Summary

  • RFC 9844 requires user interfaces that accept non-global IPv6 addresses to support a link-local or scoped-multicast address together with a zone identifier, usually an operating-system interface name.
  • That text is converted into a host-specific numeric interface index for socket use. It is essential to the local action but meaningless on other nodes and must not be sent on the wire.
  • A trustworthy operational receipt therefore preserves input, validation, mapping, interface lifecycle and result inside the node while proving that the transmitted packet contains no local zone label.

The operator had the right address and the wrong machine fact.

Two interfaces on the same host could both reach a link on which the same link-local IPv6 text was meaningful. A diagnostic form accepted the address but provided no way to state which link was intended. The command failed—not because IPv6 syntax was broken, and not because the remote device was necessarily absent, but because the local path selector had been discarded before the operating system could act.

The repair created a second danger. A developer appended an interface name and treated the resulting string as if it were a portable endpoint. It was not. The label belonged to one host's current interface table. On another host it could name a different interface, no interface, or a virtual interface created after the evidence was recorded. The same text that completed the action locally became false identity when carried elsewhere.

That boundary is the subject of RFC 9844, Entering IPv6 Zone Identifiers in User Interfaces. The RFC Editor record, plain-text edition and XML source show a Standards Track RFC published in August 2025. It obsoletes RFC 6874 and updates RFCs 4007, 7622 and 8089. Publication proves a reviewed interoperability requirement. It does not prove that a product supports it, that an entered selector is correct, or that a device reached through it is the intended device.

One address, several possible local worlds

RFC 4291 defines IPv6 addressing, and RFC 5952 recommends a canonical text style. Neither makes a link-local address globally unique. Link-local scope is deliberately bounded. When a host has several active links, the address text alone may leave more than one local route to interpret.

RFC 4007 supplies a scoped-address architecture. Internally, a non-global address can be qualified by a zone index. In a human interface, that index is often expressed as a zone identifier such as an interface name. RFC 9844 gives examples such as a Linux-style address ending in %eth0 or a Windows-style decimal index. Those examples are not new address bytes. They are instructions to this node about which local zone should interpret the address.

The distinction matters because interface selection is control. A ping, configuration transaction, capture filter or management request can be syntactically flawless yet operate on the wrong link. Conversely, refusing zone input can make a link-local-only device unreachable from a management tool even while the operating system itself could reach it. RFC 9844 describes diagnosis, device configuration, monitoring, virtual-printer ports and marine networking as practical cases. RFC 6991 gives the YANG ecosystem a related address type, while RFC 8925 frames an IPv6-mostly environment in which native IPv4 may not be available as an escape route.

Cut-and-paste is not a cosmetic feature here. Long literal addresses and long interface names invite transcription errors. A complete copied value can preserve an operator's stated intent at the UI edge. But copying preserves only text. It does not preserve the host table that gave the text meaning.

The handoff from language to running state

RFC 9844 requires a UI that accepts an IPv6 address other than a global unicast address to provide a means to enter a link-local or scoped-multicast address and select a zone. It should accept the complete RFC 4007 form. If a percent delimiter is impractical, the UI may use another delimiter, separate fields, an active-zone list or a distinct command-line parameter.

These alternatives share one invariant: address and zone remain separately accountable inputs. A single text box is not the architecture. The architecture is the conversion from human intent into a numeric interface index that the operating system will use for subsequent socket calls.

The API boundary makes that visible. A combined string such as fe80::1%eth0 cannot simply be passed to inet_pton(). An implementation may use getaddrinfo(), or split the address from the interface name and combine inet_pton() with if_nametoindex(). RFC 3493 exposes a sin6_scope_id field in the IPv6 socket address structure and leaves the mapping to interfaces implementation-specific.

A useful receipt therefore does not stop at “form accepted.” It records the raw value, the parser and policy version, length and character validation, the resolved numeric index, the interface identity observed at that moment, the scoped destination, the socket construction result and the operation's outcome. If an interface disappears or is replaced between selection and use, the receipt should make the race visible rather than quietly attach old intent to new state.

This is running-code primacy in a narrow, testable form. The standard names the minimum handoff. The local system proves which handoff occurred. A drop-down list can still be stale. A valid interface name can still select the wrong cable. A successful socket call can still reach the wrong device. Evidence must continue through the observation, not end at input validation.

The local label has no passport

RFC 9844's security boundary is unusually crisp. Zone identifiers have local significance only and must not be sent on the wire. Software that obtains one through a UI should not transmit it further. RFC 4007's security discussion also warns against trusting packets that carry textual non-global addresses as data, because a remote party could try to deceive the receiver about a locally meaningful zone.

This is not deletion of evidence. It is separation of evidence domains. Inside the node, the zone mapping is essential to explain why the socket chose an interface. At the packet boundary, the same label is unauthoritative and must disappear. The transmitted IPv6 header carries the scoped address, not the host's interface name. The audit record may retain the local selector, but a peer must never be asked to interpret it as shared identity.

That distinction protects more than protocol tidiness. Interface names can expose topology, operating-system conventions or organizational naming. More fundamentally, forwarding a local label invites accidental authority expansion. A controller may store eth0, replay it on another machine and believe it reproduced the action. It reproduced a string, not a zone.

The minimum evidence unit is consequently dual: a local receipt that binds human input to contemporaneous host state, and a packet observation that confirms the label did not escape. Logs that save only the address lose the control decision. Logs that save only the combined text but omit host identity and mapping time create apparent precision without portability. Packet captures containing the label as metadata must distinguish capture annotation from transmitted bytes.

Input freedom is not input innocence

RFC 4007 did not impose a universal maximum length or character set for zone identifiers. That leaves room for operating-system conventions, but it also means a UI cannot assume that any string is safe. RFC 9844 advises an appropriate length limit, normally aligned with the host's interface-name limit, and environment-specific character checks. ASCII NUL should be rejected because later string processing may disagree about where the value ends.

The threat is not limited to classic buffer overruns. Delimiters can be decoded at different stages; normalization can change a lookup; log renderers can display one string while a system call receives another; a shell wrapper can treat characters as syntax; a stale interface list can validate an object that no longer exists. The correct policy is not one global regular expression. It is a typed path: capture bytes, validate according to the target operating system and invocation method, map once near use, and retain both the accepted representation and resolved result.

Names and numbers also fail differently. A human-readable name aids review but can be renamed or reused. A numeric index matches the socket API more closely but may be recycled after reboot or interface recreation. Neither is a durable asset identifier. A historical record needs host identity, boot or lifecycle context, observation time and—where available—stable device metadata. Even then, the claim remains bounded: “this host resolved this input to this interface at this time.”

Why the browser detour was closed

RFC 6874 attempted to update URI syntax so zone identifiers could appear in IPv6 address literals. Its status record now points to obsolescence. RFC 9844 reports that browser implementers found that approach impracticable, reverts the update to RFC 3986 and replaces it with a generic UI requirement. It also removes RFC 6874 references from RFC 7622 and the file URI specification.

That history is a useful governance signal. A standard can be public, consensual and still meet implementation reality that requires a narrower replacement. The response was not to declare browsers non-compliant with an unusable model. It was to relocate the minimum requirement to the layer that can honor local semantics.

RFC 9844 explicitly says that its approach does not solve the HTTP origin problem described by RFC 6454, and its normative statements do not apply to URIs fetched by web browsers. This report keeps that limit. It does not smuggle a browser design back into an article about operational UIs.

Test the disappearing boundary

A serious acceptance suite starts with two live interfaces carrying the same link-local destination text. It verifies explicit selection, no accidental default, and a clear error for an unknown zone. It renames and removes the interface after display but before use. It restarts the host and tests numeric-index reuse. It sends overlong input, NUL, delimiter variants, Unicode edge cases and strings meaningful to a shell or log renderer.

Then it observes the boundary. The application receipt must show which local index was used. The packet capture must show that no textual zone identifier was transmitted. A remote system must not be allowed to supply a local label and have it trusted without local remapping and policy. Failure needs to be closed and legible: an unresolved zone is not permission to pick an arbitrary interface.

Finally, test the human consequence. Can an operator copy a complete value from a trusted local display? Does the receiving UI preserve it without mutation? Does it show the resolved interface before a destructive configuration action? Can the operator distinguish “input accepted,” “interface resolved,” “packet sent” and “intended device answered”? Those are four claims, not one green check.

Evidence boundary

No operating system, browser, router, printer, sniffer, YANG client or marine network was tested for this report. No support matrix, adoption level, error rate or security incident has been measured. The examples in RFC 9844 illustrate the mechanism; they do not certify Linux, Windows or any named tool in its present release.

The established conclusion is narrower and stronger. A scoped address can require local context to become actionable. The context must remain attributable inside the node and must lose authority at the node boundary. Good infrastructure preserves both facts at once.

Sources