idnits 2.17.1 draft-ietf-avtcore-leap-second-08.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year (Using the creation date from RFC3550, updated by this document, for RFC5378 checks: 1998-04-07) -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (January 12, 2014) is 3729 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) No issues found here. Summary: 0 errors (**), 0 flaws (~~), 1 warning (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 AVTCore K. Gross 3 Internet-Draft AVA Networks 4 Updates: 3550 (if approved) R. van Brandenburg 5 Intended status: Standards Track TNO 6 Expires: July 16, 2014 January 12, 2014 8 RTP and Leap Seconds 9 draft-ietf-avtcore-leap-second-08 11 Abstract 13 This document discusses issues that arise when RTP sessions span 14 Coordinated Universal Time (UTC) leap seconds. It updates RFC 3550 15 to describe how RTP senders and receivers should behave in the 16 presence of leap seconds. 18 Status of This Memo 20 This Internet-Draft is submitted in full conformance with the 21 provisions of BCP 78 and BCP 79. 23 Internet-Drafts are working documents of the Internet Engineering 24 Task Force (IETF). Note that other groups may also distribute 25 working documents as Internet-Drafts. The list of current Internet- 26 Drafts is at http://datatracker.ietf.org/drafts/current/. 28 Internet-Drafts are draft documents valid for a maximum of six months 29 and may be updated, replaced, or obsoleted by other documents at any 30 time. It is inappropriate to use Internet-Drafts as reference 31 material or to cite them other than as "work in progress." 33 This Internet-Draft will expire on July 16, 2014. 35 Copyright Notice 37 Copyright (c) 2014 IETF Trust and the persons identified as the 38 document authors. All rights reserved. 40 This document is subject to BCP 78 and the IETF Trust's Legal 41 Provisions Relating to IETF Documents 42 (http://trustee.ietf.org/license-info) in effect on the date of 43 publication of this document. Please review these documents 44 carefully, as they describe your rights and restrictions with respect 45 to this document. Code Components extracted from this document must 46 include Simplified BSD License text as described in Section 4.e of 47 the Trust Legal Provisions and are provided without warranty as 48 described in the Simplified BSD License. 50 Table of Contents 52 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 53 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2 54 3. Leap seconds . . . . . . . . . . . . . . . . . . . . . . . . 3 55 3.1. UTC behavior during positive leap second . . . . . . . . 3 56 3.2. NTP behavior during positive leap second . . . . . . . . 3 57 3.3. POSIX behavior during positive leap second . . . . . . . 3 58 3.4. Example of leap-second behaviors . . . . . . . . . . . . 4 59 4. Receiver behavior during leap second . . . . . . . . . . . . 5 60 5. Recommendations . . . . . . . . . . . . . . . . . . . . . . . 5 61 5.1. Sender Reports . . . . . . . . . . . . . . . . . . . . . 6 62 5.2. RTP Packet Playout . . . . . . . . . . . . . . . . . . . 7 63 6. Security Considerations . . . . . . . . . . . . . . . . . . . 7 64 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 65 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 8 66 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 67 9.1. Normative References . . . . . . . . . . . . . . . . . . 8 68 9.2. Informative References . . . . . . . . . . . . . . . . . 8 69 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 71 1. Introduction 73 In some media networking applications, RTP streams are referenced to 74 a wall-clock time (absolute date and time). This is accomplished 75 through use of the NTP timestamp field in the sender report (SR) to 76 create a mapping between RTP timestamps and the wall clock. When a 77 wall-clock reference is used, the playout time for RTP packets is 78 referenced to the wall clock. Smooth and continuous media playout 79 requires a smooth and continuous time base. The time base used by 80 the wall clock may include leap seconds which are not rendered 81 smoothly. 83 This document updates RFC 3550 [1] providing recommendations for 84 smoothly rendering streamed media referenced to common wall clocks 85 which do not have smooth or continuous behavior in the presence of 86 leap seconds. 88 2. Terminology 90 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 91 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 92 document are to be interpreted as described in RFC 2119 [2] and 93 indicate requirement levels for compliant implementations. 95 3. Leap seconds 97 The world scientific time standard is International Atomic Time (TAI) 98 which is based on vibrations of cesium atoms in an atomic clock. The 99 world civil time is based on the rotation of the Earth. In 1972 the 100 civil time standard, Coordinated Universal Time (UTC), was redefined 101 in terms of TAI and the concept of leap seconds was introduced to 102 allow UTC to remain synchronized with the rotation of the Earth. 104 Leap seconds are scheduled by the International Earth Rotation and 105 Reference Systems Service. Leap seconds may be scheduled at the last 106 day of any month but are preferentially scheduled for December and 107 June and secondarily March and September.[6] Because Earth's rotation 108 is unpredictable, leap seconds are typically not scheduled more than 109 six months in advance. 111 Leap seconds do not respect local time and always occur at the end of 112 the UTC day. Leap seconds can be scheduled to either add or remove a 113 second from the day. A leap second that adds an extra second is 114 known as a positive leap second. A leap second that skips a second 115 is known as a negative leap second. All leap seconds since their 116 introduction in 1972 have been scheduled in June or December and all 117 have been positive. 119 NOTE- The ITU is studying a proposal which could eventually eliminate 120 leap seconds from UTC. As of January 2012, this proposal is expected 121 to be decided no earlier than 2015.[7] 123 3.1. UTC behavior during positive leap second 125 UTC clocks feature a 61st second at the end of the day when a 126 positive leap second is scheduled. The leap second is designated 127 "23h 59m 60s". 129 3.2. NTP behavior during positive leap second 131 Under NTP[8] a leap second is inserted at the beginning of the last 132 second of the day. This results in the clock freezing or slowing for 133 one second immediately prior to the last second of the affected day. 134 This results in the last second of the day having a real-time 135 duration of two seconds. Timestamp accuracy is compromised during 136 this period because the clock's rate is not well defined. 138 3.3. POSIX behavior during positive leap second 140 The POSIX standard [3] requires that leap seconds be omitted from 141 reported time. All days are defined as having 86,400 seconds but the 142 timebase is defined to be UTC, a leap-second-bearing reference . 144 Implementors of POSIX systems are offered considerable latitude by 145 the standard as to how to map POSIX time to UTC. 147 In many systems leap seconds are accommodated by repeating the last 148 second of the day. A timestamp within the last second of the day is 149 therefore ambiguous in that it can refer to a moment in time in 150 either of the last two seconds of a day containing a leap second. 152 Other systems use the same technique used by NTP, freezing or slowing 153 for one second immediately prior to the last second of the affected 154 day. 156 In some cases [5] [4] leap seconds are accommodated by warping time, 157 slightly altering the length of the second in the vicinity of a leap 158 second. 160 3.4. Example of leap-second behaviors 162 Table 1 illustrates the positive leap second that occurred June 30, 163 2012 when the offset between International Atomic time (TAI) and UTC 164 changed from 34 to 35 seconds. The first column shows RTP timestamps 165 for an 8 kHz audio stream. The second column shows the TAI 166 reference. Following columns show behavior for the leap-second- 167 bearing wall clocks described above. Time values are shown at half- 168 second intervals. 170 +-------+--------------+--------------+--------------+--------------+ 171 | RTP | TAI | UTC | POSIX | NTP | 172 +-------+--------------+--------------+--------------+--------------+ 173 | 8000 | 00:00:32.500 | 23:59:58.500 | 23:59:58.500 | 23:59:58.500 | 174 | 12000 | 00:00:33.000 | 23:59:59.000 | 23:59:59.000 | 23:59:59.000 | 175 | 16000 | 00:00:33.500 | 23:59:59.500 | 23:59:59.500 | 23:59:59.500 | 176 | 20000 | 00:00:34.000 | 23:59:60.000 | 23:59:59.000 | 00:00:00.000 | 177 | 24000 | 00:00:34.500 | 23:59:60.500 | 23:59:59.500 | 00:00:00.000 | 178 | 28000 | 00:00:35.000 | 00:00:00.000 | 00:00:00.000 | 00:00:00.000 | 179 | 32000 | 00:00:35.500 | 00:00:00.500 | 00:00:00.500 | 00:00:00.500 | 180 +-------+--------------+--------------+--------------+--------------+ 182 Table 1: Positive leap second behavior 184 NOTE- Some NTP implementations do not entirely freeze the clock while 185 the leap second is inserted. Successive calls to retrieve system 186 time return infinitesimally larger (e.g. 1 microsecond or 1 187 nanosecond larger) time values. This behavior is designed to satisfy 188 assumptions applications may make that time increases monotonically. 189 This behavior occurs in the least-significant bits of the time value 190 and so is not typically visible in the human-readable format shown in 191 the table. 193 NOTE- POSIX implementations vary. The implementation shown here 194 repeats the last second of the affected day. Other implementations 195 mirror NTP behavior or alter the length of a second in the vicinity 196 of the leap second. 198 4. Receiver behavior during leap second 200 Timestamps generated during a leap second may be ambiguous or 201 interpreted differently by sender and receiver or interpreted 202 differently by different receivers. 204 Without prior knowledge of leap-second schedule, NTP servers and 205 clients may become offset by exactly one second with respect to their 206 UTC reference. This potential discrepancy begins when a leap second 207 occurs and ends when all participants receive a time update from a 208 server or peer. Depending on the system implementation, the offset 209 can last anywhere from a few seconds to a few days. A long-lived 210 discrepancy can be particularly disruptive to RTP operation. 212 These discrepancies, depending on direction, may cause receivers to 213 think they are receiving RTP packets after they should be played or 214 to attempt to buffer received data an additional second before 215 playing it. Either situation can cause an interruption in playback. 216 Some receivers may automatically recognize an unexpected offset and 217 resynchronize to the stream to accommodate it. Once the offset is 218 resolved, such receivers may need to resynchronize again. 220 5. Recommendations 222 Senders and receivers which are not referenced to a wall clock are 223 not affected by issues associated with leap seconds and no special 224 accommodation is required. 226 RTP implementation using a wall-clock reference is simplified by 227 using a clock with a timescale which does not include leap seconds. 228 IEEE 1588,[9] GPS [10] and other systems that use a TAI [11] 229 reference do not include leap seconds. NTP time, operating system 230 clocks and other systems using a UTC reference include leap seconds. 232 Note that some TAI-based systems such as IEEE 1588 and GPS, in 233 addition to the TAI reference clock, deliver TAI to UTC mapping 234 information. By combining the delivered TAI reference clock and the 235 mapping information, some receivers of these systems are able to 236 synthezise a leap-second-bearing UTC reference clock. For the 237 purposes of this draft, it is important to recognise that it is the 238 timescale used, not the delivery mechanism which determines whether a 239 reference clock is leap-second bearing. 241 +-------------------------+----------------+---------------+ 242 | Reference clock type | Examples | Accommodation | 243 +-------------------------+----------------+---------------+ 244 | None | Self clocking | None needed | 245 | Non-leap-second-bearing | 1588, GPS, TAI | None needed | 246 | Leap-second-bearing | NTP | Recommended | 247 +-------------------------+----------------+---------------+ 249 Recommendations summary 251 All participants working to a leap-second-bearing reference MUST 252 recognize leap seconds and SHOULD have a working communications 253 channel to receive notification of leap-second scheduling. A working 254 communication channel includes a protocol means of notifying clocks 255 of an impending leap second such as the Leap Indicator in the NTP 256 header [8] but also a means for top-tier clocks to receive leap- 257 second schedule information published by the International Earth 258 Rotation and Reference Systems Service. [12] 260 These recommendations appreciate that such a communications channel 261 may not be available on all networks. For security or other reasons, 262 leap-second schedules may be configured manually for some networks or 263 clocks. When a device does not reliably receive leap-second 264 scheduling information, failures as described in Section 4 may occur. 266 Because of the timestamp ambiguity that positive leap seconds can 267 introduce and the inconsistent manner in which different systems 268 accommodate positive leap seconds, generating or using NTP timestamps 269 during the entire last second of a day on which a positive leap 270 second has been scheduled SHOULD be avoided. Note that the period to 271 be avoided has a real-time duration of two seconds. In the Table 1 272 example, the region to be avoided is indicated by RTP timestamps 273 12000 through 28000 275 Negative leap seconds do not introduce timestamp ambiguity or other 276 complications. No special treatment is needed to avoid ambiguity 277 with respect to RTP timestamps in the presence of a negative leap 278 second. 280 POSIX clocks which use a warping technique to accommodate leap 281 seconds (e.g. [5] [4]) are not a good choice for an interoperable 282 timestamp reference and SHOULD be avoided for this application. 284 5.1. Sender Reports 286 In order to avoid generating or using NTP timestamps during positive 287 leap seconds, RTP senders and receivers need to avoid sending or 288 using sender reports to synchronize their clocks in the vicinity of a 289 leap second and instead rely on their internal clocks to maintain 290 sync until the leap second has passed. 292 RTP Senders working to a leap-second-bearing reference SHOULD NOT 293 generate sender reports containing an originating NTP timestamp in 294 the vicinity of a positive leap second. To maintain a consistent 295 RTCP schedule and avoid the risk of unintentional timeouts, such 296 senders MAY send receiver reports in place of sender reports in the 297 vicinity of the leap second. 299 For the purpose of suspending sender reports in the vicinity of a 300 leap second, senders MAY assume a positive leap second occurs at the 301 end of the last day of every month. 303 Receivers working to a leap-second-bearing reference SHOULD ignore 304 timestamps in any sender reports generated in the vicinity of a 305 positive leap second. 307 For the purpose of ignoring sender reports in the vicinity of a leap 308 second, receivers MAY assume a positive leap second occurs at the end 309 of the last day of every month. 311 5.2. RTP Packet Playout 313 Receivers working to a leap-second-bearing reference SHOULD take both 314 positive and negative leap seconds in the reference into account in 315 determining playout time based on RTP timestamps for data in RTP 316 packets. 318 6. Security Considerations 320 RTP streams using a wall-clock reference as discussed here present an 321 additional attack vector compared to self-clocking streams. 322 Manipulation of the wall clock at either sender or receiver can 323 potentially disrupt streaming. 325 For an RTP stream operating to an leap-second-bearing reference to 326 operate reliably across a leap second, sender and receive must both 327 be aware of the leap second. It is possible to disrupt a stream by 328 blocking or delaying leap second notification to one of the 329 participants. Streaming can be similarly affected if one of the 330 participants can be tricked into believing a leap second has been 331 scheduled where there is not one. These vulnerabilities are present 332 in RFC 3550 [1] and these new recommendations neither heighten or 333 diminish them. Integrity of the leap second schedule is the 334 responsibility of the operating system and time distribution 335 mechanism both of which are outside the scope of RFC 3550 [1] and 336 these recommendations. 338 7. IANA Considerations 340 This document has no actions for IANA. 342 8. Acknowledgements 344 The authors would like to thank Steve Allen for his valuable comments 345 in helping to improve this document. 347 9. References 349 9.1. Normative References 351 [1] Schulzrinne, H., Casner, S., Frederick, R., and V. 352 Jacobson, "RTP: A Transport Protocol for Real-Time 353 Applications", STD 64, RFC 3550, July 2003. 355 [2] Bradner, S., "Key words for use in RFCs to Indicate 356 Requirement Levels", BCP 14, RFC 2119, March 1997. 358 9.2. Informative References 360 [3] IEEE, "IEEE Standard for Information Technology - Portable 361 Operating System Interface (POSIX)", IEEE Standard 362 1003.1-2008, 2008, . 365 [4] Google, Inc., "Time, technology and leaping seconds", 366 September 2011, . 369 [5] Kuhn, M., "Coordinated Universal Time with Smoothed Leap 370 Seconds (UTC-SLS)", draft-kuhn-leapsecond-00 (work in 371 progress), January 2006. 373 [6] ITU, "Standard-frequency and time-signal emissions", ITU-R 374 TF.460-6, February 2002, 375 . 377 [7] ITU, "Question 236/7", February 2012, 378 . 380 [8] Mills, D., Martin, J., Burbank, J., and W. Kasch, "Network 381 Time Protocol Version 4: Protocol and Algorithms 382 Specification", RFC 5905, June 2010. 384 [9] IEEE, "IEEE Standard for a Precision Clock Synchronization 385 Protocol for Networked Measurement and Control Systems", 386 IEEE Standard 1588-2008, July 2008, 387 . 390 [10] Global Positioning Systems Directorate, "Navstar GPS Space 391 Segment/Navigation User Segment Interfaces", September 392 2011, . 394 [11] Bureau International des Poids et Mesures (BIPM), 395 "International Atomic Time", November 2013, 396 . 398 [12] International Earth Rotation and Reference System Service, 399 "Bulletin C", November 2013, . 402 Authors' Addresses 404 Kevin Gross 405 AVA Networks 406 Boulder, CO 407 US 409 Email: kevin.gross@avanw.com 411 Ray van Brandenburg 412 TNO 413 Brassersplein 2 414 Delft 2612CT 415 the Netherlands 417 Phone: +31-88-866-7000 418 Email: ray.vanbrandenburg@tno.nl