Subject: RE: summary of Re: another renumbering question

From: "Richard Draves" <[email-masked]>
Date: Thu, 15 Feb 2001 22:56:45 -0800

A good summary but let me add a few points.

The Microsoft IPv6 implementation supports Erik's draft. It also puts
site-local addresses in the DNS. And in normal home gateway scenarios
(requires some administrative action to stop this) it will send RAs with
a site-local prefix as well as a global prefix.

Suppose a host X, not implementing Erik's draft, resolves a DNS name and
gets back a global and a site-local address. If host X does not have a
site-local address itself, and host X implements
draft-ietf-ipngwg-default-addr-select-02, then the name resolver
function will return the global address before the site-local address.
So host X will use the right address.

Suppose host X does not implement Erik's draft and does not implement
draft-ietf-ipngwg-default-addr-select-02. Perhaps the name resolver
function always returns addresses in the order it gets them from DNS.
Then it's unpredictable which address host X will use. If it uses the
site-local address it will probably have a lengthy timeout before
falling back to the global address, but in the worst case the
application/user might give up, or it might even end up communicating
with the wrong host.

Another possibility is that a DNS server can look at the source address
of the DNS request. If the source adress is an IPv6 site-local address,
then the DNS server can include site-local addresses in its reply. If
the source address is an IPv6 global address, or an IPv4 address, then
the DNS server can filter out site-local addresses. This introduces the
constraint that a site has to contain a DNS server to use site-local
addresses. This technique could be used in conjunction with Erik's
draft.

Rich

> -----Original Message-----
> From: Paul Francis [mailto:[email-masked]]
> Sent: Thursday, February 15, 2001 1:38 AM
> To: Robert Elz; Brian E Carpenter
> Cc: [email-masked]
> Subject: summary of Re: another renumbering question 
> 
> 
> 
> Just an attempt to summarize this thread:
> 
> Jim Bound thinks the use of site-local addresses is bad.
> 
> Robert Elz things that the use of site-local addresses is ok, but that
> two-faced DNS is bad.
> 
> Other folks don't think two-faced DNS is so bad.  (I'm in 
> this camp too...)
> 
> Robert Elz also made a good suggestion as to how hosts can learn the
> site-local addresses of other hosts in the site (least-wise 
> it seemed good
> to me).  But the state of this suggestion is that it exists 
> in an email and
> nowhere else (i.e., no internet draft), so unless someone writes it up
> nothing will happen to it?  (By the way Robert, are the ICMP 
> "tell me your
> site local addresses" and ICMP "site local source exiting the 
> site" messages
> you mention in your suggestion in existing drafts, or are 
> these new messages
> you are making up?)
> 
> In the absense of Robert's suggestion or Erik's draft
> (draft-ietf-ipngwg-site-prefixes-05.txt) (both of which 
> require changes to
> existing implementations), I gather that there are only two 
> possibilities:
> 
> 1.  Don't use site-local addresses at all.
> 2.  Use site-local addresses and two-faced DNS.
> 
> Is this a reasonable summary?
> 
> PF
> 
> 
> 
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
> 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Robert Elz <[email-masked]>
Date: Fri, 16 Feb 2001 16:58:28 +0700

Date:        Thu, 15 Feb 2001 22:56:45 -0800
    From:        "Richard Draves" <[email-masked]>
    Message-ID:  <[email-masked]>

  | The Microsoft IPv6 implementation supports Erik's draft.

I'm not sure that implementing a draft which had (until last week)
expired is a wonderful idea (other than for a limited test of the
mechanisms anyway).

  | It also puts site-local addresses in the DNS.

Grunge.

  | And in normal home gateway scenarios
  | (requires some administrative action to stop this) it will send RAs with
  | a site-local prefix as well as a global prefix.

That one I don't mind - the "normal home gateway" is exactly where
site locals are most needed.

  | If it uses the
  | site-local address it will probably have a lengthy timeout before
  | falling back to the global address, but in the worst case the
  | application/user might give up, or it might even end up communicating
  | with the wrong host.

Yes, it is because this can happen to nodes that haven't implemented
Erik's draft that I don't think that the mechanisms proposed there
can work (and ideally never be let loose on an unsuspecting world).

  | Another possibility is that a DNS server can look at the source address
  | of the DNS request.

That's just two faced DNS, which doesn't work in general, and in
particular doesn't work here...

  | If the source adress is an IPv6 site-local address,
  | then the DNS server can include site-local addresses in its reply.

Typically the resolver in a node sends a query to a local cache.
Chances are it will always use site local for that if it can.  The
cache then tries to find the authoritative server, that means (in
general, even to find your own local servers) starting at the root
and climbing down the chain.  The root gives A records for the COM
servers (those won't be site local one hopes).  The COM servers
give A records for the microsoft.com servers (they won't be site
local either), your cache then sends to one of those servers, using
the address you have just been handed, so your cache sends to a global
addr, and hence uses a global source addr, and thus gets back only
global addresses.

To make two faced DNS work requires a lot of local configuration
and careful planning and management - which is exactly what your
typical home network is not going to have (nor is it typically
going to have a DNS server at all).

kre

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 16 Feb 2001 14:12:34 +0100 (CET)

> addresses. This technique could be used in conjunction with Erik's

This runs into trouble with DNSsec since DNSsec signs RRsets.
Thus the DNS server would need a SIG for AAAA/A6 with site locals
and another SIG for AAAA/A6 without the site-locals.

Also, this has problem with recursive queries at least when the
recursing name server runs on a box that belongs to two different
site-local zones.

  Erik