Subject: RE: Fwd: IPv6 Scoped Addresses and Routing Protocols

From: "Bound, Jim" <[email-masked]>
Date: Thu, 13 Jun 2002 08:47:49 -0400

and this is my biggest fear for the Internet with IPv6.  These site-locals could undo all we did with IPv6 to restore end-to-end architecture for the Internet.

Trying to limit them with words or BCPs whatever will NOT prevent the potential tragedy to our beloved Internet as Bill points out below.

/jim

> -----Original Message-----
> From: Bill Sommerfeld [mailto:[email-masked]]
> Sent: Friday, June 07, 2002 7:41 PM
> To: Michel Py
> Cc: Bob Hinden; Steven M. Bellovin; [email-masked]
> Subject: Re: Fwd: IPv6 Scoped Addresses and Routing Protocols 
> 
> 
> > The outbound-only firewall is a false idea of security as well since
> > 2nd generation peer-to-peer software such as Morpheus can easily
> > bypass firewalls and allow ingress connections to RFC1918 hosts.
> >
> > On the other hand, considering that a typical IPv6 will 
> _not_ feature
> > IPv6 NAT, an IPv6 host that has _only_ a site-local address 
> would have
> > an extra layer of protection against external attacks as it 
> would not be
> > reachable at all from the outside.
> 
> I see this as a distinction without a difference -- if the site has
> some systems running a global p2p network's software with external
> connectivity, and that p2p network is cracked, the site will be
> vulnerable to attacks relayed through the p2p network.
> 
> if one system within the site has external connectivity and is part of
> the compromised p2p network, any system at the site will now be open
> to attacks from the compromised system.
> 
> If there is widespread deployment of systems with site-local only
> addresses, this will in turn drive the creation of ipv6 NAT
> specifically to give them external connectivity..
> 
> 						- Bill
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
> 

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Robert Elz <[email-masked]>
Date: Fri, 14 Jun 2002 14:06:28 +0700

Date:        Thu, 13 Jun 2002 08:47:49 -0400
    From:        "Bound, Jim" <[email-masked]>
    Message-ID:  <[email-masked]>

  | and this is my biggest fear for the Internet with IPv6.
  | These site-locals could undo all we did with IPv6 to restore
  | end-to-end architecture for the Internet.

That's nonsense Jim.

We lost the possibility of end to end because we didn't have enough
addresses for everyone.   As long as we have enough addresses that
everyone can have one, then end to end remains.

Having even more addresses cannot possibly prevent that, whatever
their nature.

Of course, there's nothing that you, or anyone, can do to force me
to allow your systems to communicate with mine - that's completely
independent of addressing.

At MU, we have undergrad student labs, that we basically filter from
the world - they have no end to end connectivity at all.   And that has
nothing at all to do with NAT (of which we have none at all) nor with
1918 addressing (of which we also have none at all).   Nor will it have
anything at all to do with site local addresses.

The filtering (using global addressing everywhere) is because we want to
protect the rest of the world from our students' activities (as most of
these systems are in more or less open access labs, we have no reliable way
to tell which person was using which system at any particular time, so
if some system is used to break into somewhere out there, we have no way
of deciding which person was responsible, so there's nothing we would
ever be able to do about it).   And secondly, because more traffic costs
us more dollars, and we need to limit how much is being spent.

These people all have indirect access to the whole net, via access ports
that first verify who they are (for both forms of accountability, though
we don't actually generate bills) - but nothing end to end, and addressing
has nothing even slightly to do with it.

Of course, there are people who would accuse me of being anti-social for
using global IPv4 addresses for systems that could use 1918 addressing, and
perhaps with some justification - but being able to return to the world a
bunch of unrelated /26 subnets doesn't really seem like it would be useful
enough for me to switch these systems from the global addresses they are
now using.

Let's try and keep the red herrings in the red sea, and away from this
mailing list, please.

kre

---

From: Michael Thomas <[email-masked]>
Date: Fri, 14 Jun 2002 07:45:01 -0700 (PDT)

> anything at all to do with site local addresses.

Robert,

Color me clueless, but why can't you give them a
global prefix, but just not advertise their route
past the administrative boundary you choose (eg,
the lab)? Why is an IETF sanctioned "don't route
this prefix beyond where you should route it --
which, by the way, you decide where ``beyond'' is"
better than just blackholing the actual prefixes
you want to contain?

To my mind that seems easier in some sense because
it's reactive: ie globally number first, determine
who the l00zers are later -- a capability you
probably need to have anyway. I guess I don't see
what being proactive with special addresses really
buys since it's _your_ definition of site -- and
its containment thereof that's important. Indeed,
site-locals don't really seem to buy much on the
manageability front since you still need to decide
who gets them and why, and where the boundaries of
the site are.

And of course, if you ever decide to change your
policy (or part of your policy), you don't need to
renumber with global prefixes (eg, you want to
allow part of your lab to be global visible so
they can show the world their new cold fusion
results).

	       Mike

---

From: Randy Bush <[email-masked]>
Date: Fri, 14 Jun 2002 08:00:15 -0700

> better than just blackholing the actual prefixes

From: Randy Bush <[email-masked]>
To: "Steven M. Bellovin" <[email-masked]>
Cc: [email-masked]
Subject: Re: Fwd: IPv6 Scoped Addresses and Routing Protocols 
Date: Thu, 06 Jun 2002 11:24:57 -0700

> My strong preference would be to drop site-local addresses completely.  
> I think they're an administrative and technical nightmare.

trying to solve a routing problem by an ill-understood addressing
hack.

randy

---

From: Robert Elz <[email-masked]>
Date: Fri, 14 Jun 2002 22:15:45 +0700

Date:        Fri, 14 Jun 2002 07:45:01 -0700 (PDT)
    From:        Michael Thomas <[email-masked]>
    Message-ID:  <[email-masked]>

  | Color me clueless, but why can't you give them a
  | global prefix, but just not advertise their route
  | past the administrative boundary you choose (eg,
  | the lab)?

That is (essentially) exactly what we do (though for obscure reasons
we can't fix this using routing, and instead use packet filtering).

You seem to have misunderstood the point of my message (perhaps I
wasn't clear), but it was just to show that it isn't (not that it
is) the existence of site local addresses (private addresses) that
defeats end to end - it is the absence of global addresses, and/or
filtering.

  | And of course, if you ever decide to change your
  | policy (or part of your policy), you don't need to
  | renumber with global prefixes (eg, you want to
  | allow part of your lab to be global visible so
  | they can show the world their new cold fusion
  | results).

No no - I'd never do that.   My philosphy is that *everything* gets a
global address, no matter what (disconnected sites that have no ISP to
provide them being the one exception).   If a site wants, its nodes also
get site local addresses, as an additional address.

Access control is done based upon filtering (at routers, and at the
nodes themselves where possible) - packet filtering &/or route filtering.
Certainly not based upon address - the occasional suggestions that private
addressing provides any kind of security or control are just ludicrous.

What they provide is internal address stability.   That's why I don't want
to lose them (unless something equivalent replaces them, or we achieve address
stability some other way).

kre

---

From: Robert Elz <[email-masked]>
Date: Fri, 14 Jun 2002 22:22:05 +0700

Date:        Fri, 14 Jun 2002 08:00:15 -0700
    From:        Randy Bush <[email-masked]>
    Message-ID:  <[email-masked]>

  | trying to solve a routing problem by an ill-understood addressing
  | hack.

This is the second time you have said that, and it doesn't get any more
accurate with the re-telling.

SL addresses are only a second order symptom of a routing problem, and
are most certainly not any kind of attempt to solve it.

The closest they come to that is that they're an attempt to cope with the
current best solution to the routing problem that anyone has been able to
find - that is, to solve routing, we're requiring topologically meaningful
addresses, and as topology isn't stable, addresses can't be stable either.

If you have some other solution to the routing problem, and can even
suggest a direction that might allow non-topological routing of an address
space of the order of 2^48 entries, then we're all waiting to hear it.

In the meantime, please recognise that those of us who have to live with
the consequences of the best solution currently available and if there's
no sanctioned way of getting at least local stable addresses, then we will
simply invent our own - "stealing" whatever address space is needed to
make it work.

kre