Subject: [magma] Interop comment on mld-source-02

From: Pekka Savola <[email-masked]>
Date: Fri, 18 Oct 2002 09:07:22 +0300 (EEST)

Hello,

Just one comment to this very concise draft.

One thing I'd like to see in this kind of changes that modify the required 
behaviour is how upgraded and non-upgraded MLD-implementing hosts 
interoperate with upgraded and non-upgraded MLD-implementing routers.

Clearly, certain messages (if the sending host used it's tentative 
link-local address, that is) some messages are discarded, but I'm not sure 
if that's a big deal.

Ie. "if I do this now but can't expect all of the nodes be updated at 
once, will I shoot myself in the foot?"

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

_______________________________________________
magma mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/magma

---

From: Brian Haberman <[email-masked]>
Date: Fri, 18 Oct 2002 09:14:43 -0400

Hi Pekka,

      There are two ways to look at this issue.

The first is that this change is meant to allow nodes to send
MLD Report messages for their tentative solicited-node mcast
address.  In that situation, we don't care if the router drops
the message or not.

The second is that this is a longer term change that may be
used for joining groups other than the solicited-node mcast
address.  Then their is an operational issue of being able
to determine why mcast reachability breaks.  Could be a
hard to debug problem.  However, the wording states that the
:: address must only be used when a valid link-local one is
not available.

My tendency is to say that we are addressing the first case.
The other issue to consider is that MLDv1 is not going to
be advanced beyond PS, so we really are looking at a short
term issue.

Other comments?

Brian

---

From: Brian Haberman <[email-masked]>
Date: Fri, 18 Oct 2002 09:14:43 -0400

Hi Pekka,

Other comments?

Brian

---

From: Brian Haberman <[email-masked]>
Date: Fri, 18 Oct 2002 09:48:45 -0400

Pekka Savola wrote:
> On Fri, 18 Oct 2002, Brian Haberman wrote:
> 
> Isn't there a third option, that MLD Report is generated *anyway*, but 
> using the tentative (or some other!) address.

I wanted to avoid using tentative addresses since they are not
supposed to be used.

> 
> In such case that MLD Report was generated and accepted by pure-MLDv1 
> routers, the addition of this in pure-MLDv1 routers could create a problem 
> (the Report would be discarded) when nodes aren't upgraded?  There are 
> probably some other combinations.

How would the router know the address is tentative and discard it?

> I didn't have particular problem with this, except that some 
> non-upgraded router implementations might not treat '::' as link local 
> (and discard it).

Since this is only meant for joining solicited-node mcast address
as a part of stateless autconfig, it doesn't matter if the router
drops it.

Brian

---

From: Brian Haberman <[email-masked]>
Date: Fri, 18 Oct 2002 09:48:45 -0400

Brian

---

From: Pekka Savola <[email-masked]>
Date: Fri, 18 Oct 2002 16:27:35 +0300 (EEST)

Hence my interop worries.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 18 Oct 2002 16:27:35 +0300 (EEST)

---

From: Brian Haberman <[email-masked]>
Date: Fri, 18 Oct 2002 11:19:59 -0400

Pekka Savola wrote:
> I'm not suggesting changing (the spec part of) mld-source-02, but
> analyzing and documenting the effects of the chosen solution.

I mentioned it below, but that kind of text can be added if the
group thinks it is necessary.  Anyone else have an opinion?

>>From RFC2710:
>    - "report received" occurs when the node receives a valid MLD Report
>       message.  To be valid, the Report message MUST come from a link-
>       local IPv6 Source Address [...]
> 
> A node implementing mld-source-02 would use '::'.  A pure-MLDv1 router 
> would reject these messages IF it doesn't consider '::' to be link-local 
> scope. (I'm not 100% sure if the semantics have been formalized, at least 
> everywhere).

Right, I understand what you are saying.  In my opinion, this change
is only to support the sending of Reports when DAD is being run on a
tentative link-local address.  In that situation, if the router drops
the Report, it doesn't matter.  The group being joined is link-local
scope so the router would not create forwarding state for it.

> 
> Just an example.
> 
> Perhaps you see what kind of analysis I'd be interested in seeing?

I see what you are asking.  I am not sure it is needed given the
scope of this document.

Any other opinions on this?

Brian

---

From: Brian Haberman <[email-masked]>
Date: Fri, 18 Oct 2002 11:19:59 -0400

Brian

---

From: Pekka Savola <[email-masked]>
Date: Fri, 18 Oct 2002 18:10:08 +0300 (EEST)

From RFC2710:

Just an example.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 18 Oct 2002 18:10:08 +0300 (EEST)

From RFC2710:

Just an example.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 18 Oct 2002 18:21:56 +0300 (EEST)

> Any other opinions on this?

I'll just add one point:  I believe there will be a lot of MLDv1 
implementations (w/ no support for MLDv2) a couple of years now, some may 
use mld-source-02, some may not: I believe it's imporant to do this 
properly.

MLDv1 isn't dead yet :-(

---

From: Pekka Savola <[email-masked]>
Date: Fri, 18 Oct 2002 18:21:56 +0300 (EEST)

MLDv1 isn't dead yet :-(

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 22 Oct 2002 19:55:14 +0200 (CEST)

Pekka and Brian, 

if might be helpful to add text to the document to point out the issue 
and conclude that as long as :: is only used for link-local groups
there is no interoperability issue between old/new host/router combinations.

At least that would provide the answer in the document since others
might have the same question down the road.

Can you two suggest some text?

  Erik

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 22 Oct 2002 19:55:14 +0200 (CEST)

Pekka and Brian, 

  Erik

---

From: Pekka Savola <[email-masked]>
Date: Wed, 23 Oct 2002 23:59:11 +0300 (EEST)

> Can you two suggest some text?

Ok; here's a quite lengthy section just after the src selection rules, 
perhaps it can be edited down:

--8<--
MLD Source Selection Implications

   [RFC 2710] specifies that MLD Report messages MUST come
   from a link-local IPv6 source address; this memo specifies that 
   these messages may also be sent using the unspecified address (::).
   
   The behaviour of [RFC 2710] implementation, when receiving a Report
   message, depends on whether the implementation conders the unspecified address
   to be a valid link-local address.  This interpretation is 
   implementation-dependent [XXX: is it?], but generally it must be assumed the message
   with the unspecified address is considered invalid and will be discarded.

   As the unspecified address is only used when there is no link-local address,
   [RFC 2710] implementations discarding the packets may not matter at all as 
   those should only be used for joining link-local solicited-node multicast
   addresses [RFC2462].

   [RFC 2710] specifies no validation checks at all for Done messages, but
   it may be assumed that these were meant to be the same as with Report 
   messages. [XXX: was this really the case????]
--8<--

And also, add to "Security Considerations":

   MLD Reports and Done messages can now be sent using the unspecified 
   address as the source (even though link-local addresses would be 
   available): this could be used for harder-to-trace on-link abuse.

Not sure if additional implications are necessary, but _something_ about 
'::' must be added...

---

From: Pekka Savola <[email-masked]>
Date: Wed, 23 Oct 2002 23:59:11 +0300 (EEST)

--8<--

---

From: Pekka Savola <[email-masked]>
Date: Thu, 24 Oct 2002 00:04:41 +0300 (EEST)

oops typo..

>    those should only be used for joining link-local solicited-node multicast
     ^^^^^^^^^
groups...

---

From: Pekka Savola <[email-masked]>
Date: Thu, 24 Oct 2002 00:04:41 +0300 (EEST)

oops typo..

     ^^^^^^^^^
groups...

---

From: Brian Haberman <[email-masked]>
Date: Thu, 24 Oct 2002 08:27:52 -0400

>    with the unspecified address is considered invalid and will be discarded.

I believe it is implementation dependent.  The addressing architecture
does not classify it as being link-local.  It only states that routers
must never forward, it can't be the destination address, and it is meant
for use by nodes prior to learning their address.

>    messages. [XXX: was this really the case????]

Actually section 6 of 2710 specifies validation checks for Done messages.

> Not sure if additional implications are necessary, but _something_ about 

I will expand a little on the paragraph above in the Security Section.
That should cover the implications.

I will try and have an updated draft submitted by Friday.

Brian

---

From: Brian Haberman <[email-masked]>
Date: Thu, 24 Oct 2002 08:27:52 -0400

Brian

---

From: Pekka Savola <[email-masked]>
Date: Thu, 24 Oct 2002 16:04:59 +0300 (EEST)

> for use by nodes prior to learning their address.

True: _some_ might treat it as link local, but most probably will not.  
Perhaps minor reword.

> Actually section 6 of 2710 specifies validation checks for Done messages.

True missed it, kill the para and s/Report/Report and Done/ or so above.

> That should cover the implications.

Ok.

---

From: Pekka Savola <[email-masked]>
Date: Thu, 24 Oct 2002 16:04:59 +0300 (EEST)

Ok.