Subject: [v6ops] NUD and draft-byrne-v6ops-64share-03

From: Julien Laganier <[email-masked]>
Date: Wed, 21 Nov 2012 17:14:40 -0800

Hello,

I have a question regarding the interaction between NUD and the method
described in this draft.

The GGSN/PGW acting as a default router advertises via IPv6 RAs a /64
prefix over the point-to-point link to the User Equipment.

Assuming the User Equipment employs the method described in this draft
 and uses
"the 3GPP network assigned /64 to assign itself a /128 subnet address to
the 3GPP radio interface for consistent network reachability and the same
address with a /64 subnet to the tethered LAN interface.The tethered LAN
interface may then advertise the /64 subnet to the LAN with RA."

Now a host on the tethered LAN will configure an IPv6 address with SLAAC
based on the advertized /64, and starts to use it.

When a downlink packets sent towards a host on the tethered LAN arrives at
the GGSN/PGW, who believes the /64 is onlink, if the GGSN/PGW attempts NUD
towards that destination address, in the current description of the method
the UE will not reply (it has configured only one /128 on its interface
facing the 3GPP network). Thus it seems GGSN/PGW initiated NUD will fail.

So it seems to me that the current method would work only if a) the
GGSN/PGW doesn't perform NUD for downlink packets sent over the
point-to-point link, or b) the UE answers NUD probes for all addresses in
the /64.

Is this correct?

Thanks,

--julien

---

From: Cameron Byrne <[email-masked]>
Date: Wed, 21 Nov 2012 19:47:24 -0800

On Wed, Nov 21, 2012 at 5:14 PM, Julien Laganier <[email-masked]> wrote:
> The GGSN/PGW acting as a default router advertises via IPv6 RAs a /64 prefix
> over the point-to-point link to the User Equipment.
>
> Assuming the User Equipment employs the method described in this draft  and
> uses "the 3GPP network assigned /64 to assign itself a /128 subnet address
> to the 3GPP radio interface for consistent network reachability and the same
> So it seems to me that the current method would work only if a) the GGSN/PGW
> doesn't perform NUD for downlink packets sent over the point-to-point link,
> or b) the UE answers NUD probes for all addresses in the /64.
>
> Is this correct?
>

AFAIK, the GGSN/PGW does not do NUD.  The /64 is considered off-link
[1] and therefore no host resolution is done

[1] http://tools.ietf.org/html/rfc6459#section-5.2

CB

> Thanks,
>
> --julien
>
>
>
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Sun, 25 Nov 2012 10:07:37 +0000

Indeed. No DAD by GGSN/PGW for the /64 assigned to the UE.

BTW, the below text in the security consideration section reads as if
GGSN/PGW and UE are on-link (wrt IPv6), if read together with the next
line.

//
9.  Security Considerations

.. .. 

   and the fact that the UE and the first-hop router (PDN-GW/GGSN or
   SGW) are the only nodes on the link.  For off-link IPv6 attacks, the
   3GPP EPS is as vulnerable as any IPv6 system.

Cheers,
Rajiv

//
5.2. IPv6 Address Configuration

.. .. 

   In the 3GPP link model, the /64 prefix assigned to the UE cannot be
used for on-link determination (because the L-bit in the Prefix
Information Option (PIO) in the RA must always be set to zero). If
the advertised prefix is used for SLAAC, then the A-bit in the PIO
must be set to one. Details of the 3GPP link-model and address

-----Original Message-----
From: Cameron Byrne <[email-masked]>
Date: Wednesday, November 21, 2012 10:47 PM
To: Julien Laganier <[email-masked]>
Cc: "[email-masked]" <[email-masked]>,
"[email-masked]"
<[email-masked]>
Subject: Re: [v6ops] NUD and draft-byrne-v6ops-64share-03

>>prefix
>>and
>>GGSN/PGW

---

From: jouni korhonen <[email-masked]>
Date: Sun, 25 Nov 2012 14:58:43 +0200

Hi,

> Indeed. No DAD by GGSN/PGW for the /64 assigned to the UE.

Correct.

>    3GPP EPS is as vulnerable as any IPv6 system.

Excuse for my bad (non-native speaker) wording but that quote does not
try to hint anything about on-link properties of the prefix. It would
have been more appropriate quote the whole sentence where it also
refers to the actual link model (which then can be found in Section
5.2.) What was intended to say here is that if  an off-link host can
launch an attack by sending IPv6 packets to the mobile host, then
generic IPv6 host security concerns apply.

In general this is/will be (hopefully) a bit more precisely described
in draft-ietf-opsec-v6-01 and draft-ietf-v6ops-rfc3316bis.

- Jouni

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Sun, 25 Nov 2012 13:18:29 +0000

Jouni,

That sounds good. In sync.

Cheers,
Rajiv

-----Original Message-----
From: jouni korhonen <[email-masked]>
Date: Sunday, November 25, 2012 7:58 AM
To: Rajiv Asati <[email-masked]>
Cc: Cameron Byrne <[email-masked]>, Julien Laganier
<[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [v6ops] NUD and draft-byrne-v6ops-64share-03

>>>> to the 3GPP radio interface for consistent network reachability and
>>>>the
>>>>same
>>>> When a downlink packets sent towards a host on the tethered LAN
>>>>arrives
>>>>at

---

From: Julien Laganier <[email-masked]>
Date: Wed, 28 Nov 2012 09:52:09 -0800

Rajiv and Jouni,

> > Indeed. No DAD by GGSN/PGW for the /64 assigned to the UE.
I know that there's no DAD for addresses in the /64.

My comment was about NUD...

--julien

---

From: jouni korhonen <[email-masked]>
Date: Thu, 29 Nov 2012 10:17:35 +0200

On Nov 28, 2012, at 7:52 PM, Julien Laganier wrote:

> Rajiv and Jouni,
> 
> 
> On Sun, Nov 25, 2012 at 4:58 AM, jouni korhonen <[email-masked]> wrote:
> Hi,
> 

And no NUD either.

- Jouni