00 is an instantiation 3364 of the ECPVS signature scheme[X9.92]. It uses as an elliptic curve 3365 the named curve K-283[X9.92]. It uses CCM* mode[CCMStar] as the 3366 encryption scheme with M=0 (as a stream-cipher). It uses the Matyas- 3367 Meyer-Oseas unkeyed hash function[AppliedCryptography]. It uses the 3368 key derivation function based on this unkeyed hash function specified 3369 in Section 5.6.3 of [X9.63-2001], and the message encoding rule of 3370 Section 7.8 or ANSI X9.92 [X9.92]. PadLen is a non-negative integer 3371 set to M-OctCurve, where OctCurve is the byte-length of the curve in 3372 question (with K-283, one has OctCurve=36). 3374 Let 'a' be a concatenation of a six-byte representation of Counter 3375 and the message header. The packet payload is a concatenation of 3376 packet data 'c' and the signature 's'. This signature scheme is 3377 invoked with visible and recoverable message parts a and c, whereas 3378 the signature verification is invoked with as received visible and 3379 message representative a, c, and with signature s. 3381 9.6. Coverage of Integrity and Confidentiality 3383 For a RPL ICMPv6 message, the entire packet is within the scope of 3384 RPL security. The message authentication code is calculated over the 3385 entire IPv6 packet. This calculation is done before any compression 3386 that lower layers may apply. The IPv6 and ICMPv6 headers are never 3387 encrypted. The body of the RPL ICMPv6 message MAY be encrypted, 3388 starting from the first byte after the security section and 3389 continuing to the end of the packet. 3391 10. Packet Forwarding and Loop Avoidance/Detection 3393 10.1. Suggestions for Packet Forwarding 3395 When forwarding a packet to a destination, precedence is given to 3396 selection of a next-hop successor as follows: 3398 1. This specification only covers how a successor is selected from 3399 the DODAG version that matches the RPLInstanceID marked in the 3400 IPv6 header of the packet being forwarded. Routing outside the 3401 instance can be done as long as additional rules are put in place 3402 such as strict ordering of instances and routing protocols to 3403 protect against loops. 3405 2. If a local administrative preference favors a route that has been 3406 learned from a different routing protocol than RPL, then use that 3407 successor. 3409 3. If the packet header specifies a source route, then use that 3410 route [I-D.hui-6man-rpl-routing-header]. If the node fails to 3411 forward the packet with that specified source route, then that 3412 packet SHOULD be dropped. The node MAY log an error. The node 3413 MAY send an ICMPv6 Error in Source Routing Header message to the 3414 source of the packet Section 18.6. 3416 4. If there is an entry in the routing table matching the 3417 destination that has been learned from a multicast destination 3418 advertisement (e.g. the destination is a one-hop neighbor), then 3419 use that successor. 3421 5. If there is an entry in the routing table matching the 3422 destination that has been learned from a unicast destination 3423 advertisement (e.g. the destination is located down the sub- 3424 DODAG), then use that successor. If there are DAO Path Control 3425 bits associated with multiple successors, then consult the Path 3426 Control bits to order the successors by preference when choosing. 3428 6. If there is a DODAG version offering a route to a prefix matching 3429 the destination, then select one of those DODAG parents as a 3430 successor according to the OF and routing metrics. 3432 7. Any other as-yet-unattempted DODAG parent may be chosen for the 3433 next attempt to forward a unicast packet when no better match 3434 exists. 3436 8. Finally the packet is dropped. ICMP Destination Unreachable may 3437 be invoked (an inconsistency is detected). 3439 TTL must be decremented when forwarding. 3441 Note that the chosen successor MUST NOT be the neighbor that was the 3442 predecessor of the packet (split horizon), except in the case where 3443 it is intended for the packet to change from an up to an down flow, 3444 such as switching from DIO routes to DAO routes as the destination is 3445 neared. 3447 10.2. Loop Avoidance and Detection 3449 RPL loop avoidance mechanisms are kept simple and designed to 3450 minimize churn and states. Loops may form for a number of reasons, 3451 e.g. control packet loss. RPL includes a reactive loop detection 3452 technique that protects from meltdown and triggers repair of broken 3453 paths. 3455 RPL loop detection uses information that is placed into the packet. 3456 A future version of this specification will detail how this 3457 information is carried with the packet (e.g. a hop-by-hop option 3458 ([I-D.hui-6man-rpl-option]) or summarized somehow into the flow 3459 label). For the purpose of RPL operations, the information carried 3460 with a packet is constructed follows: 3462 0 1 2 3 3463 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 3464 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3465 |O|R|F|0|0|0|0|0| RPLInstanceID | SenderRank | 3466 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 3468 RPL Packet Information 3470 Down 'O' bit: 1-bit flag indicating whether the packet is expected 3471 to progress up or down. A router sets the 'O' bit when the 3472 packet is expect to progress down (using DAO routes), and 3473 resets it when forwarding towards the root of the DODAG 3474 version. A host or RPL leaf node MUST set the bit to 0. 3476 Rank-Error 'R' bit: 1-bit flag indicating whether a rank error was 3477 detected. A rank error is detected when there is a mismatch in 3478 the relative ranks and the direction as indicated in the 'O' 3479 bit. A host or RPL leaf node MUST set the bit to 0. 3481 Forwarding-Error 'F' bit: 1-bit flag indicating that this node can 3482 not forward the packet further towards the destination. The 3483 'F' bit might be set by a child node that does not have a route 3484 to destination for a packet with the down 'O' bit set. A host 3485 or RPL leaf node MUST set the bit to 0. 3487 RPLInstanceID: 8-bit field indicating the DODAG instance along which 3488 the packet is sent. 3490 SenderRank: 16-bit field set to zero by the source and to 3491 DAGRank(rank) by a router that forwards inside the RPL network. 3493 10.2.1. Source Node Operation 3495 If the source is aware of the RPLInstanceID that is preferred for the 3496 packet, then it MUST set the RPLInstanceID field associated with the 3497 packet accordingly, otherwise it MUST set it to the 3498 RPL_DEFAULT_INSTANCE. 3500 10.2.2. Router Operation 3502 10.2.2.1. Instance Forwarding 3504 Instance IDs are used to avoid loops between DODAGs from different 3505 origins. DODAGs that constructed for antagonistic constraints might 3506 contain paths that, if mixed together, would yield loops. Those 3507 loops are avoided by forwarding a packet along the DODAG that is 3508 associated to a given instance. 3510 The RPLInstanceID is associated by the source with the packet. This 3511 RPLInstanceID MUST match the RPL Instance onto which the packet is 3512 placed by any node, be it a host or router. For traffic originating 3513 outside of the RPL domain there may be a mapping occurring at the 3514 gateway into the RPL domain, possibly based on an encoding within the 3515 flow label. This aspect of RPL operation is to be clarified in a 3516 future version of this specification. 3518 The source of the packet might be aware of the RPL network, of the 3519 constraints imposed on OFs, and of associated Instance IDs. In that 3520 case, the source of the packet MAY tag the flow label with the 3521 RPLInstanceID, in which case it is used in that form within the RPL 3522 network. 3524 A router that injects a data packet into the RPL network MUST tag the 3525 packet by inserting a RPL Hop-by-hop option as specified in 3526 [I-D.hui-6man-rpl-option]. If the RPLInstanceID is not present in 3527 flow label of the data packet, the ingress router that injects the 3528 packet into the RPL network MUST add a RPLInstanceID field to the RPL 3529 Hop-by-hop option. 3531 A router that forwards a packet to outside the RPL network MUST 3532 remove the RPL Hop-by-hop option. 3534 When a router receives a packet that specifies a given RPLInstanceID 3535 and the node can forward the packet along the DODAG associated to 3536 that instance, then the router MUST do so and leave the RPLInstanceID 3537 value unchanged. 3539 If any node can not forward a packet along the DODAG associated to 3540 the RPLInstanceID, then the node SHOULD discard the packet and send 3541 an ICMP error message. 3543 10.2.2.2. DAG Inconsistency Loop Detection 3545 The DODAG is inconsistent if the direction of a packet does not match 3546 the rank relationship. A receiver detects an inconsistency if it 3547 receives a packet with either: 3549 the 'O' bit set (to down) from a node of a higher rank. 3551 the 'O' bit reset (for up) from a node of a lesser rank. 3553 When the DODAG root increments the DODAGVersionNumber a temporary 3554 rank discontinuity may form between the next version and the prior 3555 version, in particular if nodes are adjusting their rank in the next 3556 version and deferring their migration into the next version. A 3557 router that is still a member of the prior version may choose to 3558 forward a packet to a (future) parent that is in the next version. 3559 In some cases this could cause the parent to detect an inconsistency 3560 because the rank-ordering in the prior version is not necessarily the 3561 same as in the next version and the packet may be judged to not be 3562 making forward progress. If the sending router is aware that the 3563 chosen successor has already joined the next version, then the 3564 sending router MUST update the SenderRank to INFINITE_RANK as it 3565 forwards the packets across the discontinuity into the next DODAG 3566 version in order to avoid a false detection of rank inconsistency. 3568 One inconsistency along the path is not considered as a critical 3569 error and the packet may continue. But a second detection along the 3570 path of a same packet should not occur and the packet is dropped. 3572 This process is controlled by the Rank-Error bit associated with the 3573 packet. When an inconsistency is detected on a packet, if the Rank- 3574 Error bit was not set then the Rank-Error bit is set. If it was set 3575 the packet is discarded and the trickle timer is reset. 3577 10.2.2.3. DAO Inconsistency Loop Detection and Recovery 3579 A DAO inconsistency happens when router that has an down DAO route 3580 via a child that is a remnant from an obsolete state that is not 3581 matched in the child. With DAO inconsistency loop recovery, a packet 3582 can be used to recursively explore and cleanup the obsolete DAO 3583 states along a sub-DODAG. 3585 In a general manner, a packet that goes down should never go up 3586 again. If DAO inconsistency loop recovery is applied, then the 3587 router SHOULD send the packet back to the parent that passed it with 3588 the Forwarding-Error 'F' bit set and the 'O' bit left untouched. 3589 Otherwise the router MUST silently discard the packet. 3591 10.2.2.4. Forward Path Recovery 3593 Upon receiving a packet with a Forwarding-Error bit set, the node 3594 MUST remove the routing states that caused forwarding to that 3595 neighbor, clear the Forwarding-Error bit and attempt to send the 3596 packet again. The packet may be sent to an alternate neighbor. If 3597 that alternate neighbor still has an inconsistent DAO state via this 3598 node, the process will recurse, this node will set the Forwarding- 3599 Error 'F' bit and the routing state in the alternate neighbor will be 3600 cleaned up as well. 3602 11. Multicast Operation 3604 This section describes further the multicast routing operations over 3605 an IPv6 RPL network, and specifically how unicast DAOs can be used to 3606 relay group registrations up. Wherever the following text mentions 3607 Multicast Listener Discovery (MLD), one can read MLDv1 ([RFC2710]) or 3608 MLDv2 ([RFC3810]). 3610 Nodes that support the RPL storing mode of operation SHOULD also 3611 support multicast DAO operations as described below. Nodes that only 3612 support the non-storing mode of operation are not expected to support 3613 this section. 3615 The multicast operation is controlled by the MOP field in the DIO. 3617 If the MOP field requires multicast support, then a node that 3618 joins the RPL network as a router must operate as described in 3619 this section for multicast signaling and forwarding within the RPL 3620 network. A node that does not support the multicast operation 3621 required by the MOP field can only join as a leaf. 3623 If the MOP field does not require multicast support, then 3624 multicast is handled by some other way that is out of scope for 3625 this specification. (Examples may include as a series of unicast 3626 copies or limited-scope flooding) 3628 As is traditional, a listener uses a protocol such as MLD with a 3629 router to register to a multicast group. 3631 Along the path between the router and the DODAG root, MLD requests 3632 are mapped and transported as DAO messages within the RPL protocol; 3633 each hop coalesces the multiple requests for a same group as a single 3634 DAO message to the parent(s), in a fashion similar to proxy IGMP, but 3635 recursively between child router and parent up to the root. 3637 A router might select to pass a listener registration DAO message to 3638 its preferred parent only, in which case multicast packets coming 3639 back might be lost for all of its sub-DODAG if the transmission fails 3640 over that link. Alternatively the router might select to copy 3641 additional parents as it would do for DAO messages advertising 3642 unicast destinations, in which case there might be duplicates that 3643 the router will need to prune. 3645 As a result, multicast routing states are installed in each router on 3646 the way from the listeners to the root, enabling the root to copy a 3647 multicast packet to all its children routers that had issued a DAO 3648 message including a DAO for that multicast group, as well as all the 3649 attached nodes that registered over MLD. 3651 For unicast traffic, it is expected that the grounded root of an 3652 DODAG terminates RPL and MAY redistribute the RPL routes over the 3653 external infrastructure using whatever routing protocol is used in 3654 the other routing domain. For multicast traffic, the root MAY proxy 3655 MLD for all the nodes attached to the RPL domain (this would be 3656 needed if the multicast source is located in the external 3657 infrastructure). For such a source, the packet will be replicated as 3658 it flows down the DODAG based on the multicast routing table entries 3659 installed from the DAO message. 3661 For a source inside the DODAG, the packet is passed to the preferred 3662 parents, and if that fails then to the alternates in the DODAG. The 3663 packet is also copied to all the registered children, except for the 3664 one that passed the packet. Finally, if there is a listener in the 3665 external infrastructure then the DODAG root has to further propagate 3666 the packet into the external infrastructure. 3668 As a result, the DODAG Root acts as an automatic proxy Rendezvous 3669 Point for the RPL network, and as source towards the Internet for all 3670 multicast flows started in the RPL LLN. So regardless of whether the 3671 root is actually attached to the Internet, and regardless of whether 3672 the DODAG is grounded or floating, the root can serve inner multicast 3673 streams at all times. 3675 12. Maintenance of Routing Adjacency 3677 The selection of successors, along the default paths up along the 3678 DODAG, or along the paths learned from destination advertisements 3679 down along the DODAG, leads to the formation of routing adjacencies 3680 that require maintenance. 3682 In IGPs such as OSPF [RFC4915] or IS-IS [RFC5120], the maintenance of 3683 a routing adjacency involves the use of Keepalive mechanisms (Hellos) 3684 or other protocols such as BFD ([RFC5880]) and MANET Neighborhood 3685 Discovery Protocol (NHDP [I-D.ietf-manet-nhdp]). Unfortunately, such 3686 an approach is not desirable in constrained environments such as LLN 3687 and would lead to excessive control traffic in light of the data 3688 traffic with a negative impact on both link loads and nodes 3689 resources. Overhead to maintain the routing adjacency should be 3690 minimized. Furthermore, it is not always possible to rely on the 3691 link or transport layer to provide information of the associated link 3692 state. The network layer needs to fall back on its own mechanism. 3694 Thus RPL makes use of a different approach consisting of probing the 3695 neighbor using a Neighbor Solicitation message (see [RFC4861]). The 3696 reception of a Neighbor Advertisement (NA) message with the 3697 "Solicited Flag" set is used to verify the validity of the routing 3698 adjacency. Such mechanism MAY be used prior to sending a data 3699 packet. This allows for detecting whether or not the routing 3700 adjacency is still valid, and should it not be the case, select 3701 another feasible successor to forward the packet. 3703 13. Guidelines for Objective Functions 3705 An Objective Function (OF) allows for the selection of a DODAG to 3706 join, and a number of peers in that DODAG as parents. The OF is used 3707 to compute an ordered list of parents. The OF is also responsible to 3708 compute the rank of the device within the DODAG version. 3710 The Objective Function is indicated in the DIO message using an 3711 Objective Code Point (OCP), and indicates the method that must be 3712 used to construct the DODAG. The Objective Code Points are specified 3713 in [I-D.ietf-roll-of0], and related companion specifications. 3715 13.1. Objective Function Behavior 3717 Most Objective Functions are expected to follow the same abstract 3718 behavior: 3720 o The parent selection is triggered each time an event indicates 3721 that a potential next hop information is updated. This might 3722 happen upon the reception of a DIO message, a timer elapse, all 3723 DODAG parents are unavailable, or a trigger indicating that the 3724 state of a candidate neighbor has changed. 3726 o An OF scans all the interfaces on the device. Although there may 3727 typically be only one interface in most application scenarios, 3728 there might be multiple of them and an interface might be 3729 configured to be usable or not for RPL operation. An interface 3730 can also be configured with a preference or dynamically learned to 3731 be better than another by some heuristics that might be link-layer 3732 dependent and are out of scope. Finally an interface might or not 3733 match a required criterion for an Objective Function, for instance 3734 a degree of security. As a result some interfaces might be 3735 completely excluded from the computation, while others might be 3736 more or less preferred. 3738 o An OF scans all the candidate neighbors on the possible interfaces 3739 to check whether they can act as a router for a DODAG. There 3740 might be multiple of them and a candidate neighbor might need to 3741 pass some validation tests before it can be used. In particular, 3742 some link layers require experience on the activity with a router 3743 to enable the router as a next hop. 3745 o An OF computes self's rank by adding to the rank of the candidate 3746 a value representing the relative locations of self and the 3747 candidate in the DODAG version. 3749 * The increase in rank must be at least MinHopRankIncrease. 3751 * To keep loop avoidance and metric optimization in alignment, 3752 the increase in rank should reflect any increase in the metric 3753 value. For example, with a purely additive metric such as ETX, 3754 the increase in rank can be made proportional to the increase 3755 in the metric. 3757 * Candidate neighbors that would cause self's rank to increase 3758 are not considered for parent selection 3760 o Candidate neighbors that advertise an OF incompatible with the set 3761 of OF specified by the policy functions are ignored. 3763 o As it scans all the candidate neighbors, the OF keeps the current 3764 best parent and compares its capabilities with the current 3765 candidate neighbor. The OF defines a number of tests that are 3766 critical to reach the objective. A test between the routers 3767 determines an order relation. 3769 * If the routers are equal for that relation then the next test 3770 is attempted between the routers, 3772 * Else the best of the two routers becomes the current best 3773 parent and the scan continues with the next candidate neighbor 3775 * Some OFs may include a test to compare the ranks that would 3776 result if the node joined either router 3778 o When the scan is complete, the preferred parent is elected and 3779 self's rank is computed as the preferred parent rank plus the step 3780 in rank with that parent. 3782 o Other rounds of scans might be necessary to elect alternate 3783 parents. In the next rounds: 3785 * Candidate neighbors that are not in the same DODAG are ignored 3787 * Candidate neighbors that are of greater rank than self are 3788 ignored 3790 * Candidate neighbors of an equal rank to self are ignored for 3791 parent selection 3793 * Candidate neighbors of a lesser rank than self are preferred 3795 14. Suggestions for Interoperation with Neighbor Discovery 3797 This specification directly borrows the Prefix Information Option 3798 (PIO) and the Routing Information Option (RIO) from IPv6 ND. It is 3799 envisioned that as future specifications build on this base that 3800 there may be additional cause to leverage parts of IPv6 ND. This 3801 section provides some suggestions for future specifications. 3803 First and foremost RPL is a routing protocol. One should take great 3804 care to preserve architecture when mapping functionalities between 3805 RPL and ND. RPL is for routing only. That said, there may be 3806 persuading technical reasons to allow for sharing options between RPL 3807 and IPv6 ND in a particular implementation/deployment. 3809 In general the following guidelines apply: 3811 o RPL Type codes must be allocated from the RPL Control Message 3812 Options registry. 3814 o RPL Length fields must be expressed in units of single octets, as 3815 opposed to ND Length fields which are expressed in units of 8 3816 octets. 3818 o RPL Options are generally not required to be aligned to 8 octet 3819 boundaries. 3821 o When mapping/transposing an IPv6 ND option for redistribution as a 3822 RPL option, any padding octets should be removed when possible. 3823 For example, the Prefix Length field in the PIO is sufficient to 3824 describe the length of the Prefix field. When mapping/transposing 3825 a RPL option for redistribution as an IPv6 ND option, any such 3826 padding octets should be restored. This procedure must be 3827 unambiguous. 3829 15. RPL Constants and Variables 3831 Following is a summary of RPL constants and variables: 3833 BASE_RANK This is the rank for a virtual root that might be used to 3834 coordinate multiple roots. BASE_RANK has a value of 0. 3836 ROOT_RANK This is the rank for a DODAG root. ROOT_RANK has a value 3837 of MinHopRankIncrease (as advertised by the DODAG root), such 3838 that DAGRank(ROOT_RANK) is 1. 3840 INFINITE_RANK This is the constant maximum for the rank. 3841 INFINITE_RANK has a value of 0xFFFF. 3843 RPL_DEFAULT_INSTANCE This is the RPLInstanceID that is used by this 3844 protocol by a node without any overriding policy. 3845 RPL_DEFAULT_INSTANCE has a value of 0. 3847 DEFAULT_PATH_CONTROL_SIZE This is the default value used to 3848 configure PCS in the DODAG Configuration Option, which dictates 3849 the number of significant bits in the Path Control field of the 3850 Transit Information option. DEFAULT_PATH_CONTROL_SIZE has a 3851 value of 0. This configures the simplest case-- limiting the 3852 fan-out to 1 and limiting a node to send a DAO message to only 3853 one parent. 3855 DEFAULT_DIO_INTERVAL_MIN This is the default value used to configure 3856 Imin for the DIO trickle timer. DEFAULT_DIO_INTERVAL_MIN has a 3857 value of 3. This configuration results in Imin of 8ms. 3859 DEFAULT_DIO_INTERVAL_DOUBLINGS This is the default value used to 3860 configure Imax for the DIO trickle timer. 3861 DEFAULT_DIO_INTERVAL_DOUBLINGS has a value of 20. This 3862 configuration results in a maximum interval of 2.3 hours. 3864 DEFAULT_DIO_REDUNDANCY_CONSTANT This is the default value used to 3865 configure k for the DIO trickle timer. 3866 DEFAULT_DIO_REDUNDANCY_CONSTANT has a value of 10. This 3867 configuration is a conservative value for trickle suppression 3868 mechanism. 3870 DEFAULT_MIN_HOP_RANK_INCREASE This is the default value of 3871 MinHopRankIncrease. DEFAULT_MIN_HOP_RANK_INCREASE has a value 3872 of 256. This configuration results in an 8-bit wide integer 3873 part of Rank. 3875 DIO Timer One instance per DODAG that a node is a member of. Expiry 3876 triggers DIO message transmission. Trickle timer with variable 3877 interval in [0, DIOIntervalMin..2^DIOIntervalDoublings]. See 3878 Section 7.3.1 3880 DAG Version Increment Timer Up to one instance per DODAG that the 3881 node is acting as DODAG root of. May not be supported in all 3882 implementations. Expiry triggers increment of 3883 DODAGVersionNumber, causing a new series of updated DIO message 3884 to be sent. Interval should be chosen appropriate to 3885 propagation time of DODAG and as appropriate to application 3886 requirements (e.g. response time vs. overhead). 3888 DelayDAO Timer Up to one instance per DAO parent (the subset of 3889 DODAG parents chosen to receive destination advertisements) per 3890 DODAG. Expiry triggers sending of DAO message to the DAO 3891 parent. See Section 8.4 3893 RemoveTimer Up to one instance per DAO entry per neighbor (i.e. 3894 those neighbors that have given DAO messages to this node as a 3895 DODAG parent) Expiry triggers a change in state for the DAO 3896 entry, setting up to do unreachable (No-Path) advertisements or 3897 immediately deallocating the DAO entry if there are no DAO 3898 parents. 3900 16. Manageability Considerations 3902 The aim of this section is to give consideration to the manageability 3903 of RPL, and how RPL will be operated in a LLN. The scope of this 3904 section is to consider the following aspects of manageability: 3905 configuration, monitoring, fault management, accounting, and 3906 performance of the protocol in light of the recommendations set forth 3907 in [RFC5706]. 3909 16.1. Introduction 3911 Most of the existing IETF management standards are Structure of 3912 Management Information (SMI) based data models (MIB modules) to 3913 monitor and manage networking devices. 3915 For a number of protocols, the IETF community has used the IETF 3916 Standard Management Framework, including the Simple Network 3917 Management Protocol [RFC3410], the Structure of Management 3918 Information [RFC2578], and MIB data models for managing new 3919 protocols. 3921 As pointed out in [RFC5706], the common policy in terms of operation 3922 and management has been expanded to a policy that is more open to a 3923 set of tools and management protocols rather than strictly relying on 3924 a single protocol such as SNMP. 3926 In 2003, the Internet Architecture Board (IAB) held a workshop on 3927 Network Management [RFC3535] that discussed the strengths and 3928 weaknesses of some IETF network management protocols and compared 3929 them to operational needs, especially configuration. 3931 One issue discussed was the user-unfriendliness of the binary format 3932 of SNMP [RFC3410]. In the case of LLNs, it must be noted that at the 3933 time of writing, the CoRE Working Group is actively working on 3934 resource management of devices in LLNs. Still, it is felt that this 3935 section provides important guidance on how RPL should be deployed, 3936 operated, and managed. 3938 As stated in [RFC5706], "A management information model should 3939 include a discussion of what is manageable, which aspects of the 3940 protocol need to be configured, what types of operations are allowed, 3941 what protocol-specific events might occur, which events can be 3942 counted, and for which events an operator should be notified". These 3943 aspects are discussed in detail in the following sections. 3945 RPL will be used on a variety of devices that may have resources such 3946 as memory varying from a very few Kbytes to several hundreds of 3947 Kbytes and even Mbytes. When memory is highly constrained, it may 3948 not be possible to satisfy all the requirements listed in this 3949 section. Still it is worth listing all of these in an exhaustive 3950 fashion, and implementers will then determine which of these 3951 requirements could be satisfied according to the available resources 3952 on the device. 3954 16.2. Configuration Management 3956 16.2.1. Initialization Mode 3958 "Architectural Principles of the Internet" [RFC1958], Section 3.8, 3959 states: "Avoid options and parameters whenever possible. Any options 3960 and parameters should be configured or negotiated dynamically rather 3961 than manually. This especially true in LLNs where the number of 3962 devices may be large and manual configuration is infeasible. This 3963 has been taken into account in the design of RPL whereby the DODAG 3964 root provides a number of parameters to the devices joining the 3965 DODAG, thus avoiding cumbersome configuration on the routers and 3966 potential sources of misconfiguration (e.g. values of trickle timers, 3967 ...). Still there are additional RPL parameters that a RPL 3968 implementation should allow to be configured, which are discussed in 3969 this section. 3971 16.2.1.1. DIS mode of operation upon boot-up 3973 When a node is first powered up: 3975 1. The node may decide to stay silent, waiting to receive DIO 3976 messages from DODAG of interest (advertising a supported OF and 3977 metrics/constraints) and not send any multicast DIO messages 3978 until it has joined a DODAG. 3980 2. The node may decide to send one or more DIS messages (optionally 3981 requesting DIO for a specific DODAG) message as an initial probe 3982 for nearby DODAGs, and in the absence of DIO messages in reply 3983 after some configurable period of time, the node may decide to 3984 root a floating DODAG and start sending multicast DIO messages. 3986 A RPL implementation SHOULD allow configuring the preferred mode of 3987 operation listed above along with the required parameters (in the 3988 second mode: the number of DIS messages and related timer). 3990 16.2.2. DIO and DAO Base Message and Options Configuration 3992 RPL specifies a number of protocol parameters considering the large 3993 spectrum of applications where it will be used. That said, 3994 particular attention has been given to limiting the number of these 3995 parameters that must be configured on each RPL router. Instead, a 3996 number of the default values can be used, and when required these 3997 parameters can be provided by the DODAG root thus allowing for 3998 dynamic parameter setting. 4000 A RPL implementation SHOULD allow configuring the following routing 4001 protocol parameters. As pointed out above, note that a large set of 4002 parameters is configured on the DODAG root. 4004 16.2.3. Protocol Parameters to be configured on every router in the LLN 4006 o RPLInstanceID [DIO message, in DIO base message]. Although the 4007 RPLInstanceID must be configured on the DODAG root, it must also 4008 be configured as a policy on every node in order to determine 4009 whether or not the node should join a particular DODAG. Note that 4010 a second RPLInstance can be configured on the node, should it 4011 become root of a floating DODAG. 4013 o Objective Code Point (OCP) 4015 o List of supported metrics: [I-D.ietf-roll-routing-metrics] 4016 specifies a number of metrics and constraints used for the DODAG 4017 formation. Thus a RPL implementation should allow configuring the 4018 list of metrics that a node can accept and understand. If a DIO 4019 is received with a metric and/or constraint that is not understood 4020 or supported, as specified in Section 7.5, the node would join as 4021 a leaf node. 4023 o DODAGID [DIO, DIO base option] and [DAO message when the D flag of 4024 the DAO message is set). 4026 o Route Information (and preference) [DIO message, in Route 4027 Information option] 4029 o Solicited Information [DIS message, in Solicited Information 4030 option]. Note that an RPL implementation SHOULD allow configuring 4031 when such messages should be sent and under which circumstances, 4032 along with the value of the RPLInstance ID, V/I/D flags. 4034 o K flag [DAO message, in DAO base message]. 4036 o MOP (Mode of Operation) [DIO message, in DIO base message] 4038 16.2.4. Protocol Parameters to be configured on every non-root router 4039 in the LLN 4041 o Target prefix [DAO, in RPL Target option and DIO messages] 4042 o Transit information [DAO, Transit information option]: A RPL 4043 implementation SHOULD allow configuring whether a non-storing node 4044 provides the transit information in DAO messages. 4046 A node whose DODAG parent set is empty may become the DODAG root of a 4047 floating DODAG. It may also set its DAGPreference such that it is 4048 less preferred. Thus a RPL implementation MUST allow configuring the 4049 set of actions that the node should initiate in this case: 4051 o Start its own (floating) DODAG: the new DODAGID must be configured 4052 in addition to its DAGPreference 4054 o Poison the broken path (see procedure in Section 7.2.2.5) 4056 o Trigger a local repair 4058 16.2.5. Parameters to be configured on the DODAG root 4060 In addition, several other parameters are configured only on the 4061 DODAG root and advertised in options carried in DIO messages. 4063 As specified in Section 7.3, a RPL implementation makes use of 4064 trickle timers to govern the sending of DIO messages. The operation 4065 of the trickle algorithm is determined by a set of configurable 4066 parameters, which MUST be configurable and that are then advertised 4067 by the DODAG root along the DODAG in DIO messages. 4069 o DIOIntervalDoublings [DIO, in DODAG configuration option] 4071 o DIOIntervalMin [DIO, in DODAG configuration option] 4073 o DIORedundancyConstant [DIO, in DODAG configuration option] 4075 In addition, a RPL implementation SHOULD allow for configuring the 4076 following set of RPL parameters: 4078 o Path Control Size [DIO, in DODAG configuration option] 4080 o MinHopRankIncrease [DIO, in DODAG configuration option] 4082 o The following fields: MOP (Mode of Operation), DODAGPreference 4083 field [DIO message, DIO Base object] 4085 o Route information (list of prefixes with preference) [DIO message, 4086 in Route Information option] 4088 o The T flag allows for triggering a refresh of the downward routes. 4089 A RPL implementation SHOULD support manual setting of the T flag 4090 or upon the occurrence of a set of event such as the expiration of 4091 a configurable periodic timer. 4093 o List of metrics and constraints used for the DODAG. 4095 o Prefix information along with valid and preferred lifetime and the 4096 L and A flags. [DIO message, Prefix Information option]. A RPL 4097 implementation SHOULD allow configuring if the Prefix Information 4098 Option must be carried with the DIO message to distribute the 4099 prefix information for auto-configuration. In that case, the RPL 4100 implementation MUST allow the list of prefixes to be advertised in 4101 the Prefix Information Option along with the corresponding flags. 4103 DAG Root behavior: in some cases, a node may not want to permanently 4104 act as a floating DODAG root if it cannot join a grounded DODAG. For 4105 example a battery-operated node may not want to act as a floating 4106 DODAG root for a long period of time. Thus a RPL implementation MAY 4107 support the ability to configure whether or not a node could act as a 4108 floating DODAG root for a configured period of time. 4110 DAG Version Number Increment: a RPL implementation may allow by 4111 configuration at the DODAG root to refresh the DODAG states by 4112 updating the DODAGVersionNumber. A RPL implementation SHOULD allow 4113 configuring whether or not periodic or event triggered mechanisms are 4114 used by the DODAG root to control DODAGVersionNumber change (which 4115 triggers a global repair as specified in Section 3.3.2. 4117 16.2.6. Configuration of RPL Parameters related to DAO-based mechanisms 4119 DAO messages are optional and used in DODAGs that require downward 4120 routing operation. This section deals with the set of parameters 4121 related to DAO message and provides recommendations on their 4122 configuration. 4124 An implementation SHOULD bound the time that the entry is allocated 4125 in the UNREACHABLE state. Upon the equivalent expiry of the related 4126 timer (RemoveTimer), the entry SHOULD be suppressed. Thus a RPL 4127 implementation MAY allow for the configuration of the RemoveTimer. 4129 While the entry is in the UNREACHABLE state a node SHOULD make a 4130 reasonable attempt to report a No-Path to each of the DAO parents. 4131 That number of attempts MAY be configurable. 4133 When the associated Retry Counter for a REACHABLE(Pending) entry 4134 reaches a maximum threshold, the entry is placed into the UNREACHABLE 4135 state and No-Path should be scheduled to send to the node's DAO 4136 Parents. The maximum threshold MAY be configurable. 4138 An implementation should support rate-limiting the sending of DAO 4139 messages. The related parameters MAY be configurable. 4141 When scheduling to send a DAO, an implementation should equivalently 4142 start a timer (DelayDAO) to delay sending the DAO, thus helping to 4143 potentially aggregate DAOs. The DelayDAO timer MAY be configurable. 4145 16.2.7. Default Values 4147 This document specifies default values for the following set of RPL 4148 variables: 4149 DEFAULT_PATH_CONTROL_SIZE 4150 DEFAULT_DIO_INTERVAL_MIN 4151 DEFAULT_DIO_INTERVAL_DOUBLINGS 4152 DEFAULT_DIO_REDUNDANCY_CONSTANT 4153 DEFAULT_MIN_HOP_RANK_INCREASE 4155 It is recommended to specify default values in protocols; that being 4156 said, as discussed in [RFC5706], default values may make less and 4157 less sense. RPL is a routing protocol that is expected to be used in 4158 a number of contexts where network characteristics such as the number 4159 of nodes, link and nodes types are expected to vary significantly. 4160 Thus, these default values are likely to change with the context and 4161 as the technology will evolve. Indeed, LLNs' related technology 4162 (e.g. hardware, link layers) have been evolving dramatically over the 4163 past few years and such technologies are expected to change and 4164 evolve considerably in the coming years. 4166 The proposed values are not based on extensive best current practices 4167 and are considered to be conservative. 4169 16.3. Monitoring of RPL Operation 4171 Several RPL parameters should be monitored to verify the correct 4172 operation of the routing protocol and the network itself. This 4173 section lists the set of monitoring parameters of interest. 4175 16.3.1. Monitoring a DODAG parameters 4177 A RPL implementation SHOULD provide information about the following 4178 parameters: 4180 o DODAG Version number [DIO message, in DIO base message] 4182 o Status of the G flag [DIO message, in DIO base message] 4184 o Status of the MOP field [DIO message, in DIO base message] 4185 o Value of the DTSN [DIO message, in DIO base message] 4187 o Value of the rank [DIO message, in DIO base message] 4189 o DAOSequence: Incremented at each unique DAO message, echoed in the 4190 DAO-ACK message [DAO and DAO-ACK messages] 4192 o Route Information [DIO message, Route Information option] (list of 4193 IPv6 prefixes per parent along with lifetime and preference] 4195 o Trickle parameters: 4197 * DIOIntervalDoublings [DIO, in DODAG configuration option] 4199 * DIOIntervalMin [DIO, in DODAG configuration option] 4201 * DIORedundancyConstant [DIO, in DODAG configuration option] 4203 o Path Control Size [DIO, in DODAG configuration option] 4205 o MinHopRankIncrease [DIO, in DODAG configuration option] 4207 Values that may be monitored only on the DODAG root 4209 o Transit Information [DAO, Transit Information option]: A RPL 4210 implementation SHOULD allow configuring whether the set of 4211 received Transit Information options should be displayed on the 4212 DODAG root. In this case, the RPL database of received Transit 4213 Information should also contain: the path-sequence, path control, 4214 path lifetime and parent address. 4216 16.3.2. Monitoring a DODAG inconsistencies and loop detection 4218 Detection of DODAG inconsistencies is particularly critical in RPL 4219 networks. Thus it is recommended for a RPL implementation to provide 4220 appropriate monitoring tools. A RPL implementation SHOULD provide a 4221 counter reporting the number of a times the node has detected an 4222 inconsistency with respect to a DODAG parent, e.g. if the DODAGID has 4223 changed. 4225 When possible more granular information about inconsistency detection 4226 should be provided. A RPL implementation MAY provide counters 4227 reporting the number of following inconsistencies: 4229 o Packets received with O bit set (to down) from a node with a 4230 higher rank 4232 o Packets received with O bit reset (to up) from a node with a lower 4233 rank 4235 o Number of packets with the F bit set 4237 o Number of packets with the R bit set 4239 16.4. Monitoring of the RPL data structures 4241 16.4.1. Candidate Neighbor Data Structure 4243 A node in the candidate neighbor list is a node discovered by the 4244 some means and qualified to potentially become a parent (with high 4245 enough local confidence). A RPL implementation SHOULD provide a way 4246 to monitor the candidate neighbor list with some metric reflecting 4247 local confidence (the degree of stability of the neighbors) as 4248 measured by some metrics. 4250 A RPL implementation MAY provide a counter reporting the number of 4251 times a candidate neighbor has been ignored, should the number of 4252 candidate neighbors exceeds the maximum authorized value. 4254 16.4.2. Destination Oriented Directed Acyclic Graph (DAG) Table 4256 For each DODAG, a RPL implementation is expected to keep track of the 4257 following DODAG table values: 4259 o RPLInstanceID 4261 o DODAGID 4263 o DODAGVersionNumber 4265 o Rank 4267 o Objective Code Point 4269 o A set of DODAG Parents 4271 o A set of prefixes offered upwards along the DODAG 4273 o Trickle timers used to govern the sending of DIO messages for the 4274 DODAG 4276 o List of DAO parents 4278 o DTSN 4279 o Node status (router versus leaf) 4281 A RPL implementation SHOULD allow for monitoring the set of 4282 parameters listed above. 4284 16.4.3. Routing Table and DAO Routing Entries 4286 A RPL implementation maintains several information elements related 4287 to the DODAG and the DAO entries (for storing nodes). In the case of 4288 a non storing node, a limited amount of information is maintained 4289 (the routing table is mostly reduced to a set of DODAG parents along 4290 with characteristics of the DODAG as mentioned above) whereas in the 4291 case of storing nodes, this information is augmented with routing 4292 entries. 4294 A RPL implementation SHOULD provide the ability to monitor the 4295 following parameters: 4297 o Next Hop (DODAG parent) 4299 o Next Hop Interface 4301 o Path metrics value for each DODAG parent 4303 A DAO Routing Table Entry conceptually contains the following 4304 elements (for storing nodes only): 4306 o Advertising Neighbor Information 4308 o IPv6 Address 4310 o Interface ID to which DAO Parents has this entry been reported 4312 o Retry Counter 4314 o Logical equivalent of DAO Content: 4316 * DAO Sequence 4318 * DAO Lifetime 4320 * DAO Path Control 4322 o Destination Prefix (or Address or Mcast Group) 4324 A RPL implementation SHOULD provide information about the state of 4325 each DAO Routing Table entry states. 4327 16.5. Fault Management 4329 Fault management is a critical component used for troubleshooting, 4330 verification of the correct mode of operation of the protocol, 4331 network design, and is also a key component of network performance 4332 monitoring. A RPL implementation SHOULD allow providing the 4333 following information related to fault managements: 4335 o Memory overflow along with the cause (e.g. routing tables 4336 overflow, ...) 4338 o Number of times a packet could not be sent to a DODAG parent 4339 flagged as valid 4341 o Number of times a packet has been received for which the router 4342 did not have a corresponding RPLInstanceID 4344 o Number of times a local repair procedure was triggered 4346 o Number of times a global repair was triggered by the DODAG root 4348 o Number of received malformed messages 4350 o Number of seconds with packets to forward and no next hop (DODAG 4351 parent) 4353 o Number of seconds without next hop (DODAG parent) 4355 o Number of times a node has joined a DODAG as a leaf because it 4356 received a DIO with metric/constraint not understood and it was 4357 configured to join as a leaf node in this case (see Section 16.6). 4359 It is RECOMMENDED to report faults via at least error log messages. 4360 Other protocols may be used to report such faults. 4362 16.6. Policy 4364 Policy rules can be used by a RPL implementation to determine whether 4365 or not the node is allowed to join a particular DODAG advertised by a 4366 neighbor by means of DIO messages. 4368 This document specifies operation within a single DODAG. A DODAG is 4369 characterized by the following tuple (RPLInstanceID, DODAGID). 4370 Furthermore, as pointed out above, DIO messages are used to advertise 4371 other DODAG characteristics such as the routing metrics and 4372 constraints used to build to the DODAG and the Objective Function in 4373 use (specified by OCP). 4375 The first policy rules consists of specifying the following 4376 conditions that a RPL node must satisfy to join a DODAG: 4378 o RPLInstanceID 4380 o DODAGID 4382 o List of supported routing metrics and constraints 4384 o Objective Function (OCP values) 4386 A RPL implementation MUST allow configuring these parameters and 4387 SHOULD specify whether the node must simply ignore the DIO if the 4388 advertised DODAG is not compliant with the local policy or whether 4389 the node should join as the leaf node if only the list of supported 4390 routing metrics and constraints, and the OF is not supported. 4392 A RPL implementation SHOULD allow configuring the set of acceptable 4393 or preferred Objective Functions (OF) referenced by their Objective 4394 Codepoints (OCPs) for a node to join a DODAG, and what action should 4395 be taken if none of a node's candidate neighbors advertise one of the 4396 configured allowable Objective Functions, or if the advertised 4397 metrics/constraint is not understood/supported. Two actions can be 4398 taken in this case: 4400 o The node joins the DODAG as a leaf node as specified in 4401 Section 7.5 4403 o The node does not join the DODAG 4405 A node in an LLN may learn routing information from different routing 4406 protocols including RPL. It is in this case desirable to control via 4407 administrative preference which route should be favored. An 4408 implementation SHOULD allow for specifying an administrative 4409 preference for the routing protocol from which the route was learned. 4411 Internal Data Structures: some RPL implementations may limit the size 4412 of the candidate neighbor list in order to bound the memory usage, in 4413 which case some otherwise viable candidate neighbors may not be 4414 considered and simply dropped from the candidate neighbor list. 4416 A RPL implementation MAY provide an indicator on the size of the 4417 candidate neighbor list. 4419 16.7. Liveness Detection and Monitoring 4421 By contrast with several other routing protocols, RPL does not define 4422 any 'keep-alive' mechanisms to detect routing adjacency failure: this 4423 is in most cases, because such a mechanism may be too expensive in 4424 terms of bandwidth and even more importantly energy (a battery 4425 operated device could not afford to send periodic Keep alive). Still 4426 RPL requires mechanisms to detect that a neighbor is no longer 4427 reachable: this can be performed by using mechanisms such as NUD 4428 (Neighbor Unreachability Detection) or even some form of Keep-alive 4429 that are outside of this document. 4431 16.8. Fault Isolation 4433 It is RECOMMENDED to quarantine neighbors that start emitting 4434 malformed messages at unacceptable rates. 4436 16.9. Impact on Other Protocols 4438 RPL has very limited impact on other protocols. Where more than one 4439 routing protocol is required on a router such as a LBR, it is 4440 expected for the device to support routing redistribution functions 4441 between the routing protocols to allow for reachability between the 4442 two routing domains. Such redistribution SHOULD be governed by the 4443 use of user configurable policy. 4445 With regards to the impact in terms of traffic on the network, RPL 4446 has been designed to limit the control traffic thanks to mechanisms 4447 such as Trickle timers (Section 7.3). Thus the impact of RPL on 4448 other protocols should be extremely limited. 4450 16.10. Performance Management 4452 Performance management is always an important aspect of a protocol 4453 and RPL is not an exception. Several metrics of interest have been 4454 specified by the IP Performance Monitoring (IPPM) Working Group: that 4455 being said, they will be hardly applicable to LLN considering the 4456 cost of monitoring these metrics in terms of resources on the devices 4457 and required bandwidth. Still, RPL implementation MAY support some 4458 of these, and other parameters of interest are listed below: 4460 o Number of repairs and time to repair in seconds (average, 4461 variance) 4463 o Number of times and duration during which a devices could not 4464 forward a packet because of a lack of reachable neighbor in its 4465 routing table 4467 o Monitoring of resources consumption by RPL itself in terms of 4468 bandwidth and required memory 4470 o Number of RPL control messages sent and received 4472 17. Security Considerations 4474 17.1. Overview 4476 From a security perspective, RPL networks are no different from any 4477 other network. They are vulnerable to passive eavesdropping attacks 4478 and potentially even active tampering when physical access to a wire 4479 is not required to participate in communications. The very nature of 4480 ad hoc networks and their cost objectives impose additional security 4481 constraints, which perhaps make these networks the most difficult 4482 environments to secure. Devices are low-cost and have limited 4483 capabilities in terms of computing power, available storage, and 4484 power drain; and it cannot always be assumed they have neither a 4485 trusted computing base nor a high-quality random number generator 4486 aboard. Communications cannot rely on the online availability of a 4487 fixed infrastructure and might involve short-term relationships 4488 between devices that may never have communicated before. These 4489 constraints might severely limit the choice of cryptographic 4490 algorithms and protocols and influence the design of the security 4491 architecture because the establishment and maintenance of trust 4492 relationships between devices need to be addressed with care. In 4493 addition, battery lifetime and cost constraints put severe limits on 4494 the security overhead these networks can tolerate, something that is 4495 of far less concern with higher bandwidth networks. Most of these 4496 security architectural elements can be implemented at higher layers 4497 and may, therefore, be considered to be outside the scope of this 4498 standard. Special care, however, needs to be exercised with respect 4499 to interfaces to these higher layers. 4501 The security mechanisms in this standard are based on symmetric-key 4502 and public-key cryptography and use keys that are to be provided by 4503 higher layer processes. The establishment and maintenance of these 4504 keys are outside the scope of this standard. The mechanisms assume a 4505 secure implementation of cryptographic operations and secure and 4506 authentic storage of keying material. 4508 The security mechanisms specified provide particular combinations of 4509 the following security services: 4511 Data confidentiality: Assurance that transmitted information is only 4512 disclosed to parties for which it is intended. 4514 Data authenticity: Assurance of the source of transmitted 4515 information (and, hereby, that information was not 4516 modified in transit). 4518 Replay protection: Assurance that a duplicate of transmitted 4519 information is detected. 4521 Timeliness (delay protection): Assurance that transmitted 4522 information was received in a timely manner. 4524 The actual protection provided can be adapted on a per-packet basis 4525 and allows for varying levels of data authenticity (to minimize 4526 security overhead in transmitted packets where required) and for 4527 optional data confidentiality. When nontrivial protection is 4528 required, replay protection is always provided. 4530 Replay protection is provided via the use of a non-repeating value 4531 (nonce) in the packet protection process and storage of some status 4532 information for each originating device on the receiving device, 4533 which allows detection of whether this particular nonce value was 4534 used previously by the originating device. In addition, so-called 4535 delay protection is provided amongst those devices that have a 4536 loosely synchronized clock on board. The acceptable time delay can 4537 be adapted on a per-packet basis and allows for varying latencies (to 4538 facilitate longer latencies in packets transmitted over a multi-hop 4539 communication path). 4541 Cryptographic protection may use a key shared between two peer 4542 devices (link key) or a key shared among a group of devices (group 4543 key), thus allowing some flexibility and application-specific 4544 tradeoffs between key storage and key maintenance costs versus the 4545 cryptographic protection provided. If a group key is used for peer- 4546 to-peer communication, protection is provided only against outsider 4547 devices and not against potential malicious devices in the key- 4548 sharing group. 4550 Data authenticity may be provided using symmetric-key based or 4551 public-key based techniques. With public-key based techniques (via 4552 signatures), one corroborates evidence as to the unique originator of 4553 transmitted information, whereas with symmetric-key based techniques 4554 data authenticity is only provided relative to devices in a key- 4555 sharing group. Thus, public-key based authentication may be useful 4556 in scenarios that require a more fine-grained authentication than can 4557 be provided with symmetric-key based authentication techniques alone, 4558 such as with group communications (broadcast, multicast), or in 4559 scenarios that require non-repudiation. 4561 18. IANA Considerations 4563 18.1. RPL Control Message 4565 The RPL Control Message is an ICMP information message type that is 4566 to be used carry DODAG Information Objects, DODAG Information 4567 Solicitations, and Destination Advertisement Objects in support of 4568 RPL operation. 4570 IANA has defined an ICMPv6 Type Number Registry. The suggested type 4571 value for the RPL Control Message is 155, to be confirmed by IANA. 4573 18.2. New Registry for RPL Control Codes 4575 IANA is requested to create a registry, RPL Control Codes, for the 4576 Code field of the ICMPv6 RPL Control Message. 4578 New codes may be allocated only by an IETF Consensus action. Each 4579 code should be tracked with the following qualities: 4581 o Code 4583 o Description 4585 o Defining RFC 4587 Three codes are currently defined: 4589 +------+----------------------------------------------+-------------+ 4590 | Code | Description | Reference | 4591 +------+----------------------------------------------+-------------+ 4592 | 0x00 | DODAG Information Solicitation | This | 4593 | | | document | 4594 | | | | 4595 | 0x01 | DODAG Information Object | This | 4596 | | | document | 4597 | | | | 4598 | 0x02 | Destination Advertisement Object | This | 4599 | | | document | 4600 | | | | 4601 | 0x03 | Destination Advertisement Object | This | 4602 | | Acknowledgment | document | 4603 | | | | 4604 | 0x80 | Secure DODAG Information Solicitation | This | 4605 | | | document | 4606 | | | | 4607 | 0x81 | Secure DODAG Information Object | This | 4608 | | | document | 4609 | 0x82 | Secure Destination Advertisement Object | This | 4610 | | | document | 4611 | | | | 4612 | 0x83 | Secure Destination Advertisement Object | This | 4613 | | Acknowledgment | document | 4614 +------+----------------------------------------------+-------------+ 4616 RPL Control Codes 4618 18.3. New Registry for the Mode of Operation (MOP) DIO Control Field 4620 IANA is requested to create a registry for the Mode of Operation 4621 (MOP) DIO Control Field, which is contained in the DIO Base. 4623 New fields may be allocated only by an IETF Consensus action. Each 4624 field should be tracked with the following qualities: 4626 o Mode of Operation 4628 o Capability description 4630 o Defining RFC 4632 Three values are currently defined: 4634 +-----+----------------------------------------------+--------------+ 4635 | MOP | Description | Reference | 4636 +-----+----------------------------------------------+--------------+ 4637 | 000 | No downward routes maintained by RPL | This | 4638 | | | document | 4639 | | | | 4640 | 001 | Non-Storing mode of operation | This | 4641 | | | document | 4642 | | | | 4643 | 010 | Storing mode of operation with no multicast | This | 4644 | | support | document | 4645 | | | | 4646 | 011 | Storing mode of operation with multicast | This | 4647 | | support | document | 4648 +-----+----------------------------------------------+--------------+ 4650 DIO Base Flags 4652 18.4. RPL Control Message Option 4654 IANA is requested to create a registry for the RPL Control Message 4655 Options 4656 +-------+-----------------------+---------------+ 4657 | Value | Meaning | Reference | 4658 +-------+-----------------------+---------------+ 4659 | 0 | Pad1 | This document | 4660 | | | | 4661 | 1 | PadN | This document | 4662 | | | | 4663 | 2 | DAG Metric Container | This Document | 4664 | | | | 4665 | 3 | Routing Information | This Document | 4666 | | | | 4667 | 4 | DODAG Configuration | This Document | 4668 | | | | 4669 | 5 | RPL Target | This Document | 4670 | | | | 4671 | 6 | Transit Information | This Document | 4672 | | | | 4673 | 7 | Solicited Information | This Document | 4674 | | | | 4675 | 8 | Prefix Information | This Document | 4676 +-------+-----------------------+---------------+ 4678 RPL Control Message Options 4680 18.5. Objective Code Point (OCP) Registry 4682 IANA is requested to create a registry to manage the codespace of the 4683 Objective Code Point (OCP) field. 4685 No OCP codepoints are defined in this specification. 4687 18.6. ICMPv6: Error in Source Routing Header 4689 In some cases RPL will return an ICMPv6 error message when a message 4690 cannot be delivered as specified by its source routing header. This 4691 ICMPv6 error message is "Error in Source Routing Header" 4693 IANA has defined an ICMPv6 "Code" Fields Registry for ICMPv6 Message 4694 Types. ICMPv6 Message Type 1 describes "Destination Unreachable" 4695 codes. The "Error in Source Routing Header" code is suggested to be 4696 allocated from the ICMPv6 Code Fields Registry for ICMPv6 Message 4697 Type 1, with a suggested code value of 7, to be confirmed by IANA. 4699 18.7. Link-Local Scope multicast address 4701 The rules for assigning new IPv6 multicast addresses are defined in 4702 [RFC3307]. This specification requires the allocation of a new 4703 permanent multicast address with a link local scope for RPL routers, 4704 with a suggested value of FF02::1:A, to be confirmed by IANA. 4706 19. Acknowledgements 4708 The authors would like to acknowledge the review, feedback, and 4709 comments from Roger Alexander, Emmanuel Baccelli, Dominique Barthel, 4710 Yusuf Bashir, Yoav Ben-Yehezkel, Phoebus Chen, Mischa Dohler, 4711 Mathilde Durvy, Joakim Eriksson, Omprakash Gnawali, Manhar Goindi, 4712 Mukul Goyal, Ulrich Herberg, Anders Jagd, JeongGil (John) Ko, Quentin 4713 Lampin, Jerry Martocci, Matteo Paris, Alexandru Petrescu, Joseph 4714 Reddy, Don Sturek, Joydeep Tripathi, and Nicolas Tsiftes. 4716 The authors would like to acknowledge the guidance and input provided 4717 by the ROLL Chairs, David Culler and JP Vasseur. 4719 The authors would like to acknowledge prior contributions of Robert 4720 Assimiti, Mischa Dohler, Julien Abeille, Ryuji Wakikawa, Teco Boot, 4721 Patrick Wetterwald, Bryan Mclaughlin, Carlos J. Bernardos, Thomas 4722 Watteyne, Zach Shelby, Caroline Bontoux, Marco Molteni, Billy Moon, 4723 Jim Bound, Yanick Pouffary, Henning Rogge and Arsalan Tavakoli, whom 4724 have provided useful design considerations to RPL. 4726 RPL Security Design, found in Section 9, Section 17, and elsewhere 4727 throughout the document, is primarily the contribution of the 4728 Security Design Team: Tzeta Tsao, Roger Alexander, Dave Ward, Philip 4729 Levis, Kris Pister, and Rene Struik. 4731 20. Contributors 4733 RPL is the result of the contribution of the following members of the 4734 RPL Author Team, including the editors, and additional contributors 4735 as listed below: 4737 JP Vasseur 4738 Cisco Systems, Inc 4739 11, Rue Camille Desmoulins 4740 Issy Les Moulineaux, 92782 4741 France 4743 Email: jpv@cisco.com 4745 Thomas Heide Clausen 4746 LIX, Ecole Polytechnique, France 4748 Phone: +33 6 6058 9349 4749 EMail: T.Clausen@computer.org 4750 URI: http://www.ThomasClausen.org/ 4752 Philip Levis 4753 Stanford University 4754 358 Gates Hall, Stanford University 4755 Stanford, CA 94305-9030 4756 USA 4758 Email: pal@cs.stanford.edu 4760 Richard Kelsey 4761 Ember Corporation 4762 Boston, MA 4763 USA 4765 Phone: +1 617 951 1225 4766 Email: kelsey@ember.com 4768 Jonathan W. Hui 4769 Arch Rock Corporation 4770 501 2nd St. Ste. 410 4771 San Francisco, CA 94107 4772 USA 4774 Email: jhui@archrock.com 4775 Kris Pister 4776 Dust Networks 4777 30695 Huntwood Ave. 4778 Hayward, 94544 4779 USA 4781 Email: kpister@dustnetworks.com 4783 Anders Brandt 4784 Sigma Designs 4785 Emdrupvej 26A, 1. 4786 Copenhagen, DK-2100 4787 Denmark 4789 Email: abr@sdesigns.dk 4791 R. Struik 4793 Email: rstruik.ext@gmail.com 4795 Stephen Dawson-Haggerty 4796 UC Berkeley 4797 Soda Hall, UC Berkeley 4798 Berkeley, CA 94720 4799 USA 4801 Email: stevedh@cs.berkeley.edu 4803 21. References 4805 21.1. Normative References 4807 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 4808 Requirement Levels", BCP 14, RFC 2119, March 1997. 4810 21.2. Informative References 4812 [AppliedCryptography] 4813 Menzes, AJ., van Oorschot, PC., and SA. Vanstone, 4814 "Handbook of Applied Cryptography", CRC Press , 1997. 4816 [CCMStar] IEEE, "IEEE Std. 802.15.4-2006, IEEE Standard for 4817 Information Technology - Telecommunications and 4818 Information Exchange between Systems - Local and 4819 Metropolitan Area Networks - Specific requirements Part 4820 15.4: Wireless Medium Access Control (MAC) and Physical 4821 Layer (PHY) Specifications for Low-Rate Wireless Personal 4822 Area Networks (WPANs)", IEEE Press Revision of IEEE Std 4823 802.15.4-2003, 2006. 4825 [I-D.hui-6man-rpl-option] 4826 Hui, J. and J. Vasseur, "RPL Option for Carrying RPL 4827 Information in Data-Plane Datagrams", 4828 draft-hui-6man-rpl-option-01 (work in progress), 4829 June 2010. 4831 [I-D.hui-6man-rpl-routing-header] 4832 Hui, J., Vasseur, J., and D. Culler, "An IPv6 Routing 4833 Header for Source Routes with RPL", 4834 draft-hui-6man-rpl-routing-header-02 (work in progress), 4835 June 2010. 4837 [I-D.ietf-manet-nhdp] 4838 Clausen, T., Dearlove, C., and J. Dean, "Mobile Ad Hoc 4839 Network (MANET) Neighborhood Discovery Protocol (NHDP)", 4840 draft-ietf-manet-nhdp-12 (work in progress), March 2010. 4842 [I-D.ietf-roll-of0] 4843 Thubert, P., "RPL Objective Function 0", 4844 draft-ietf-roll-of0-02 (work in progress), June 2010. 4846 [I-D.ietf-roll-routing-metrics] 4847 Vasseur, J., Kim, M., Networks, D., and H. Chong, "Routing 4848 Metrics used for Path Calculation in Low Power and Lossy 4849 Networks", draft-ietf-roll-routing-metrics-07 (work in 4850 progress), June 2010. 4852 [I-D.ietf-roll-terminology] 4853 Vasseur, J., "Terminology in Low power And Lossy 4854 Networks", draft-ietf-roll-terminology-03 (work in 4855 progress), March 2010. 4857 [I-D.ietf-roll-trickle] 4858 Levis, P., Clausen, T., Hui, J., and J. Ko, "The Trickle 4859 Algorithm", draft-ietf-roll-trickle-01 (work in progress), 4860 April 2010. 4862 [Perlman83] 4863 Perlman, R., "Fault-Tolerant Broadcast of Routing 4864 Information", North-Holland Computer Networks 7: 395-405, 4865 1983, . 4868 [RFC1958] Carpenter, B., "Architectural Principles of the Internet", 4869 RFC 1958, June 1996. 4871 [RFC1982] Elz, R. and R. Bush, "Serial Number Arithmetic", RFC 1982, 4872 August 1996. 4874 [RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J. 4875 Schoenwaelder, Ed., "Structure of Management Information 4876 Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. 4878 [RFC2710] Deering, S., Fenner, W., and B. Haberman, "Multicast 4879 Listener Discovery (MLD) for IPv6", RFC 2710, 4880 October 1999. 4882 [RFC3307] Haberman, B., "Allocation Guidelines for IPv6 Multicast 4883 Addresses", RFC 3307, August 2002. 4885 [RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart, 4886 "Introduction and Applicability Statements for Internet- 4887 Standard Management Framework", RFC 3410, December 2002. 4889 [RFC3535] Schoenwaelder, J., "Overview of the 2002 IAB Network 4890 Management Workshop", RFC 3535, May 2003. 4892 [RFC3610] Whiting, D., Housley, R., and N. Ferguson, "Counter with 4893 CBC-MAC (CCM)", RFC 3610, September 2003. 4895 [RFC3810] Vida, R. and L. Costa, "Multicast Listener Discovery 4896 Version 2 (MLDv2) for IPv6", RFC 3810, June 2004. 4898 [RFC3819] Karn, P., Bormann, C., Fairhurst, G., Grossman, D., 4899 Ludwig, R., Mahdavi, J., Montenegro, G., Touch, J., and L. 4901 Wood, "Advice for Internet Subnetwork Designers", BCP 89, 4902 RFC 3819, July 2004. 4904 [RFC4101] Rescorla, E. and IAB, "Writing Protocol Models", RFC 4101, 4905 June 2005. 4907 [RFC4191] Draves, R. and D. Thaler, "Default Router Preferences and 4908 More-Specific Routes", RFC 4191, November 2005. 4910 [RFC4443] Conta, A., Deering, S., and M. Gupta, "Internet Control 4911 Message Protocol (ICMPv6) for the Internet Protocol 4912 Version 6 (IPv6) Specification", RFC 4443, March 2006. 4914 [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, 4915 "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, 4916 September 2007. 4918 [RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless 4919 Address Autoconfiguration", RFC 4862, September 2007. 4921 [RFC4915] Psenak, P., Mirtorabi, S., Roy, A., Nguyen, L., and P. 4922 Pillay-Esnault, "Multi-Topology (MT) Routing in OSPF", 4923 RFC 4915, June 2007. 4925 [RFC5120] Przygienda, T., Shen, N., and N. Sheth, "M-ISIS: Multi 4926 Topology (MT) Routing in Intermediate System to 4927 Intermediate Systems (IS-ISs)", RFC 5120, February 2008. 4929 [RFC5548] Dohler, M., Watteyne, T., Winter, T., and D. Barthel, 4930 "Routing Requirements for Urban Low-Power and Lossy 4931 Networks", RFC 5548, May 2009. 4933 [RFC5673] Pister, K., Thubert, P., Dwars, S., and T. Phinney, 4934 "Industrial Routing Requirements in Low-Power and Lossy 4935 Networks", RFC 5673, October 2009. 4937 [RFC5706] Harrington, D., "Guidelines for Considering Operations and 4938 Management of New Protocols and Protocol Extensions", 4939 RFC 5706, November 2009. 4941 [RFC5826] Brandt, A., Buron, J., and G. Porcu, "Home Automation 4942 Routing Requirements in Low-Power and Lossy Networks", 4943 RFC 5826, April 2010. 4945 [RFC5867] Martocci, J., De Mil, P., Riou, N., and W. Vermeylen, 4946 "Building Automation Routing Requirements in Low-Power and 4947 Lossy Networks", RFC 5867, June 2010. 4949 [RFC5880] Katz, D. and D. Ward, "Bidirectional Forwarding Detection 4950 (BFD)", RFC 5880, June 2010. 4952 [X9.63-2001] 4953 "ANSI X9.63-2001, Public Key Cryptography for the 4954 Financial Services Industry - Key Agreement and Key 4955 Transport Using Elliptic Curve Cryptography", 2001. 4957 [X9.92] "ANSI X9.92, Public Key Cryptography for the Financial 4958 Services Industry - Digital Signature Algorithms Giving 4959 Partial Message Recovery - Part 1: Elliptic Curve Pintsov- 4960 Vanstone Signatures (ECPVS)", 2009. 4962 Authors' Addresses 4964 Tim Winter (editor) 4966 Email: wintert@acm.org 4968 Pascal Thubert (editor) 4969 Cisco Systems 4970 Village d'Entreprises Green Side 4971 400, Avenue de Roumanille 4972 Batiment T3 4973 Biot - Sophia Antipolis 06410 4974 FRANCE 4976 Phone: +33 497 23 26 34 4977 Email: pthubert@cisco.com 4979 RPL Author Team 4980 IETF ROLL WG 4982 Email: rpl-authors@external.cisco.com