Subject: [dhcwg] draft-forte-dhc-passive-dad-02

From: Andrea G Forte <[email-masked]>
Date: Thu, 08 Jun 2006 15:12:37 -0400

Dear all,

We have submitted the new version of the pDAD draft. You can find it here:
https://datatracker.ietf.org/public/idindex.cgi?command=id_detail&id=13702

Some adjustments have been included in the IPv6 part, as discussed on 
the mailing list.
We are looking forward to comments and feedback.

Regards,
-Andrea

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Andrea G Forte <[email-masked]>
Date: Fri, 09 Jun 2006 11:22:29 -0400

Shane,

In our test implementation, packets from AUC to DHCP server were UDP 
packets on a particular port. A while ago, I had a very interesting 
exchange of ideas with Barr Ribbs here on the mailing list and we both 
agreed that having a TCP connection between AUC (which is usually on a 
Relay Agent) and DHCP server would be the way to go. From the draft:

"In general, we RECOMMEND using a TCP session between hosts that are
   generators and consumers of DAD information.  In this particular
   context, a TCP session should be established between the AUC and the
   DHCP server.  Different kinds of authentication such as EAP-based
   authentication [6] secure connections such as TLS MAY also be used.
   This can help in preventing bogus AUCs from sending invalid data to
   the DHCP server and perhaps performing a DoS attack."

-Andrea

Shane Kerr wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Andrea G Forte wrote:
>   
>> Dear all,
>>
> Andrea,
> It's not clear to me what exactly happens with the packet that the AUC
> sends to the DHCP server. Is this a UDP packet, that gets sent to a
> special port?
>
> - --
> Shane
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2.2 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFEiXwaMsfZxBO4kbQRAgSOAKCBNuCN0kw09c1JCMzyeFwWR1ERJQCfZJtF
> XtRLuaVAxpMuvfMXJ+GPgpU=
> =8wZ2
> -----END PGP SIGNATURE-----
>

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Tue, 27 Jun 2006 17:46:09 +0900

>>>>> On Thu, 08 Jun 2006 15:12:37 -0400, 
>>>>> Andrea G Forte <[email-masked]> said:

> We are looking forward to comments and feedback.

I'm afraid the IPv6 discussion is not really reasonable.  I've read
the pDAD draft more closely, but could not find any advantage over
optimistic DAD (RFC4429) for this purpose.  Besides, as the draft
itself admits, pDAD has one clear disadvantage that it cannot work
with stateless address autoconfiguration (while optimistic DAD can).

So, I now suggest we "simplify" the IPv6 section as follows:

9.  IPv6

   RFC 3315 [4] describes the DHCP infrastructure in conjunction with
   IPv6 (DHCPv6) and a stateful configuration mechanism for IPv6
   addresses.  The uniqueness of an IPv6 address configured via RFC
   3315 is tested by the common Duplicate Address Detection procedure
   described in RFC 2462, and a separate mechanism called optimistic
   DAD (RFC 4429) is defined to avoid the delay in the DAD process.
   This document thus excludes DAD for IPv6 from its scope.

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]

---

From: Andrea G Forte <[email-masked]>
Date: Tue, 27 Jun 2006 11:07:41 -0400

Jinmei,

thank you for your comments. The section about IPv6 wanted only to say 
"pDAD can also be used in IPv6 networks but with certain limitations ... 
". We never wanted to imply that pDAD should replace optimistic DAD. 
Optimistic DAD should remain the default mechanism for IPv6, we just 
wanted to point out that under particular conditions (e.g. no stateless 
configuration), pDAD would still work.
However, it seems that the section about IPv6 is causing a lot of 
worries, so it is up to the WG to decide. If people think it is better 
to substitute it with what you wrote, we will do so.
I am waiting for comments regarding this issue.

-Andrea

---

From: Jari Arkko <[email-masked]>
Date: Wed, 28 Jun 2006 13:42:34 +0300

> to substitute it with what you wrote, we will do so.

We recently defined optimistic DAD in the IPv6 WG. Your discussion
on this list seems to indicate that passive DAD does not work in all
situations and that it may not provide additional optimization over
optimistic DAD.

I would like to quote RFC 1958 for principles that we should follow:

      If there are several ways of doing the same thing, choose one.  If
      a previous design, in the Internet context or elsewhere, has
      successfully solved the same problem, choose the same solution
      unless there is a good technical reason not to.  Duplication of
      the same protocol functionality should be avoided as far as
      possible, without of course using this argument to reject
      improvements.

Based on this, I think we would need very convincing arguments
to start work on a new DAD-delay reduction mechanism for IPv6.
And I do not see such arguments right now.

--Jari

---

From: Andrea G Forte <[email-masked]>
Date: Wed, 28 Jun 2006 12:26:37 -0400

I agree with you. I do not think new work should start on a new 
DAD-delay reduction mechanism for IPv6. This was never the intention.
pDAD was created for IPv4 networks. The paragraph about IPv6 was only 
meant to answer the question "would pDAD also work in an IPv6 network?" 
which is a legitimate question that a reader might have. The answer is 
"yes it would work but with certain limitations ... ". Is it going to be 
used in IPv6? Probably not because of optimistic DAD already being there.
Personally I do not see any harm in saying "pDAD would work in IPv6 
networks with the following limitations ...". I could also add something 
saying "we discourage the use of this architecture in IPv6 networks 
because of its limitations and the presence of optimistic DAD which 
already does the job ... ".
However I am fine with either solution for as long as we all agree.

POLL: which version of the IPv6 section do you mostly agree with?
1 - IPv6 out of scope as there already is optimistic DAD
2 - pDAD works in IPv6 networks with the following limitations ... 
however its use in IPV6 networks is discouraged. Optimistic DAD should 
be used instead.

-Andrea

---

From: Jari Arkko <[email-masked]>
Date: Wed, 28 Jun 2006 22:17:28 +0300

Andrea,

> however its use in IPV6 networks is discouraged. Optimistic DAD should

1 -- Jinmei's text was great.

(The question of whether it would work with IPv6 is perhaps
interesting. But its a bit academic exercise if you are going
to say "don't do it" and mean it. At the very least the text should
start by clearly stating that this method should not be applied
to IPv6. You could of course provide a list of reasons that include
the limitations.)

--Jari