Re: Why has RFC 4941 been designed in such a way, that it might cause address conflicts?

james woodyatt <jhw@apple.com> Tue, 15 March 2011 20:34 UTC

Return-Path: <jhw@apple.com>
X-Original-To: ipv6@core3.amsl.com
Delivered-To: ipv6@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 30A123A6976 for <ipv6@core3.amsl.com>; Tue, 15 Mar 2011 13:34:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.552
X-Spam-Level:
X-Spam-Status: No, score=-106.552 tagged_above=-999 required=5 tests=[AWL=0.047, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yR72Q6LsB0-a for <ipv6@core3.amsl.com>; Tue, 15 Mar 2011 13:34:29 -0700 (PDT)
Received: from mail-out3.apple.com (mail-out.apple.com [17.254.13.22]) by core3.amsl.com (Postfix) with ESMTP id 6FE0E3A6808 for <ipv6@ietf.org>; Tue, 15 Mar 2011 13:34:29 -0700 (PDT)
Received: from relay15.apple.com (relay15.apple.com [17.128.113.54]) by mail-out3.apple.com (Postfix) with ESMTP id 22F66D6FC28C for <ipv6@ietf.org>; Tue, 15 Mar 2011 13:35:55 -0700 (PDT)
X-AuditID: 11807136-b7c6bae000004a34-c1-4d7fcdaaa493
Received: from elliott.apple.com (elliott.apple.com [17.151.62.13]) by relay15.apple.com (Apple SCV relay) with SMTP id 68.75.18996.AADCF7D4; Tue, 15 Mar 2011 13:35:55 -0700 (PDT)
MIME-version: 1.0
Content-transfer-encoding: 7bit
Content-type: text/plain; charset="us-ascii"
Received: from [17.193.13.64] by elliott.apple.com (Sun Java(tm) System Messaging Server 6.3-7.04 (built Sep 26 2008; 32bit)) with ESMTPSA id <0LI4009W397UMI50@elliott.apple.com> for ipv6@ietf.org; Tue, 15 Mar 2011 13:35:54 -0700 (PDT)
Subject: Re: Why has RFC 4941 been designed in such a way, that it might cause address conflicts?
From: james woodyatt <jhw@apple.com>
In-reply-to: <E8CD61BF-827E-4A83-AA63-275D0CCB0B53@equinux.de>
Date: Tue, 15 Mar 2011 13:35:54 -0700
Message-id: <35A891E0-9BA1-4694-AFA3-C6C46C8F3625@apple.com>
References: <C744C51B-F2B0-4137-B39F-54B8D62F1C97@equinux.de> <E7CFEDBC-5048-413E-93C9-DBF79B4FC238@apple.com> <E8CD61BF-827E-4A83-AA63-275D0CCB0B53@equinux.de>
To: Markus Hanauska <hanauska@equinux.de>
X-Mailer: Apple Mail (2.1084)
X-Brightmail-Tracker: AAAAAA==
Cc: ipv6@ietf.org
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipv6>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Mar 2011 20:34:30 -0000

On Mar 15, 2011, at 12:11 , Markus Hanauska wrote:
> 
> [...] but making a tiny change to existing RFCs to make it impossible will always be better IMHO

Let me try again... there is no "tiny change" to existing RFCs that can make it *impossible* for address conflicts to arise.  The best we can do is to reduce the probability of address conflicts from arising inadvertently under normal usage scenarios.

You seem to think that by reserving certain IID patterns for use with different address configuration schemes, we could have more than *optimism* that DAD will succeed, c.f. RFC 4429, that we could be *certain*.  No such determinism is possible.  EUI-48 and EUI-64 addresses with global uniqueness flags are not always globally unique because factories make errors.  Cryptographic and privacy addresses can collide in rare circumstances.  Most importantly, because it's the most frequent cause of error, manual configuration procedures are-- sing it with me-- prone to manual error, including but not limited to humans inappropriately loading addresses that conflict with otherwise automatically configured addresses on the network.

No certainty is possible.  Duplicate Address Detection (DAD) is your last best hope for civilization.


--
james woodyatt <jhw@apple.com>
member of technical staff, core os networking