RFC 5187 - OSPFv3 Graceful Restart

Overview

Positive

what Ze has

Neutral

measures that are neither good news nor bad

The 8 shares marked as a part above are the whole of the 4 gated MUSTs: they add to 100%. Proven by a recorded break is a share of TAGGED UNITS, a different population, so it is not one of them.

At a glance

Enrolment

Enrolled: OSPFv3 Graceful Restart: four MUST-level requirements, all met and tested with both polarities. RFC5187-2.2-1 (Grace Period TLV always in a grace-LSA) and RFC5187-2.2-2 (Restart Reason TLV always present) via the OSPFv3 grace-LSA body codec (internal/plugins/ospf/v3/packet/lsa_grace.go, which the OSPFv3 origination v6OriginateGraceLSA in gr_preserve.go encodes and the helper's grInspectV6Update decodes): TestRFC5187OriginatedGraceLSACarriesPeriodAndReasonTLVs (the originated LSA's body is the literal Type 1 Length 4 and Type 2 Length 1 TLVs) and TestRFC5187HelperIgnoresGraceLSAMissingMandatoryTLV (a peer's grace-LSA lacking either TLV is ignored by the helper). Ze originates the OSPFv3 link-scoped grace-LSA (LS Type 0x000B). RFC5187-3.1-1 (preserve LSA-ID to prefix correspondence across restart) and RFC5187-3.2-1 (preserve OSPFv3 Interface ID across restart) via the NVS preservation maps PrefixLSIDs/InterfaceIDs (internal/plugins/ospf/gr_nvs.go:41-45): TestRestartFactPersistsAcrossRestart (maps read back intact after a restart) and TestStaleRestartFactIgnored (an expired/cleared restart fact is inactive, so stale IDs are not restored). No SHOULD/MAY requirements are gated.

What the public ledger says

Status: Experimental

What the ledger says is covered:

What the ledger says remains:

Coverage

Positive and negative tests (4): RFC5187-2.2-1, RFC5187-2.2-2, RFC5187-3.1-1, RFC5187-3.2-1

Requirements

Gaps and untested MUSTs

RFC 5187 declares no gap, and every gated MUST it carries has a test bound to it.

Proof state

A tagged unit reads unproven where no discrimination record exists for it: nothing in this tree has been observed to break it, so the claim its tag makes is unproven.

RFC5187-2.2-1

Grace Period (Type=1, Length=4). The number of seconds that the router's neighbors should continue to advertise the router as fully adjacent, regardless of the state of database synchronization between the router and its neighbors. This TLV MUST always appear in a grace-LSA. (§2.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. c22 re-judge. Forbidden: a grace-LSA without the Grace Period TLV (Type=1, Length=4). Positive TestRFC5187OriginatedGraceLSACarriesPeriodAndReasonTLVs drives the OSPFv3 origination v6OriginateGraceLSA (gr_restarter.go calls it) and compares the installed LSA body after the 20-octet v3 header with literal octets 00 01 00 04 <period> for period 120 and 0, so a wrong type, wrong length or dropped TLV goes red (author overlay GraceTLVPeriod=3 red; recorded revert of v3/packet/lsa_grace.go::tlvs). Negative under OWNER RULING 2 (generate row: the negative is how Ze handles a peer PDU lacking it; RFC 5187 prescribes no handling and the helper cannot run a window it was not given, so ignore): TestRFC5187HelperIgnoresGraceLSAMissingMandatoryTLV feeds a reason-only v3 Grace-LSA to grInspectV6Update (instance.go receive path) while helping X and asserts the helper grace end is unchanged, with a both-TLV control that moves it to now+600, isolating the hasPeriod check (author overlay: removing hasPeriod reds only that subtest; recorded revert of ::decodeGraceLSA). Tags moved off the OSPFv2 RFC 3623 codec units (D-15).

RFC5187-2.2-2

Graceful restart reason (Type=2, Length=1). Encodes the reason for the router restart, as one of the following: 0 (unknown), 1 (software restart), 2 (software reload/upgrade), or 3 (switch to redundant control processor). This TLV MUST always appear in a grace-LSA. (§2.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. c22 re-judge. Forbidden: a grace-LSA without the Graceful restart reason TLV (Type=2, Length=1). Positive: same origination unit asserts the literal 00 02 00 01 <reason> 00 00 00 after the period TLV for reason 2 and 0, body exactly 16 octets, so a wrong type number, length or omission goes red (recorded revert of v3 lsa_grace.go::tlvs). Negative under OWNER RULING 2: a period-only (600) v3 Grace-LSA through grInspectV6Update leaves the helper session and its grace end unchanged while the both-TLV control applies 600, isolating the hasReason check (author overlay; recorded revert of ::decodeGraceLSA). Tags moved off the OSPFv2 codec units (D-15).

RFC5187-3.1-1

Hence, to avoid network churn during graceful restart, the restarting router MUST preserve the LSA ID to prefix correspondence across graceful restarts. (§3.1)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-judged 2026-09-30 (independent judge, c11). Now proven through the real restart path (rfc5187_preserve_restart_test.go): engine A redistributes 2001:db8:5187::/48 (v6InjectExternal), prepareRestart persists into a store; engine B over the same store resumes (inRestart asserted). TestRFC5187LSAIDToPrefixPreservedAcrossRestart +: B maps the prefix to A's LSA ID without redistributing it (only restorePrefixLSIDs can put it there; a no-op capture or restore leaves no entry -> red). - same unit: a prefix first redistributed on B does not take the preserved ID and the preserved prefix keeps its own; an overlay mutants (go test -overlay, tree untouched, scratch/ospf-judge-mut) removing the redistV6Next bump in restorePrefixLSIDs turns it red ('took the preserved LSA ID 1'). Revert records on restorePrefixLSIDs observed red. Old gr_nvs_test.go tags (store round-trip only) remain, unproven.

RFC5187-3.2-1

Therefore, the OSPFv3 Interface ID, as described in section 3.1.2 of [OSPFv3], MUST be preserved by the restarting router across restarts. (§3.2)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Re-judged 2026-10-12 (independent auditor) after 711a3d1ea0: TestRFC5187InterfaceIDPreservedAcrossRestart moved byte-identical into rfc5187_preserve_restart_linux_test.go under //go:build linux, so its key changed. Re-read against Section 3.2 ("the OSPFv3 Interface ID, as described in section 3.1.2 of [OSPFv3], MUST be preserved by the restarting router across restarts"): the negative fails if grInterfaceID(lo) or the announced topology ID equals the kernel ifindex a fresh start takes, the positive pins the preserved 1041. Limit named: the unit now compiles on Linux only, so on another host the row's discrimination is not exercised and the gr_nvs_test.go tags (NVS round-trip) are supplementary. Re-judged 2026-09-30 (independent judge, c12). Section 3.2: 'the OSPFv3 Interface ID ... MUST be preserved by the restarting router across restarts.' The c11 vacuous negative is replaced: TestRFC5187InterfaceIDPreservedAcrossRestart runs on lo, whose kernel ifindex is the Interface ID a fresh start takes (grInterfaceID falls back to interfaceIndex, gr_preserve.go). - neither grInterfaceID(lo) nor the announced topology ID is the kernel ifindex; + the resumed engine announces the preserved 1041. Author overlay making restoreInterfaceIDs' maps.Copy a no-op reds the negative line ('lo resolves to its fresh-start Interface ID 1'), judge read the diff and the log. Records +/- revert on restoreInterfaceIDs observed. The unit needs a host lo interface (Linux naming) and Fatalf's without it. gr_nvs_test.go tags are supplementary (NVS round-trip).

Extraction sign-off

Sections

Excluded sentences

The walk over RFC 5187 declined no sentence: every site it found is mapped to a requirement.

Superseded

No document obsoletes RFC 5187, so its obligations are stated where they were written.