[IPv6]Re: Should known-local be a generalized mechanism?

Kyle Rose <krose@krose.org> Mon, 12 August 2024 02:36 UTC

Return-Path: <krose@krose.org>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9AD6C14F6E1 for <ipv6@ietfa.amsl.com>; Sun, 11 Aug 2024 19:36:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.106
X-Spam-Level:
X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=krose.org
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gy-9cKU5FDIh for <ipv6@ietfa.amsl.com>; Sun, 11 Aug 2024 19:36:31 -0700 (PDT)
Received: from mail-ed1-x530.google.com (mail-ed1-x530.google.com [IPv6:2a00:1450:4864:20::530]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8280C14F6A5 for <ipv6@ietf.org>; Sun, 11 Aug 2024 19:36:31 -0700 (PDT)
Received: by mail-ed1-x530.google.com with SMTP id 4fb4d7f45d1cf-5b01af9b0c9so4006565a12.3 for <ipv6@ietf.org>; Sun, 11 Aug 2024 19:36:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=krose.org; s=google; t=1723430190; x=1724034990; darn=ietf.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=SasY80J3FjXIPKhiHlDNjTymDlVBZSuZlVKaUYlLc6c=; b=UiTSB+CH+RZFIWg+U+4E1Vh2IpuiqdMMUAnpPO9ghp9srf+JGPk/qnj9uONJ6cd7sY n9TN2So+yZuy5o5MA6HLtoWbIKknTQ5hQCVhItL3mJayNBR53tLGfNMD6ITdYDGkzH/m dZJzIwo40AVxMz3sHx6xrIONuD0qBTi/A8aBQ=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1723430190; x=1724034990; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=SasY80J3FjXIPKhiHlDNjTymDlVBZSuZlVKaUYlLc6c=; b=hIxpUaDFxpUyt2MEnPtTD1pK2udjHGRzGguk6HwmAfE37jfubwD7ZUEhPPsmnsuIIb /DgS8HhNwCSA3+E2RIykH5HSsS7Gp8eQNPh1zVqAqnFBrkWaYzbCs11VATwofncMFWhG gFJWFZKkCVIAqv49u8YFQBhKNOa3RPTDksSVDrmcu5Hu7FcSxl3mursu0FyYTnpyqKXU tONgvBE+nH50pxJIkurP4+lGiXOYbk9Bs1SJnK6gHM5VbhWXBwei5ZC4l4t6BAW97dj9 9Skfe5uU5VQkzHIz7kij6iDo00YaEiXocSwfcz/YPhU5eKxm0n3WVCBCcA9gt8Wv165J WAkw==
X-Forwarded-Encrypted: i=1; AJvYcCUul+kIcLpQnM7CCNmr586eVjBoJtshrFrqg3LgfbvU92tpTrOL6iK4T0rEX9llq3T/tgNTYN2j91hF37XR
X-Gm-Message-State: AOJu0YyeLvcoLEVOeTbXYUuMWuwueh9gx6RUazSq9K9VBDF3KLhUCk1F 5doqI42P8xF2HBtN87jWsmXSay+TyeDzgFRlAQuiLLGGSaElNdxPYSpMwZ7b/xeytPHABJBgEzo DYVNEF7f/ttOFVBYBzj8YnUjuFrco9ofBHuIyHpf9s44TU2ea
X-Google-Smtp-Source: AGHT+IH9xlDoxY4Sb9HHw4EDG2ECP5y+8rwfmDQXvePn5bVT5X7AUOChYp4cJ+V2uq0LKCmgdV86hN+BgWtN9FyTZWA=
X-Received: by 2002:a17:907:efde:b0:a77:b01b:f949 with SMTP id a640c23a62f3a-a80aa600c8cmr603879666b.35.1723430188935; Sun, 11 Aug 2024 19:36:28 -0700 (PDT)
MIME-Version: 1.0
References: <CAN-Dau2W6E5QOfxg1RRGcje=xc7wjQse4VZVWHou6gAyUe7UoA@mail.gmail.com> <CAJU8_nXiDkTCnP86Qb1feeAPYz19AnmHLUV68ydz4O+oLT=qGQ@mail.gmail.com> <DB9PR07MB7771997A65124BA6A25D9FC0D6B92@DB9PR07MB7771.eurprd07.prod.outlook.com> <15169.1723331258@obiwan.sandelman.ca>
In-Reply-To: <15169.1723331258@obiwan.sandelman.ca>
From: Kyle Rose <krose@krose.org>
Date: Sun, 11 Aug 2024 22:36:17 -0400
Message-ID: <CAJU8_nXCuqYQRxJJhMoCh1iP_JD+6CbJ2W17gHenoyUwWo5OSw@mail.gmail.com>
To: Michael Richardson <mcr+ietf@sandelman.ca>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Message-ID-Hash: 53ABZJRMDEAOYLEIZ5CSIQQDUDKYJL3W
X-Message-ID-Hash: 53ABZJRMDEAOYLEIZ5CSIQQDUDKYJL3W
X-MailFrom: krose@krose.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-ipv6.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Tim Chown <Tim.Chown=40jisc.ac.uk@dmarc.ietf.org>, 6man WG <ipv6@ietf.org>
X-Mailman-Version: 3.3.9rc4
Precedence: list
Subject: [IPv6]Re: Should known-local be a generalized mechanism?
List-Id: "IPv6 Maintenance Working Group (6man)" <ipv6.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipv6/EcPDNJJtLujiCE4xMv_8N2okea8>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipv6>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Owner: <mailto:ipv6-owner@ietf.org>
List-Post: <mailto:ipv6@ietf.org>
List-Subscribe: <mailto:ipv6-join@ietf.org>
List-Unsubscribe: <mailto:ipv6-leave@ietf.org>

On Sat, Aug 10, 2024 at 7:07 PM Michael Richardson
<mcr+ietf@sandelman.ca> wrote:
>     > I still don't really understand what problem known-local is trying to
>     > solve outside of misconfigurations (e.g., ULA prefixes that leak into
>     > global DNS), but that aside, I simply don't need it in my deployments:
>     > my router advertises a default route that applies to both GUA and ULA,
>     > with the router actively rejecting with destination-unreachable any
>     > packets a client tries to send to a ULA not in the router's FIB, i.e.,
>
> What happens to your default route when you have lost all your connectivity?
> Yes, many of us our involved in significant engineering making sure that
> never happens, but in other situations, global connectivity might be less
> critical, impossible (disasters) or might even be unwanted at that time.
> Yet, local connectivity is still important.  That's why we have ULAs!
>
> Tim, I'm not even sure what use ULAs are in R&E networks. Why do you have
> them at all?  Or do you?

Tim didn't write that text. I did. (There appears to be some quoted
email mangling involved.)

A default route to my border router always exists. If it has no
connectivity to the public internet, those packets just get dropped.
But all internal connectivity continues to work just fine, including
(src,dst) pairs involving RFC 1918 space and ULAs within the given
site. The router decides whether VPN-connected ULAs or public internet
destinations are currently reachable or not, and clients simply have
to deal with the fallout when they get RESETs, ICMP
destination-unreachables, or timeouts.

Kyle