Subject: Re: Fwd: IPv6 Scoped Addresses and Routing Protocols

From: "Steven M. Bellovin" <[email-masked]>
Date: Sun, 09 Jun 2002 22:31:14 -0400

In message <[email-masked]>, "Tony Hain" writes
:
>
>
>While I am all for avoiding architectural and operational pain, I don't
>see this is as big a deal as the thread seems to be making it out to be.
>There is no need for fixing the IGPs to deal with SiteLocal as they run
>within the context of the site, therefore shouldn't know about any other
>sites. Implementations where a given router will have an interface in
>multiple sites will need a way to tag and keep each IGP isolated. The
>simplest way is to track which interface the IGP message comes in on and
>make sure it maps to the corresponding IGP process.
>
>I think most of this thread is focused on what are simply implementation
>details, not an issue for the standards per se. The biggest issue I saw
>was related to DNS returning SL or not, and this is not an issue as long
>as the DNS server is not expected to deal with multiple sites. As long
>as routing is filtering SL at the borders, the only way a DNS query
>would get to the SL of the DNS server would be within a site, and the
>only reason a DNS server should return an SL address is if the query was
>addressed to its SL address. Maybe this needs to be stated clearly in
>the ngtrans doc on DNS issues, but this should be obvious from the
>perspective of 'don't return an answer that can't be used'.
>
>What this means is that an SP will not provide SL addresses for
>customers. This is not a problem today, unless an SP DNS is resolving to
>RFC1918 addresses.

The problem is that the definition of "site" you assume above doesn't 
match the RFCs, which are deliberately vague.  If it were AS-local or 
organization-local addresses, I'd be much less concerned.  But it's 
site-local, which is not the same thing.  Quoting 
draft-ietf-ipngwg-scoping-arch-03.txt:

	      A "site" is, by intent, not
              rigorously defined, but is typically expected to cover a
              region of topology that belongs to a single organization
              and is located within a single geographic location, such
              as an office, an office complex, or a campus.

For a multi-site company, that's smaller than an AS.  As I noted 
earlier, DNS servers are supposed to be distributed across multiple 
sites, and a remote one doesn't know whether or not a querier is in the
same site as the destination.  Maybe a DNS server could look to see if 
the querying address is site-local, but that implies site-local 
addresses (indirectly) in NS records.  It also implies that even within 
a site, a host will sometimes get the site-local address of the 
destination and sometimes the global address, depending on which DNS 
server it happened to query.  This strikes me as seriously ugly.  And, 
as Allison has pointed out, it's not at all clear that we've worked 
through all the cases for caching servers or mobile IP.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Tony Hain" <[email-masked]>
Date: Sun, 9 Jun 2002 23:00:13 -0700

> through all the cases for caching servers or mobile IP.

THere is a mismatch between the DNS perception of 'site' and the
site-local definition of 'site'. The DNS version is much stricter about
physical separation, but there shouldn't be a requirement that DNS
servers for a segment of an AS have to be in differrent SL regions. It
sounds like there is more to do on the DNS operations document... In any
case, the only way a DNS server should return a SL in a response is if
the query was received on a SL. This is the only reasonable way for the
server to know if the answer is usable. If the DNS servers for a given
set of hosts are split across multiple SL zones, then some of the
answers will be global. This is logically the right thing to do from the
DNS query/response perspective, but from the operations perspective, the
servers shouldn't be in separate SL zones. If a particular network
doesn't want to add to the DNS infrastructure, there is no requirement
to populate it with SL addresses. If the routers don't announce them in
the RA, and they aren't in the DNS, they don't get used. That does not
mean we should get rid of them, because smaller organizations will
typically find them useful to minimize the impact of changing providers.

Tony

---

From: Keith Moore <[email-masked]>
Date: Mon, 10 Jun 2002 11:13:30 -0400

> In any
> server to know if the answer is usable.

it doesn't work in general, because the query could be from a cache
that doesn't know anything about SL.

putting limited-scope addrs in DNS is a Bad Idea, period.

Keith

---

From: [email-masked]
Date: Tue, 11 Jun 2002 13:47:49 +1000

> putting limited-scope addrs in DNS is a Bad Idea, period.

	No.

	Putting limited-scope addrs in DNS is a bad idea *unless*
	you have a way to uniquely identify the scope.

	Neither AAAA or A6 provide support for this.  I made a proposal
	that would have added this to A6 *before* there was any A6
	deployment.  It got totally ignored by the IPv6 community (with
	the exception of Matt).

	Now might be a good time to raise the idea again except I won't
	tie it to A6.

	<ownername> SA <IPV6 address> <scopename>

	SA	  scoped address
	scopename is a domainname choosen to be globally unique.
		  global addresses have a scopename of ".".

	the conversion from scopename to scopeid / zoneid is a
	*local* resolution problem for the machine.

	Mark
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Tue, 11 Jun 2002 00:09:24 -0400

>         you have a way to uniquely identify the scope.

since there is no notion of a scope identifier in the Internet
architecure, what you are saying is tantamount to saying that
putting limited-scope addresses in the DNS is a bad idea.

>         *local* resolution problem for the machine.

great - so let's add a lot of complexity to every application just so 
we can get no additional functionality and reduced reliability.

let's stamp out SL addresses, now.

Keith

---

From: Vladislav Yasevich <[email-masked]>
Date: Thu, 13 Jun 2002 15:08:37 -0400

[I am not sure if this has been said yet, I stil have ~130 unread
messages, but...]

Tony

I strongly disagree.  DNS servers function from the stand point of RRsets
not individuals RRs like A and AAAA.  What you are proposing is similar
to not returning A records for a query that used IPv6 network which was 
discussed on ngtrans a while ago.  This would end up splitting the RRset
and returning a partial set, which may not be what was required by the
requestor.

You are limiting the response of the server based on the protocol/addresses
used to access it.  The only thing that does this now is two-faced DNS or
multiple views in bind 9.  But, I am not sure that handle muliple sites.

-vlad

-- 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Vladislav Yasevich	       Tru64 UNIX - IPv6 Project Lead
Hewlett Packard 	       Tel: (603) 884-1079
Nashua, NH 03062	       ZKO3-3/T07

---

From: Keith Moore <[email-masked]>
Date: Tue, 11 Jun 2002 00:09:24 -0400

Keith