Re: [OPSEC] [v6ops] IPv6 LL-only as WG document

Answer as individual contributor.

Fred B. and myself did a draft to exactly address the traceability of interfaces without 
increasing the attack vector on interfaces: Passive IPv6 addresses

No new class of addresses at all... no new IANA allocation... just behaviour of the address:

1) it is configured as a normal address
2) just an extra keyword attached to the address identifying its behavior
3) It can only be used as a 'source' address
4) if it is used as destination address, then when reaching the router it will be directed to the Null0 interface

This will help visibility of the trace-route in cases of LL-only...

G/

-----Original Message-----
From: Brian E Carpenter [mailto:brian.e.carpenter@gmail.com] 
Sent: 06 August 2012 11:25
To: Gunter Van de Velde (gvandeve)
Cc: opsec@ietf.org; v6ops v6ops WG (v6ops@ietf.org); opsec-chairs@ietf.org; 'draft-behringer-lla-only@tools.ietf.org' (draft-behringer-lla-only@tools.ietf.org)
Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested

Hi,

>    o  Management plane traffic, such as SSH, Telnet, SNMP, ICMP echo
>       request ... can be addressed to loopback addresses of routers with
>       a global scope address.  Router management can also be done over
>       out-of-band channels.
> 
>    o  ICMP error message can also be sourced from the global scope
>       loopback address.

These statements seem too weak. Using GUAs for ICMP in particular needs to have a normative MUST somewhere (preferably in a BCP). In the context of this Informational draft, the language needs to state a requirement ("must" not "can") even if you don't use RFC 2119 terminology.

This matters because packets with a LL source address MUST NOT be forwarded, so a router that is misconfigured to send ICMP replies with a LL source address breaks both ping and traceroute.

I think the rule is that any packet that is *not* sent to a LL address must have a GUA as the source address. That takes care of ICMP, and everything else as well.

Furthermore, that GUA needs to be associated with a prefix that belongs to the organisation operating the router in question. Otherwise the traceroute results can be very confusing. We discussed that on v6ops back in March.

Regards
   Brian Carpenter

On 06/08/2012 10:03, Gunter Van de Velde (gvandeve) wrote:
> (distributed to OPSEC WG and in cc v6ops)
> 
> Dear all,
> 
> During the OPSEC WG meeting last Wednesday there was consensus to adopt the draft http://tools.ietf.org/html/draft-behringer-lla-only-01 as working group document with Informational status.
> 
> Please read the draft, and if there is no violent objection on the list, the document will be requested to be submitted as WG document in 7 days.
> 
> Ciao,
> G/, KK & Warren
> 
> 
> 
> ----------------------------------------------------------------------
> --
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops

Re: [OPSEC] [v6ops] IPv6 LL-only as WG document - feedback requested