[v6ops] A good example of why we need to careful about ULAs

[Lorenzo Colitti <[e-mail]>]

News at 11:

1. ULAs leak.
2. People assign ULAs by hand.

Yes, both of these a violation of IETF guidance. I don't think that matters
much, though - while we can always claim that the implementer/operator is
"holding it wrong", we should be careful that what we design/standardize is
hard to misconfigure and possibly robust in the face of misconfiguration.
Subtle nuances like "these addresses are global scope, but not globally
routable" tend to get lost very easily.

Of course, in the case of ULAs, there's not much that can be done about the
design at this point, but we should make an effort to make it clear that
the potential for misconfiguration exists and provide clear guidance on how
not to misconfigure them.

Personally, I think that providing said guidance is much more useful and
important than enumerating scenarios that aren't widely, if at all,
implemented, and I hope that the authors
of draft-ietf-v6ops-ula-usage-recommendations will agree.

Cheers,
Lorenzo

---------- Forwarded message ----------
From: Jeroen Massar <[e-mail]>
Date: Thu, May 30, 2013 at 4:59 AM
Subject: Usage of fd00::/8 on the Interwebz - something with filters and
uRPF
To: [e-mail]


...
 4  2001:7f8:1::a500:3303:1 (2001:7f8:1::a500:3303:1)  20.755 ms  20.763 ms
 20.784 ms
 5  fd00:3303::1 (fd00:3303::1)  22.010 ms  21.984 ms  21.986 ms
 6  2a02:120c:1051:d010::1 (2a02:120c:1051:d010::1)  17.806 ms  17.889 ms
 17.842 ms
 7  2a02:120c:1051:d010::1 (2a02:120c:1051:d010::1)  18.720 ms  18.593 ms
 18.617 ms
...

Hmmmm fd00::/8, that really should never ever be visible on the Internet,
being Unique *LOCAL* Addresses.
And it does not look like they applied the randomness bit for picking a
prefix either.
You would also almost think that a /28 is more than enough address space to
put a few router loopbacks in.

It is apparently time for people to start checking their filters again
because it seems that these packets leak into other ASNs too...

More generally, do recheck your network for BCP38 compliance, please do
apply it and require your peers to do the same!

Greets,
 Jeroen