Requirements for Address Selection Mechanisms
What address selection mechanisms must support to work reliably
Matsumoto, A., Fujisaki, T., Hiromi, R., and K. Kanayama, "Requirements for Address Selection Mechanisms", RFC 5221, DOI 10.17487/RFC5221, July 2008, <https://www.rfc-editor.org/info/rfc5221>.
@misc{rfc5221,
series = {Request for Comments},
number = 5221,
howpublished = {RFC 5221},
publisher = {RFC Editor},
doi = {10.17487/RFC5221},
url = {https://www.rfc-editor.org/info/rfc5221},
author = {A. Matsumoto and T. Fujisaki and R. Hiromi and K. Kanayama},
title = {{Requirements for Address Selection Mechanisms}},
pagetotal = 7,
year = 2008,
month = jul,
} RFC text
Contents
Network Working Group A. Matsumoto
Request for Comments: 5221 T. Fujisaki
Category: Informational NTT
R. Hiromi
Intec NetCore
K. Kanayama
INTEC Systems
July 2008
Requirements for Address Selection Mechanisms
Status of This Memo
This memo provides information for the Internet community. It does
not specify an Internet standard of any kind. Distribution of this
memo is unlimited.
Abstract
There are some problematic cases when using the default address
selection mechanism that RFC 3484 defines. This document describes
additional requirements that operate with RFC 3484 to solve the
problems.
Table of Contents
1. Introduction ....................................................2
2. Requirements of Address Selection ...............................2
2.1. Effectiveness ..............................................2
2.2. Timing .....................................................2
2.3. Dynamic Behavior Update ....................................3
2.4. Node-Specific Behavior .....................................3
2.5. Application-Specific Behavior ..............................3
2.6. Multiple Interface .........................................3
2.7. Central Control ............................................3
2.8. Next-Hop Selection .........................................3
2.9. Compatibility with RFC 3493 ................................4
2.10. Compatibility and Interoperability with RFC 3484 ..........4
2.11. Security ..................................................4
3. Security Considerations .........................................4
3.1. List of Threats Introduced by New Address-Selection
Mechanism ..................................................4
3.2. List of Recommendations in Which Security Mechanism
Should Be Applied ..........................................5
4. Normative References ............................................5
1. Introduction
Today, the RFC 3484 [RFC3484] mechanism is widely implemented in
major OSs. However, in many sites, the default address-selection
rules are not appropriate, and cause a communication failure. The
problem statement (PS) document [RFC5220] lists problematic cases
that resulted from incorrect address selection.
Though RFC 3484 made the address-selection behavior of a host
configurable, typical users cannot make use of that because of the
complexity of the mechanism and lack of knowledge about their network
topologies. Therefore, an address-selection autoconfiguration
mechanism is necessary, especially for unmanaged hosts of typical
users.
This document contains requirements for address-selection mechanisms
that enable hosts to perform appropriate address selection
automatically.
2. Requirements of Address Selection
Address-selection mechanisms have to fulfill the following eleven
requirements.
2.1. Effectiveness
The mechanism can modify RFC 3484 default address-selection behavior
at nodes. As documented in the PS [RFC5220], the default rules
defined in RFC 3484 do not work properly in some environments.
Therefore, the mechanism has to be able to modify the address-
selection behavior of a host and to solve the problematic cases
described in the PS document.
2.2. Timing
Nodes can perform appropriate address selection when they select
addresses.
If nodes need to have address-selection information to perform
appropriate address selection, then the mechanism has to provide a
function for nodes to obtain the necessary information beforehand.
The mechanism should not degrade usability. The mechanism should not
enforce long address-selection processing time upon users.
Therefore, forcing every consumer user to manipulate the address-
selection policy table is usually not an acceptable solution. So, in
this case, some kind of autoconfiguration mechanism is desirable.
2.3. Dynamic Behavior Update
The address-selection behavior of nodes can be dynamically updated.
When the network structure changes and the address-selection behavior
has to be changed accordingly, a network administrator can modify the
address-selection behavior of nodes.
2.4. Node-Specific Behavior
The mechanism can support node-specific address-selection behavior.
Even when multiple nodes are on the same subnet, the mechanism should
be able to provide a method for the network administrator to make
nodes behave differently. For example, each node may have a
different set of assigned prefixes. In such a case, the appropriate
address-selection behavior may be different.
2.5. Application-Specific Behavior
The mechanism can support application-specific address-selection
behavior or combined use with an application-specific address-
selection mechanism such as address-selection APIs.
2.6. Multiple Interface
The mechanism can support those nodes equipped with multiple
interfaces. The mechanism has to assume that nodes have multiple
interfaces and makes address selection of those nodes work
appropriately.
2.7. Central Control
The address-selection behavior of nodes can be centrally controlled.
A site administrator or a service provider could determine or could
have an effect on the address-selection behavior at their users'
hosts.
2.8. Next-Hop Selection
The mechanism can control next-hop-selection behavior at hosts or
cooperate with other routing mechanisms, such as routing protocols
and RFC 4191 [RFC4191]. If the address-selection mechanism is used
with a routing mechanism, the two mechanisms have to be able to work
synchronously.
2.9. Compatibility with RFC 3493
The mechanism can allow an application that uses the basic socket
interface defined in RFC 3493 [RFC3493] to work correctly. That is,
with the basic socket interface the application can select
appropriate source and destination addresses and can communicate with
the destination host. This requirement does not necessarily mean
that OS protocol stack and socket libraries should not be changed.
2.10. Compatibility and Interoperability with RFC 3484
The mechanism is compatible with RFC 3484. Now that RFC 3484 is
widely implemented, it is preferable that a new address selection
mechanism does not conflict with the address selection mechanisms
defined in RFC 3484.
If the solution mechanism changes or replaces the address-selection
mechanism defined in RFC 3484, interoperability has to be retained.
That is, a host with the new solution mechanism and a host with the
mechanism of RFC 3484 have to be interoperable.
2.11. Security
The mechanism works without any security problems. Possible security
threats are described in the Security Considerations section of this
document.
3. Security Considerations
3.1. List of Threats Introduced by New Address-Selection Mechanism
There will be some security incidents when combining the requirements
described in Section 2 into a protocol. In particular, there are 3
types of threats: leakage, hijacking, and denial of service.
1. Leakage: Malicious nodes may tap to collect the network policy
information and leak it to unauthorized parties.
2. Hijacking: Nodes may be hijacked by malicious injection of
illegitimate policy information. RFC 3484 defines both a source
and destination selection algorithm. An attacker able to inject
malicious policy information could redirect packets sent by a
victim node to an intentionally chosen server that would scan the
victim node activities to find vulnerable code. Once vulnerable
code is found, the attacker can take control of the victim node.
3. Denial of Service: This is an attack on the ability of nodes to
communicate in the absence of the address-selection policy. An
attacker could launch a flooding attack on the controller to
prevent it from delivering the address selection policy
information to nodes, thus preventing those nodes from
appropriately communicating.
3.2. List of Recommendations in Which Security Mechanism Should Be
Applied
The address selection mechanism should be afforded security services
listed below. It is preferable that these security services are
afforded via use of existing protocols (e.g., IPsec).
1. Integrity of the network policy information itself and the
messages exchanged in the protocol. This is a countermeasure
against leakage, hijacking, and denial of service.
2. Authentication and authorization of parties involved in the
protocol. This is a countermeasure against Leakage and
Hijacking.
4. Normative References
[RFC3484] Draves, R., "Default Address Selection for Internet
Protocol version 6 (IPv6)", RFC 3484, February 2003.
[RFC3493] Gilligan, R., Thomson, S., Bound, J., McCann, J., and W.
Stevens, "Basic Socket Interface Extensions for IPv6", RFC
3493, February 2003.
[RFC4191] Draves, R. and D. Thaler, "Default Router Preferences and
More-Specific Routes", RFC 4191, November 2005.
[RFC5220] Matsumoto, A., Fujisaki, T., Hiromi, R., and K. Kanayama,
"Problem Statement for Default Address Selection in
Multi-Prefix Environments: Operational Issues of RFC 3484
Default Rules", RFC 5220, July 2008.
Authors' Addresses
Arifumi Matsumoto
NTT PF Lab
Midori-Cho 3-9-11
Musashino-shi, Tokyo 180-8585
Japan
Phone: +81 422 59 3334
EMail: arifumi@nttv6.net
Tomohiro Fujisaki
NTT PF Lab
Midori-Cho 3-9-11
Musashino-shi, Tokyo 180-8585
Japan
Phone: +81 422 59 7351
EMail: fujisaki@nttv6.net
Ruri Hiromi
Intec Netcore, Inc.
Shinsuna 1-3-3
Koto-ku, Tokyo 136-0075
Japan
Phone: +81 3 5665 5069
EMail: hiromi@inetcore.com
Ken-ichi Kanayama
INTEC Systems Institute, Inc.
Shimoshin-machi 5-33
Toyama-shi, Toyama 930-0804
Japan
Phone: +81 76 444 8088
EMail: kanayama_kenichi@intec-si.co.jp
Full Copyright Statement
Copyright (C) The IETF Trust (2008).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
AI ELI5
On this page
§1The Address Selection Problem
RFC 3484 specifies a default algorithm for choosing between multiple source and destination addresses in IPv6. However, the algorithm does not always choose correctly in real network environments, particularly when a host has multiple address prefixes or belongs to multiple subnets.
The problems are compounded because configuring RFC 3484's rules is complex and requires users or administrators to understand their network topology, which many lack the knowledge to do. This document identifies the requirements for an automated mechanism that extends or improves upon RFC 3484, so hosts can select addresses correctly without manual configuration.
Right now, computers use a simple rule to pick addresses. That rule does not always work when a computer has many addresses. We need a system that learns the rules automatically instead of making people configure them by hand.
§2Eleven Core Requirements
The RFC specifies eleven requirements any address selection mechanism must meet. The mechanism must be effective—capable of actually modifying address selection behavior to solve the problematic cases described in RFC 5220. It must support appropriate timing, allowing nodes to obtain selection information when they need it without degrading usability or imposing long processing delays.
The mechanism must support dynamic behavior updates, so administrators can change address selection rules when network structures change. It must handle node-specific behavior, allowing different nodes on the same subnet to behave differently based on their assigned prefixes. It must also support application-specific behavior, working alongside application-layer address selection APIs when needed.
Additional requirements include support for multiple interfaces, central control by administrators or service providers, next-hop selection coordination with routing mechanisms, and backward compatibility with existing RFC 3493 socket interfaces, RFC 3484 address selection, and existing security expectations.
A good address selection system needs to solve real problems, work fast, change when networks change, let administrators control it, work with many network cards, and not break old programs.
- EffectivenessSolve the problems RFC 3484 does not handle.
- TimingLet nodes learn rules when needed without delay.
- Dynamic UpdatesAllow rule changes when networks change.
- Node-Specific BehaviorSupport different rules for different hosts.
- Central ControlLet admins manage address selection policy.
- CompatibilityWork with RFC 3484 and existing applications.
§3Security Threats and Protections
Deploying an automated address selection mechanism introduces security risks. The RFC identifies three classes of threats: leakage (malicious nodes collecting policy information and leaking it), hijacking (attackers injecting malicious policy information to redirect traffic), and denial of service (flooding a policy controller to prevent delivery of correct selection rules).
To counter these threats, the mechanism must provide integrity protection for both the policy information and the messages carrying it. It must also provide authentication and authorization of parties involved in the protocol. The RFC recommends using existing protocols like IPsec rather than inventing new security mechanisms. These security services are critical because address selection policy directly affects which servers a host connects to, making it a valuable target for attackers.
Bad actors could try to trick a computer into sending data to the wrong place by lying about address rules. The system needs to check that rules come from a trusted source and cannot be changed in transit.
§4Multi-Prefix Scenarios
The underlying problem this RFC addresses is that IPv6 networks increasingly have multiple prefixes due to multi-homing, site changes, and transitions from IPv4. A single host may have addresses from different prefixes or providers simultaneously. Selecting the correct source address depends on the destination address, the network topology, and policy—not just on a simple default rule.
In some cases, a node may be connected to multiple subnets with different prefixes, each with specific routing paths. In others, a node may receive multiple prefixes from the same provider or transition between prefixes during network renumbering. Without a mechanism to dynamically learn and apply correct selection rules, hosts either fail to communicate or connect to the wrong endpoints.
In the real world, networks are messy. A computer might be in two places at once (with two different addresses), or move to a new network. The old rules for picking an address do not handle this well.
§5Deployment and Management
Effective address selection is essential for IPv6 deployment in complex networks. Manual configuration is not scalable for large organizations or consumer networks. An automated mechanism that satisfies these requirements enables seamless multi-address support without requiring users to understand network topology.
The document emphasizes that any solution must work in both managed networks (where administrators can configure policies) and unmanaged networks (where policies must be distributed automatically). It must accommodate single-interface hosts as well as multi-homed systems. The mechanism should integrate with existing management infrastructure and work compatibly with other protocol mechanisms like DNS, DHCP, and routing protocols.
Network administrators need a way to tell all computers how to pick addresses without manually configuring each one. The system should also work for people at home who do not have IT support.