IETF Logo Mail Archive

Re: [homenet] I-D Action: draft-haddad-homenet-multihomed-00

Teco Boot <teco@inf-net.nl> Tue, 23 October 2012 16:56 UTC

Return-Path: <teco@inf-net.nl>
X-Original-To: homenet@ietfa.amsl.com
Delivered-To: homenet@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71E6D11E80CC for <homenet@ietfa.amsl.com>; Tue, 23 Oct 2012 09:56:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.499
X-Spam-Level:
X-Spam-Status: No, score=-3.499 tagged_above=-999 required=5 tests=[AWL=0.100, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 82pYOw66SZOs for <homenet@ietfa.amsl.com>; Tue, 23 Oct 2012 09:56:23 -0700 (PDT)
Received: from mail-ee0-f44.google.com (mail-ee0-f44.google.com [74.125.83.44]) by ietfa.amsl.com (Postfix) with ESMTP id 42F6F1F0419 for <homenet@ietf.org>; Tue, 23 Oct 2012 09:56:22 -0700 (PDT)
Received: by mail-ee0-f44.google.com with SMTP id d4so1746491eek.31 for <homenet@ietf.org>; Tue, 23 Oct 2012 09:56:21 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=subject:mime-version:content-type:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to:x-mailer :x-gm-message-state; bh=6ErtoKwcIl2WGDPX2ywIS5BTS+3cX4ZcDAZs3Xj1hDg=; b=DO6yavdpYf+GgG6984+C37ICIV79OIcpsw/ShA4vlDMfYaKb/IAGQTkfeJ16/XWWrH wCiHTECk/fQv9cyMcGAeT8l5iV7bgH7P0E4PPaluyUEQTUiiiy8MdFI/yIaqefEWgAUC OzCaFUQ18zCD8l5L7D+3NyCtp4Di28T/D19lYOxsPOpA9ZO1iYgAIIY7phlppFGXB5O/ Ua+WNJsLpKNa9oUB8ScBiwVTAHfcc+hsoQDirfcb9LIHtSDoh7cImuZX94x2N6x1RO8b uhHmESQ2B+9TIHyU3Uz2BjpQP6hhRHMJB6D7QYYfQ95yCaWrs3+xRglMwDK/AlNEld37 HpOQ==
Received: by 10.14.216.193 with SMTP id g41mr8598949eep.37.1351011381038; Tue, 23 Oct 2012 09:56:21 -0700 (PDT)
Received: from ?IPv6:2001:470:7a9b:1:4183:8674:893b:f478? ([2001:470:7a9b:1:4183:8674:893b:f478]) by mx.google.com with ESMTPS id s1sm21721492eem.9.2012.10.23.09.56.19 (version=SSLv3 cipher=OTHER); Tue, 23 Oct 2012 09:56:20 -0700 (PDT)
Mime-Version: 1.0 (Apple Message framework v1283)
Content-Type: text/plain; charset="us-ascii"
From: Teco Boot <teco@inf-net.nl>
In-Reply-To: <5086B5A7.3040706@mtcc.com>
Date: Tue, 23 Oct 2012 18:56:17 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <BCBB5332-50EF-40CB-A741-76CD8239CF2A@inf-net.nl>
References: <201210011801.q91I1tfW056624@gateway1.orleans.occnc.com> <506A07D1.8050605@gmail.com> <10328E81-3C94-455B-9A37-B421200A5C38@ecs.soton.ac.uk> <EMEW3|19238916f7ff9a0ada655caf80bba8cao9AAbJ03tjc|ecs.soton.ac.uk|10328E81-3C94-455B-9A37-B421200A5C38@ecs.soton.ac.uk> <7F6EA97D-5DA8-4872-A647-D879B1955824@gmail.com> <49FCFE49-9DFB-44D2-ADAD-636A3C80F906@ecs.soton.ac.uk> <EMEW3|09bc323dc12a06be7c21e18f2752cd05o9LECn03tjc|ecs.soton.ac.uk|49FCFE49-9DFB-44D2-ADAD-636A3C80F906@ecs.soton.ac.uk> <7F4B245F-9355-4134-9176-EB7DB1634469@apple.com> <77A8749D-DF81-4816-8277-CB69861E524A@fugue.com> <C3720598-400C-4B83-9CEC-878B3FA8109E@ecs.soton.ac.uk> <EMEW3|3e5d3f7836c5b4ddbd99d74df88ecc6ao9LJ8r03tjc|ecs.soton.ac.uk|C3720598-400C-4B83-9CEC-878B3FA8109E@ecs.soton.ac.uk> <5085905A.8030206@mtcc.com> <52E31542-3B7C-4EC1-9B2C-3C9D8E6B3BB1@apple.com> <50859C1B.7070707@mtcc.com> <CAKD1Yr0v3NdN+QCj=jFiZcv0ox1S-YAj29dZyMd6kAWAv723dg@mail.gmail.com> <5086B5A7.3040706@mtcc.com>
To: Michael Thomas <mike@mtcc.com>
X-Mailer: Apple Mail (2.1283)
X-Gm-Message-State: ALoCoQk/psuk+QAhV/WAICsuXzM9dLUh7/pZST7lntJ22ZdA6EMx/MtACwb6Z2oMdRcc2eGJjgP8
Cc: homenet@ietf.org, james woodyatt <jhw@apple.com>, Lorenzo Colitti <lorenzo@google.com>
Subject: Re: [homenet] I-D Action: draft-haddad-homenet-multihomed-00
X-BeenThere: homenet@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: <homenet.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/homenet>, <mailto:homenet-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/homenet>
List-Post: <mailto:homenet@ietf.org>
List-Help: <mailto:homenet-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/homenet>, <mailto:homenet-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Oct 2012 16:56:24 -0000

Op 23 okt. 2012, om 17:20 heeft Michael Thomas het volgende geschreven:

> On 10/22/2012 08:35 PM, Lorenzo Colitti wrote:
>> On Tue, Oct 23, 2012 at 4:18 AM, Michael Thomas <mike@mtcc.com <mailto:mike@mtcc.com>> wrote:
>> 
>>    No, sorry. Corporate VPN's using v6 and the lack of a coherent source address selection mechanism causes breakage in bizarre and unpredictable ways. You are not going to get the results you hope for if your mac uses an ISP prefix to get back inside the corpro firewall, uRPF if nothing else. SLAAC changes a lot of things over v4.
>> 
>> 
>> VPN clients already modify the routing table to ensure traffic going through the VPN goes through the VPN, to enforce policies around split tunneling, and so on. Mine even monitors the routing table for changes so it can act on them.
> 
> Routing is irrelevant.
> 
>> 
>> Can you explain why this behaviour, combined with the "prefer matching interface" rule in RFC 3484, is not sufficient? If not, then there is no problem to solve here.
> 
> Your ISP gives you 2001:xxxx:: via SLAAC. Your employer gives you 2000::,
> but also has 2001:yyyy::. You connect to a server on 2001:yyyy::. Your
> 3484 v6 stack picks 2001:xxxx for the source address. Hilarity ensues:
> 
> 1) the packet gets rejected via uRPF
> 2) the return packet splats against the inside firewall since it's not allowed outside
> 3) the packet makes it outside unarmored with sad faces from the security team

Employer should also provide 2001:yyyy::. Or make server accessible via Internet.
BRDP will handle this scenario nicely, also for existing hosts.

Teco

> 
> Mike
> _______________________________________________
> homenet mailing list
> homenet@ietf.org
> https://www.ietf.org/mailman/listinfo/homenet

v2.23.0 | Report a Bug | By Email