ping-pong phenomenon with p2p links & /127 prefixes
Fernando Gont <fernando@gont.com.ar> Mon, 16 August 2010 08:29 UTC
Return-Path: <owner-v6ops@ops.ietf.org>
X-Original-To: ietfarch-v6ops-archive@core3.amsl.com
Delivered-To: ietfarch-v6ops-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3CB993A680C for <ietfarch-v6ops-archive@core3.amsl.com>; Mon, 16 Aug 2010 01:29:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.547
X-Spam-Level:
X-Spam-Status: No, score=-1.547 tagged_above=-999 required=5 tests=[AWL=-1.052, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xA+c6Q6RhzM2 for <ietfarch-v6ops-archive@core3.amsl.com>; Mon, 16 Aug 2010 01:29:18 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 4AC9A3A687F for <v6ops-archive@lists.ietf.org>; Mon, 16 Aug 2010 01:29:18 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.72 (FreeBSD)) (envelope-from <owner-v6ops@ops.ietf.org>) id 1OkuzL-0007TB-CI for v6ops-data0@psg.com; Mon, 16 Aug 2010 08:24:11 +0000
Received: from [209.85.213.194] (helo=mail-yx0-f194.google.com) by psg.com with esmtp (Exim 4.72 (FreeBSD)) (envelope-from <fernando.gont.netbook.win@gmail.com>) id 1OkuzI-0007Sn-Jo for v6ops@ops.ietf.org; Mon, 16 Aug 2010 08:24:08 +0000
Received: by yxj4 with SMTP id 4so599013yxj.5 for <v6ops@ops.ietf.org>; Mon, 16 Aug 2010 01:24:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:sender:message-id:date:from :user-agent:mime-version:to:cc:subject:x-enigmail-version:openpgp :content-type:content-transfer-encoding; bh=QLhq/qvYE2XtyrKb54JT68IhwxcL/bWGlAYY0VCFO7Q=; b=XdedKQuxxqeuX8bvnv35IVgt8ZGutePbgrmgUvHMjpLoMsVppd3MCEtJcYlOLrkP2e Jf0Kr+i0pYiQIyEUGjfp8H4naQMD62PnyDQTDIoyULcUA2jELL+whQyj+s0uArwWO5vO L5WtlSh3GaaqMhfoynnAOvbn29yllxpUuPpKc=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:cc:subject :x-enigmail-version:openpgp:content-type:content-transfer-encoding; b=Vekh2g7eYKh3t0METWBvs76+BGzZR/uiWBnOSIKwN0cXr3NPDSnm4UiHhRBwOPVyyJ S5bQZIx5PcbqchK7/A3tc6e0B/oYddHDQfqGbufuTMJkHjPpJO90JWNrV6LMETSK9x3z 1gYmWneuDAeof2g7Xv4mCxNn2lvY5hDkgMpDk=
Received: by 10.100.122.15 with SMTP id u15mr5404749anc.98.1281947045968; Mon, 16 Aug 2010 01:24:05 -0700 (PDT)
Received: from [192.168.2.3] ([190.245.181.90]) by mx.google.com with ESMTPS id l6sm9952087ang.38.2010.08.16.01.24.02 (version=TLSv1/SSLv3 cipher=RC4-MD5); Mon, 16 Aug 2010 01:24:05 -0700 (PDT)
Message-ID: <4C68F1E1.2090003@gont.com.ar>
Date: Mon, 16 Aug 2010 05:08:01 -0300
From: Fernando Gont <fernando@gont.com.ar>
User-Agent: Thunderbird 2.0.0.24 (Windows/20100228)
MIME-Version: 1.0
To: "ipv6@ietf.org" <ipv6@ietf.org>
CC: "v6ops@ops.ietf.org" <v6ops@ops.ietf.org>
Subject: ping-pong phenomenon with p2p links & /127 prefixes
X-Enigmail-Version: 0.96.0
OpenPGP: id=D076FFF1
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk
List-ID: <v6ops.ops.ietf.org>
Folks, draft-ietf-ipngwg-p2p-pingpong-00.txt proposes a solution to the ping-pong problem with point-to-point links, which IMHO is elegant: > Check the incoming/outgoing interface of the packet. If the > interface is the same, is a point-to-point interface and the > destination address on the packet seems to be on-link (in terms of > Neighbor Discovery) on the point-to-point interface, the forwarding > router SHOULD NOT forward the packet. Also, in this case, the router > SHOULD NOT generate ICMPv6 redirect message even if the incoming > packet meets conditions in RFC2461 section 8.2. The router SHOULD > generate an ICMPv6 error message instead, with the type field being 1 > (destination unreachable), and the code field being 3 (address > unreachable). Then incorporated into RFC 4443 as follows: > One specific case in which a Destination Unreachable message is sent > with a code 3 is in response to a packet received by a router from a > point-to-point link, destined to an address within a subnet assigned > to that same link (other than one of the receiving router's own > addresses). In such a case, the packet MUST NOT be forwarded back > onto the arrival link. However, this fix allegedly has big performance implications on routers. Can anybody comment on this "claim"? P.S.: This fix doesn't prevent the use of /127s (it's orthogonal), but I'm wondering about the reasons for which this fix is not the "first line of defense" for *this* (i.e., ping-pong) vulnerability. -- yes, the Kohno et al I-D mentions other (additional) reasons for using /127 prefixes o p2p links. Thanks! Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
- ping-pong phenomenon with p2p links & /127 prefix… Fernando Gont
- Re: ping-pong phenomenon with p2p links & /127 pr… Jeroen Massar
- Re: ping-pong phenomenon with p2p links & /127 pr… sthaug
- Re: ping-pong phenomenon with p2p links & /127 pr… Jeroen Massar
- Re: ping-pong phenomenon with p2p links & /127 pr… sthaug
- Re: ping-pong phenomenon with p2p links & /127 pr… Jeroen Massar
- Re: ping-pong phenomenon with p2p links & /127 pr… Randy Bush
- Re: ping-pong phenomenon with p2p links & /127 pr… Ole Troan
- Re: ping-pong phenomenon with p2p links & /127 pr… Jeroen Massar
- Re: ping-pong phenomenon with p2p links & /127 pr… Randy Bush
- Re: ping-pong phenomenon with p2p links & /127 pr… Fernando Gont
- Re: ping-pong phenomenon with p2p links & /127 pr… Ole Troan
- Re: ping-pong phenomenon with p2p links & /127 pr… Gert Doering
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Ole Troan
- Re: ping-pong phenomenon with p2p links & /127 pr… Ole Troan
- Re: ping-pong phenomenon with p2p links & /127 pr… Ole Troan
- Re: ping-pong phenomenon with p2p links & /127 pr… sthaug
- Re: ping-pong phenomenon with p2p links & /127 pr… Ole Troan
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Randy Bush
- Re: ping-pong phenomenon with p2p links & /127 pr… Seiichi Kawamura
- Re: ping-pong phenomenon with p2p links & /127 pr… Ole Troan
- Re: ping-pong phenomenon with p2p links & /127 pr… Seiichi Kawamura
- Re: ping-pong phenomenon with p2p links & /127 pr… Randy Bush
- RE: ping-pong phenomenon with p2p links & /127 pr… Eric Vyncke (evyncke)
- draft-ietf-ipngwg-p2p-pingpong-00.txt vs RFC4443 Pekka Savola
- Re: ping-pong phenomenon with p2p links & /127 pr… Ole Troan
- Re: ping-pong phenomenon with p2p links & /127 pr… sthaug
- Re: ping-pong phenomenon with p2p links & /127 pr… Seiichi Kawamura
- Re: ping-pong phenomenon with p2p links & /127 pr… Truman Boyes
- Re: ping-pong phenomenon with p2p links & /127 pr… Randy Bush
- Re: draft-ietf-ipngwg-p2p-pingpong-00.txt vs RFC4… Fernando Gont
- Re: ping-pong phenomenon with p2p links & /127 pr… Fernando Gont
- Re: ping-pong phenomenon with p2p links & /127 pr… Ole Troan
- Re: ping-pong phenomenon with p2p links & /127 pr… t.petch
- Re: ping-pong phenomenon with p2p links & /127 pr… James Joyce
- Re: ping-pong phenomenon with p2p links & /127 pr… Randy Bush
- Re: ping-pong phenomenon with p2p links & /127 pr… Seiichi Kawamura
- Re: ping-pong phenomenon with p2p links & /127 pr… Truman Boyes
- Re: draft-ietf-ipngwg-p2p-pingpong-00.txt vs RFC4… Pekka Savola
- Re: draft-ietf-ipngwg-p2p-pingpong-00.txt vs RFC4… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Randy Bush
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… sthaug
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Randy Bush
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… sthaug
- Re: ping-pong phenomenon with p2p links & /127 pr… Joel Jaeggli
- Re: ping-pong phenomenon with p2p links & /127 pr… Fred Baker
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… sthaug
- Re: ping-pong phenomenon with p2p links & /127 pr… Randy Bush
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Fred Baker
- RE: ping-pong phenomenon with p2p links & /127 pr… Hemant Singh (shemant)
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Mark Smith
- Re: ping-pong phenomenon with p2p links & /127 pr… Fernando Gont