Re: [v6ops] draft-ietf-v6ops-host-addr-availability discussion

Brian E Carpenter <brian.e.carpenter@gmail.com> Tue, 03 November 2015 01:46 UTC

Return-Path: <brian.e.carpenter@gmail.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3EAD71B2B5F for <v6ops@ietfa.amsl.com>; Mon, 2 Nov 2015 17:46:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gPtaZ-_m0Hvn for <v6ops@ietfa.amsl.com>; Mon, 2 Nov 2015 17:46:10 -0800 (PST)
Received: from mail-pa0-x232.google.com (mail-pa0-x232.google.com [IPv6:2607:f8b0:400e:c03::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FBC91B2B5B for <v6ops@ietf.org>; Mon, 2 Nov 2015 17:46:10 -0800 (PST)
Received: by pasz6 with SMTP id z6so2889240pas.2 for <v6ops@ietf.org>; Mon, 02 Nov 2015 17:46:09 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:cc:from:organization:message-id:date :user-agent:mime-version:in-reply-to:content-type :content-transfer-encoding; bh=rdfdKfgWquUC/D71xH1J+GG2Zpc89AVb7tJP1nd3ix4=; b=SKxhxAhSRbbjwD5hfGZafGuqaVgDlHpqzIU7SPEzqr0LsS5vXH1jkVeEx6gDal+USa IObCuiByrgZmUmEeljU7W7kdM2YbUFCMHDFY8Xw1Ii3jhZtBCVcgTpSo6880T1vw6GKP 71GqAqRwxGNJAyrqME8BeRpLhEy2Rddb/+GVcaPwCxRZ3sFpRc1dDU+mHvCIn4Rnyz2Q sH8nSpwdaasGVlnzQUIXU5EbkJrJ/I7Eoi29EoPJpYMxfYs9NFkxvKtNKGAc0LDh2qxI ol7PnnUGeLPwwaOUAjxeNXBWh9WPy8lGtlr7nt6OSXro0IIjMjE1OWaZP6V8qzvc2OKM Pjbw==
X-Received: by 10.66.228.199 with SMTP id sk7mr31092810pac.8.1446515169898; Mon, 02 Nov 2015 17:46:09 -0800 (PST)
Received: from ?IPv6:2001:df0:0:2006:c0da:ac17:5f6d:8e76? ([2001:df0:0:2006:c0da:ac17:5f6d:8e76]) by smtp.gmail.com with ESMTPSA id sb6sm9185440pbc.66.2015.11.02.17.46.06 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Nov 2015 17:46:08 -0800 (PST)
To: "Templin, Fred L" <Fred.L.Templin@boeing.com>, Lorenzo Colitti <lorenzo@google.com>
References: <8D175A1F-B1AE-44B4-838E-1C853B6C937D@cisco.com> <2134F8430051B64F815C691A62D9831832F391A7@XCH-BLV-504.nw.nos.boeing.com> <CAKD1Yr15C-uoxUw0kgWO-d=LmUK8qWGLS7vt+22W+k8xXtDY+g@mail.gmail.com> <2134F8430051B64F815C691A62D9831832F393F1@XCH-BLV-504.nw.nos.boeing.com> <2134F8430051B64F815C691A62D9831832F3941D@XCH-BLV-504.nw.nos.boeing.com>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Organization: University of Auckland
Message-ID: <563811DF.9020603@gmail.com>
Date: Tue, 3 Nov 2015 14:46:07 +1300
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <2134F8430051B64F815C691A62D9831832F3941D@XCH-BLV-504.nw.nos.boeing.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Archived-At: <http://mailarchive.ietf.org/arch/msg/v6ops/ZNZAgwMr3cen2Sof4OIki37a1-Y>
Cc: "v6ops@ietf.org" <v6ops@ietf.org>
Subject: Re: [v6ops] draft-ietf-v6ops-host-addr-availability discussion
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 03 Nov 2015 01:46:12 -0000

On 03/11/2015 14:31, Templin, Fred L wrote:
> Bumping up one level – is it clear to everyone that it is OK to assign addresses
> taken from a DHCPv6 delegated prefix to the interface over which the prefix
> was received? 

If it was legitimately received, I can't see why it wouldn't be OK.

> And, that DAD is not required for those addresses?

How is that safe? What is to stop a host running SLAAC once it
sees that prefix in an RA, and hitting the same IID by chance?
At least you need to specify that the A bit must not be set.

Come to that, a manual address might collide.

    Brian

> 
> Thanks - Fred
> 
> From: v6ops [mailto:v6ops-bounces@ietf.org] On Behalf Of Templin, Fred L
> Sent: Monday, November 02, 2015 5:24 PM
> To: Lorenzo Colitti
> Cc: v6ops@ietf.org
> Subject: Re: [v6ops] draft-ietf-v6ops-host-addr-availability discussion
> 
> Hi Lorenzo,
> 
> Responses below in “green”:
> 
> From: Lorenzo Colitti [mailto:lorenzo@google.com]
> Sent: Monday, November 02, 2015 5:04 PM
> To: Templin, Fred L
> Cc: Fred Baker (fred); v6ops@ietf.org<mailto:v6ops@ietf.org>
> Subject: Re: [v6ops] draft-ietf-v6ops-host-addr-availability discussion
> 
> On Tue, Nov 3, 2015 at 8:59 AM, Templin, Fred L <Fred.L.Templin@boeing.com<mailto:Fred.L.Templin@boeing.com>> wrote:
> I have one text addition suggestion and one question. On P. 7, in Table 1,
> suggest adding a new final row as follows:
> 
>   requires DAD               Yes                  Yes                   No                 N/A
> 
> Meaning that multi-addresses configured by SLAAC or DHCPv6 IA_NA/IA_TA
> must use DAD to check for duplicates on the link they were obtained. In a
> multi-addressing environment where millions of addresses are required,
> this could amount to a substantial amount of DAD multicast traffic. On the
> other hand, DAD is not needed for DHCPv6 PD because the network has
> unambiguously delegated the prefix for the node's exclusive use.
> 
> I don't think "Requires DAD: No" is correct. Even if the device gets a /64 prefix entirely for its own use, it still needs to do DAD with any other devices on that /64 (e.g., tethered devices, VMs, etc.).
> 
> I'm not opposed to adding a line to the table, though I don't think it provides much value - if we put our mind to it, I'm sure we could come up with lots of things we could add to the table that aren't there at the moment. My main concern is that if we add something to the table it needs to be correct.
> 
> What I mean is “Requires DAD on the interface over which the prefix was received”,
> but that was too long to fit in the table. Let’s call the interface “A”. If the node gets
> SLAAC addresses or DHCP IA_NA/IA_TA addresses over interface “A”, then it needs
> to do DAD on interface “A” for each such address. If the node gets a DHCPv6 PD
> over interface “A”, however, it does not need to do DAD over interface “A” at all.
> 
> If the node assigns the delegated prefix to interface “B”, then you are right that
> that DAD will be required among all tethered devices, VMs, etc. on interface “B”.
> But, there will still be no need for DAD on interface “A”. Does that clarify?
> 
> I have a question also on table 1. Under ""Unlimited" endpoints", why does
> it say "no" for DHCPv6 PD? I think it should say "yes" instead, since a prefix
> obtained by DHCPv6 PD can be used to configure an unlimited number of
> addresses on the link over which the prefix was received.
> 
> The table is written from the perspective of the network assigning addresses to devices that connect to it. Therefore, it says "no" because if you use DHCPv6 PD you can't assign address space to an unlimited number of endpoints - you are limited to however many /64s you have available.
> 
> If you use IA_NA or SLAAC, any network with a /64 subnet has, at least in theory, an "unlimited" number of addresses to assign to clients. Of course, that's only true in theory. In practice, there's going to be a limit due to scaling reasons.
> 
> I don’t understand this. True that SLAAC and DHCPv6 IA_NA/IA_TA can be used
> to assign an unlimited number of addresses to interface “A”. But, so can DHCPv6
> PD. When the node receives the delegated prefix (e.g., a /64), it can assign as
> many unique IPv6 addresses as it likes to interface “A”. And again, it need not
> do DAD for any of them.
> 
> 
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>