Re: [v6ops] A common problem with SLAAC in "renumbering" scenarios

Brian E Carpenter <brian.e.carpenter@gmail.com> Thu, 21 February 2019 19:59 UTC

Return-Path: <brian.e.carpenter@gmail.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4AD84130E57; Thu, 21 Feb 2019 11:59:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VELXd_jMJS4d; Thu, 21 Feb 2019 11:59:57 -0800 (PST)
Received: from mail-pg1-x534.google.com (mail-pg1-x534.google.com [IPv6:2607:f8b0:4864:20::534]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D3AE129A87; Thu, 21 Feb 2019 11:59:57 -0800 (PST)
Received: by mail-pg1-x534.google.com with SMTP id l11so2755945pgq.10; Thu, 21 Feb 2019 11:59:57 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=Jsp9x15MgCtIklmdHiYhrYXtCuHGWAhNqGytTu7YCEs=; b=u5qwc6IRYzKT6cuSjV447aGMBgLaWAOjvAQJmw1lWda9q+CY7QGzDYbGhX8kw2y+qU p3me15VfVZJDWaKdibLcsKf36aYhOiIjinJ3+RCMRZu5EfqbGNLiqtUeznRdRCIkLlbG XhmuyYiwClMJZV6Ar9cNt9gcu4Yq2OmviT2P/g3a+NoJi/7q+LXyt0RKzDzdlWP5G01g Rhe8cb/chNXYpqswZZe4ZETBjRxnRnUeFcz8XrynoZcTh+saoIqarEqLzVKNnbJlD3eS F0CG6zLR2NrKQNLTf2RCdncw5M0cBh4usdNlIbSkRPIOA/n0Kf3JRkzh1O8+pcTNa9JI PJ2A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=Jsp9x15MgCtIklmdHiYhrYXtCuHGWAhNqGytTu7YCEs=; b=fuVEmBKa6U9FpMwLenTjOTEIqH6HAnKxqGCjNhm7vzVCFEsDrskGp8w+/RxzOVNMGN 4THQtvSrNDgllwa2stlwT3N2jyxNNm8ga2R6Xqu83PwGCh8NTtHhuuvouZ+//pOogm4T x56O34QSBRDAQniqK3uZD+z2etpVNTSaKBbx8fSa136qZK4H5/b9Nj99PrpyXaqtYo7D msD4YC+seXk4G3KQKzCiO9GGTFwlSU33+YcGd3UUKqMie9y76lS3n10R6ajoWDMh8lih LrHUSBVPPq2vxJYJwIdGp2u13Su4GaHigMhy5dLzNSbXua04ML/Utl503SEqN6+pgnU2 jI6Q==
X-Gm-Message-State: AHQUAuZftQZgdbTPsxhvhIom8wgsdyJdj+a6VlKbSPBl+Fey3vyYQeWe mimq4Tn1UakJswTalU27ZGY=
X-Google-Smtp-Source: AHgI3Ibpe8EBca7uZ8qxSQ9NWvWI8aN7q+TqK7jGBs1hRXYiTbPDoaNEQVTsNRAJAPkOdMZqpzvlIA==
X-Received: by 2002:a62:5249:: with SMTP id g70mr236400pfb.115.1550779196457; Thu, 21 Feb 2019 11:59:56 -0800 (PST)
Received: from [192.168.178.30] ([118.148.79.176]) by smtp.gmail.com with ESMTPSA id y70sm3301115pgd.6.2019.02.21.11.59.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 21 Feb 2019 11:59:55 -0800 (PST)
To: Timothy Winters <twinters@iol.unh.edu>, Fernando Gont <fgont@si6networks.com>
Cc: IPv6 Operations <v6ops@ietf.org>, "6man@ietf.org" <6man@ietf.org>, "ek@loon.co" <ek@loon.co>
References: <60fabe4b-fd76-4b35-08d3-09adce43dd71@si6networks.com> <alpine.DEB.2.20.1901311236320.5601@uplift.swm.pp.se> <35adea8e-704a-76f2-857f-a83a9ad689ef@si6networks.com> <CAFU7BAS1_veTu-ZXAF0MF4niJwz149nGipx3ep_6fh1bewOzgg@mail.gmail.com> <d9503983-6524-a13a-2cb0-cdcb95f76ea6@si6networks.com> <CAFU7BAQfg712UfgW9wi9pd3eVeZP9cqJEXd6=FDmchuSdauv+g@mail.gmail.com> <82c00442-bbc4-581b-2054-2d02d50d20ad@si6networks.com> <CAFU7BASDgmSwY=SLiabSqyiTOphxU0COtFLQvT8drm0iTxM+-Q@mail.gmail.com> <76c488e0-5be7-3b81-d4c3-7af826f0dbef@si6networks.com> <CAAedzxq5d0fgOq5KZu7aCL9wxoDij6C-1Ad9+nQbYyhu2aMt-Q@mail.gmail.com> <da1c6391-5e69-f09b-dee5-83d25f1cd8cd@si6networks.com> <CAAedzxouCqcmW0rA6KwDZEO-n5yVZUYHc+GSetJ8O7=Liou4tA@mail.gmail.com> <0DDB4538-62F8-442A-A12C-D3C176540884@jisc.ac.uk> <a0a4246c-24cd-905c-4cde-0428b83ba5a3@si6networks.com> <CAOSSMjVtOXOOCHVvofsMQH5=bjV_tupqCKed6C4fXiS_ZnCSQg@mail.gmail.com>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Message-ID: <0e3a8985-6aa6-e24d-dc83-82f7b5012cc6@gmail.com>
Date: Fri, 22 Feb 2019 08:59:48 +1300
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1
MIME-Version: 1.0
In-Reply-To: <CAOSSMjVtOXOOCHVvofsMQH5=bjV_tupqCKed6C4fXiS_ZnCSQg@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/OwElUzVjU1OyiGIFcdTPEcsmxNM>
Subject: Re: [v6ops] A common problem with SLAAC in "renumbering" scenarios
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Feb 2019 19:59:59 -0000

On 2019-02-22 05:14, Timothy Winters wrote:
> On Thu, Feb 21, 2019 at 11:12 AM Fernando Gont <fgont@si6networks.com>
> wrote:
> 
>> On 21/2/19 07:41, Tim Chown wrote:
>>>> On 21 Feb 2019, at 02:01, Erik Kline <ek@loon.co <mailto:ek@loon.co>>
>>>> wrote:
>>>>
>>>> On Wed, 20 Feb 2019 at 17:49, Fernando Gont <fgont@si6networks.com
>>>> <mailto:fgont@si6networks.com>> wrote:
>>>>
>>>>     Hi, Eric,
>>>>
>>>>     On 20/2/19 22:12, Erik Kline wrote:
>>>>     >
>>>>     >
>>>>     > On Wed, 20 Feb 2019 at 17:07, Fernando Gont
>>>>     <fgont@si6networks.com <mailto:fgont@si6networks.com>
>>>>     > <mailto:fgont@si6networks.com <mailto:fgont@si6networks.com>>>
>>>>     wrote:
>>>>     >
>>>>     >     On 20/2/19 06:36, Jen Linkova wrote:
>>>>     >     [...]
>>>>     >     >> Example:
>>>>     >     >>
>>>>     >     >> Say you have two network interfaces: If1 and If2.
>>>>     >     >> Say If1, is configured with 2001:db8:1::/64, and If2 with
>>>>     >     2001:db8:2::/64
>>>>     >     >>
>>>>     >     >> Say the first default router is that associated with If1.
>>>>     >     >>
>>>>     >     >> Say prefix 2001:db8:1::/64 stops being announced, or that
>>>>     you stop
>>>>     >     >> receiving RAs on If1, but RAs on If2 keep arriving fine.
>>>>     >     >>
>>>>     >     >> Based on the logic of your algorithm, one would expect
>>>>     that a new
>>>>     >     >> connection uses 2001:db8:2::/64/If2 (since that's the
>>>>     "more recently
>>>>     >     >> advertised information). However, Rule #5 would override
>>>>     that and
>>>>     >     make
>>>>     >     >> you employ 2001:db8:1::/64/If1, since Rule #5 prioritizes
>>>>     >     addresses on
>>>>     >     >> the outgoing interface.
>>>>     >     >
>>>>     >     > I'm even more confused now, sorry ;((
>>>>     >
>>>>     >     I was referring to the fact that some of the previous rules
>>>>     might
>>>>     >     prevent the evaluation of the rule about freshness. e.g.:
>>>>     >
>>>>     >     * You have two network interfaces eth0 and eth1 (say each
>>>>     connected to a
>>>>     >     different ISP)
>>>>     >     * eth0 has stopped receiving RAs
>>>>     >     * eth1 receives RAs as usual (hence all info associated with
>>>>     this
>>>>     >       interface is "fresher" than than corresponding to eth0)
>>>>     >     * The default router employed by eth0 has precedence
>>>>     (whether because it
>>>>     >       had a higher preference value, because it was the first
>>>>     one that was
>>>>     >       learned, or whatever)
>>>>     >     * When you evaluate the rules in RFC6724, rule 5 will say
>>>>     that the
>>>>     >       outgoing interface will be eth0, and thus you should pick
>>>>     an address
>>>>     >       associated with it --- however, as noted above, the
>>>>     addresses on eth1
>>>>     >       are fresher than those from eth1.
>>>>     >
>>>>     >
>>>>     > Not receiving multicast RAs is not a condition you can really
>>>>     take any
>>>>     > action on.
>>>>
>>>>     Agreed.
>>>>
>>>>     The main issue I see with incorporating an explicit rule in RFC6724
>>>>     about "freshness" is that in multi-prefix scenarios, it's guaranteed
>>>>     that the default SA will oscillate among the different prefixes, and
>>>>     that if you only implement this workaround, you wouldn't be able to
>>>>     communicate with hosts actively employing your stale prefix.
>>>>
>>>>
>>>> that's where rule 5.5 would help (wherever it is actually implemented;
>>>> alas...)
>>>
>>> Yeah.... we did add an explicit pointer to this in the Nodes
>>> Requirements -bis, fwiw (noting RFC 8028).
>>
>> Probably an irrelevant question to ask now :-), but, anyway: any clues
>> why RFC8028 is a "SHOULD" rather than "MUST"? -- It would seem to me you
>> cannot really do multi-prefix without RFC8028...
>>
> My memory of this was the working group wasn't convinced that every node
> needed to support it.

fwiw the text changed from "would therefore be applicable" to "SHOULD"
after IESG review of draft-ietf-6man-multi-homed-host-07, and specifically
following a comment from Alvaro Retana. I didn't find anything to indicate
that we discussed MUST at all.

But indeed, nodes that don't support rule 5.5 are at risk from egress
filtering.

   Brian

>>
>> --
>> Fernando Gont
>> SI6 Networks
>> e-mail: fgont@si6networks.com
>> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
>>
>>
>>
>>
>> _______________________________________________
>> v6ops mailing list
>> v6ops@ietf.org
>> https://www.ietf.org/mailman/listinfo/v6ops
>>
> 
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>