Re: Last Call: <draft-ietf-6man-rfc4291bis-07.txt> (IP Version 6 Addressing Architecture) to Internet Standard

Lorenzo Colitti <lorenzo@google.com> Wed, 22 February 2017 15:57 UTC

Return-Path: <lorenzo@google.com>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E3A1129A41 for <ipv6@ietfa.amsl.com>; Wed, 22 Feb 2017 07:57:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0fxstGSVALh3 for <ipv6@ietfa.amsl.com>; Wed, 22 Feb 2017 07:57:09 -0800 (PST)
Received: from mail-ua0-x229.google.com (mail-ua0-x229.google.com [IPv6:2607:f8b0:400c:c08::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87C16129A45 for <ipv6@ietf.org>; Wed, 22 Feb 2017 07:57:07 -0800 (PST)
Received: by mail-ua0-x229.google.com with SMTP id g30so4475991uac.3 for <ipv6@ietf.org>; Wed, 22 Feb 2017 07:57:07 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=2/tnWnIvuYT4QcpDrle9xMCLJ646fRHxwpe1Ty8TAJA=; b=vezZeEIlBZ5bXXgi7DO8MUH9u1+Pednu76w6jeFrNYnyEj/Sn026rRHStmlDYKJq6t Ku5n5hx26CgoaBr9xKk8kX2k3sy/fWlk2VETJWAknoFmWZw3DrrVeSEOu7UYvi9GBewR fGz6qWs6h2bd7c6pyjkykxI6UNFCv+f5YNpV8J2jb3vbtmll8s1zuYg2mVKcPHOtbL6v 5rcTeF/5umjfKoZhiaJzMEnMOrJpJjzN3LYgsFJDx5v6NF4LLBUls0IxddUAd3bOOfZH xHMHuuY7vFiU3pUjQHHLRjlS2dGgAunllxxqLou5HSYwOuXODtOkhRackovBcdb6Hh3g Gpzg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=2/tnWnIvuYT4QcpDrle9xMCLJ646fRHxwpe1Ty8TAJA=; b=byzGocESIlrQYUclF3oNVILx9BP4CKw/FaZ6CWahR3IuGSCGihwKWcYvBLrTWwNIDj 3mSDkYzQsxeXKHNIwTxvIZ3n1+AAtW99Pyh8ZqFkaRyTH1e+JXn9SgFt8PBFAiDJcKbx x8bdhzqZzcnxx3a8CT14j5U50kbZ2wgrAeiMO1Qc0jd4zEfuqPc0hDNn/TvevZz4GMsR OihAXR2KASmA05H2g8tsuGXxlOmvIfMWS2BzohIiUoGGQdUGY3EF8qrrt1G3yolO9baj XCLjv9+0sDA66B6ew4szbBwFjQhaJsXo6UrFqbLFxTBNjQzJFcliVdmbl0tdUKqq5fB9 hZCw==
X-Gm-Message-State: AMke39kq2XoT772m5Kvpqsrj5S+HMLSMrklWgL7fE5wxWQZC12w4nYULusJlKvn9DSTZ4vGBZaw63P9flXLs8i74
X-Received: by 10.176.8.4 with SMTP id a4mr255664uaf.171.1487779026289; Wed, 22 Feb 2017 07:57:06 -0800 (PST)
MIME-Version: 1.0
Received: by 10.31.171.2 with HTTP; Wed, 22 Feb 2017 07:56:45 -0800 (PST)
In-Reply-To: <20170222153129.GE89584@hanna.meerval.net>
References: <20170221101339.GC84656@Vurt.local> <CAKD1Yr33oQb=gMGaEM++hLgmMtxMdihiDrUihEsjs63vy8qRbA@mail.gmail.com> <54c81141-e4f5-4436-9479-9c02be6c09bb@Spark> <CAKD1Yr28iQHt0iuLvR3ndrT3Hfct=4k9dxjJeu3MAjDjOogEvA@mail.gmail.com> <CAL9jLaZgTp++PJ9KGHEWuPoVm6t3b8QfVDCEhz5h4fv-0fuUAA@mail.gmail.com> <CAKD1Yr3SbR=xt3RPu7+q1o14wKuUuwUc6oG+BgZtEK1O+m5sWw@mail.gmail.com> <4936e96b-fc82-4de0-9188-ced9547deb2f@Spark> <CAKD1Yr3K+SJb_4ksZ96yNypVKJE-fXopuVaXNhhKp1gkh1=QEg@mail.gmail.com> <20170222144147.GC89584@hanna.meerval.net> <CAKD1Yr2n=ogFo7LJYgjcraoFxioQQzmo8HYxzNRJ10VA8xMVOg@mail.gmail.com> <20170222153129.GE89584@hanna.meerval.net>
From: Lorenzo Colitti <lorenzo@google.com>
Date: Thu, 23 Feb 2017 00:56:45 +0900
Message-ID: <CAKD1Yr2-yS-tX9Pe0Rk_74hnXa9Rc-yTHV0m=Kbi2q0wvYGgPg@mail.gmail.com>
Subject: Re: Last Call: <draft-ietf-6man-rfc4291bis-07.txt> (IP Version 6 Addressing Architecture) to Internet Standard
To: Job Snijders <job@ntt.net>
Content-Type: multipart/alternative; boundary="f403045ee7785e73b70549208cc5"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipv6/XMujzA7DkaTlZ87X50-5zaQ9QIA>
Cc: 6man WG <ipv6@ietf.org>, draft-ietf-6man-rfc4291bis@ietf.org, IETF-Discussion Discussion <ietf@ietf.org>, 6man-chairs@ietf.org
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipv6/>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Feb 2017 15:57:10 -0000

On Thu, Feb 23, 2017 at 12:31 AM, Job Snijders <job@ntt.net> wrote:

> rfc6164 and rfc6583 are great examples that document considerations
> regarding not using a /64, it simply is not always the best fit.
>

RFC6583-style attacks (of which the class addressed by RFC6164 is a subset)
are low payoff and pretty easy to mitigate using very small changes to ND
implementations. You can solve most or all of the problem by using
per-interface ND queues and prioritizing existing and gleaned ND entries
over incomplete ones. You can do even better by pushing the filtering away
from the host so that you don't have to carry the packets.

Also, bear in mind that the interface ID length is *not* the same as the
prefix you route to the link. Given that you're talking about static
configuration, you can perfectly well configure all the hosts with /64
prefixes, but give them addresses that are all in a given /120 and then
route only the /120 to that link. That will also avoid all the attacks.

It also makes configuration much simpler, because you don't have to touch
any of the hosts when you run out of the /120: just increase the /120 to a
/119 on the router and move up from ::ff to ::100. That is 100% supported
by the current text of RFC4291bis, which requires that the router forward
packets to the /120.

This trick doesn't work in IPv4, so it will take a bit of getting used to
for people who only know IPv4, but I doubt that's the common case in NTT.

As such, I am confident to state that almost every deployed backbone
> uses a mixture of /64, /127, /126 and perhaps other lengths.

...

> There is public data that suggests that the backbone you are familiar
> with might be connected to a public internet exchange which uses a /112
> as peering lan prefix.
>

For the record, I don't dispute either of those.

> Also, backbone networks are a tiny percentage of the links on the planet.
>
> I certainly will not deny that fact. Are you familiar with the concept
> of the McNamara fallacy?
>

I wasn't. But that fallacy would apply to your arguments just as well as to
mine. You're the one that brought numbers to the thread first.