Re: [v6ops] A good example of why we need to careful about ULAs

[Owen DeLong <[e-mail]>]

My point is that link local packets shouldn't even get far enough for BCP38 to matter. Every router is required to not forward then no matter what. If the packet gets far enough into the forwarding process for your BCP38 filters to matter, then you need a software update for the router. 

Owen

On May 31, 2013, at 23:50, Jeroen Massar <[e-mail]> wrote:

> On 2013-05-31 21:33, Owen DeLong wrote:
>> 
>> On May 31, 2013, at 9:31 PM, Jeroen Massar <[e-mail]> wrote:
>> 
>>> On 2013-05-31 21:07, Brian E Carpenter wrote: [..]
>>>> Agreed. But when it does get through, it does no particular harm
>>>> (you just see a bizarre hop in the traceroute). If it got through
>>>> in a SYN/ACK exchange, it would probably distress a user.
>>> 
>>> If such a packet gets through it means BCP38 is not applied as
>>> things are not properly filtered.
>>> 
>> 
>> This has nothing to do with BCP38.
> 
> I would say it has everything to do with it actually ;)
> 
> Especially as it covers checking ALL traffic being forwarded and doing a
> simple source check on them.
> 
>> Any router which forwards a packet containing a link local address in
>> the header is broken regardless of any BCP38 configuration.
> 
> And BCP38 (Section 3, please read it, it is really informative ;) is
> inclusive of those requirements. Of course do also take into account
> BCP84 which details things a lot more.
> 
> Note that you have a fe80::/10 on every single interface, thus receiving
> such packets from another box and trying to forward it to another
> interface is just not right as it would fail uRPF do it being present on
> multiple interfaces.
> 
> Greets,
> Jeroen