Re: [v6ops] I-D Action: draft-ietf-v6ops-design-choices-04.txt

Philip Matthews <philip_matthews@magma.ca> Thu, 19 February 2015 19:07 UTC

Return-Path: <philip_matthews@magma.ca>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C5AD1A005C for <v6ops@ietfa.amsl.com>; Thu, 19 Feb 2015 11:07:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.5
X-Spam-Level:
X-Spam-Status: No, score=-0.5 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8BshbPUqDHvK for <v6ops@ietfa.amsl.com>; Thu, 19 Feb 2015 11:07:47 -0800 (PST)
Received: from mail-07.primus.ca (mail20.primus.ca [216.254.141.187]) by ietfa.amsl.com (Postfix) with ESMTP id 841C71A1EEF for <v6ops@ietf.org>; Thu, 19 Feb 2015 11:07:39 -0800 (PST)
Received: from [24.114.104.93] (helo=[172.20.10.4]) by mail-07.primus.ca with esmtpa (Exim 4.72) (envelope-from <philip_matthews@magma.ca>) id 1YOWRm-0001Rv-7D; Thu, 19 Feb 2015 14:07:38 -0500
Mime-Version: 1.0 (Apple Message framework v1085)
Content-Type: text/plain; charset=us-ascii
From: Philip Matthews <philip_matthews@magma.ca>
In-Reply-To: <54E5176B.7000404@gmail.com>
Date: Thu, 19 Feb 2015 14:07:36 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <8AAD52EA-DB6A-4FA9-950A-D1DAF8D9F138@magma.ca>
References: <20150218205728.31470.50859.idtracker@ietfa.amsl.com> <54E5176B.7000404@gmail.com>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
X-Mailer: Apple Mail (2.1085)
X-Authenticated: philip_matthews - ([172.20.10.4]) [24.114.104.93]
Archived-At: <http://mailarchive.ietf.org/arch/msg/v6ops/GfaD7raD7Uwr3O7irT-wFN7T0n0>
Cc: v6ops@ietf.org
Subject: Re: [v6ops] I-D Action: draft-ietf-v6ops-design-choices-04.txt
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Feb 2015 19:07:49 -0000

Hi Brian:

I personally do not know of a way to get a packet to a link-local address on a different link unless the routers in-between are very very broken. However, I think the discovery a couple of years ago that most routers happily forwarded packets with link-local _source_ addresses surprised people, even though in hindsight it should not have. And security folk (and researchers!) are always leery of absolute statements like "This is impossible". So when Jen Lincova requested that we soften the wording around link-local address security (in her comments at the mike during the Honolulu session), I was happy to comply.  Hence the text below, and similar changes in a couple of other spots.

- Philip

On 2015-02-18, at 17:51 , Brian E Carpenter wrote:

>> It is very difficult to impossible to ping a link-local address
>> from a device that is not on the same subnet. This is a	
>> troubleshooting disadvantage, though it can also be viewed as a
>> security advantage.
> 
> I am puzzled by how it could ever be possible at all.
> Link-local addresses are by definition meaningless off
> the link in question, and they should never even be known by
> any node on another link. (And of course it gets even more
> complicated on devices with several interfaces, such as routers,
> since a link local address is only meaningful with a ZoneID,
> and that is a node-specific value, meaningless to other nodes
> on the *same* link.)
> 
>   Brian
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>