Subject: node local addresses?

From: Peter Tattam <[email-masked]>
Date: Fri, 3 Dec 1999 17:07:06 +1100 (EST)

In all the discussion about site local & link local addressing, A thought
occured to me that another class of addresses might exist that I am not sure
has been defined (as far can tell from RFC 2373).

The class of addresses is those which are node local, i.e. they don't go out on
the wire ever.  Ipv6 has restricted the loopback addresses to 1 address so they
can't be used anymore.

The usage of such addresses is for providing virtual IP services within the
host using addresses that won't ever go out on the wire.  This may sound
unusual, but I have had circumstances which required me to "make up" some
addresses in V4 to serve the purpose of demultiplexing V4-V6 address
translation at the API level.

I can think of applications that might benefit from such a division within a
multi user host such as providing each process with it's own local address,
each user with their own subnet and so forth.  This might also then be a useful
tool in the arsenal required in fortifying shared hosts, and could possibly
helps resolve problems associated with security attacks where the attacker uses
a benign service to get access to a restricted service.

The range of applications would be typically those that access IP based
client/server system that reside on the same host.  (e.g. shared proxy & web
server, SQL server on same server as web server etc...)

Peter
--
Peter R. Tattam                            [email-masked]
Managing Director,    Trumpet Software International Pty Ltd
Hobart, Australia,  Ph. +61-3-6245-0220,  Fax +61-3-62450210

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Steve Deering <[email-masked]>
Date: Thu, 2 Dec 1999 22:51:33 -0800

At 5:07 PM +1100 12/3/99, Peter Tattam wrote:
>The class of addresses is those which are node local, i.e. they don't go
>out on the wire ever.  Ipv6 has restricted the loopback addresses to 1
>address so they can't be used anymore.

Peter,

What leads you to that conclusion?.  If you think of a node's loopback
address as simply its link-local address on a phantom interface that
goes nowhere (the so-called loopback interface), you might realize you
can assign any number of additional addresses to that phantom interface,
of any scope  (though to be useful for scopes larger than link-local,
you'll need to do "forwarding" between the phantom interface and one
or more real interfaces).

You could also in theory create multiple phantom interfaces, each with
its own address(es), if that were useful for some reason.

Perhaps this model is a little less elegant than having a class of
node-local unicast addresses, but it avoids having to change our
definition of an address as an identifier for an interface, and
having to deal with the consequences of having interface-less
addresses.  Besides, it's a a familiar model from IPv4.

I certainly don't think we have removed any functionality available
in IPv4, which is what your "can't be used anymore" phrase would seem
to imply.

Steve

---

From: Peter Tattam <[email-masked]>
Date: Fri, 3 Dec 1999 18:43:48 +1100 (EST)

On Thu, 2 Dec 1999, Steve Deering wrote:

> I certainly don't think we have removed any functionality available in IPv4,
> which is what your "can't be used anymore" phrase would seem to imply. 

That is fine.  I didn't know the reason for the change.  I'm not arguing for
functionality loss, but if you want to split hairs, *if* I had used 127.*
addresses for my bump-in-the-api mechanism, and then wanted to reimplement the
same strategy for IPv6 but for some as yet undefined protocol in another
family, I would be stumped.  I currently use part of the reserved for
experimental use v4 address space and there is no parallel in the v6
address space.

Given your definition that addresses can only be assigned to interfaces, then
would it be legal to invent a virtual interface for each entity on the host (be
it a process, user, process class, socket, file or whatever)? Then my need for
node-local addresses should go away right?  I would then need a sure fire way
to generate a link-local address that is unique in the domain of the host/node,
and I believe this is specified somewhere, but I can't find it. There are added
problems in that the EUI-64 component for the virtual interfaces will need to
be derived from other sources. 

It's a kludge but I think I can make it achieve the desired result.

I will leave open the issue of whether the interface number of the virtual
interfaces is encoded in the address or not.  It would simplify transport layer
issues if it was, and also make life easier for any applications that might use
the addresses in such a way to perform service selection... e.g. proxy web
server filter lists.

Another issue with my kludge is that the traffic from real interfaces would be
indistinguishable from virtual interfaces, and with potential address
overloading problems necessitating using an out of band interface ID to work
out exactly who the address was from.  Not very pretty, especially when trying
to set up address matching lists.

The concepts might be better dealt with by node local addresses that can be
guranteed locally unique by address alone, even if they were still allocated
from the current link local address space. 

I believe computing will be taking two independent directions in the future,
one towards more and more mobile computing and nano devices.  The other
direction I think may happen is the growth of more and more centralized server
based computing to manage the needs of the smaller devices being connected.
Hence the need for finer grained node local addressing.

---

From: "Matt Crawford" <[email-masked]>
Date: Fri, 03 Dec 1999 09:26:08 -0600

>  I would then need a sure fire way to generate a link-local address
> that is unique in the domain of the host/node, and I believe this
> is specified somewhere, but I can't find it. There are added
> problems in that the EUI-64 component for the virtual interfaces
> will need to be derived from other sources.

Then you want a non-EUI64 address (the "globally unique" bit set to
0) and with 63 other bits to play with and all the interfaces created
by the same kernel, it should be trivial to generate guaranteed
node-unique identifiers.

---

From: Bob Hinden <[email-masked]>
Date: Sat, 04 Dec 1999 09:08:45 -0800

See Appendix A "Creating EUI-64 based Interface Identifiers" in RFC-2373.

Bob