Subject: ND next generation

From: Vasilenko Eduard <[email-masked]>
Date: Thu, 1 Oct 2020 12:15:53 +0000

Pascal,
Please, rename subject when talking different topic.

In general, I agree to you that many things was not possible to predict in 1995.
Who was capable at that time to guess that majority of connections would be wireless? Hence, multicast is not good. Loss ratio would be different.
Distributed architecture always complex - it looks like it is not the right balance for the business. Distributed architecture should have more justification then we have for ND.
By the way, the assumption that all traffic would be encrypted has proved to be right - we are very close to this situation. Just the political battle who would possess keys do destroy the value from encryption.

But be real!
Do you believe that it is possible to move to something principally different? Billions of hosts.
I believe it is not. Who would pay? It is like the famous IPv10 discussion - comparable scale.
Hence, only optimization is left.

May be in the far-far future (definitely past my life) when the world would decide to more to IP next-next generation
ND problem could be on the list.
Definitely it should not be in the first 10 justification points.

Eduard
> -----Original Message-----
> From: Pascal Thubert (pthubert) [mailto:[email-masked]]
> Sent: 1 октября 2020 г. 14:37
> To: Fernando Gont <[email-masked]>; Vasilenko Eduard
> <[email-masked]>; Fernando Gont <[email-masked]>;
> Xipengxiao <[email-masked]>; [email-masked]
> Subject: RE: New draft-vasilenko-6man-nd-mitm-protection-00.txt
> 
> Hello Fernando
> 
> > >> If you consider RA-guard a mitigation for RA-based attacks, then,
> > >> things like "First Hop Security"/ND inspection/SAVI would solve the
> > >> ND
> > counterpart.
> > > I have not understood what you mean by "First Hop Security"/ND inspection"
> > - it looks as very general term.
> >
> > See e.g.:
> > https://www.cisco.com/c/en/us/td/docs/ios-
> > xml/ios/ipv6_fhsec/configuration/15-sy/ip6-nd-inspect.html
> 
> As you point out, this 10 years-old approach mitigates ND attacks including the
> ones addressed here.  It's interesting that 20 years old problems keep
> resurfacing in new drafts. The world has moved on and 6MAN was left behind.
> 
> Still you'll find that we do a number of internal tricks, inclusion transformations
> of the frames and "intelligent" frame drops, that were not discussed / validated
> by the community. This yields its own dangers so yes, it's not an ideal situation. I
> know, I wrote a good deal of that code.
> 
> ND inspection is based in snooping and would benefit from a real interface with
> the host. We saw that in the GRAND discussion, another trick like the one
> proposed because the base ND is outdated. How many till this group wakes up?
> 
> Now, there is second chance to reconciliate the needs of the real world and the
> work at 6MAN. We all know what shape ND needs to have in a modern
> managed network. And it's not reactive.
> 
> Keep safe;
> 
> Pascal
>

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 1 Oct 2020 12:28:00 +0000

Hello Eduard

> But be real!
> Do you believe that it is possible to move to something principally different?

Not move, but migrate

> Billions of hosts.

3 major OSes

> I believe it is not. Who would pay? It is like the famous IPv10 discussion -

Big, big confusion. 

The difference is coexistence. Both proactive and unchanged legacy reactive ND can coexist and interwork in a same network, so there's a smooth migration scenario with proxy ND. The more nodes migrate, the bigger the benefit.

, the value rising with the number of migrated hosts.

> Hence, only optimization is left.

Well, no.

Keep safe;

Pascal

---

From: Vasilenko Eduard <[email-masked]>
Date: Thu, 1 Oct 2020 13:07:24 +0000

No. It is billions of hosts.
Many would not be possible to upgrade at all.
One should wait till it would be refreshed for other reasons.
It is 10 years in the most optimistic scenario.
And efforts comparable to introduction of IP next-next generation.

Worst case scenario: the business just ignore SLAAC, would use only DHCP.
But the rest of ND is with us for a few decades to come.

> Sent: 1 октября 2020 г. 15:28
> To: Vasilenko Eduard <[email-masked]>; [email-masked]
> Subject: RE: ND next generation
> 
> Hello Eduard
> 
> > But be real!
> The difference is coexistence. Both proactive and unchanged legacy reactive ND
> can coexist and interwork in a same network, so there's a smooth migration
> scenario with proxy ND. The more nodes migrate, the bigger the benefit.
>

---

From: Ted Lemon <[email-masked]>
Date: Thu, 1 Oct 2020 09:10:47 -0400

Eduard, Pascal’s point is that it’s okay if not every host is upgraded. Hit the big three, and things change a lot. It’s okay to continue the legacy support. 

> On Oct 1, 2020, at 09:07, Vasilenko Eduard <[email-masked]> wrote:
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 1 Oct 2020 14:29:21 +0000

Exactly, Ted, many thanks for the clarification.

The classical reactive ND has neat advantages in unmanaged situations with limited broadcast domains, e.g., autonomic operation. So deprecating that operation is not an objective. 

An upgraded host may move in a home network with a legacy GW that does not (expose) support for the proactive ND. In that network, the host must fall back to classical ND operation. But when it joins a corporate network, that same host can use the registration and get higher grade services such as address protection. 

And true, not every host will quickly upgrade the OS. OTOH, for most mobile phones and tablets, managed GWs such as home boxes, and corporate laptops, the upgrade usually a matter of months after the OS is available. The registration is already the standard for IoT devices. 

So once the big 3 make the move, the majority of the active wireless devices will be capable to reduce their broadcast footprint in the (large, managed) networks where it counts the most within a year or 2. That is what we are after.

Keep safe,

Pascal

> From: Ted Lemon <[email-masked]>
> Sent: jeudi 1 octobre 2020 15:11
> To: Vasilenko Eduard <[email-masked]>
> Cc: Pascal Thubert (pthubert) <[email-masked]>; [email-masked]
> Subject: Re: ND next generation
> 
> Eduard, Pascal’s point is that it’s okay if not every host is upgraded. Hit the big
> three, and things change a lot. It’s okay to continue the legacy support.
> 
> >> The difference is coexistence. Both proactive and unchanged legacy
> >> reactive ND can coexist and interwork in a same network, so there's a
> >> smooth migration scenario with proxy ND. The more nodes migrate, the
> bigger the benefit.
> >>

---

From: Vasilenko Eduard <[email-masked]>
Date: Thu, 1 Oct 2020 14:52:21 +0000

Is it possible to have on 1 link some hosts ND, other hosts ND NG? Probably yes, with negative operational consequences.
Anyway, it would be many pros and cons. And the model (assumptions) should be carefully specified.

I am from business for last 20+ years. I remember that to compare incomparable things some $$ estimation should be done for every "business driver".
Or else the dispute would be endless.
I do not have any clue what would be the result if somebody would try to properly document all positive and negative drivers for the case that you pushing.
I am not ready to accept such job because I strongly suspect the work for garbage basket.
I am still pessimistic about business case.

But what I am sure that is does not matter how many emails you would send to push this problem,
Only comprehensive document could help.

Ed/
> Sent: 1 октября 2020 г. 17:29
> To: Ted Lemon <[email-masked]>; Vasilenko Eduard
> <[email-masked]>
> Cc: [email-masked]
> The classical reactive ND has neat advantages in unmanaged situations with
> limited broadcast domains, e.g., autonomic operation. So deprecating that
> operation is not an objective.
> 
> An upgraded host may move in a home network with a legacy GW that does not
> (expose) support for the proactive ND. In that network, the host must fall back
> to classical ND operation. But when it joins a corporate network, that same host
> can use the registration and get higher grade services such as address
> protection.
> 
> And true, not every host will quickly upgrade the OS. OTOH, for most mobile
> phones and tablets, managed GWs such as home boxes, and corporate laptops,
> the upgrade usually a matter of months after the OS is available. The
> registration is already the standard for IoT devices.
> 
> So once the big 3 make the move, the majority of the active wireless devices will
> be capable to reduce their broadcast footprint in the (large, managed) networks
> where it counts the most within a year or 2. That is what we are after.
> 
> Keep safe,
> 
> Pascal
> 
> 
> > Eduard, Pascal’s point is that it’s okay if not every host is
> > upgraded. Hit the big three, and things change a lot. It’s okay to continue the
> legacy support.
> >
> > > On Oct 1, 2020, at 09:07, Vasilenko Eduard
> > > <[email-masked]>
> > wrote:
> > >
> > >>> Do you believe that it is possible to move to something
> > >>> principally
> > different?
> > >>
> > >> Not move, but migrate
> > >>
> > >>> Billions of hosts.
> > >>
> > >> 3 major OSes
> > >>
> > >> reactive ND can coexist and interwork in a same network, so there's
> > >> a smooth migration scenario with proxy ND. The more nodes migrate,
> > >> the
> > bigger the benefit.
> > >>
> > > IETF IPv6 working group mailing list [email-masked] Administrative
> > > Requests: https://www.ietf.org/mailman/listinfo/ipv6

---

From: Ted Lemon <[email-masked]>
Date: Thu, 1 Oct 2020 11:10:25 -0400

Tbh, for constrained use cases like WiFi base stations, It might work just as well to simply capture multi casts on the base station and do proxy nd there without changes on the host. 

> On Oct 1, 2020, at 10:52, Vasilenko Eduard <[email-masked]> wrote:
>

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 1 Oct 2020 15:29:47 +0000

Yes, Ted, that's pretty much the starting point for what we ship with FHS. And yes, we filter a lot of multicast, convert into L2 unicast when we can.

In that process, we found limits, and designed the registration to address those. ND is not very explicit about what's going on and it is hard to differentiate some valid situations from attacks. Messages can be missed. Hosts can be silent. Not all multicast can be filtered.

E.g., an address is voluntarily transferred because a server is migrated or the node decides to form a new privacy MAC, vs. an attacker is active stealing the address.

The more the host tells about its intention, the better the network can serve it. E.g., how long is the host expecting to retain the address? When it moves and shows up in different place, which is the most recent?

Keep safe

Pascal

> Sent: jeudi 1 octobre 2020 17:10
> Tbh, for constrained use cases like WiFi base stations, It might work just as well
> to simply capture multi casts on the base station and do proxy nd there
> without changes on the host.
> 
> > Is it possible to have on 1 link some hosts ND, other hosts ND NG? Probably
> yes, with negative operational consequences.
> > I am from business for last 20+ years. I remember that to compare
> incomparable things some $$ estimation should be done for every "business
> driver".
> > I do not have any clue what would be the result if somebody would try to
> properly document all positive and negative drivers for the case that you
> pushing.
> > But what I am sure that is does not matter how many emails you would
> > send to push this problem, Only comprehensive document could help.
> >
> > Ed/
> >> The classical reactive ND has neat advantages in unmanaged situations
> >> with limited broadcast domains, e.g., autonomic operation. So
> >> deprecating that operation is not an objective.
> >>
> >> (expose) support for the proactive ND. In that network, the host must
> >> fall back to classical ND operation. But when it joins a corporate
> >> network, that same host can use the registration and get higher grade
> >> services such as address protection.
> >>
> >> And true, not every host will quickly upgrade the OS. OTOH, for most
> >> mobile phones and tablets, managed GWs such as home boxes, and
> >> corporate laptops, the upgrade usually a matter of months after the
> >> OS is available. The registration is already the standard for IoT devices.
> >>
> >> So once the big 3 make the move, the majority of the active wireless
> >> devices will be capable to reduce their broadcast footprint in the
> >> (large, managed) networks where it counts the most within a year or 2. That
> is what we are after.
> >>
> >> Keep safe,
> >>
> >> Pascal
> >>
> >>
> >>>>> reactive ND can coexist and interwork in a same network, so
> >>>>> there's a smooth migration scenario with proxy ND. The more nodes
> >>>>> migrate, the
> >>> bigger the benefit.
> >>>>>
> >>>> -------------------------------------------------------------------
> >>>> - IETF IPv6 working group mailing list [email-masked] Administrative

---

From: Vasilenko Eduard <[email-masked]>
Date: Thu, 1 Oct 2020 17:00:00 +0000

Hi Ted,
Proxy would not eliminate a lot of multicast.
Pascal is pushing the solution with host software change - it is the revolution for that reason.
Eduard
> From: Ted Lemon [mailto:[email-masked]]
> Sent: 1 октября 2020 г. 18:10
> to simply capture multi casts on the base station and do proxy nd there without
> changes on the host.
>