Subject: Re: [v6ops] A good example of why we need to careful about ULAs

From: Ted Lemon <[email-masked]>
Date: Sat, 1 Jun 2013 10:54:29 +0000

On May 31, 2013, at 10:44 PM, Owen DeLong <[email-masked]> wrote:
> The TTL Exceeded packet shouldn't get forwarded by any router as a result of the LL Source address.
> Thus it should never reach its destination.
> Thus it will break traceroutes.
> Thus it is harmful.

So you're arguing that every router on the internet needs a global IP address?

---

From: Ted Lemon <[email-masked]>
Date: Sat, 1 Jun 2013 11:07:01 +0000

On May 31, 2013, at 11:19 PM, Lorenzo Colitti <[email-masked]<mailto:[email-masked]>> wrote:
Just number your internal network using ULAs and no global addresses, and then run a traceroute across it.   Global addresses on the source end, global addresses on the destination end, ULAs in the middle.   The only way to "fix" this is to break traceroute.   This does not represent brokenness.

RFC 4193 section 4.3 disagrees with you. It says that border routers should drop those packets and send back ICMP unreachables.

To be clear, I'm not saying that a network that uses ULAs for transit routers and that returns those ULAs as source addresses in TTL exceeded packets is following 4193, or even that its behavior is correct.   What I am saying is that if the border routers behave correctly, they break traceroute across such a network.   So there's an incentive not to filter the ULA at the border router.   But likely the reason people are seeing these is simply that there's no egress filtering for the ULA on the border router due to inaction, rather than due to deliberate action.

---

From: Ole Troan <[email-masked]>
Date: Sat, 1 Jun 2013 13:15:22 +0200

> So you're arguing that every router on the internet needs a global IP address?

Every node on the IPv6 internet needs a global IPv6 address. 

Cheers,
Ole

---

From: Gert Doering <[email-masked]>
Date: Sat, 1 Jun 2013 13:59:51 +0200

Hi,

> So you're arguing that every router on the internet needs a global IP address?

I would second that argument.

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

---

From: Sander Steffann <[email-masked]>
Date: Sat, 1 Jun 2013 14:26:23 +0200

> Every node on the IPv6 internet needs a global IPv6 address. 

+1
Sander

---

From: Owen DeLong <[email-masked]>
Date: Sat, 1 Jun 2013 07:42:51 -0500

> So you're arguing that every router on the internet needs a global IP address?

Yes.

Owen

---

From: Arturo Servin <[email-masked]>
Date: Sat, 01 Jun 2013 11:24:30 -0300

And Jeroen are that if this happen you have a broken router (as you
mentioned) and a possible leakage of traffic due to not applying BCP38.

	Both are bad, I think we all agree on that.

.as

On 6/1/13 3:05 AM, Owen DeLong wrote:
> My point is that link local packets shouldn't even get far enough for BCP38 to matter. Every router is required to not forward then no matter what. If the packet gets far enough into the forwarding process for your BCP38 filters to matter, then you need a software update for the router. 
> 
> Owen

---

From: Ted Lemon <[email-masked]>
Date: Sat, 1 Jun 2013 16:16:47 +0000

>> Every node on the IPv6 internet needs a global IPv6 address. 

So I also +1 this, but if people are seeing traceroutes with ULAs in them, apparently _someone_ doesn't agree.

---

From: Alexandru Petrescu <[email-masked]>
Date: Sat, 01 Jun 2013 18:23:58 +0200

>>> Every node on the IPv6 internet needs a global IPv6 address.

I am divided on this.

The link local address is also mandatory.

Do we end up saying that every node in the IPv6 Internet needs at least 
two addresses?

Alex

>>
>> +1
>
> So I also +1 this, but if people are seeing traceroutes with ULAs in
> them, apparently _someone_ doesn't agree.
>
> _______________________________________________ v6ops mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/v6ops
>
>

---

From: Ted Lemon <[email-masked]>
Date: Sat, 1 Jun 2013 16:33:02 +0000

On Jun 1, 2013, at 12:23 PM, Alexandru Petrescu <[email-masked]> wrote:
> Do we end up saying that every node in the IPv6 Internet needs at least two addresses?

If all you have is a link-local address, then by definition you are not on the global internet.   The link-local vs. global address selection problem is easy, so I don't think you need to lose any sleep over this.

---

From: Jeroen Massar <[email-masked]>
Date: Sat, 01 Jun 2013 10:05:27 -0700

> them, apparently _someone_ doesn't agree.

Nothing to do with disagreement, everything to do with not understanding
(nicely put) where ULA should be used and how.

Next to not understanding the concepts of BCP38/84.

Note that it seems that in this specific case the vendor actually
informed them that they could/should use a ULA there as it would never
leak to the Internet anyway..... thus can't even completely blame the
person who configured it, though I don't understand why one still then
would try and select ULA there when you have enough global space.

Greets,
 Jeroen

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 02 Jun 2013 08:53:35 +1200

>> Do we end up saying that every node in the IPv6 Internet needs at least two addresses?

There is a case for s/node/interface/ in that statement.

    Brian

---

From: Owen DeLong <[email-masked]>
Date: Sun, 2 Jun 2013 00:04:50 -0500

> Do we end up saying that every node in the IPv6 Internet needs at least two addresses?

Yes

Owen

> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Sun, 2 Jun 2013 06:55:11 +0000

On May 29, 2013, at 11:41 PM, Lorenzo Colitti <[email-masked]> wrote:

> Of course, in the case of ULAs, there's not much that can be done about the design at this point, but we should make an effort to make it clear that the potential for misconfiguration exists and provide clear guidance on how not to misconfigure them.

And how to avoid leakage, by not including them in announcements and by refusing them in BGP acceptance policies...

---

From: Brian Haberman <[email-masked]>
Date: Mon, 03 Jun 2013 08:33:39 -0400

On 6/1/13 12:33 AM, Owen DeLong wrote:
>
> On May 31, 2013, at 9:31 PM, Jeroen Massar <[email-masked]> wrote:
>
>> On 2013-05-31 21:07, Brian E Carpenter wrote:
>> [..]
>>> Agreed. But when it does get through, it does no particular
>>> harm (you just see a bizarre hop in the traceroute). If it got
>>> through in a SYN/ACK exchange, it would probably distress a user.
>>
>> If such a packet gets through it means BCP38 is not applied as things
>> are not properly filtered.
>>
>
> This has nothing to do with BCP38.
>
> Any router which forwards a packet containing a link local address in the header is broken regardless of any BCP38 configuration.
>

The IPv6 Scoped Addressing Architecture covers this for less-than-global 
scoped addresses...

https://tools.ietf.org/html/rfc4007#section-9

Regards,
Brian

---

From: "Gunter Van de Velde (gvandeve)" <[email-masked]>
Date: Mon, 3 Jun 2013 12:43:24 +0000

Look for GV>

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Fred Baker (fred)
Sent: 02 June 2013 08:55
To: Lorenzo Colitti
Cc: [email-masked] WG; [email-masked]
Subject: Re: [v6ops] A good example of why we need to careful about ULAs

GV> is the recommendation on BGP filters which is done in draft-ietf-opsec-bgp-security in "section 5.1.1 Prefixes that MUST not be routed by definition" maybe a reference worthy? This section clearly specifies the fact that ULA should be filtered. 

G/

---

From: "Gunter Van de Velde (gvandeve)" <[email-masked]>
Date: Mon, 3 Jun 2013 12:46:53 +0000

Inline: GV>

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Gert Doering
Sent: 01 June 2013 14:00
To: Ted Lemon
Cc: [email-masked] WG; [email-masked]
Subject: Re: [v6ops] A good example of why we need to careful about ULAs

Hi,

GV> I think that the key is that they "SHOULD" have an IP address, not that they "MUST" or "NEED TO" have an IP address.
In some situatiations a networks works perfectly fine without a global IP address, however it may not be the best thing todo imho.

G/

---

From: Lorenzo Colitti <[email-masked]>
Date: Mon, 3 Jun 2013 21:52:01 +0900

On Mon, Jun 3, 2013 at 9:46 PM, Gunter Van de Velde (gvandeve) <
[email-masked]> wrote:

> GV> I think that the key is that they "SHOULD" have an IP address, not
> that they "MUST" or "NEED TO" have an IP address.
> In some situatiations a networks works perfectly fine without a global IP
> address, however it may not be the best thing todo imho.
>

A router which forwards packets to and from destinations on the global
internet MUST have a global IPv6 address, because otherwise it cannot
support mandatory parts of the IPv6 specifications like PMTUd and ICMP
errors.

---

From: "Gunter Van de Velde (gvandeve)" <[email-masked]>
Date: Mon, 3 Jun 2013 12:58:07 +0000

A router which forwards packets to and from destinations on the global internet MUST have a global IPv6 address, because otherwise it cannot support mandatory parts of the IPv6 specifications like PMTUd and ICMP errors.

GV> I was thinking about MPLS clouds? (those may have non-BGP speaking routers in there)... PMTUd and ICMP could be captured at the edge of those clouds with cludge solutions. I am sure there are other places also...

G/

---

From: Wuyts Carl <[email-masked]>
Date: Mon, 3 Jun 2013 14:56:59 +0200

+1 for GV's comment, i.e., in CPE-land, a PPP-based WAN interface is being used regularly without GUA, so "SHOULD" seems to be sufficient.
However, in this case, it'll use its GUA from his LAN interface to e.g. source packets, so it depends a little on what you mean that the box MUST have a GUA.

regs
Carl

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Gunter Van de Velde (gvandeve)
Sent: maandag 3 juni 2013 14:47
To: Gert Doering; Ted Lemon
Cc: [email-masked] WG; [email-masked]
Subject: Re: [v6ops] A good example of why we need to careful about ULAs

Inline: GV>

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Gert Doering
Sent: 01 June 2013 14:00
To: Ted Lemon
Cc: [email-masked] WG; [email-masked]
Subject: Re: [v6ops] A good example of why we need to careful about ULAs

Hi,

G/

_______________________________________________
v6ops mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/v6ops

---

From: Owen DeLong <[email-masked]>
Date: Mon, 3 Jun 2013 08:52:37 -0500

> In some situatiations a networks works perfectly fine without a global IP address, however it may not be the best thing todo imho.

Depends on how you define "works perfectly fine".

I would argue that a router which emits ULAs or Link Locals in ICMP time exceeded messages which are forwarded outside of the appropriate scope (LL) or administrative boundary(yes) (ULA) is not "working perfectly fine".

Thus, any router which may emit a time exceeded packet (any router on the internet) to an external destination will need the ability to do so with a GUA. In order to do that, said router does, in fact, need a GUA. IMHO, this is a must, not a should or a may.

Owen

---

From: Owen DeLong <[email-masked]>
Date: Mon, 3 Jun 2013 08:56:11 -0500

On Jun 3, 2013, at 7:58 AM, "Gunter Van de Velde (gvandeve)" <[email-masked]> wrote:

> On Mon, Jun 3, 2013 at 9:46 PM, Gunter Van de Velde (gvandeve) <[email-masked]> wrote:
> GV> I was thinking about MPLS clouds? (those may have non-BGP speaking routers in there)… PMTUd and ICMP could be captured at the edge of those clouds with cludge solutions. I am sure there are other places also…

Routers inside an MPLS cloud are not routers for purposes of the packets traversing them inside MPLS tunnels.

If the router has no interfaces which talk to the internet outside of MPLS tunnels, then, it is not technically a "router on the internet".

Owen

---

From: Gert Doering <[email-masked]>
Date: Mon, 3 Jun 2013 16:00:35 +0200

Hi,

> However, in this case, it'll use its GUA from his LAN interface to e.g. source packets, so it depends a little on what you mean that the box MUST have a GUA.

Nobody said "it must have a GUA on every single interface", so a box
that is using unnumbered WAN and uses the LAN GUA for the purpose of
sourcing packets is perfectly fine - and it has "*a* GUA address".

"SHOULD" is giving people ideas.  MUST is the right term.

Gert Doering
        -- NetMaster

---

From: Wuyts Carl <[email-masked]>
Date: Mon, 3 Jun 2013 16:01:45 +0200

OK, Ack

regs

Carl

-----Original Message-----
From: Gert Doering [mailto:[email-masked]] 
Sent: maandag 3 juni 2013 16:01
To: Wuyts Carl
Cc: Gunter Van de Velde (gvandeve); Gert Doering; Ted Lemon; [email-masked] WG; [email-masked]
Subject: Re: [v6ops] A good example of why we need to careful about ULAs

Hi,

> However, in this case, it'll use its GUA from his LAN interface to e.g. source packets, so it depends a little on what you mean that the box MUST have a GUA.

Nobody said "it must have a GUA on every single interface", so a box that is using unnumbered WAN and uses the LAN GUA for the purpose of sourcing packets is perfectly fine - and it has "*a* GUA address".

Gert Doering
        -- NetMaster