Subject: Re: Thinking differently about the site local problem (was: RE: site local addresses (was Re: Fw: Welcome to the InterNAT...))

From: Bill Manning <[email-masked]>
Date: Tue, 1 Apr 2003 11:33:46 -0800 (PST)

% > > Let's assume that there is a FooBar server in SiteA.  If 
% > > another node in SiteA (NodeA) is communicating via a 
% > > multi-party application to a node in SiteB (NodeB), and wants 
% > > to refer NodeB to the FooBar server in SiteA, what does it do?
% > 
% > Send a name.
% 
% Not all addresses are published in DNS.
% DNS isn't a requirement for IP either.
% 
% Greets,
%  Jeroen

	Quoth Steve... "There are no urgent DNS problems"

	Are the apps for which IPv6 is enabled that -can not-
	use address literals?  If so, then Steve is wrong and 
	the DNS has become critical infrastructure to the working
	of the Internet.  Otherwise, we should trapese down the
	path of separation of topology locator from stack identifier.

	and then revisit the DNS to see if its best used as a lookup
	service between these two things... :)

--bill
Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: Michael Richardson <[email-masked]>
Date: Tue, 01 Apr 2003 22:32:31 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Bill" == Bill Manning <[email-masked]> writes:
    Bill> 	Are the apps for which IPv6 is enabled that -can not-
    Bill> 	use address literals?  If so, then Steve is wrong and 

  yes.
  Both IPv4 and IPv6 web browsers behave differently if you do,
for instance:
    http://192.139.46.2/
vs  http://www.sandelman.ca/

  A different Host: header is sent, and therefore one gets a different 
(virtual) web site. Of course, we have no need of this in IPv6, since
2^64 web sites per LAN is plenty, but the protocol still exists to do it.
  Can we change this in IPv6? Maybe.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

---

From: Pekka Savola <[email-masked]>
Date: Wed, 2 Apr 2003 09:49:45 +0300 (EEST)

On Tue, 1 Apr 2003, Bill Manning wrote:
> 	use address literals?

There are a few.

Mostly cauzed by lazy porting, and optimizing at the first stage for the 
masses only (ie., changing the API to use getaddrinfo, but if there are 
some internal address-manually-typed-is-ok checks, those may or may not 
be modified).

> If so, then Steve is wrong and 

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Wed, 02 Apr 2003 09:42:17 +0200

--On tirsdag, april 01, 2003 11:33:46 -0800 Bill Manning <[email-masked]> 
wrote:

> 	of the Internet.

anyone who believes that the DNS is not critical infrastructure for just 
about every single purpose the Internet is used for is either living in a 
fantasy world or has redefined the "Internet" to be something that's 
strictly at layer 3 and below.

there are advantages to being able to keep the layer 3 infrastructure 
running for a while (hours, I think) without referring to the DNS.
But for end-user purposes, the DNS being down equates to the Internet being 
down.

Infrastructure doesn't get much more critical than that.

              Harald

---

From: "Jeroen Massar" <[email-masked]>
Date: Wed, 2 Apr 2003 13:13:31 +0200

Michael Richardson wrote:

> (virtual) web site.

Configure your server better than :) (eg use _default_ )
HTTP goes by name, not by IP. Also there is a RFC which
says to never use IPv6 IP's in URL's... That's also why
IE in XP doesn't support it. "Host" is now an integral
part of HTTP/1.1 and one can't even do without it anymore.

> Of course, we have no need of this in IPv6, since

I don't think many hosters will like configuring 2^64 addresses
on their webservers, even though it is possible.

One neat thing about this is HTTPS though, as there are now enough
addresses for that. But fortunatly there are propositions for
enabling the "Host" header for different SSL sites even while
using the same IP (v4+v6 ofcourse).

Greets,
 Jeroen

---

From: Spencer Dawkins <[email-masked]>
Date: Wed, 2 Apr 2003 05:08:33 -0800 (PST)

Hi, Jeroen,

Are you talking about
ftp://ftp.rfc-editor.org/in-notes/rfc2732.txt (PS)? 

My quick read of this RFC is that it says "don't use IPv6
literals without enclosing them in brackets", as in

      host          = hostname | IPv4address | IPv6reference
      ipv6reference = "[" IPv6address "]"

But that's not quite the same thing you said: "never use IPv6
IP's in URL's".

If you're talking about another reference, could you provide it?
A quick RFC search for "IPv6 URL" turned up only this RFC...

Thanks,

Spencer

--- Jeroen Massar <[email-masked]> wrote:
> Also there is a RFC which

---

From: Keith Moore <[email-masked]>
Date: Wed, 2 Apr 2003 08:09:33 -0500

> strictly at layer 3 and below.

agreed.  but there's a difference between saying that DNS is critical
infrastructure and that it's appropriate to use DNS every time an address is
needed.  DNS is necessary, not sufficient.

Keith

---

From: "Jeroen Massar" <[email-masked]>
Date: Wed, 2 Apr 2003 17:18:31 +0200

> A quick RFC search for "IPv6 URL" turned up only this RFC...

Yes, though I can't seem to google up any references. Except for:
http://www.microsoft.com/windowsxp/pro/techinfo/administration/ipv6/defa
ult.asp

"Q: How can I force IPv6 connections using my Web browser?"
<SNIP>
"For applications other than Internet Explorer: Connect using a literal
IPv6 address. URLs that use the format for literal IPv6 addresses
described in RFC 2732, "Format for Literal IPv6 Addresses in URLs," are
not supported by the version of Internet Explorer provided with Windows
XP."

There was some discussion about this deprecation as the
Techpreviews (Win2k/NT4) did support literal url's.
The XP version and up though won't support it to overcome
one major 'problem': website 'designers' embedding IP's
inside websites to 'speed things up' (go figure).
And there where a number of other reasons for deciding so.
Unfortunatly I can't find the messages which where sent
to a mailinglist about this discussion which also contained
why they decided this. Note that wininet.dll doesn't support
it that's why IE doesn't either...

MS CC'd, they can best explain the rationale behind it.

Greets,
 Jeroen

PS: Is 'google' already an official english verb? :)

---

From: Bill Manning <[email-masked]>
Date: Wed, 2 Apr 2003 08:12:36 -0800 (PST)

% > > 	Are the apps for which IPv6 is enabled that -can not-
% > > 	use address literals?  If so, then Steve is wrong and
% > > 	the DNS has become critical infrastructure to the working
% > > 	of the Internet.
% > 
% > anyone who believes that the DNS is not critical infrastructure for just 
% > about every single purpose the Internet is used for is either living in a 
% > fantasy world or has redefined the "Internet" to be something that's 
% > strictly at layer 3 and below.
% 
% agreed.  but there's a difference between saying that DNS is critical
% infrastructure and that it's appropriate to use DNS every time an address is
% needed.  DNS is necessary, not sufficient.
% 
% Keith

	to pass bits, in the IPv4 world, DNS is -NOT- critical.
	no application forbids address literals and every app
	will allow address literals to be used.  Couple this with
	the fact that IPv4 addresses are within the scope of human
	comprehension, i.e. I can remember 128.9.160.160

	with IPv6, the addresses are long enough to not be human
	friendly, e.g.  2001:0478:6: is about as much as I remember
	on my own...  I must use the DNS or my little yellow sticky note
	to complete the address.  And there are intimations that some
	applications now forbid the use of address literals, even
	if bracketed.  

	Sounds like you both are arguing that the DNS has become
	"embedded" and the applications that use IP are unusable 
	without a working DNS.  This assertion, if true, has ramifcations
	beyond a simple requirement to have the latency of an extra
	lookup against a third party.  (Can you say "Death to e2e!...
	sure you can :)

--bill

---

From: Keith Moore <[email-masked]>
Date: Wed, 2 Apr 2003 11:23:56 -0500

> 	without a working DNS.  

as a practical matter, this was true even in IPv4.  yes, you can
often use address literals in either v4 or v6 apps, but this isn't
practical for ordinary users on an ordinary basis.  and in both v4 and
v6, several essential apps (e.g. email, the web) have explicit
dependencies on DNS.  yes you can use address literals in email
addresses and URLs but there is no assurance that an email address or
URL with an address literal is equivalent to the same address or URL
with a domain instead of the address. Both email and the web define
their resources in relation to a DNS name, not relative to a host or
address.

of course it is possible to write apps that do not use DNS, but this is
rarely done.

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 2 Apr 2003 11:24:56 -0500

> inside websites to 'speed things up' (go figure).

perfectly reasonable thing to do.  browsers that don't support it are
broken.

---

From: Keith Moore <[email-masked]>
Date: Wed, 2 Apr 2003 11:36:51 -0500

> > perfectly reasonable thing to do.  browsers that don't support it
> > are broken.
> 
> It's perfectly reasonable to not support RFC2732? or?

it's perfectly reasonable for sites to use address literals in URLs
referenced by their web pages.

---

From: "Jeroen Massar" <[email-masked]>
Date: Wed, 2 Apr 2003 18:34:37 +0200

Greets,
 Jeroen

---

From: John C Klensin <[email-masked]>
Date: Wed, 02 Apr 2003 11:52:22 -0500

--On Wednesday, 02 April, 2003 11:23 -0500 Keith Moore 
<[email-masked]> wrote:

> as a practical matter, this was true even in IPv4.  yes, you
> can often use address literals in either v4 or v6 apps, but
> this isn't practical for ordinary users on an ordinary basis.
> and in both v4 and v6, several essential apps (e.g. email, the
> web) have explicit dependencies on DNS.  yes you can use
> address literals in email addresses and URLs but there is no
> assurance that an email address or URL with an address literal
> is equivalent to the same address or URL with a domain instead
> of the address. Both email and the web define their resources
> in relation to a DNS name, not relative to a host or address.

At least in the case of email, it is important to be precise 
about this, because we have a clear evolutionary trend:

	(i) RFC 2821 can be read (and was intended to be read)
	to prohibit the use of an address literal in a HELO or
	EHLO command unless the relevant host has no DNS name.
	(sections 3.6, 4.1.1.1, 4.1.4)
	
	(ii) The use of address literals is described as a
	mechanism to bypass a barrier, not one for normal use
	(RFC2821, section 4.1.3)
	
	(iii) On the other hand, the address literal "should"
	still be provided in the From clause of a Received
	field.  Received field information is expected to not be
	picked up by other software and protocols, but the
	inclusion of address information there is very
	leak-friendly.

Contrast this with RFC 821, which doesn't seem to strongly argue 
that explicit address use is undesirable.

> of course it is possible to write apps that do not use DNS,
> but this is rarely done.

Yep.  And as pointed out earlier, we have pushed back strongly 
against such protocol proposals and implementations.

     john

---

From: "Jeroen Massar" <[email-masked]>
Date: Wed, 2 Apr 2003 19:02:39 +0200

> of course it is possible to write apps that do not use DNS, 

Fortunatly we still all are humans and like names, not numbers :)
We'll let the numbers to computers (big fast math machines)
Our brains are more advanced and just can't cope with numbers any more
;)

Greets,
 Jeroen

---

From: Keith Moore <[email-masked]>
Date: Wed, 2 Apr 2003 12:03:37 -0500

> 	(sections 3.6, 4.1.1.1, 4.1.4)

these days it's sort of odd to think that a host has a distinguished DNS
name - hosts quite ordinarily have either an emphemeral DNS name,
multiple DNS names, or no DNS name.

> 	mechanism to bypass a barrier, not one for normal use

right.  about the only reasonable use of an address literal is for
testing, or to reach the postmaster at a particular host associated with
a particular address (since "postmaster" is the only address that is
guaranteed to be valid when associated with an address literal - and
even this is often not true in practice)

> 	inclusion of address information there is very

this is different than using address literals in addresses.  email
addresses are defined relative to DNS names because you cannot properly
send mail to an email address without an MX lookup.  OTOH MTAs are
still expected to be hosts with addresses.

> against such protocol proposals and implementations.

many apps that are used in practice are not standardized; we need to be
careful about believing that what's good for standard apps is good for
every app.

I could certainly make a case for some apps to have their own naming
systems and their own name-to-address lookup mechanisms independent of
DNS, or more generally, for alternate means of mapping resource names
(say URNs) to IP addresses that did not involve DNS names or DNS
queries.  But it's difficult to believe that such apps would not employ
DNS names at all - if nothing else, for initial configuration.

---

From: Randy Bush <[email-masked]>
Date: Wed, 2 Apr 2003 09:05:42 -0800

> of course it is possible to write apps that do not use DNS, but this is

why not just embed the ip addresses in the data payloads?  death to
nats!  :-)

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 2 Apr 2003 09:07:12 -0800

Jeroen Massar wrote:
> ... That's also why IE in XP doesn't support it. 

Making claims that you know nothing about, only exposes your lack of
clue.

Tony

---

From: Daniel Senie <[email-masked]>
Date: Wed, 02 Apr 2003 12:09:15 -0500

>MS CC'd, they can best explain the rationale behind it.

This line of reasoning troubles me. One of the ways in which numeric IP 
addresses are useful in URLs is for talking to systems which are not yet 
fully configured (e.g. configuring routers and such). I'm sure Microsoft's 
answer to this is "Use UPNP" but that may not be a universally sufficient 
answer. Others will say "Use Zeroconf" which may also not be sufficient. I 
guess I'm just really uncomfortable requiring name spaces in temporary and 
disconnected networks as an absolute requirement.

Ad-hoc networks are another similar case, where two machines are connected 
via ad-hoc wireless, bluetooth, firewire, or similar. I'd think it might be 
useful to be able to serve web pages between two laptops on a train without 
requiring a naming service to be present. Perhaps that won't be an issue in 
the brave new world.

It just seems to me there is some utility in having this capability (and 
others must have thought so since we have an RFC describing the 
formatting). Let's think hard before deciding we are sure there are no 
useful cases left.

---

From: "Jeroen Massar" <[email-masked]>
Date: Wed, 2 Apr 2003 19:49:41 +0200

Keith Moore wrote:

<Large snip>

> DNS names at all - if nothing else, for initial configuration.

You might almost forget about SMB/CIFS :)
No DNS in there and most people use it daily without even realising it.

Greets,
 Jeroen

---

From: "Jeroen Massar" <[email-masked]>
Date: Wed, 2 Apr 2003 20:47:47 +0200

Daniel Senie wrote:

<big SNIP>

> Ad-hoc networks are another similar case, where two machines 
> are connected via ad-hoc wireless, bluetooth, firewire,
> or similar. I'd think it might be useful to be able to
> serve web pages between two laptops on a train without 
> requiring a naming service to be present. Perhaps that won't 
> be an issue in the brave new world.

Your naming service will probably be of the broadcast kind
In any other way do you like remembering and typing over 128bit
addresses?? :)
Most OS's require a (unique) hostname to be entered/automatically
generated on install to identify the host to the rest of the
system/network/users. This note can also be used to identify
it over your file sharing protocol. SMB/CIFS comes with it's
own version for example. Most Gnutella/* I don't know what
filesharing protocols also have a naming system based on
the users login name etc. Heck even your bluetooth cellphone
nicely announces it's name + address around the room when
you accidentally forget to turn it off. Last weekend some
unnamed person was even spamming all the people at the
national ISP Karting competition over bluetooth. Good guess
to try and spam there as most ISP people are fond of geek
tools but also forget to turn their toys off/protect them :)

> It just seems to me there is some utility in having this 
> capability (and  others must have thought so since we have
> an RFC describing the formatting). Let's think hard before
> deciding we are sure there are no useful cases left.

Ofcourse there is a need for this, but like SL there are some
ways of solving the current ways of doing it. Better clean
up now than be sorry in the end. Eg alcatel adsl modems have a
web&telnet-interface for configuring them, then again being
a SOHO product it should be capable of autoconfiguration.
One thing that's for sure is that you can't use two of those
devices in the same network as the IP's will always be 10.0.0.138
with no other way to change it than by serial or the network.
As we did invent DAD there is no such 'defacto' IP for those
boxes to configure themselves with any more... 
We could use ping6 ff02::1%eth0, but tell that to a homeuser...

Greets,
 Jeroen

---

From: "Jeroen Massar" <[email-masked]>
Date: Wed, 2 Apr 2003 21:40:42 +0200

> Making claims that you know nothing about, only exposes your lack of

Fortunatly I don't have to resolve to personal accusations
to get my point across. I cc:'d the people who really
know how the stuff works so they could comment on these statements. :)

Greets,
 Jeroen

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 2 Apr 2003 12:02:53 -0800

> know how the stuff works so they could comment on these statements. :)

I was the IPv6 program manager for what ended up shipping in XP, and
literals in wininet didn't make it for lack of testing resources. 

Tony

---

From: John Stracke <[email-masked]>
Date: Wed, 02 Apr 2003 14:10:41 -0500

Jeroen Massar wrote:

>>or similar.
:: is your friend.  If you're building an ad hoc, point-to-point 
network, you can pick convenient addresses.

>generated on install
False.

-- 
/============================================================\
|John Stracke      [email-masked]                     |
|Principal Engineer|http://www.centive.com                   |
|Centive           |My opinions are my own.                  |
|============================================================|
|"God does not play games with His loyal servants." "Whoo-ee,|
|where have you *been*?" --_Good Omens_                      |
\============================================================/

---

From: "Jeroen Massar" <[email-masked]>
Date: Thu, 3 Apr 2003 14:12:22 +0200

> network, you can pick convenient addresses.

:: as in all 0's which corresponds to 'not bound'?
I don't see how you are going to communicate between
two hosts with a unbound IP. Especially in a ad-hoc
network where everything should be configured automatically.

> >Most OS's require a (unique) hostname to be entered/automatically

And is there any reasoned argument instead of the simple 'false'?

Greets,
 Jeroen

---

From: Margaret Wasserman <[email-masked]>
Date: Thu, 03 Apr 2003 07:29:33 -0500

Hi Jeroen,

>And is there any reasoned argument instead of the simple 'false'?

Some examples certainly would have been helpful...

I can give one common example.  Special-purpose client systems
(consumer devices, car infotainment systems, etc.) seldom require
or configure a DNS name.

In most IPv4 situations, though, these types of systems would
receive their addresses through DHCP, usually through an ISPs
DHCP server.  In many cases, ISPs provide generic (e.g.
hostNNNNNNN.isp.com) host names for all of the addresses in their
DHCP pool, so that reverse lookups will work, etc.

But the operating system and TCP/IP stack on the device do
not actually require that a hostname be configured.

Margaret

---

From: "Jeroen Massar" <[email-masked]>
Date: Thu, 3 Apr 2003 14:43:28 +0200

> not actually require that a hostname be configured.

My thought went out from both the manual page of a typical Unix box:
8<-------
 Hostname is used to either set or display the current
 host or domain name of the system. This name is used
 by many of the networking programs to identify the
 machine. The domain name is also used by NIS/YP.
------->8

And the fact that windows boxes nowadays also
autogenerate a hostname based on some of the
properties of the machine to overcome clashes
in the SMB/CIFS namespace. Note that this still
has nothing to with IP.

Phones and other devices that could be used
for transfering files usually autogenerate a
hostname based on their cellphonenumber.

But indeed there are bound to be apparatus which 
don't have such a feature, thus one will have to
type the full IP then if you want to do something.
Fortunatly finding out all the hosts on a subnet
isn't that trivial anymore ff02::1 ;)
But I wonder how consumer friendly that is...

Greets,
 Jeroen

---

From: John Stracke <[email-masked]>
Date: Thu, 03 Apr 2003 08:08:23 -0500

>:: as in all 0's which corresponds to 'not bound'?
No, as in a string of 0s.  If you set up your own isolated network, you 
can make one host be 1::1 and the other 1::2.

>And is there any reasoned argument instead of the simple 'false'?
It seems pretty obvious: no OS can require a unique hostname at install 
time, because it has no way of checking uniqueness.  The Unices I've 
installed (various versions of Solaris and Linux), even if they prompt 
for a hostname, will accept the default of "localhost.localdomain".  In 
addition, many, many machines (especially those bought preinstalled) are 
installed from standardized images, and have standardized hostnames.