Subject: (IPng 6718) Site prefixes?

From: Erik Nordmark <[email-masked]>
Date: Tue, 10 Nov 1998 09:49:52 -0800 (PST)

In the lull after the last IETF I submitted this draft:
	Site Prefixes in Neighbor Discovery
	<draft-ietf-ipngwg-site-prefixes-02.txt>

This is supposed to be controversial stuff - yet I've seen
no comments on the mailing list (yet)!

The idea is to store site-local addresses in the global DNS and using 
information advertized in Router Advertisements to determine if 
the site-local addresses should be ignored or preferred over the
global addresses.

So please read the draft and comment. Hopefully we can then make progress
on this on the mailing list.
If there aren't any comments I'll have to ask the chairs to do a WG last call.

   Erik

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Jun-ichiro itojun Itoh <[email-masked]>
Date: Wed, 11 Nov 1998 11:41:11 +0900

From the abstract:

>>   This protocol requires that all IPv6 implementations, even those that
>>   do not implement this protocol, ignore all site-local addresses that
>>   they retrieve from the DNS.

	I believe this requirement expects too much to existing IPv6
	implementation... (how many new MUST requirements will be added to
	IPv6 implementations?  there should be "router requirement"
	and "host rqeuirement" document...)  Use of site-local address is
	local matter to a site, and should not bother outsiders.

	Requiring two-faced DNS to a site that uses site-local address is
	much easier to implement.  If two-faced DNS is a common practice,
	someone may implement a tool that makes it easier to deploy.
	(example: bind8 is much useful than bind4 for firewall border)

itojun

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 11 Nov 1998 15:00:45 -0800 (PST)

> 	local matter to a site, and should not bother outsiders.

I agree this is a new requirement which is why it is "flagged" in the
abstract. It would be nice if the requirement wasn't needed 
but as far as I can tell that would require a two-faced DNS instead.

> 	(example: bind8 is much useful than bind4 for firewall border)

Others have argued strongly against requiring a two-faced DNS for every site.
True that they might not be too hard to administer for large sites (like
large corporations) but I don't see small sites (like households) 
ever doing this.

So how can we resolve this issue? Any good ideas out there?

   Erik

---

From: Jun-ichiro itojun Itoh <[email-masked]>
Date: Sun, 29 Nov 1998 03:03:49 +0900

Sorry for delayed reply,

>large corporations) but I don't see small sites (like households) 

	Really?  I believe every firewalled sites (regardles from its size)
	does this.  Some of them use pseudo top-level domain name
	(maintain "foo.com." and "foo.com.private." and add "private."
	to the search list in host in the site), but basically they manage
	to do this.

>So how can we resolve this issue? Any good ideas out there?

	I feel two points are unsafe about the current draft:
	1. requires all implementations to ignore site-local addresses
	   on the DNS database.  how about those product that has already been
	   shipped?  I believe Jim Bound has something to say about this...:-P
	2. this draft is just for site local addresses.  what about other
	   scoped addresses that will be defined in the future?

	My alternative solutions are:
	a. Require two-faced DNS server for every site.  Large sites with
	   full-time admin person should be happy with this.

	b. Implement address filter functionality into named.  For specific
	   interfaces, filter out AAAA records that matches specific prefix.
	   For example, "filter out fec0::/10 for interface le0" removes
	   AAAA records that matches fec0::/10, from the result.
	   By this way we can configure single named to behave as two-faced
	   DNS server.
	   Filtering function can also be implemented as separate program,
	   of course.
	   -> effects on cache? (it should be the same as two-faced DNS)

	c. Register (virtual) global address to DNS server.  redistribute
	   rewriting rule (from global to site-local) by using RA, just
	   like site-prefix information option.  For example:
		3ffe:0501:0410::/48 -> fec0::/48
	   A node supporting this option should contact the addresses that
	   have been rewrote first, then the address got from DNS server.
	   If a node got the following record from DNS,
		foo.baa.com.	IN AAAA	3ffe:0501:0410::x
				IN AAAA	3ffe:0501:0499::x
	   the node should contact fec0::x first, then 3ffe:0501:0410::x
	   3ffe:0501:0499::x.

	   By this way, no old implementations will be harmed.
	   Old implementations will contact 3ffe:0501:0410::x or
	   3ffe:0501:0499::x, and will success or fail based on the topology/
	   configuration.
	   It is a rewriting rule for prefix so it can be used for future
	   (non-site) scoped address.

	   This approach require global address prefixes to be (virtually)
	   assigned to all subnets in the site. 
	   Virtually assigning global prefixes to a large site is hard,
	   but large site will use approach (a).  Small sites have no
	   problem assigning global prefixes to subnets.

	If you think (c) to be possible, I'll investigate this approach
	in more detail.

[email-masked]
jun-ichiro itoh

--- very basic "rewriting rule" option format (tentative)
 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|     Type      |    Length     | Prefix Length |Reserved       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                         Lifetime of mapping                   |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                                                               +
|                                                               |
+                       rewrite-from prefix                     +
|                                                               |
+                                                               +
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                                                               +
|                                                               |
+                       rewrite-to prefix                       +
|                                                               |
+                                                               +
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Jun-ichiro itojun Itoh <[email-masked]>
Date: Mon, 30 Nov 1998 11:39:20 +0900

>		3ffe:0501:0410::/48 -> fec0::/48

	I was wrong.  the old draft (-00 and -01) used rewriting rule.
	like I wrote.  Sorry for confusion.

	I personally prefer (1) two-faced DNS, or (2) use something like
	dnsind-local-names-06.

itojun