Re: Limited Domains:

[Toerless Eckert <[e-mail]>]

> On 14-Apr-21 22:36, Stewart Bryant wrote:
> > As far as I can see the only safe limited domain protocol is one specifically designed for use in limited domains.

Which IMHO does not exclude the option to design such a protocol for
limited domain in a way that it also supports "non-limited domains".

> On Thu, Apr 15, 2021 at 08:33:58AM +1200, Brian E Carpenter wrote:
> Absolutely. And also, there needs to be a secure and objective definition of the membership and boundary of the domain. That's why we wrote RFC8799.

And especially the permissible/desirable in/out between the limited domain
and other networks, because limited domain >= isolated domain. That
particular issue is what makes semantic overloading problematic as
any enterprise operator can attest to who has gone through an M&A
of multiple 10 net domains, or who had to start multi-homing without
PI addresses just to name two common cases.

Cheers
    Toerless

>    Brian
> 
> > Any other approach leads to confusion, mistakes, security threats, complexity and cost.
> > 
> > Thus declaring that an ???ordinary??? IPv6 packet can simultaneously have both global and limited scope has the potential for creating significant issues for those wishing to use basic IPv6 in a limited domain.
> > 
> > We have an example of an IETF limited domain protocol: MPLS. This has a very simple lightweight data plane security model: it is a different protocol from IP and if it is presented with an IP packet at its edge, it simple wraps it in MPLS and sends it safely on its way across the network for export Into some other network. Operators have a lot of experience with this protocol and we know that the model that MPLS is not IP results in complete confidence that the network will not confuse the two.
> > 
> > Equally we know of cases where IP is vulnerable to attack because it is so difficult to exclude packets. This was at the heart of the reason that source routing, was deprecated some years ago.
> > 
> > Now I am not for a moment suggesting that the limited domain applications that the flow-label authors have in mind should be done in MPLS, but I am suggesting that if they want a limited domain protocol with properties different from IPv6, and there is no obvious way to unambiguously indicate the new functionality in basic IPv6, they ought to design a protocol with the properties that they require that is not IPv6.
> > 
> > I am reminded in this discussion of the a time when another SDO wanted to make a ???small??? incompatible change to MPLS and argued that as this was only deployed in a limited domain that was safe.The IETF position was that incompatible and unrecognisable modification to one of our network protocols was a bad thing. A protracted high profile argument ensued and in the end  the IETF view won the day.
> > 
> > This protracted discussion on flow labels seems to be in a similar mould, and I would argue that we should not accept a change to the forwarding actions on an IPv6 packet unless it is possible for the forwarder to know precisely and unambiguously  which action it is to take on the packet is is currently parsing.
> > 
> > - Stewart
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

-- 
---
[e-mail]