Re: last call comments for draft-ietf-6man-stable-privacy-addresses-06

[Andrew McGregor <[e-mail]>]

Further to that, ifindexes of tunnels and PPP sessions can change
dynamically as the bearer connection goes up and down, even if the
interface has the same name and authenticated identity.  That raises the
interesting question of whether even the interface name is stable, as on
many systems it is pure chance if the same name-identity mapping repeats
itself.

If you want a stable address, you want to use something that actually has
the exact stability properties you require, and interface indexes and names
are seldom what you actually need.

Andrew


On Thu, Apr 25, 2013 at 7:00 PM, t.p. <[e-mail]> wrote:

> ----- Original Message -----
> From: "Christian Huitema" <[e-mail]>
> To: "Fernando Gont" <[e-mail]>; "SM" <[e-mail]>
> Cc: "RJ Atkinson" <[e-mail]>; <[e-mail]>
> Sent: Tuesday, April 23, 2013 6:02 PM
>
> <snip>
>
> Instead, the draft goes into great details on how to actually implement
> the random number generator. Apart from not being necessary, some of
> these details are wrong. For example, the suggested algorithm includes
> an "interface index," but different operating systems have different
> ways of enumerating interfaces, and the variations in enumeration could
> end up violating the "stable address" property.
>
> <tp>
>
> The ifIndex, as it appears in the IF-MIB is not stable; it can change
> on each and every re-boot of a system, depending on the order in which
> modules are loaded.  It remains the same only until the next re-boot. I
> do not know what impact this has on the ipi6_ifindex as used in the
> IPv6 API, whether that in turn is unstable.
>
> (This is a property of the IF-MIB and is a reason why the YANG
> equivalent
> has used a name to index the interface table and not the index value,
> which may give the users of the YANG module, also currently in Last
> Call, an interesting migration problem).
>
> So if you want a stable address, perhaps you should not use the
> interface index.
>
> Tom Petch
>
> </tp>
> I would suggest reworking the draft to separate a normative section,
> effectively a variation of the 3 lines paragraph above, and an
> informational section, the current specification of the algorithm as
> "an example of a way to achieve this result if the operating system
> meets certain condition, like stable interface identifiers."
>
> I would also explain the inherent issues that have to be solved, e.g.,
> swapping interfaces, or enabling multi-homed hosts. And I would observe
> that the DAD problem cannot be solved ina  reliable way.
>
> -- Christian Huitema
>
>
>
>
>