Subject: RE: Node Requirements Issue 3

From: Margaret Wasserman <[email-masked]>
Date: Sun, 27 Oct 2002 21:56:41 -0500

>For a multi-sited host, one additional requirement is that applications
>should deal with sockaddrs instead of directly with addresses, so that
>the scope-id is preserved & passed around as needed. Another additional
>requirement is routing table lookup needs to be cognizant of scoping.

When a multi-sited implementation gets site-local addresses from
the DNS (assuming that it runs two-faced DNS and returns site-locals),
how will the multi-sited host know which site the addresses are in?

Margaret

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Markku Savela <[email-masked]>
Date: Mon, 28 Oct 2002 09:43:01 +0200

> how will the multi-sited host know which site the addresses are in?

My guess, and tentative implementation is that the resolver library
completes the scope id to the address using the interface from which
the DNS reply came in.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 28 Oct 2002 08:50:30 -0500

>completes the scope id to the address using the interface from which

I keep winding-up back here, myself, but it isn't really a satisfactory
answer for several reasons:

         (1) A multi-sited node might receive different sets of
                 addresses in response to the same query, based on
                 which site's DNS server was tried first.  There is
                 no provision to try another DNS server if the first
                 one succeeds, so there is no way to be sure you've
                 gotten all of the available addresses to reach a
                 node.

         (2) This solution presumes some relationship between the
                 routing hierarchy and the organization of DNS servers.
                 For example, it assumes that I will use the DNS
                 server that is configured with two-faced DNS for my
                 site.

         (3) The two-faced DNS solution requires that we store routing
                 information in a DNS configuration file.  This creates
                 another way for the network to break when routing
                 information changes.

         (4) If the DNS requests are done via global addresses, I am
                 not sure that it is safe to assume that the results
                 will always come back through the correct interface.
                 What if there were a partition in Site1, but parts of
                 Site1 could still reach other parts of Site1 using
                 global addresses, by sending across the global
                 Internet.  Is that possible?

Anyway, we'd certainly have to document the "two-faced" DNS concept
and describe this solution in more detail before I'd feel comfortable
counting on it to work.

Margaret

---

From: Roy Brabson <[email-masked]>
Date: Mon, 28 Oct 2002 10:10:25 -0400

> completes the scope id to the address using the interface from which

You may also need to send the DNS query into each site-local scope zone in 
order to obtain all necessary results, or even to obtain any results, if a 
given host name only resolves to site-local addresses in one of the 
site-local scope zones.  If the DNS name server is on a muti-sited host 
(which I suppose makes sense if it is performing name-to-address 
resolution for hosts which are muti-sited), then it needs to be configured 
to return different site-local addresses for each given site to which it 
is connected.

Since Stateless Address Autoconfiguration or (eventually) DHCPv6 may be 
used to configure addresses, the DNS name server also needs to understand 
the site-local scope zone over which a DNS registration is made, placing 
"global" addresses into the "global" pool and "site-local" addresses 
associated with the site-local scope zone over which the registration is 
received.  Likewise, the host performing the registration needs to 
restrict the site-local addresses which are registered to the site-local 
scope zone in which they are  valid.

There are probably other requirements for this to work as well.  The only 
point I'm trying to make is it isn't just as simple as connecting to 
multiple sites and having this work properly without additional standards 
being defined.

Roy

---

From: Keith Moore <[email-masked]>
Date: Mon, 28 Oct 2002 09:45:14 -0500

anything that encourages multi-faced DNS is a bad idea.

Keith

---

From: Keith Moore <[email-masked]>
Date: Mon, 28 Oct 2002 10:31:58 -0500

> If the DNS name server is on a muti-sited host

Distributed applications depend on consistent results from DNS,
regardless of where the query came from.  

> received.  

As if such scope were visible to the DNS server (it isn't), or the DNS 
server could depend on results only being used in the scope for which 
they were intended (it can't).

> Likewise, the host performing the registration needs to

except that there's no way for the host to know where those addresses 
are valid.

> multiple sites and having this work properly without additional standards

indeed.  

and what compelling purpose does all of this complexity serve?
none that I can see.

Keith

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 28 Oct 2002 10:39:28 -0500

>and what compelling purpose does all of this complexity serve?

I think that this is a key question.

Could folks who support the use of site-local addresses on
globally-connected networks explain what benefits they
offer that out-weigh the considerable costs?

Margaret

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 28 Oct 2002 10:42:52 -0500

It has been pointed out to me that having an extensive discussion
of whether or not the IPv6 WG should limit the use of site-local
addresses to non-globally-connected networks in a lengthy thread
called "Node Requirements Issue 3" may be flying below the radar
for many IPv6 list members.

So, let's try to move the discussion to this new subject.

Folks who want to know what has already been said should read
the aforementioned thread.

Thanks,
Margaret

---

From: Steven Blake <[email-masked]>
Date: 28 Oct 2002 11:11:31 -0500

> offer that out-weigh the considerable costs?

Are you suggesting that someone should actually write router code to
prevent this (i.e., treat site-locals as anything other than regular
unicast addresses)?

It would be better to produce a "Use of Non-Globally Reachable Unicast
Addresses" BCP rather than put meaningless restrictions on address use
in the specs.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Steven L. Blake               <[email-masked]>
Ericsson IP Infrastructure                +1 919-472-9913

---

From: Keith Moore <[email-masked]>
Date: Mon, 28 Oct 2002 11:53:55 -0500

> Addresses" BCP rather than put meaningless restrictions on address use

since when is a restriction 'meaningless' just because it doesn't affect
routers?

network designers, network maintainers, and application designers all
need to realize that use of non-globals is in general a bad idea.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 28 Oct 2002 11:44:50 -0500

>prevent this (i.e., treat site-locals as anything other than regular

No.  In fact, I am suggesting that all routers and hosts treat
site-local unicast addresses exactly like global unicast addresses,
and that we administratively restrict the use of site-local unicast
addresses to non-globally-connected networks.

If site-locals are used on globally-connected networks, it is necessary
for them to be treated specially by the IP stack (address selection
rules), DNS resolvers, applications, routing protocols and management
software.  And, I am suggesting that we do not want to define this
usage.

>Addresses" BCP rather than put meaningless restrictions on address use

What would you suggest as the contents of that BCP?

Margaret

---

From: Rob Austein <[email-masked]>
Date: Mon, 28 Oct 2002 16:18:35 -0500

> regardless of where the query came from.  

Yep.  RFC 2826 discusses this in some detail.

> and what compelling purpose does all of this complexity serve?

Precisely.