One Internet To Rule Them All

Feb 22, 2008 at 5:58 PM
4 comments

The context for today's rant is the rapidly approaching Internet Address Space Crisis. This topic has been on my mind a lot lately, for a variety of professional reasons, many of them related to the constellation of issues that got me invited to be the Technical Editor for an Internet-Draft in the V6OPS working group of IETF on the subject of Recommended Simple Security Capabilities in Customer Premises Equipment for Providing Residential IPv6 Internet Service. Lately, the urgency of public calls for accelerating the transition of the Internet to IPv6 have grown louder, and so have the heat surrounding the arguments revolving around...

Why IPv6 Sucks Balls
How IPv6 Is So Amazingly Bad At Sucking Balls

and most importantly...

Who's To Blame For The Fact That The Internet Needs To Transition To A Next Generation Protocol That Sucks Balls So Badly Right Now.

I've had just about as much as I can take of this. A lot of people who should know better have said a lot of stupid things about this problem, but there's one particular stupid thing that a lot of them have said that really drives me up the goddamn wall, and here is where I'm composing my answer to them. Who are some of these people?

First, it was Daniel J. Bernstein complaining about how...

Unfortunately, the straightforward transition plan described above does not work with the current IPv6 specifications. The IPv6 designers made a fundamental conceptual mistake: they designed the IPv6 address space as an alternative to the IPv4 address space, rather than an extension to the IPv4 address space.

Now, it's Randy Bush ranting about how...

IPv6 is Incompatible with IPv4 on the Wire!
The Stupidity and Short-
Sighted Arrogance of this
is Utterly Mind-Blowing

Could have been avoided, e.g. if IPv6

had variable length addressing, IPv4

could have become the 32 bit variant.

These people are extremely senior computer scientists. Widely regarded as brilliant super-geniuses. Deny the truth and correctness of their dissertations at grave peril to your reputation. Or, so it's supposed. There are a lot of others who keep trotting out this nonsense. Big name Internet greybeards. I don't understand what is their major malfunction.

Okay. So, what's wrong with this argument?

On the surface, it seems sensible. When the North American Numbering Plan started running out of area codes, they had to transition to a system that allowed the middle digit in the area code to be a number other than one or zero. It was a mess, but nobody had to upgrade their telephones to be able to dial the new telephone numbers. A slightly more applicable analogy arose with overlay plans, which are the reason many Americans are now required to dial ten digits instead of seven.

Alas, if you drill a little deeper, the distinction between IPv6 being an alternative to IPv4 and it being an extension to IPv4 is completely illusory. Yes, I'm saying that Dan Bernstein is missing the point, and the Randy Bush is actively avoiding it.

To begin with, let's just observe that every IPv4 address is also an IPv6 address. The IPv4 address for my home server is currently 69.12.155.90. Can you guess what IPv6 address that is? Hint: it's really easy. It's 0000:0000:0000:0000:0000:0000:450c:9b5a. All those preceding zeroes are usually collapsed into a '::' prefix, so that address might be more easily written as ::450c:9b5a. And since this address is in the reserve IPv6 prefix for IPv4 addresses, i.e. ::/96, it's actually more commonly written as ::69.12.155.90.

This is cheating, I hear you bleat. My home server isn't reachable at that IPv6 address. Look up the AAAA record for conjury.org and this is what it says:

~ 501$ dig aaaa conjury.org
; <<>> DiG 9.4.1-P1 <<>> aaaa conjury.org
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28106
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;; QUESTION SECTION:
;conjury.org. IN AAAA
;; ANSWER SECTION:
conjury.org. 86400 IN AAAA 2001:5a8:4:2290::2
;; AUTHORITY SECTION:
conjury.org. 119 IN NS c.auth-ns.sonic.net.
conjury.org. 119 IN NS grymling.conjury.org.
conjury.org. 119 IN NS a.auth-ns.sonic.net.
conjury.org. 119 IN NS b.auth-ns.sonic.net.
;; ADDITIONAL SECTION:
c.auth-ns.sonic.net. 32092 IN A 69.9.186.104
grymling.conjury.org. 58152 IN A 69.12.155.90
a.auth-ns.sonic.net. 9576 IN A 209.204.159.20
b.auth-ns.sonic.net. 61677 IN A 64.142.88.72
;; Query time: 24 msec
;; SERVER: 17.206.12.12#53(17.206.12.12)
;; WHEN: Fri Feb 22 17:21:58 2008
;; MSG SIZE rcvd: 220

This is not ::69.12.155.90. There's no point in making any of the addresses in ::/96 reachable over IPv6. Any nodes that are reachable over IPv4 do not need to be reachable over IPv6 at their IPv4-compatible addresses. They're reachable over IPv4. Use IPv4 when communicating with them. In any case, IPv6 addresses are completely backward compatible with IPv4 addresses, i.e. it's trivial to use IPv6 addresses to identify all the same things identified today by IPv4 addresses. Just pad the upper 96 bits with zeroes. You're done.

"But wait," you say. "Look at the IPv6 header and packet format. It's completely different from the IPv4 header and packet format! Surely, they're not compatible on the wire!" Ah, look closely my young initiate.

Here's the IPv4 header:

+ Bits 0–3 4–7 8–15 16–18 19–31
0 Version Header length Type of Service
(now DiffServ and ECN) Total Length
32 Identification Flags Fragment Offset
64 Time to Live Protocol Header Checksum
96 Source Address
128 Destination Address
160 Options
160
or
192+
Data

+	Bits 0–3	4–7	8–15	16–18	19–31
0	Version	Header length	Type of Service (now DiffServ and ECN)	Total Length
32	Identification	Flags	Fragment Offset
64	Time to Live	Protocol	Header Checksum
96	Source Address
128	Destination Address
160	Options
160 or 192+	Data

Here's the IPv6 header:

Look very closely at the first four bits of the each header. That version field is there for a goddamn reason. See, in IPv4, the value in that field is a 4. In IPv6, the value in that field is a 6. It's how you tell the difference between an IPv4 header and an IPv6 header when all you have are the raw bits.

The Internet Protocol has ALWAYS had extensible addressing and packet formats. Every version of the protocol ever designed had the first four bits reserved for identifying the Version of the Internet Protocol in use. IPv4 is the 32 bit variant of the Internet Protocol. That's what that 4 is doing there taking up all that valuable space on the wire in the goddamn IPv4 header.

Bernstein goes on a long rant in his piece. Here's an illustrative excerpt...

[...]

Keith [Moore], there is one network that has aol.com and cnn.com and cs.utk.edu and an incredible number of other sites.

Normal people call this network ``the Internet.'' They insist on being connected to the Internet, so that they can exchange email and web pages and so on with other Internet sites.

The universe you're imagining, in which sites are split across two global networks that have trouble talking to each other, is an ancient historical mistake that will never be repeated. What kind of idiot would be the first to disconnect his site from the original Internet in favor of the new Internet? Why haven't you cut yourself off from IPv4, Keith?

[...]

Except, the universe where IPv6 and IPv4 coexist properly is a single global network. All those useful sites Bernstein is talking about are all on that network. It's called the Internet, and all those sites are reachable today on it by IPv4. Soon, when those sites want to communicate with other nodes that can get affordable IPv6 service but not IPv4 service— which is what the IPv4 Address Crisis is all about— all those legacy sites, e.g. google.com, cnn.com and playboy.com, will be reachable by IPv6 as well. Or they will be replaced by competitors who are.

So please— spare me the crap about how the designers of IPv6 failed to consider the engineering issues surrounding transition properly. They did make a couple major mistakes, e.g. site-local address scoping, excessively loose source routing, et cetera— but those are all ancient history now. The remaining minor issues are lot less intractable than you think. IPv6 would be ready for industrial use today, except for the sad fact that network operators— yes, if you've read all the way this far, and you think I'm talking about you personally, then I probably am— are deliberating trying to impede the progress of transition to IPv6 by making it harder to deploy than it needs to be.

More on all that later. I gotta run to catch a commuter shuttle.

4 comments

Tags:

Comments

Whoa, whoa, whoa. Randy Bush is an "extremely senior computer scientist"? Maybe in the way that Andy Rooney is an "extremely senior writer", whose last dozen years consist of extremely senior moments. I wouldn't trust Randy Bush to program my Tivo, let alone to put together a cogent explanation about the quality of a particular network. And djb, well, come freaking on, he's a lunatic. He makes RMS look like Barack Obama.

Both of these guys have credentials that make mine look like I should still be in training pants.

And yet i'd still trust your opinion over theirs even if you'd been drinking for two weeks solid. Their words and their actions speak a lot more loudly than any of their damned "credentials".

I wish I could say I've been drinking for two weeks solid.

One Internet To Rule Them All

Comments

Post a comment

About Me

My Groups

Neighborhood

Tags

Archives