Re: there should be a ULA prefix?? [was: A common problem with SLAAC in "renumbering" scenarios]

On Wed., 27 Feb. 2019, 10:57 Brian E Carpenter, <brian.e.carpenter@gmail.com>
wrote:

> On 27-Feb-19 11:10, Mark Smith wrote:
> > On Wed., 27 Feb. 2019, 06:36 Brian E Carpenter, <
> brian.e.carpenter@gmail.com>
> > wrote:
> >
> >> Philip,
> >>
> >> On 26-Feb-19 23:33, Philip Homburg wrote:
> >>>> So given that document is 12 years old, with that default copied from
> >> one that
> >>>> is 21 years old, is an update required?
> >>>>
> >>>> And if so, to what?
> >>>
> >>> I think this should be updated.
> >>>
> >>> A long time ago, the model was that you would get a prefix from your
> ISP
> >>> and that was the only global prefix on the local network.
> >>>
> >>> So with short lifetimes, if the internet connection would go down for a
> >>> relatively long period, there would be no global prefix anymore and
> hosts
> >>> would have to resort to link local to communicate (which obviously
> fails
> >>> if there are multiple subnets).
> >>>
> >>> Some time in the past, the thinking changed and now there should be a
> ULA
> >>> prefix in addition to any global prefixes.
> >>
> >> Really? Where do you think that is stated?
> >>
> >> I happen to run my CPE with ULA enabled, but I'm not aware of any
> >> recommendation to do so.
> >>
> >
> > RFC7084. Was also in its ancestor.
>
> Not so. All it says is:
>
>    ULA-1:  The IPv6 CE router SHOULD be capable of generating a ULA
>            prefix [RFC4193].
>

That could be interpreted to mean if it is capable of generating a ULA then
it should generate and announce one. It's probably a bit of ambiguity in
what generate can mean - generate could mean generate without
using/announcing it, but what would be the point of doing so?

There is earlier text in that section such implies ULAs are to be used if
the device can  generate them - "will need".

   An IPv6 CE router is expected to support an IPv6 end-user network and
   IPv6 hosts that exhibit the following characteristics:

   1.  Link-local addresses may be insufficient for allowing IPv6
       applications to communicate with each other in the end-user
       network.  The IPv6 CE router will need to enable this
       communication by providing globally scoped unicast addresses or
       ULAs [RFC4193 <https://tools.ietf.org/html/rfc4193>], whether
or not WAN connectivity exists.

> Unless I've missed something, nowhere does it recommend that ULA
> should be enabled by default, and even though I'm a strong advocate
> of ULAs, it isn't obvious that they should be on by default as a
> general recommendation.
>
> > OpenWRT is enabling ULAs by default (although with infinite lifetimes
> which
> > is something that should be changed).
>
> And for homenets that is a reasonable default IMHO, and is advocated
> by RFC7368. However, https://tools.ietf.org/html/rfc7788#section-6.5
> doesn't make it mandatory.
>

The concern with infinite is that in theory they'll persist on a hosts
interface until the OS is rebooted. So a mobile laptop that is suspended
while moved around, and never rebooted could carry those addresses around
and possibly open sockets around for months.

Infinite LTs are implying the address is infinitely valid in any context.
It would be the most extreme case of the issue Fernando and Jan have raised.

I think the loopback address is the only address where infinite lifetimes
are valid. The Link-Local prefix has infinite lifetimes, however I think
there is a privacy case where link-local addresses shouldn't. (Which I'll
put in an email in the next day or so.)

> > Back in 2010 Fritzboxes were doing ULAs too, although badly. They had all
> > zeros random parts, and were trying to swap them in and out with the PD
> GUA
> > addresses as the WAN link went up or down. (It seemed they didn't
> > understand the fundamental idea that IPv6 supports multiaddressing.)
>
> My 2013-vintage FritzBox does better than that.
>

Good. I worked for the ISP who introduced them to Australia, and was doing
work with a number of IPv6 CPE vendors, however Fritz just seemed to be a
blackhole regarding working with us to improve their IPv6 implementation at
the time.

Regards,
Mark.

>    Brian>
> >>> So I think that with a ULA, it makes more sense for a CPE to limit
> >> lifetimes
> >>> to some multiple of the RA interval.
> >>
> >> Why? I don't expect my ULA prefix to change ever. Or do you mean the
> >> lifetimes
> >> for globally routeable prefixes?
> >
> >
> >>    Brian
> >>
> >> --------------------------------------------------------------------
> >> IETF IPv6 working group mailing list
> >> ipv6@ietf.org
> >> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> >> --------------------------------------------------------------------
> >>
> >
>