Re: [v6ops] IPv6 LL-only as WG document

On 06/08/2012 11:18, Gunter Van de Velde (gvandeve) wrote:
> I am confused. Please correct my understanding if possible.
> 
> 1) You are ok with the Behringer-LL draft being an informational draft? (not BCP)

Yes. All I'm saying is that it should insist on a valid source address,
which means that a LL source address is not allowed for packets that leave
the local link.

Section 2.5.6 of RFC 4291 makes this clear but people seem to ignore it:
"Link-Local addresses are for use on a single link."

Obviously, therefore, packets whose destination is not LL must not
have a LL source address.

> 2) Passive addresses is something that creates potential issues in your view?

I said I have no problem with that. It doesn't affect the above point.

   Brian
> 
> For (2) I would say... It is just as a normal address... no need at all to discard them on any other box then the receiving box as those boxes just see the address as being a normal IPv6 address. Nothing special about it. It is just a normal address. The behaviour of passive addresses is to do with the way the recipient device deals with this address.
> 
> G/
> 
> 
> 
> 
> -----Original Message-----
> From: Brian E Carpenter [mailto:brian.e.carpenter@gmail.com] 
> Sent: 06 August 2012 11:40
> To: Gunter Van de Velde (gvandeve)
> Cc: opsec@ietf.org; v6ops v6ops WG (v6ops@ietf.org); opsec-chairs@ietf.org; 'draft-behringer-lla-only@tools.ietf.org' (draft-behringer-lla-only@tools.ietf.org)
> Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested
> 
> Hi Gunter,
> 
> I have no problem with the passive address idea, but the immediate issue is that routers must not source ICMP packets that other routers must discard - hence no LL source addresses.
> 
>     Brian
> 
> On 06/08/2012 10:36, Gunter Van de Velde (gvandeve) wrote:
>> Answer as individual contributor.
>>
>> Fred B. and myself did a draft to exactly address the traceability of 
>> interfaces without increasing the attack vector on interfaces: Passive 
>> IPv6 addresses
>>
>> No new class of addresses at all... no new IANA allocation... just behaviour of the address:
>>
>> 1) it is configured as a normal address
>> 2) just an extra keyword attached to the address identifying its 
>> behavior
>> 3) It can only be used as a 'source' address
>> 4) if it is used as destination address, then when reaching the router 
>> it will be directed to the Null0 interface
>>
>> This will help visibility of the trace-route in cases of LL-only...
>>
>> G/
>>
>>
>> -----Original Message-----
>> From: Brian E Carpenter [mailto:brian.e.carpenter@gmail.com]
>> Sent: 06 August 2012 11:25
>> To: Gunter Van de Velde (gvandeve)
>> Cc: opsec@ietf.org; v6ops v6ops WG (v6ops@ietf.org); 
>> opsec-chairs@ietf.org; 'draft-behringer-lla-only@tools.ietf.org' 
>> (draft-behringer-lla-only@tools.ietf.org)
>> Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested
>>
>> Hi,
>>
>>>    o  Management plane traffic, such as SSH, Telnet, SNMP, ICMP echo
>>>       request ... can be addressed to loopback addresses of routers with
>>>       a global scope address.  Router management can also be done over
>>>       out-of-band channels.
>>>
>>>    o  ICMP error message can also be sourced from the global scope
>>>       loopback address.
>> These statements seem too weak. Using GUAs for ICMP in particular needs to have a normative MUST somewhere (preferably in a BCP). In the context of this Informational draft, the language needs to state a requirement ("must" not "can") even if you don't use RFC 2119 terminology.
>>
>> This matters because packets with a LL source address MUST NOT be forwarded, so a router that is misconfigured to send ICMP replies with a LL source address breaks both ping and traceroute.
>>
>> I think the rule is that any packet that is *not* sent to a LL address must have a GUA as the source address. That takes care of ICMP, and everything else as well.
>>
>> Furthermore, that GUA needs to be associated with a prefix that belongs to the organisation operating the router in question. Otherwise the traceroute results can be very confusing. We discussed that on v6ops back in March.
>>
>> Regards
>>    Brian Carpenter
>>
>>
>>
>>
>> On 06/08/2012 10:03, Gunter Van de Velde (gvandeve) wrote:
>>> (distributed to OPSEC WG and in cc v6ops)
>>>
>>> Dear all,
>>>
>>> During the OPSEC WG meeting last Wednesday there was consensus to adopt the draft http://tools.ietf.org/html/draft-behringer-lla-only-01 as working group document with Informational status.
>>>
>>> Please read the draft, and if there is no violent objection on the list, the document will be requested to be submitted as WG document in 7 days.
>>>
>>> Ciao,
>>> G/, KK & Warren
>>>
>>>
>>>
>>> ---------------------------------------------------------------------
>>> -
>>> --
>>>
>>> _______________________________________________
>>> v6ops mailing list
>>> v6ops@ietf.org
>>> https://www.ietf.org/mailman/listinfo/v6ops