Re: Limited Domains:

[Robert Raszuk <[e-mail]>]

I think this this thread nicely demonstrates that we need to first define
what a "limited domain" is.

To some it seems to be 1980s definition of an IGP network boundary. More
modern folks would consider as "limited domain" a set of IGP ASNs areas
interconnected by p2p BGP still under the same administration.

For me "limited domain" is an arbitrary collection of sites anywhere in the
world using Internet for inter-connectivity.

So any protocol which claims to be defined for "limited domain" and which
claims that it is backwards compatible with nodes not supporting it is
equal to allow it to traverse Internet.

As simple as this.

Cheers,
Robert.




On Wed, Apr 14, 2021 at 12:36 PM Stewart Bryant <[e-mail]>
wrote:

> As far as I can see the only safe limited domain protocol is one
> specifically designed for use in limited domains.
>
> Any other approach leads to confusion, mistakes, security threats,
> complexity and cost.
>
> Thus declaring that an “ordinary” IPv6 packet can simultaneously have both
> global and limited scope has the potential for creating significant issues
> for those wishing to use basic IPv6 in a limited domain.
>
> We have an example of an IETF limited domain protocol: MPLS. This has a
> very simple lightweight data plane security model: it is a different
> protocol from IP and if it is presented with an IP packet at its edge, it
> simple wraps it in MPLS and sends it safely on its way across the network
> for export Into some other network. Operators have a lot of experience with
> this protocol and we know that the model that MPLS is not IP results in
> complete confidence that the network will not confuse the two.
>
> Equally we know of cases where IP is vulnerable to attack because it is so
> difficult to exclude packets. This was at the heart of the reason that
> source routing, was deprecated some years ago.
>
> Now I am not for a moment suggesting that the limited domain applications
> that the flow-label authors have in mind should be done in MPLS, but I am
> suggesting that if they want a limited domain protocol with properties
> different from IPv6, and there is no obvious way to unambiguously indicate
> the new functionality in basic IPv6, they ought to design a protocol with
> the properties that they require that is not IPv6.
>
> I am reminded in this discussion of the a time when another SDO wanted to
> make a “small” incompatible change to MPLS and argued that as this was only
> deployed in a limited domain that was safe.The IETF position was that
> incompatible and unrecognisable modification to one of our network
> protocols was a bad thing. A protracted high profile argument ensued and in
> the end  the IETF view won the day.
>
> This protracted discussion on flow labels seems to be in a similar mould,
> and I would argue that we should not accept a change to the forwarding
> actions on an IPv6 packet unless it is possible for the forwarder to know
> precisely and unambiguously  which action it is to take on the packet is is
> currently parsing.
>
> - Stewart
>
>