Re: [OPSEC] [v6ops] IPv6 LL-only as WG document - feedback requested

["Gunter Van de Velde (gvandeve)" <[e-mail]>]

I agree... packets with LL source-address should not leave the link indeed.

I expect the Behringer editor team to make that more specific in the draft text.

G/

-----Original Message-----
From: Brian E Carpenter [mailto:[e-mail]] 
Sent: 06 August 2012 12:53
To: Gunter Van de Velde (gvandeve)
Cc: [e-mail]; v6ops v6ops WG ([e-mail]); [e-mail]; '[e-mail]' ([e-mail])
Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested

On 06/08/2012 11:18, Gunter Van de Velde (gvandeve) wrote:
> I am confused. Please correct my understanding if possible.
> 
> 1) You are ok with the Behringer-LL draft being an informational 
> draft? (not BCP)

Yes. All I'm saying is that it should insist on a valid source address, which means that a LL source address is not allowed for packets that leave the local link.

Section 2.5.6 of RFC 4291 makes this clear but people seem to ignore it:
"Link-Local addresses are for use on a single link."

Obviously, therefore, packets whose destination is not LL must not have a LL source address.

> 2) Passive addresses is something that creates potential issues in your view?

I said I have no problem with that. It doesn't affect the above point.

   Brian
> 
> For (2) I would say... It is just as a normal address... no need at all to discard them on any other box then the receiving box as those boxes just see the address as being a normal IPv6 address. Nothing special about it. It is just a normal address. The behaviour of passive addresses is to do with the way the recipient device deals with this address.
> 
> G/
> 
> 
> 
> 
> -----Original Message-----
> From: Brian E Carpenter [mailto:[e-mail]]
> Sent: 06 August 2012 11:40
> To: Gunter Van de Velde (gvandeve)
> Cc: [e-mail]; v6ops v6ops WG ([e-mail]); 
> [e-mail]; '[e-mail]' 
> ([e-mail])
> Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested
> 
> Hi Gunter,
> 
> I have no problem with the passive address idea, but the immediate issue is that routers must not source ICMP packets that other routers must discard - hence no LL source addresses.
> 
>     Brian
> 
> On 06/08/2012 10:36, Gunter Van de Velde (gvandeve) wrote:
>> Answer as individual contributor.
>>
>> Fred B. and myself did a draft to exactly address the traceability of 
>> interfaces without increasing the attack vector on interfaces: 
>> Passive
>> IPv6 addresses
>>
>> No new class of addresses at all... no new IANA allocation... just behaviour of the address:
>>
>> 1) it is configured as a normal address
>> 2) just an extra keyword attached to the address identifying its 
>> behavior
>> 3) It can only be used as a 'source' address
>> 4) if it is used as destination address, then when reaching the 
>> router it will be directed to the Null0 interface
>>
>> This will help visibility of the trace-route in cases of LL-only...
>>
>> G/
>>
>>
>> -----Original Message-----
>> From: Brian E Carpenter [mailto:[e-mail]]
>> Sent: 06 August 2012 11:25
>> To: Gunter Van de Velde (gvandeve)
>> Cc: [e-mail]; v6ops v6ops WG ([e-mail]); 
>> [e-mail]; '[e-mail]'
>> ([e-mail])
>> Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested
>>
>> Hi,
>>
>>>    o  Management plane traffic, such as SSH, Telnet, SNMP, ICMP echo
>>>       request ... can be addressed to loopback addresses of routers with
>>>       a global scope address.  Router management can also be done over
>>>       out-of-band channels.
>>>
>>>    o  ICMP error message can also be sourced from the global scope
>>>       loopback address.
>> These statements seem too weak. Using GUAs for ICMP in particular needs to have a normative MUST somewhere (preferably in a BCP). In the context of this Informational draft, the language needs to state a requirement ("must" not "can") even if you don't use RFC 2119 terminology.
>>
>> This matters because packets with a LL source address MUST NOT be forwarded, so a router that is misconfigured to send ICMP replies with a LL source address breaks both ping and traceroute.
>>
>> I think the rule is that any packet that is *not* sent to a LL address must have a GUA as the source address. That takes care of ICMP, and everything else as well.
>>
>> Furthermore, that GUA needs to be associated with a prefix that belongs to the organisation operating the router in question. Otherwise the traceroute results can be very confusing. We discussed that on v6ops back in March.
>>
>> Regards
>>    Brian Carpenter
>>
>>
>>
>>
>> On 06/08/2012 10:03, Gunter Van de Velde (gvandeve) wrote:
>>> (distributed to OPSEC WG and in cc v6ops)
>>>
>>> Dear all,
>>>
>>> During the OPSEC WG meeting last Wednesday there was consensus to adopt the draft http://tools.ietf.org/html/draft-behringer-lla-only-01 as working group document with Informational status.
>>>
>>> Please read the draft, and if there is no violent objection on the list, the document will be requested to be submitted as WG document in 7 days.
>>>
>>> Ciao,
>>> G/, KK & Warren
>>>
>>>
>>>
>>> --------------------------------------------------------------------
>>> -
>>> -
>>> --
>>>
>>> _______________________________________________
>>> v6ops mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/v6ops