RFC 5220
Problem Statement for Default Address Selection in Multi-Prefix Environments: Operational Issues of RFC 3484 Default Rules
RFC 5220 🎀 Part 1 of 3
Title: Problem Statement for Default Address Selection in Multi-Prefix Environments: Operational Issues of RFC 3484 Default Rules ✨ Authors: A. Matsumoto, T. Fujisaki (both NTT), R. Hiromi (Intec Netcore), K. Kanayama (INTEC Systems) 🫶 Category: Informational 📚 Date: July 2008 🍓 Obsoletes / Updates: this one doesn't list anything it obsoletes or updates, so it stands on its own 🦋 Network Working Group 💜
Status of This Memo 💅
okay bestie, first the boring-but-important bit 🙈 This memo gives information to the Internet community. It is not an Internet standard of any kind 🙅♀️ And distribution of this memo is unlimited, so share it with whoever 🌈
Abstract ✨
so picture this 🧚 A single physical link can have a bunch of prefixes assigned to it, which means end hosts might end up with multiple IP addresses and need to pick between them on purpose 💖 [RFC3484] is the thing that defines the default source and destination address selection rules, and tons of OSs implement it 🔥 but honestly? It's been way too hard to actually use day to day 😭 When several prefixes sit on one link, a host using the default rules can run into real communication trouble 💀 This doc is basically a list of all the ways end hosts can get into trouble in a multi-prefix setup 🫶
Table of Contents 🎀
1. Introduction ....................................................2
1.1. Scope of This Document .....................................3
2. Problem Statement ...............................................4
2.1. Source Address Selection ...................................4
2.1.1. Multiple Routers on a Single Interface ..............4
2.1.2. Ingress Filtering Problem ...........................5
2.1.3. Half-Closed Network Problem .........................6
2.1.4. Combined Use of Global and ULA ......................7
2.1.5. Site Renumbering ....................................8
2.1.6. Multicast Source Address Selection ..................9
2.1.7. Temporary Address Selection .........................9
2.2. Destination Address Selection .............................10
2.2.1. IPv4 or IPv6 Prioritization ........................10
2.2.2. ULA and IPv4 Dual-Stack Environment ................11
2.2.3. ULA or Global Prioritization .......................12
3. Conclusion .....................................................13
4. Security Considerations ........................................14
5. Normative References ...........................................141. Introduction 🌸
okay so in IPv6, one physical link can carry multiple prefixes ✨ which means an end host can end up with multiple IP addresses on the same interface on that link 🦋 It's also giving the same vibe in an IPv4-IPv6 dual-stack setup, or at a site that's connected to both a Unique Local Address (ULA) [RFC4193] and globally routable networks 💅 Basically, end hosts usually have multiple addresses in these situations, and those are the networks this doc is obsessed with 😭 In that kind of environment, a host can run into some communication troubles 💀
Here's the tea 🍵 Picking the wrong source address at the host can cause unexpected asymmetric routing, get filtered by a router, or get discarded because there's no route to the host 😱
And with multiple prefixes, destination address selection matters too, for setting up communication correctly or better 💖
RFC 3484 [RFC3484] defines the default source and destination address selection algorithms, and it's implemented in a bunch of OSs 🔥 But it's been too hard to use operationally for a few reasons, like the lack of an autoconfiguration method 🙃 There are some problem cases where hosts using the default rules run into communication trouble 💀
So this document explains all the ways bad address selection can lead to dropped packets and failed communication 🫶
1.1. Scope of This Document 🎀
Multi-homing techniques for getting redundancy already have other mechanisms covering them, so they're basically out of scope for this doc 🙅♀️
We're focusing on end-site networks and unmanaged hosts inside them 🏠 Why? Because address selection behavior on these hosts is hard to change, thanks to users not knowing much, where the hosts are, or just how many hosts there are 🙈
The goal is to sort out the problem cases related to address selection 🧹 That includes problems that can be solved inside the RFC 3484 framework and problems that can't 💅 For the ones that can't, RFC 3484 might get modified to meet those needs, or a different address selection solution might be needed 👑 For the ones that can, an extra mechanism might be needed to make the operational pain go away 🫶
This doc also includes a simple solution analysis for each problem case ✨ That analysis mostly asks whether the case can be solved inside the RFC 3484 framework 🤔 If it can't, some possible solutions get described 🦋 Even when a case can be solved within RFC 3484, that does not automatically mean there's no operational difficulty 😭 For example, in the environment described above, configuring each host's policy table by hand is not a realistic solution 🙅♀️ So for that kind of solution, the difficulty of configuration is yet another common problem 💀
2. Problem Statement 💖
2.1. Source Address Selection 🌈
2.1.1. Multiple Routers on a Single Interface 🧚
==================
| Internet |
==================
| |
2001:db8:1000::/36 | | 2001:db8:8000::/36
+----+-+ +-+----+
| ISP1 | | ISP2 |
+----+-+ +-+----+
| |
2001:db8:1000:::/48 | | 2001:db8:8000::/48
+-----+---+ +----+----+
| Router1 | | Router2 |
+-------+-+ +-+-------+
| |
2001:db8:1000:1::/64 | | 2001:db8:8000:1::/64
| |
-----+-+-----+------
|
+-+----+ 2001:db8:1000:1::100
| Host | 2001:db8:8000:1::100
+------+
Figure 1Generally speaking, next-hop determination and address selection don't really talk to each other 🙈 In this example, when a host starts a new connection and sends a packet via Router1, it doesn't necessarily pick 2001:db8:1000:1::100 (the address given by Router1) as its source address 😬 And this causes the same problem as the next section, "Ingress Filtering Problem" 💅
Solution analysis: Since this case depends on next-hop selection, controlling address selection at the Host alone doesn't fix the whole thing 🙅♀️ One possible fix is using source-address-based routing at Router1 and Router2 🦋 Another option might be using static routing at Router1, Router2, and the Host, plus the matching static address selection policy at the Host 🫶
2.1.2. Ingress Filtering Problem 🔥
==================
| Internet |
==================
| |
2001:db8:1000::/36 | | 2001:db8:8000::/36
+----+-+ +-+----+
| ISP1 | | ISP2 |
+----+-+ +-+----+
| |
2001:db8:1000:::/48 | | 2001:db8:8000::/48
++-------++
| Router |
+----+----+
| 2001:db8:1000:1::/64
| 2001:db8:8000:1::/64
------+---+----------
|
+-+----+ 2001:db8:1000:1::100
| Host | 2001:db8:8000:1::100
+------+
Figure 2Picture a relatively small site (we call it a "customer network") hooked up to two upstream ISPs 🏡 Each ISP hands out a network address block, usually a /48, and the host ends up with multiple IPv6 addresses 🌸
Now here's the drama 😱 If an outgoing packet's source address isn't the one delegated by its upstream ISP, the packet might get dropped at that ISP by its ingress filter 💀 Ingress filtering is getting more and more popular among ISPs, since it helps mitigate the damage from denial-of-service (DoS) attacks 🛡️
In this example, the router picks the default route to ISP2, and the host picks 2001:db8:1000:1::100 as the source address for packets going to a host at 2001:db8:2000::1 somewhere on the Internet 🌍 Those packets may get dropped at ISP2 because of ingress filtering 😭
Solution analysis: One possible fix for this case is source-address-based routing at the Router 🦋 Another option may be static routing at the Router, plus the matching static address selection policy at the Host 💖
(part 1 of 3, more coming bestie 🫶 don't go anywhere!) 💜
2.1.3. Half-Closed Network Problem
okay so this one is a second source address selection mess, and it's in a multi-homed site with global half-closed connectivity 🙈 Host-A is in a multi-homed network and has two IPv6 addresses, one delegated from each upstream ISP. The tea: ISP2 is a closed network and has no connectivity to the Internet 💀
+--------+
| Host-C | 2001:db8:a000::1
+-----+--+
|
============== +--------+
| Internet | | Host-B | 2001:db8:8000::1
============== +--------+
| |
2001:db8:1000:/36 | | 2001:db8:8000::/36
+----+-+ +-+---++
| ISP1 | | ISP2 | (Closed Network/VPN tunnel)
+----+-+ +-+----+
| |
2001:db8:1000:/48 | | 2001:db8:8000::/48
++-------++
| Router |
+----+----+
| 2001:db8:1000:1::/64
| 2001:db8:8000:1::/64
------+---+----------
|
+--+-----+ 2001:db8:1000:1::100
| Host-A | 2001:db8:8000:1::100
+--------+
Figure 3you do NOT need two physical network connections here 🙅♀️ the link from the Router to ISP2 can be a logical link over ISP1 and the Internet 🦋
when Host-A starts a connection to Host-B in ISP2, the source address of the packet that gets sent will be the one delegated from ISP2 (that's 2001:db8:8000:1::100) because of rule 8 (longest matching prefix) in RFC 3484 💅
now Host-C is out on the Internet with 2001:db8:a000::1. when Host-A sends a packet to Host-C, the longest matching algorithm picks 2001:db8:8000:1::100 as the source address 😭 so the packet goes through ISP1 and might get caught by ISP1's ingress filter. and even if it slips past, the return packet from Host-C can't possibly reach Host-A, because it's headed for 2001:db8:8000:1::100, which is closed off from the Internet. not it 💀
the big takeaway: each host has to pick a correct source address for a given destination address ✨ to solve this kind of network-policy-based address selection problem, it's likely that delivering extra information to a node is a better fix than relying on algorithms that are local to the node 🧚
Solution analysis: This problem can be solved in the RFC 3484 framework. For example, configuring some address selection policies into Host-A's RFC 3484 policy table can solve this problem.
2.1.4. Combined Use of Global and ULA
============
| Internet |
============
|
|
+----+----+
| ISP |
+----+----+
|
2001:db8:a::/48 |
+----+----+
| Router |
+-+-----+-+
| | 2001:db8:a:100::/64
fd01:2:3:200:/64 | | fd01:2:3:100:/64
-----+--+- -+--+----
| |
fd01:2:3:200::101 | | 2001:db8:a:100::100
+----+----+ +-+----+ fd01:2:3:100::100
| Printer | | Host |
+---------+ +------+
Figure 4so [RFC4864] explains that using a ULA can be beneficial in some scenarios 🌸 if the ULA is used for internal communication, packets with the ULA need to be filtered at the Router 🧱
this case doesn't create an address selection problem yet 👀 because the ULA and the global unicast address are really different from each other. the longest matching rule of RFC 3484 picks the right address for both intra-site and extra-site communication 💖
BUT in the future, the longest matching rule might stop being able to pick the correct address 😱 that's the moment the assignment of global unicast addresses starts, where the first bit is 1. per [RFC4291], almost all of the IPv6 address space, including the parts whose first bit is 1, is assigned as global unicast addresses 🌈
so basically, when we start assigning a part of the address block 8000::/1 as global unicast addresses, and that part is used somewhere on the Internet, the longest matching rule stops working properly for people trying to connect to servers with those addresses 💀
for example, say the destination host has the IPv6 address 8000::1, and the originating host has 2001:db8:a:100::100 and fd01:2:3:100::100. the source address will be fd01:2:3:100::100, because the longest matching bit length is 0 for 2001:db8:a:100::100 and 1 for fd01:2:3:100::100, respectively 🎀
Solution analysis: This problem can be solved in the RFC 3484 framework. For example, configuring some address selection policies into the Host's RFC 3484 policy table can solve this problem. Another solution is to modify RFC 3484 and define ULA's scope smaller than the global scope.
2.1.5. Site Renumbering
okay renumbering is a whole vibe 🧹 [RFC4192] describes a recommended procedure for renumbering a network from one prefix to another ✨ an autoconfigured address has a lifetime, so when you stop advertising the old prefix, the autoconfigured address eventually gets invalidated 🦋
BUT invalidating the old prefix takes forever ⏳ you can't stop routing to the old prefix as long as it hasn't been removed from the host. ISP network admins really feel this one 😩
there's a technique where you advertise the prefix with a preferred lifetime of zero 🧃 however, [RFC4862] Section 5.5.4 does not absolutely prohibit using a deprecated address for a new outgoing connection, because of limitations on what applications can do 💅
+-----+---+
| Router |
+----+----+
| 2001:db8:b::/64 (new)
| 2001:db8:a::/64 (old)
------+---+----------
|
+--+---+ 2001:db8:b::100 (new)
| Host | 2001:db8:a::100 (old)
+------+
Figure 5Solution analysis: This problem can be mitigated in the RFC 3484 framework. For example, configuring some address selection policies into the Host's RFC 3484 policy table can solve this problem.
2.1.6. Multicast Source Address Selection
this one is an example of site-local vs. global unicast prioritization 🌟 when you send a multicast packet across site borders, the source address of that multicast packet should be a globally routable address 🌍 the longest matching algorithm, though, picks a ULA if the sending host has both a ULA and a Global Unicast Address 😤
Solution analysis: This problem can be solved in the RFC 3484 framework. For example, configuring some address selection policies into the sending host's RFC 3484 policy table can solve this problem.
2.1.7. Temporary Address Selection
[RFC3041] defines a Temporary Address 🫶 using one has pros AND cons. it's great for browsing web pages or talking to the general public, but it's bad for services that use address-based authentication and for logging 📋
it would be better if you could turn temporary addresses on and off 🔁 and it would be even better if you could switch their usage per service (per destination address) 🧠 the same situation shows up with an HA (home address) and a CoA (care-of address) in a Mobile IPv6 [RFC3775] network 🛰️
Section 6 ("Future Work") of RFC 3041 discusses that an API extension might be necessary to get a better address selection mechanism with finer granularity 🔍
Solution analysis: This problem cannot be solved in the RFC 3484 framework. A possible solution is to make applications select desirable addresses by using the IPv6 Socket API for Source Address Selection defined in [RFC5014] 📱
2.2. Destination Address Selection
2.2.1. IPv4 or IPv6 Prioritization
okay so the default policy table gives IPv6 addresses higher precedence than IPv4 addresses 💜 BUT there are lots of cases where network admins want end hosts' address selection policy to be the other way around 🙃
+---------+
| Tunnel |
| Service |
+--+---++-+
| ||
| ||
===========||==
| Internet || |
===========||==
| ||
192.0.2.0/24 | ||
+----+-+ ||
| ISP | ||
+----+-+ ||
| ||
IPv4 (Native) | || IPv6 (Tunnel)
192.0.2.0/26 | ||
++-----++-+
| Router |
+----+----+
| 2001:db8:a:1::/64
| 192.0.2.0/28
|
------+---+----------
|
+-+----+ 2001:db8:a:1::100
| Host | 192.0.2.2
+------+
Figure 6in the figure above, the site has native IPv4 AND tunneled IPv6 connectivity 🌐 so the admin might want to give IPv4 a higher priority than IPv6, because the quality of the tunnel seems worse than the native transport 🐢
Solution analysis: This problem can be solved in the RFC 3484 framework. For example, configuring some address selection policies into the Host's RFC 3484 policy table can solve this problem. 💅
2.2.2. ULA and IPv4 Dual-Stack Environment
Okay so this is a special flavor of the IPv4 vs IPv6 prioritization drama 💅. Picture an enterprise with IPv4 Internet connectivity but no IPv6 Internet connectivity yet, and they still want site-local IPv6 connectivity 🌸. A ULA is the best choice for that. Every employee host gets both an IPv4 global or private address and a ULA. So when Host-A tries to reach Host-B, which has both A and AAAA records in DNS, Host-A picks the AAAA as the destination and the ULA as the source. And ngl, this will clearly result in a connection failure 💀.
+--------+
| Host-B | AAAA = 2001:db8::80
+-----+--+ A = 192.0.2.1
|
============
| Internet |
============
| no IPv6 connectivity
+----+----+
| Router |
+----+----+
|
| fd01:2:3::/48 (ULA)
| 192.0.2.128/25
++--------+
| Router |
+----+----+
| fd01:2:3:4::/64 (ULA)
| 192.0.2.240/28
------+---+----------
|
+-+------+ fd01:2:3:4::100 (ULA)
| Host-A | 192.0.2.245
+--------+
Figure 7Solution analysis: this one can be fixed inside the RFC 3484 framework 🫶. For example, configuring some address selection policies into Host-A's RFC 3484 policy table can solve this problem.
2.2.3. ULA or Global Prioritization
Differentiating services by the client's source address is super common 👀. IP-address-based authentication is a classic example. Another one is a web service with pages for the public and internal pages for employees or involved parties. And yet another is DNS zone splitting 🧚.
However, a ULA and an IPv6 global address both have global scope, and RFC 3484 default rules do not specify which address should be given priority. So IPv6 implementation of address-based service differentiation is a bit harder 🥲.
+--------+
| Host-B |
+-+--|---+
| |
===========|==
| Internet | |
===========|==
| |
| |
+----+-+ +-->+------+
| ISP +------+ DNS | 2001:db8:a::80
+----+-+ +-->+------+ fc12:3456:789a::80
| |
2001:db8:a::/48 | |
fc12:3456:789a::/48 | |
+----+----|+
| Router ||
+---+-----|+
| | 2001:db8:a:100::/64
| | fc12:3456:789a:100::/64
--+-+---|-----
| |
+-+---|--+ 2001:db8:a:100::100
| Host-A | fc12:3456:789a:100::100
+--------+
Figure 8Solution analysis: this problem can be fixed inside the RFC 3484 framework too ✨. For example, configuring some address selection policies into Host-A's RFC 3484 policy table can solve this problem.
3. Conclusion
We have covered problems related to destination or source address selection 🎀. These problems have their roots in the situation where end hosts have multiple IP addresses. In this situation, every end host must choose an appropriate destination and source address, and this choice cannot be achieved only by routers 🧠.
It should be noted that end hosts must be informed about routing policies of their upstream networks for appropriate address selection 📣. A site administrator must consider every possible address false-selection problem and take countermeasures beforehand 🛡️.
4. Security Considerations
Okay, this section is the serious one, bestie 🚨. Read it all.
When an intermediate router performs policy routing (e.g., source-address-based routing), inappropriate address selection causes unexpected routing 😳. For example, in the network described in Section 2.1.3, when Host-A uses a default address selection policy and chooses an inappropriate address, a packet sent to a VPN can be delivered to a location via the Internet. This issue can lead to packet eavesdropping or session hijack 👀. However, sending the packet back to the correct path from the attacker to the node is not easy, so these two risks are not serious 🙈.
As documented in the Security Considerations section of RFC 3484, address selection algorithms expose a potential privacy concern 🔒. When a malicious host can make a target host perform address selection (for example, by sending an anycast or multicast packet), the malicious host can get knowledge of multiple addresses attached to the target host. In a case like Section 2.1.4, if an attacker can make the Host send a multicast packet and the Host performs the default address selection algorithm, the attacker may be able to determine the ULAs attached to the host 😱.
These security risks have roots in inappropriate address selection 🌈. Therefore, if a countermeasure is taken, and hosts always select an appropriate address that is suitable to a site's network structure and routing, these risks can be avoided 🫶.
5. Normative References
- [RFC3041] Narten, T. and R. Draves, "Privacy Extensions for Stateless Address Autoconfiguration in IPv6", RFC 3041, January 2001. 🧾
- [RFC3484] Draves, R., "Default Address Selection for Internet Protocol version 6 (IPv6)", RFC 3484, February 2003. 🧾
- [RFC3775] Johnson, D., Perkins, C., and J. Arkko, "Mobility Support in IPv6", RFC 3775, June 2004. 🧾
- [RFC4192] Baker, F., Lear, E., and R. Droms, "Procedures for Renumbering an IPv6 Network without a Flag Day", RFC 4192, September 2005. 🧾
- [RFC4193] Hinden, R. and B. Haberman, "Unique Local IPv6 Unicast Addresses", RFC 4193, October 2005. 🧾
- [RFC4291] Hinden, R. and S. Deering, "IP Version 6 Addressing Architecture", RFC 4291, February 2006. 🧾
- [RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless Address Autoconfiguration", RFC 4862, September 2007. 🧾
- [RFC4864] Van de Velde, G., Hain, T., Droms, R., Carpenter, B., and E. Klein, "Local Network Protection for IPv6", RFC 4864, May 2007. 🧾
- [RFC5014] Nordmark, E., Chakrabarti, S., and J. Laganier, "IPv6 Socket API for Source Address Selection", RFC 5014, September 2007. 🧾
Authors' Addresses
Here's who wrote this, bestie 💜
Arifumi Matsumoto
NTT PF Lab
Midori-Cho 3-9-11
Musashino-shi, Tokyo 180-8585
Japan
Phone: +81 422 59 3334
EMail: arifumi@nttv6.netTomohiro Fujisaki
NTT PF Lab
Midori-Cho 3-9-11
Musashino-shi, Tokyo 180-8585
Japan
Phone: +81 422 59 7351
EMail: fujisaki@nttv6.netRuri Hiromi
Intec Netcore, Inc.
Shinsuna 1-3-3
Koto-ku, Tokyo 136-0075
Japan
Phone: +81 3 5665 5069
EMail: hiromi@inetcore.comKen-ichi Kanayama
INTEC Systems Institute, Inc.
Shimoshin-machi 5-33
Toyama-shi, Toyama 930-0804
Japan
Phone: +81 76 444 8088
EMail: kanayama_kenichi@intec-si.co.jpFull Copyright Statement
Copyright (C) The IETF Trust (2008) ©️.
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights 📜.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79 🪪.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org 💌.
📦 where this page comes from
- ietf: rfc5220 2008-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms