Re: [v6ops] IPv6 LL-only as WG document

Hi Gunter,

I have no problem with the passive address idea, but the immediate issue
is that routers must not source ICMP packets that other routers must
discard - hence no LL source addresses.

    Brian

On 06/08/2012 10:36, Gunter Van de Velde (gvandeve) wrote:
> Answer as individual contributor.
> 
> Fred B. and myself did a draft to exactly address the traceability of interfaces without 
> increasing the attack vector on interfaces: Passive IPv6 addresses
> 
> No new class of addresses at all... no new IANA allocation... just behaviour of the address:
> 
> 1) it is configured as a normal address
> 2) just an extra keyword attached to the address identifying its behavior
> 3) It can only be used as a 'source' address
> 4) if it is used as destination address, then when reaching the router it will be directed to the Null0 interface
> 
> This will help visibility of the trace-route in cases of LL-only...
> 
> G/
> 
> 
> -----Original Message-----
> From: Brian E Carpenter [mailto:brian.e.carpenter@gmail.com] 
> Sent: 06 August 2012 11:25
> To: Gunter Van de Velde (gvandeve)
> Cc: opsec@ietf.org; v6ops v6ops WG (v6ops@ietf.org); opsec-chairs@ietf.org; 'draft-behringer-lla-only@tools.ietf.org' (draft-behringer-lla-only@tools.ietf.org)
> Subject: Re: [v6ops] IPv6 LL-only as WG document - feedback requested
> 
> Hi,
> 
>>    o  Management plane traffic, such as SSH, Telnet, SNMP, ICMP echo
>>       request ... can be addressed to loopback addresses of routers with
>>       a global scope address.  Router management can also be done over
>>       out-of-band channels.
>>
>>    o  ICMP error message can also be sourced from the global scope
>>       loopback address.
> 
> These statements seem too weak. Using GUAs for ICMP in particular needs to have a normative MUST somewhere (preferably in a BCP). In the context of this Informational draft, the language needs to state a requirement ("must" not "can") even if you don't use RFC 2119 terminology.
> 
> This matters because packets with a LL source address MUST NOT be forwarded, so a router that is misconfigured to send ICMP replies with a LL source address breaks both ping and traceroute.
> 
> I think the rule is that any packet that is *not* sent to a LL address must have a GUA as the source address. That takes care of ICMP, and everything else as well.
> 
> Furthermore, that GUA needs to be associated with a prefix that belongs to the organisation operating the router in question. Otherwise the traceroute results can be very confusing. We discussed that on v6ops back in March.
> 
> Regards
>    Brian Carpenter
> 
> 
> 
> 
> On 06/08/2012 10:03, Gunter Van de Velde (gvandeve) wrote:
>> (distributed to OPSEC WG and in cc v6ops)
>>
>> Dear all,
>>
>> During the OPSEC WG meeting last Wednesday there was consensus to adopt the draft http://tools.ietf.org/html/draft-behringer-lla-only-01 as working group document with Informational status.
>>
>> Please read the draft, and if there is no violent objection on the list, the document will be requested to be submitted as WG document in 7 days.
>>
>> Ciao,
>> G/, KK & Warren
>>
>>
>>
>> ----------------------------------------------------------------------
>> --
>>
>> _______________________________________________
>> v6ops mailing list
>> v6ops@ietf.org
>> https://www.ietf.org/mailman/listinfo/v6ops