Subject: Re: [v6ops] Semantic IPv6 Prefix drafts

From: Erik Nygren <[email-masked]>
Date: Mon, 19 Nov 2012 18:41:19 -0500

The concept of semantic addressing is certainly useful in some contexts,
and it does feel like an area where having some standards and shared best
practices could be useful.

Some particular feedback:

* I think it is critical to be clear that any semantic addressing is only
meaningful within administrative/operational domains (such as within an
address prefix controlled by an organization).

* Semantic addressing has applications outside of just semantic prefixes.
There are certainly cases where having address semantics outside of the
prefix (ie, in the bottom 64 bits) would also be valuable, although this
has different considerations as to security and interaction with address
assignment.

* A big missing piece of semantic addressing is a standard way of
communicating the semantic match or bits.  This feels like one area where
it may be valuable to do IETF standardization work to define a language for
specifying semantic address matches or patterns.  This way semantic
addresses could be usefully communicated between parties and devices within
an organization, as well as between organizations.  Ideally this would be
implemented in routers and other network devices (such as to allow the
application of packet filtering based on these semantic address matches).

Expanding on that last point about allowing semantic matches to be
specified, an initial proposal is that this consists of three parts:   an
address prefix or set of prefixes (the context within the semantic match
applies), a mask (specifying which bits have semantics), and a value (the
value of the bits after masking the address).  Once there is a language to
talk about these matches, it becomes possible to apply policies based on
these matches.

For example, if an organization has the network 2001:db8::/32 and decides
that bits 48-51 specify the subscriber type (eg,
http://tools.ietf.org/html/draft-sun-semantic-usecase-01 section 2), it
would be possible to specify wifi subscribers with:

            { prefix: "2001:db8::/32", mask: "0:0:0:f000::", values: [
"0:0:0:a000::", "0:0:0:b000::" ] }

For another example, some other organization might want to apply a policy
to all devices with a particular EUI-64 value ("AC:DE:48") within their
network (eg, to do some extra logging for debugging).
They might then specify that with:

            { prefix: "2001:db8:abcd::/48", mask: "::ffff:ffff:ff00:0",
value: "::acde:48ff:fe00:0" }

Another example might be for an organization that always runs a particular
virtual server host on addresses ending with "::1234" to communicate that
as:

           { prefixes: [ "2001:db8:abcd::/48", "2001:db8:abce::/48" ],
mask: "::ffff", value: "::1234" }

The JSON notation above is just one example --- there may be some other
syntax more friendly to more router configuration languages.
Having some standard notation like this that specifies a mask, masked
value(s), and the applicable prefix(es) would make semantic prefixing
(and semantic addressing in general) much more viable for those networks or
operators for whom it makes sense within their environment
as there would then be some way to communicate and use it.

       Erik

On Tue, Oct 23, 2012 at 5:54 AM, Sheng Jiang <[email-masked]> wrote:

> Hi, all,
>
> Two semantic IPv6 prefix have been submitted to IETF. Could you please
> review them? Any comments/suggestions/advices are appreciated.
>
> A Framework for Semantic IPv6 Prefix and Gap Analysis,
> http://tools.ietf.org/html/draft-jiang-v6ops-semantic-prefix-01
>
> Use case of IPv6 prefix semantics for operators,
> http://tools.ietf.org/html/draft-sun-semantic-usecase-01
>
> Best regards,
>
> Sheng + Qiong
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Sheng Jiang <[email-masked]>
Date: Tue, 20 Nov 2012 02:34:50 +0000

Hi, Erik,

Thanks for your email and support. Some detailed replies in lines.

Sheng

From: [email-masked] [mailto:[email-masked]] On Behalf Of Erik Nygren
Sent: Tuesday, November 20, 2012 7:41 AM
To: Sheng Jiang
Cc: [email-masked]; sunqiong; [email-masked]
Subject: Re: [v6ops] Semantic IPv6 Prefix drafts

The concept of semantic addressing is certainly useful in some contexts, and it does feel like an area where having some standards and shared best practices could be useful.

* I think it is critical to be clear that any semantic addressing is only meaningful within administrative/operational domains (such as within an address prefix controlled by an organization).

<sheng> fully agree. That’s why we defines the Semantic Prefix Domain to clearly draw the borders.

* Semantic addressing has applications outside of just semantic prefixes.  There are certainly cases where having address semantics outside of the prefix (ie, in the bottom 64 bits) would also be valuable, although this has different considerations as to security and interaction with address assignment.

<sheng>This is an interesting use case. We did consider it before. But we were not sure how these address can be trusted. If you only consider DHCPv6 assigning address model, this is a valuable use case (we may write other draft for this, I guess). But if you consider SLAAC, the host generated interface ID are not trusted for semantics.

* A big missing piece of semantic addressing is a standard way of communicating the semantic match or bits.  This feels like one area where it may be valuable to do IETF standardization work to define a language for specifying semantic address matches or patterns.  This way semantic addresses could be usefully communicated between parties and devices within an organization, as well as between organizations.  Ideally this would be implemented in routers and other network devices (such as to allow the application of packet filtering based on these semantic address matches).

<sheng> This is one of the gaps we have identified in the framework document. So fully agree, also the below example looks good. However, I am not sure whether it is too early to design this. We should get the basic idea (framework document) accepted first.
Best regards,
Sheng

Expanding on that last point about allowing semantic matches to be specified, an initial proposal is that this consists of three parts:   an address prefix or set of prefixes (the context within the semantic match applies), a mask (specifying which bits have semantics), and a value (the value of the bits after masking the address).  Once there is a language to talk about these matches, it becomes possible to apply policies based on these matches.

For example, if an organization has the network 2001:db8::/32 and decides that bits 48-51 specify the subscriber type (eg, http://tools.ietf.org/html/draft-sun-semantic-usecase-01 section 2), it would be possible to specify wifi subscribers with:

            { prefix: "2001:db8::/32", mask: "0:0:0:f000::", values: [ "0:0:0:a000::", "0:0:0:b000::" ] }

For another example, some other organization might want to apply a policy to all devices with a particular EUI-64 value ("AC:DE:48") within their network (eg, to do some extra logging for debugging).
They might then specify that with:

            { prefix: "2001:db8:abcd::/48", mask: "::ffff:ffff:ff00:0", value: "::acde:48ff:fe00:0" }

Another example might be for an organization that always runs a particular virtual server host on addresses ending with "::1234" to communicate that as:

           { prefixes: [ "2001:db8:abcd::/48", "2001:db8:abce::/48" ], mask: "::ffff", value: "::1234" }

The JSON notation above is just one example --- there may be some other syntax more friendly to more router configuration languages.
Having some standard notation like this that specifies a mask, masked value(s), and the applicable prefix(es) would make semantic prefixing
(and semantic addressing in general) much more viable for those networks or operators for whom it makes sense within their environment
as there would then be some way to communicate and use it.

       Erik

On Tue, Oct 23, 2012 at 5:54 AM, Sheng Jiang <[email-masked]<mailto:[email-masked]>> wrote:
Hi, all,

Two semantic IPv6 prefix have been submitted to IETF. Could you please review them? Any comments/suggestions/advices are appreciated.

A Framework for Semantic IPv6 Prefix and Gap Analysis, http://tools.ietf.org/html/draft-jiang-v6ops-semantic-prefix-01

Use case of IPv6 prefix semantics for operators, http://tools.ietf.org/html/draft-sun-semantic-usecase-01

Best regards,

Sheng + Qiong
_______________________________________________
v6ops mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/v6ops