Re: 6MAN Adoption call on raft-chakrabarti-nordmark-6man-efficient-nd-04

[Lorenzo Colitti <[e-mail]>]

On Wed, Nov 20, 2013 at 4:23 AM, Mark ZZZ Smith
<[e-mail]>wrote:

> It is also a method of preventing source address spoofing towards off-link
> victims. The router could refuse to forward packets for which the source
> address isn't registered and therefore validated as present.
>

More in general, it's a way for the router to control what the host can do
on the link, and what addresses it can assume. We never had that in the
IPv6 architecture. Why do we need it?

And, yes, I am well aware that "we can already do this today stuff". The
problem is that that argument isn't really true. Sure, a wifi AP can
already decide to accept packets only if your IID is prime and the
 immediately-highest on-link is a perfect square. And sure, a wifi AP can
already deny the capability to use more than one address - hell, it can
simply dropping all the sent by all addresses except one. And sure, an
operator can already decide not to let you onto the network if you don't do
DHCPv6.

But we *don't do* this today. Why? Because it breaks compliant host
implementations, and when hosts break users complain, and when users
complain it creates pressure on the network operator and the network
designer to fix the problem.

For example: today, if you only accept packets from two IPv6 addresses per
MAC address, then implementations break. Privacy addresses don't work, the
host has no way of knowing that its packets are being dropped, and things
generally don't work that well. At best, HE implementations will use IPv4
and possibly cause scaling issues on NATs and latency issues for users.
This suboptimal operation causes operators to modify their configurations
in order to provide working service to clients. This is very different from
making registraion a supported mode of operation.

What this draft proposes is to place the control of what happens on link in
the hands of the registering router, and make this a *supported mode of
operation*. Yes, this is possible today, but *not without application
breakage*. There is a huge difference; in fact, it's quite a fundamental
change in the architecture to have a limited set of layer 3 devices be
gatekeepers for all on-link communication.