Re: [v6ops] IPv6 link-local traffic questions

[Jen Linkova <[e-mail]>]

On Thu, Mar 12, 2020 at 11:01 AM Toerless Eckert <[e-mail]> wrote:
>
> Sorry for cross posting, but this is both ops and arch questions.
>
> I was trying to find any generic description that/if link-local IPv6
> traffic MUST/SHOULD use Hop-count 1, but could not find one in
> rfc8200 or rfc4291 and its updates. Instead, text like
> MUST set Hop-limit to 1 is repeated in various RFCs using link-local
> IPv6 traffic.

I believe it depends what you are trying to achieve. If you want to
make sure that the traffic never leaves the network - then hop limit =
1 helps. But using link-local sources/destinations would help even
better if the routers comply with RFC4291 Section 2.5.6
If you want to make sure those packets are not sent by a malicious
party from outside - hop limit shall be 255.
For example, see RFC4861 Section 3.1

> Am i overlooking something ? Or is this intentional in the IPv6 architecture ?
>
> If intentional, i guess it means: Any RFC introducing some type of link-local
> traffic can specify Hop-limit requirements for its traffic. As in
> "our WG likes 42 as the Hop-limit" (silly to me, but should be fine with
> IPv6 architecture then, right ?).
>
> In one of my draft document reviews using such link-local IPv6 traffic,
> EricV brought up the Q if that traffic shouldn't use RFC5082 instead
> of Hop-Count 1 too. But given how we do not seem to have architectural
> recommendations for TTL=1 (unless, quite likely i overlook something),
> and given how i am not aware of any actual use of GTSM, i am quite
> weary to go down that route. Aka: Would like learn of actual uses of
> GTSM with IPv6.

Neighbor Discovery.

> There is an additional set of consideration re. link-local traffic
> when trying to use it as a HW accelerated tunneling mechanism across links,
> a use we both have in ANIMA, and maybe get the same in BIER (probably
> other WGs too, not sure).
>
> In implementations, i have seen quite a range of issues with
> accelerated forwarding planes across link-local addressed tunnels,
> and when using non-link-local addresses (loopback addresses),
> the HW plane forwarding might have issues doing HW forwarding, because
> usually TTL=1 is only used for control plane traffic. Of course,
> this is not a good architectural argument, but if given architectural
> leeway to even choose 42, maybe GTSM/255 is easier to be supported
> across various HW accelerated forwarding planes than 1.
>
> Opinions and experiences welcome!

If you control the router I'd say 'link-local source/destination,
HL=255 AND RFC4291 would be the best option.

I did see a few devices somewhere far away sending me ICMPv6 (packet
too big) from their link-local addresses but it was not very common
case.

-- 
SY, Jen Linkova aka Furry