Subject: Re: [v6ops] draft-liu-v6ops-ula-usage-analysis

From: Philipp Kern <[email-masked]>
Date: Mon, 1 Apr 2013 13:53:02 +0200

On Sat, Mar 30, 2013 at 07:28:43PM +0100, Alexandru Petrescu wrote:
> IPv6 ULA local verwenden (use): [unchecked]
> Lokale IPv6-Adresse (ULA): fd46:8713:d5b8:0001::1')
> 
> By the suggested example algorithm in RFC4193, the overall length of
> the 'random' part should be 48, which seems to be the case with the
> example above.

Indeed it's being regenerated whenever the box is ticked. Which has the
funny effect that you don't actually get what's written there, but after
you submit the form to enable it, you get a new ULA. And a new ULA is
presented after you turned it off (i.e. one you'll never get because it
will be regenerated upon activation next time).

Kind regards
Philipp Kern

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 12 Apr 2013 16:44:51 +0200

Since this discussion happened we went on experimenting.

The discussion was in the context of ULA usage and in some way about
whether or not various platforms implement RIO Route Information Option
(RFC 4191 "Default Router Preferences and More Specific Routes").

Linux does it.

Le 22/03/2013 04:52, Owen DeLong a écrit :
[...]
>>> I don't know how to help you operate your equipment. I use
>>> different equipment. However, even if it is not possible with
>>> your equipment, see above.
>>
>> Do you know of any equipment that actually supports RIO?
>
> I haven't done such an analysis as it hasn't been important until
> now. I've avoided the use of ULAs which helps a lot.

We've tested the use of RIO in linux recent kernels 3.8.x.

The RIO option is there in the kernel with two different statuses.
First, the Pref field which applies only to configuring a DEfault Router
with preferences is present ok; otoh its suboption of using a PIO is
stated as "EXPERIMENTAL" which in linux lingo means to be careful about
it; in this case the carefulness is a security warning (although IMHO
it's just as insecure to allow DEfault Router preferences).

The implementation works fine between two routers sending each other RAs
with PIO.  The software radvd.conf sends the RA and the receiving kernel
interprets the PIO and adds routes in its routing table, provided it has
the forwarding==2.  There are some questions about lifetime, but we'll
see later.

With respect to ULAs, the prefix we've put in the PIO is a ULA.  We used
the prefix fd00:f00d:1::/64; that has 'food' because we have a hard time
to generate a random and syntactically correct prefix.  We used a ULA
because the experiment took one week and that's not enough time to learn
how to get a PA space and do it.

Alex

> Owen
>
> _______________________________________________ v6ops mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/v6ops
>
>

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 12 Apr 2013 16:21:52 +0100

On 12/04/2013 15:44, Alexandru Petrescu wrote:
...
> to generate a random and syntactically correct prefix.  

Really? http://www.sixxs.net/tools/grh/ula/

   Brian

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 12 Apr 2013 17:26:18 +0200

Le 12/04/2013 17:21, Brian E Carpenter a écrit :
> On 12/04/2013 15:44, Alexandru Petrescu wrote: ...
>> With respect to ULAs, the prefix we've put in the PIO is a ULA.  We
>> used the prefix fd00:f00d:1::/64; that has 'food' because we have a
>> hard time to generate a random and syntactically correct prefix.
>

That GUI may be helpful.  It is a good starting point, we will try to
use it in general.

However, in one particular case it's not clear _which_ EUI-64 to use?

A Router has two interfaces - two such EUI-64.  The ULA prefix which is
PIO (Prefix Information Option) on one interface is RIO on the other
interface.

Which EUI-64 to use?

Alex

---

From: Simon Perreault <[email-masked]>
Date: Fri, 12 Apr 2013 17:35:17 +0200

> PIO (Prefix Information Option) on one interface is RIO on the other

Why do you think it matters?

Simon
-- 
DTN made easy, lean, and smart --> http://postellation.viagenie.ca
NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
STUN/TURN server               --> http://numb.viagenie.ca

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 12 Apr 2013 17:44:42 +0200

Le 12/04/2013 17:35, Simon Perreault a écrit :
>>>> With respect to ULAs, the prefix we've put in the PIO is a ULA.
>>>> We used the prefix fd00:f00d:1::/64; that has 'food' because we
>>>> have a hard time to generate a random and syntactically correct
>>>> prefix.
>>>
>> That GUI may be helpful.  It is a good starting point, we will try
>> to use it in general.
>>
>> A Router has two interfaces - two such EUI-64.  The ULA prefix
>> which is PIO (Prefix Information Option) on one interface is RIO on
>> the other interface.
>>
>> Which EUI-64 to use?
>

Because if not then everyone would use the same? (hence more risk of
collision?)

Another unique identifier which would cover the Router entirely, not
only one of its interfaces, would be better.

Alex

---

From: Simon Perreault <[email-masked]>
Date: Fri, 12 Apr 2013 18:30:18 +0200

> Because if not then everyone would use the same? (hence more risk of

My question was: Why do you think it matters which of your router's two 
interfaces you use?

Not: Why do you think it matters that you use a real MAC address to 
generate a ULA prefix?

Simon

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 12 Apr 2013 18:55:32 +0200

Le 12/04/2013 18:30, Simon Perreault a écrit :
>>>>>> With respect to ULAs, the prefix we've put in the PIO is a
>>>>>>  ULA. We used the prefix fd00:f00d:1::/64; that has 'food'
>>>>>>  because we have a hard time to generate a random and
>>>>>> syntactically correct prefix.
>>>>>
>>>> That GUI may be helpful.  It is a good starting point, we will
>>>>  try to use it in general.
>>>>
>>>> which is PIO (Prefix Information Option) on one interface is
>>>> RIO on the other interface.
>>>>
>>>> Which EUI-64 to use?
>>>
>> Because if not then everyone would use the same? (hence more risk
>> of collision?)
>
> My question was: Why do you think it matters which of your router's
> two interfaces you use?

In that sense - I think it does not matter.  Any one of the two would do.

And actually any third, in oui.txt, like f0:02:2b:f0:00:0d, which is not
any of my router's interface - would do as well.

(why should I bother revealing a real MAC address when I could just pick
someone else's out of oui.txt)

(also, my Router may not have any MAC address, at which point I should
pick someone's MAC address)

The algorithm would generate uniqueness, but maybe less so when
preferences shape up for some particular MAC addresses picked out of
oui.txt.  Or until oui.txt space runs out.

> Not: Why do you think it matters that you use a real MAC address to

Ok.

Alex

---

From: Owen DeLong <[email-masked]>
Date: Fri, 12 Apr 2013 11:26:28 -0700

> PIO (Prefix Information Option) on one interface is RIO on the other

IT DOESN'T MATTER. Pick one and just use it. Either one will work just fine.

Owen

> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops

---

From: Mark Andrews <[email-masked]>
Date: Sat, 13 Apr 2013 08:09:10 +1000

In message <[email-masked]>, Owen DeLong write
s:
> 
> On Apr 12, 2013, at 08:26 , Alexandru Petrescu <[email-masked]=
> m> wrote:
> 
> > Le 12/04/2013 17:21, Brian E Carpenter a =E9crit :
> >> =
> > =
> > =
> > =
> > =

Additionally *ANY* source of truly random numbers will do (RFC 4193,
Section 3.2.1.  Locally Assigned Global IDs).  If your /dev/random
generates truly random values then the following will do.

	dd if=/dev/random bs=5 count=1 | od -tx1

% dd if=/dev/random bs=5 count=1 | od -tx1
1+0 records in
1+0 records out
5 bytes transferred in 0.000051 secs (97998 bytes/sec)
0000000    83  d1  17  05  7f                                            
0000005
%

Which would result in fd83:d117:057f.

Flip a coin 40 times (heads 1, tails 0) and use the resulting bit
pattern.

Don't just choose a value.  Go to the effort of generating the bits
from a random source.

The algorithm in RFC4193 Section 3.2.2. is written for the case
where the CPE *does not* have a good source of randomness but does
have a clock or just trusts its ntp source and a unique identifier
(MAC).

> > =
> > =
> > =
> >> =
> >> =
> >> =
> > =
> > =
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Alexandru Petrescu <[email-masked]>
Date: Sat, 13 Apr 2013 23:11:10 +0200

Mark - yes; thanks for the /dev/random command to generate ULA prefix 
without EUI-64.  It makes sense.  It's not documented.  Not sure whether 
it needs to be documented.

But this rfc4191 implementation report was more geared towards the 
dhcp-route discussion, and less about ULA.  I will have to refromulate 
separately.

Alex