Subject: RE: DAD failure for global IPv6 addresses?

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Thu, 1 Jan 2009 21:57:49 -0500

Sorry, your email sounds a little confusing to me.  Specifically, are
you talking about a network interface on a router where the interface
fails DAD during acquiring a global IPv6 address?  Or are you talking
about a node (potentially a host) in an IPv6 routed network where a
network interface on the node failed DAD for a global IPv6 address?
Also, I take it when you say "DAD failed", you mean the sending
interface of the DAD has received an NA signaling a duplicate for the
global address?
 
If a duplicate for a global address is found in the network, then the
network interface that send the DAD should not use the global IPv6
address to source any packets that need a global address for source.
See text like the following snipped from section 5.4 of RFC 4861
 
[The procedure for detecting duplicate addresses uses Neighbor
  Solicitation and Advertisement messages as described below.  If a
  duplicate address is discovered during the procedure, the address
  cannot be assigned to the interface. ]
 
Nowhere does the text above differentiate between a link-local or a
global address, so the rule applies to a global address a well.
 
Happy New Year to everyone on this mailer.
 
Hemant

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Thu, 1 Jan 2009 22:02:21 -0500

Sorry, I meant, section 5.4 of RFC 4862, not RFC 4861.
 
Hemant

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Hemant Singh (shemant)
Sent: Thursday, January 01, 2009 9:58 PM
To: [email-masked]; [email-masked]
Subject: RE: DAD failure for global IPv6 addresses?

 

 
Hemant

---

From: <[email-masked]>
Date: Fri, 2 Jan 2009 20:20:17 +0200

Hermant,
 
thanks very much for your reply.
 
To answer your questions, I am talking about a network interface on a router where the interface fails DAD for a global IPv6 address. "DAD failure" means that the interface received an NA or a DAD NS for the tentative global address, signalling a duplicate on another system on that link.
 
I understand that the global address is not assigned to the interface, but I'm really asking about the implications of that on the behaviour of the router.
 
The RFC states that the failure of a link-local address causes all IPv6 traffic to/from that interface to be dropped, and this led me to wonder about the effect of a global address DAD failure on traffic.
 
>From the RFC excerpt you gave, I would infer that on DAD failure of a global address, the router doesn't install the address, and forwards all traffic to/from that network based on the contents of its forwarding table. It does no special filtering of packets that are sourced from or destined to that network.
 
Do you agree?
 
Thanks,
Peter

From: ext Hemant Singh (shemant) [mailto:[email-masked]]
Sent: Thu 1/1/2009 6:57 PM
To: Hunt Peter (Nokia-S&S/MtView); [email-masked]
Subject: RE: DAD failure for global IPv6 addresses?

Sorry, your email sounds a little confusing to me.  Specifically, are you talking about a network interface on a router where the interface fails DAD during acquiring a global IPv6 address?  Or are you talking about a node (potentially a host) in an IPv6 routed network where a network interface on the node failed DAD for a global IPv6 address?  Also, I take it when you say "DAD failed", you mean the sending interface of the DAD has received an NA signaling a duplicate for the global address?
 
If a duplicate for a global address is found in the network, then the network interface that send the DAD should not use the global IPv6 address to source any packets that need a global address for source.  See text like the following snipped from section 5.4 of RFC 4861

Nowhere does the text above differentiate between a link-local or a global address, so the rule applies to a global address a well.

Hemant

---

From: "Erik Kline" <[email-masked]>
Date: Fri, 2 Jan 2009 12:06:43 -0800

> From the RFC excerpt you gave, I would infer that on DAD failure of a global
> address, the router doesn't install the address, and forwards all traffic
> to/from that network based on the contents of its forwarding table. It does
> no special filtering of packets that are sourced from or destined to that
> network.
>
> Do you agree?
>
> Thanks,
> Peter

This sounds to me like a recipe for a hard-to-debug problem.

I assume that when this DAD failure happens you'd have to stop sending
RAs and responding to RSs (or ...?).  So the only way the router
should be seeing packets destined to this interface would be either
some misconfiguration OR a cached RA/RS response where the max/valid
lifetimes had not yet expired AND a neighbor re-discovery had not yet
been performed.

I haven't computed how long this could in theory persist.  But again,
regardless of any technical correctness, it sounds like the making of
a weird debugging problem.
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Suresh Krishnan <[email-masked]>
Date: Mon, 05 Jan 2009 10:32:35 -0500

Hi Peter,
   There are really two questions hidden in your question.

[email-masked] wrote:
> All,
>  
> I have a question about what the correct behaviour should be for a 
> router if a global address fails DAD.
>  
> Specifically, if an interface has a link-local address which passes DAD, 
> but also has a global address configured which is not based on the 
> hardware address, and which fails DAD, what packets should be allowed 
> in/out of the interface?

If the global address fails DAD, it should not be configured on the 
interface. i.e. The only IPv6 address configured on the interface will 
be the link local address.

>  
> Should the system behave exactly as though the global address was 
> absent? That is, should the router forward packets to or from the failed 
> address/network based on whatever routes exist in the forwarding table?

Routing and forwarding decisions are completely independent of what 
addresses are configured on the interface. Contrary to IPv4 behavior, 
the configuration of an address using P::/64 prefix does not 
automatically add a route to the P::/64 prefix. What prefixes are 
on-link is determined by

a) on a router - by configuration
b) on a host - by information contained in the RAs

This means that you can add a route pointing to the right interface for 
the P::/64 prefix even if DAD failed for an address configured using 
this prefix on the same interface.

Cheers
Suresh

---

From: <[email-masked]>
Date: Mon, 5 Jan 2009 21:46:23 +0200

Suresh,
 
okay, that's very clear.
 
Thanks,
Peter

From: ext Suresh Krishnan [mailto:[email-masked]]
Sent: Mon 1/5/2009 7:32 AM
To: Hunt Peter (Nokia-S/MtView)
Cc: [email-masked]
Subject: Re: DAD failure for global IPv6 addresses?

Hi Peter,

Cheers
Suresh

---

From: [email-masked]
Date: Wed, 07 Jan 2009 09:23:47 +0100 (CET)

> b) on a host - by information contained in the RAs

It may be sacrilege to mention it in this group - but b) here is
certainly not the only view of how things work (or for that matter
how they *should* work). For instance - FreeBSD 7.x needs explicit
configuration to turn on IPv6. If IPv6 is turned on, you can configure
a static IPv6 address (for instance a /64 prefix) for an interface -
and this will indeed add a route to this /64 network. Or you can use
various types of autoconfiguration.

Steinar Haug, Nethelp consulting, [email-masked]
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Wed, 07 Jan 2009 17:07:13 -0800

> various types of autoconfiguration.

As you seem to indicate, this should rather be considered an
implementation details, but this FreeBSD's behavior should be viewed
as a shortcut of configuring both an address and an on-link prefix by
a single operation, rather than an instance that "configuring an
address automatically adds a route to the /64 prefix" (I know that,
because I designed and implemented it:-).  In fact, the FreeBSD kernel
internally maintains addresses and prefixes separately, and in that
sense it rather diligently follows the model that Suresh explained.
It adopts the "shortcut" behavior as a compromise for existing
operators who are very familiar with IPv4 operations and would expect
the same side effect.

---
JINMEI, Tatuya
Internet Systems Consortium, Inc.
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------