Re: [OPSEC] [v6ops] IPv6 LL-only as WG document - feedback requested

["Michael Behringer (mbehring)" <[e-mail]>]

> -----Original Message-----
> From: Gunter Van de Velde (gvandeve)
> Sent: 06 August 2012 11:57
> To: Brian E Carpenter
> Cc: [e-mail]; v6ops v6ops WG ([e-mail]); opsec-
> [e-mail]; '[e-mail]' (draft-behringer-
> [e-mail])
> Subject: RE: [v6ops] IPv6 LL-only as WG document - feedback requested
> 
> I agree... packets with LL source-address should not leave the link indeed.
> 
> I expect the Behringer editor team to make that more specific in the draft
> text.

This was sort of implied (and mentioned during presentations), but needs to be made clearer, agreed. We'll include this in the next revision. 

Thanks for the feedback Brian! 

Michael


> 
> G/
> 
> -----Original Message-----
> From: Brian E Carpenter [mailto:[e-mail]]
> Sent: 06 August 2012 12:53
> To: Gunter Van de Velde (gvandeve)
> Cc: [e-mail]; v6ops v6ops WG ([e-mail]); opsec-
> [e-mail]; '[e-mail]' (draft-behringer-
> [e-mail])
> Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested
> 
> On 06/08/2012 11:18, Gunter Van de Velde (gvandeve) wrote:
> > I am confused. Please correct my understanding if possible.
> >
> > 1) You are ok with the Behringer-LL draft being an informational
> > draft? (not BCP)
> 
> Yes. All I'm saying is that it should insist on a valid source address, which
> means that a LL source address is not allowed for packets that leave the
> local link.
> 
> Section 2.5.6 of RFC 4291 makes this clear but people seem to ignore it:
> "Link-Local addresses are for use on a single link."
> 
> Obviously, therefore, packets whose destination is not LL must not have a LL
> source address.
> 
> > 2) Passive addresses is something that creates potential issues in your
> view?
> 
> I said I have no problem with that. It doesn't affect the above point.
> 
>    Brian
> >
> > For (2) I would say... It is just as a normal address... no need at all to
> discard them on any other box then the receiving box as those boxes just
> see the address as being a normal IPv6 address. Nothing special about it. It
> is just a normal address. The behaviour of passive addresses is to do with
> the way the recipient device deals with this address.
> >
> > G/
> >
> >
> >
> >
> > -----Original Message-----
> > From: Brian E Carpenter [mailto:[e-mail]]
> > Sent: 06 August 2012 11:40
> > To: Gunter Van de Velde (gvandeve)
> > Cc: [e-mail]; v6ops v6ops WG ([e-mail]);
> > [e-mail]; '[e-mail]'
> > ([e-mail])
> > Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested
> >
> > Hi Gunter,
> >
> > I have no problem with the passive address idea, but the immediate issue
> is that routers must not source ICMP packets that other routers must discard
> - hence no LL source addresses.
> >
> >     Brian
> >
> > On 06/08/2012 10:36, Gunter Van de Velde (gvandeve) wrote:
> >> Answer as individual contributor.
> >>
> >> Fred B. and myself did a draft to exactly address the traceability of
> >> interfaces without increasing the attack vector on interfaces:
> >> Passive
> >> IPv6 addresses
> >>
> >> No new class of addresses at all... no new IANA allocation... just
> behaviour of the address:
> >>
> >> 1) it is configured as a normal address
> >> 2) just an extra keyword attached to the address identifying its
> >> behavior
> >> 3) It can only be used as a 'source' address
> >> 4) if it is used as destination address, then when reaching the
> >> router it will be directed to the Null0 interface
> >>
> >> This will help visibility of the trace-route in cases of LL-only...
> >>
> >> G/
> >>
> >>
> >> -----Original Message-----
> >> From: Brian E Carpenter [mailto:[e-mail]]
> >> Sent: 06 August 2012 11:25
> >> To: Gunter Van de Velde (gvandeve)
> >> Cc: [e-mail]; v6ops v6ops WG ([e-mail]);
> >> [e-mail]; '[e-mail]'
> >> ([e-mail])
> >> Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested
> >>
> >> Hi,
> >>
> >>>    o  Management plane traffic, such as SSH, Telnet, SNMP, ICMP echo
> >>>       request ... can be addressed to loopback addresses of routers with
> >>>       a global scope address.  Router management can also be done over
> >>>       out-of-band channels.
> >>>
> >>>    o  ICMP error message can also be sourced from the global scope
> >>>       loopback address.
> >> These statements seem too weak. Using GUAs for ICMP in particular
> needs to have a normative MUST somewhere (preferably in a BCP). In the
> context of this Informational draft, the language needs to state a
> requirement ("must" not "can") even if you don't use RFC 2119 terminology.
> >>
> >> This matters because packets with a LL source address MUST NOT be
> forwarded, so a router that is misconfigured to send ICMP replies with a LL
> source address breaks both ping and traceroute.
> >>
> >> I think the rule is that any packet that is *not* sent to a LL address must
> have a GUA as the source address. That takes care of ICMP, and everything
> else as well.
> >>
> >> Furthermore, that GUA needs to be associated with a prefix that belongs
> to the organisation operating the router in question. Otherwise the
> traceroute results can be very confusing. We discussed that on v6ops back in
> March.
> >>
> >> Regards
> >>    Brian Carpenter
> >>
> >>
> >>
> >>
> >> On 06/08/2012 10:03, Gunter Van de Velde (gvandeve) wrote:
> >>> (distributed to OPSEC WG and in cc v6ops)
> >>>
> >>> Dear all,
> >>>
> >>> During the OPSEC WG meeting last Wednesday there was consensus to
> adopt the draft http://tools.ietf.org/html/draft-behringer-lla-only-01 as
> working group document with Informational status.
> >>>
> >>> Please read the draft, and if there is no violent objection on the list, the
> document will be requested to be submitted as WG document in 7 days.
> >>>
> >>> Ciao,
> >>> G/, KK & Warren
> >>>
> >>>
> >>>
> >>> --------------------------------------------------------------------
> >>> -
> >>> -
> >>> --
> >>>
> >>> _______________________________________________
> >>> v6ops mailing list
> >>> [e-mail]
> >>> https://www.ietf.org/mailman/listinfo/v6ops