FW: 6MAN WG Last Call:draft-ietf-6man-ipv6-subnet-model-00.txt

["Hemant Singh (shemant)" <[e-mail]>]

Tatuya,

Maybe you have not read all the emails in 6man or v6ops related to the src-address of ND messages rule. See this email below from me where I proved why the 4th bullet rule from on-link definition in RFC4861 is needed in a router-less IPv6 network. But still, I and Wes agree with Thomas that this 4th bullet rule can be deprecated. 

Yes, in v6ops, it was alluded to that this src-address rule from ND is a security concern but no one could prove it. I will now reply to your other email from last night.

Hemant

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Hemant Singh (shemant)
Sent: Monday, June 30, 2008 10:37 AM
To: MILES DAVID; Wes Beebee (wbeebee); Wojciech Dec (wdec); Brian Haberman; [e-mail]
Cc: Bob Hinden
Subject: RE: 6MAN WG Last Call:draft-ietf-6man-ipv6-subnet-model-00.txt

David,

We will explain where we think RFC4861 came from with the 4th bullet in on-link definition in Terminology section of RFC4861. We will explain why that bullet is needed and why the bullet does not change. Further, we don't understand where you are going with these contrived examples?
It's a stretch already being in a router-less network and contriving examples that clearly have source-address selection problems. In the routerA to routerB contrived example, the example included routes between A and B. We have said routing table takes precedence over ND cache in that example. For the host to host case below, since IPv6 addresses have been configured on the hosts with a prefix length, each host has an entry in data forwarding table for the prefix derived from host IPv6 address configuration. IPv6 data forwarding tables on the host will take precedence in the same way as in your router example.

Anyhow, here is the justification for the 4th bullet in RFC 4861 which is what statements in our draft derive from.

In a router-less network, a node's network interface may be configured using manual configuration or DHCPv6. Note DHCPv6 does not dole out prefix length without which, just given an IPv6 address from DHCPv6, a
DHCPv6 client cannot make an on-link determination for any prefix.
Likewise, manual configuration may not configure a prefix length when an
IPv6 address is configured on the interface - in this case, the node still does not have any means to determine what prefix is on-link.  Thus far, any host in this network has not been able to determine if any prefix is on-link. Only if the host is able to determine any prefix is on-link, can the host in such a network send data. There in comes the rule in 4th bullet from the definition of on-link from RFC4861 that applies to this network

- any Neighbor Discovery message is received from the address.

Hemant & Wes

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of MILES DAVID
Sent: Thursday, June 26, 2008 8:57 PM
To: Wes Beebee (wbeebee); Wojciech Dec (wdec); Brian Haberman; [e-mail]
Cc: Bob Hinden
Subject: RE: 6MAN WG Last Call:draft-ietf-6man-ipv6-subnet-model-00.txt

Wes & Hemant,

Can we walk through the situation of hosts without routers where you suggest a possible issue?


HostA ----(link)---- HostB

HostA:
2002:db8:100::1234/64
2002:db8:200::1234/64

HostB:
2002:db8:100::9999/64

Are we suggesting HostA may src from 2002:db8:200::1234 to 2002:db8:100::9999, ie, we are forgoing source-address selection and are overriding this behaviour?
Assuming that is the case, and assuming HostB did in fact populate a Neighbour Cache entry with 2002:db8:200::1234 - STALE, I cannot see how this would affect HostB's next-hop/on-link determination.

According to the current text in RFC4861 HostB would perform the following on the first packet to send to 2002:db8:200::1234:
1) Check destination cache (empty, never seen this destination before)
2) Check Prefix List for on-link determination (off-link) -
2002:db8:200::1234 is not in the Prefix List
3) If off-link, select a router from Default Router List and determine next-hop IP (no default routers) --end in our example as there are no
routers--
4) Consult Neighbour Cache for link-layer address of next-hop, invoke Address Resolution if needed
5) Cache result in destination cache

I understand Neighbour Cache is not consulted for next-hop/on-link determination, and Destination Cache is updated with the result of the Prefix-List lookup (next-hop determination). So while there is a STALE entry in the Neighbour Cache, it is never queried. Similar to the case of a router, I think we would need to update a host's equivalent (the Prefix List) to affect forwarding.

It would be good to better understand the scenario you are seeing between host and host. 


Best Regards,

-David



-----Original Message-----
From: Wes Beebee (wbeebee) [mailto:[e-mail]]
Sent: Friday, 27 June 2008 12:29 AM
To: Wojciech Dec (wdec); Brian Haberman; [e-mail]
Cc: MILES DAVID; Bob Hinden
Subject: RE: 6MAN WG Last Call:draft-ietf-6man-ipv6-subnet-model-00.txt

This rule derives directly from the Terminology section of RFC 4861 (definition of on-link).

Note that the presence of a bogus entry causes no harm (the routing table takes precedence over the ND cache in this case).

However, the removal of the rule DOES cause harm in the case of communication without routers.

Therefore, we currently see no reason to change the text.

- Wes & Hemant

-----Original Message-----
From: [e-mail] [mailto:[e-mail]] On Behalf Of Wojciech Dec (wdec)
Sent: Thursday, June 26, 2008 10:05 AM
To: Brian Haberman; [e-mail]
Cc: MILES DAVID; Bob Hinden
Subject: RE: 6MAN WG Last Call:draft-ietf-6man-ipv6-subnet-model-00.txt

Based on a recent thread
(http://www.ops.ietf.org/lists/v6ops/v6ops.2008/msg00896.html) the following paragraph from the draft appears to warrant some more thought if not outright a revision

"   In addition to the Prefix List, individual addresses are on-link if
   they are the target of a Redirect Message indicating on-link, or the
   source of a valid Neighbor Solicitation or Neighbor Advertisement
   message.  Note that Redirect Messages can also indicate an address is
   off-link.  Individual address entries can be expired by the Neighbor
   Unreachability Detection mechanism."

Using unconditionally the source address of a neighbour solicitation or NA to determine on-link would indeed appear to be undesirable, unless the intent is allow some direct host-host cross subnet/prefix communication without a router involved at any stage (this is not a good idea IMO). A constraint could be introduced such as: A host only learns on-link addresses from the source of NS and NA messages iff it already has an on-link prefix that would cover that address. Learning from Redirect messages would continue to be allowed.

My 2c.
-Woj.
 

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf 
> Of Brian Haberman
> Sent: 26 June 2008 14:17
> To: [e-mail]
> Cc: Bob Hinden
> Subject: 6MAN WG Last Call:draft-ietf-6man-ipv6-subnet-model-00.txt
> 
> All,
>       This message starts a 3-week 6MAN Working Group Last Call on
> advancing:
> 
>       Title     : IPv6 Subnet Model: the Relationship between
>                   Links and Subnet Prefixes
>       Author(s) : H. Singh, et al.
>       Filename  : draft-ietf-6man-ipv6-subnet-model-00.txt
>       Pages     : 8
>       Date      : 2008-05-08
> 
> as a Proposed Standard.  Substantive comments and statements of 
> support for advancing this document should be directed to the mailing 
> list.
> Editorial suggestions can be sent to the document editor.  
> This last call will end on July 10, 2008.
> 
> Regards,
> Brian & Bob
> 6MAN co-chairs
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
> 
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[e-mail]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[e-mail]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[e-mail]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[e-mail]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------