Re: [v6ops] A good example of why we need to careful about ULAs

[Jeroen Massar <[e-mail]>]

On 2013-05-31 21:33, Owen DeLong wrote:
> 
> On May 31, 2013, at 9:31 PM, Jeroen Massar <[e-mail]> wrote:
> 
>> On 2013-05-31 21:07, Brian E Carpenter wrote: [..]
>>> Agreed. But when it does get through, it does no particular harm
>>> (you just see a bizarre hop in the traceroute). If it got through
>>> in a SYN/ACK exchange, it would probably distress a user.
>> 
>> If such a packet gets through it means BCP38 is not applied as
>> things are not properly filtered.
>> 
> 
> This has nothing to do with BCP38.

I would say it has everything to do with it actually ;)

Especially as it covers checking ALL traffic being forwarded and doing a
simple source check on them.

> Any router which forwards a packet containing a link local address in
> the header is broken regardless of any BCP38 configuration.

And BCP38 (Section 3, please read it, it is really informative ;) is
inclusive of those requirements. Of course do also take into account
BCP84 which details things a lot more.

Note that you have a fe80::/10 on every single interface, thus receiving
such packets from another box and trying to forward it to another
interface is just not right as it would fail uRPF do it being present on
multiple interfaces.

Greets,
 Jeroen