Subject: RE: I-D Action: draft-ietf-6man-rfc6434-bis-01.txt

From: "Templin, Fred L" <[email-masked]>
Date: Tue, 19 Sep 2017 17:23:48 +0000

I realize that this goes back to the previous node requirements docs (RFC6434
and RFC4294), but shouldn't this document cite RFC1122 and RFC1812?

Thanks - Fred

---

From: Tim Chown <[email-masked]>
Date: Wed, 20 Sep 2017 09:01:29 +0000

Hi,

> On 19 Sep 2017, at 18:23, Templin, Fred L <[email-masked]> wrote:
> 

RFC1122 could be added in the intro.

I’d suggest RFC1812 could be reviewed/cited in draft-ietf-v6ops-ipv6rtr-reqs-00, something for Russ to consider.

Tim

---

From: "Templin, Fred L" <[email-masked]>
Date: Wed, 20 Sep 2017 14:50:50 +0000

Hi Tim,

> -----Original Message-----
> From: Tim Chown [mailto:[email-masked]]
> Sent: Wednesday, September 20, 2017 2:01 AM
> To: Templin, Fred L <[email-masked]>
> Cc: [email-masked]; Russ White <[email-masked]>
> Subject: Re: I-D Action: draft-ietf-6man-rfc6434-bis-01.txt
> 
> Hi,
> 

OK, thanks. One of the reasons I ask is because I think our IPv6 node/router
requirements documents are missing something important that appeared
in these earlier standards - the model of a host that also acts as a router.

RFC1122 calls them "end systems", or "hosts with embedded gateway".
They host their own local applications and can also forward packets on
behalf of nodes connected to a downstream interface. The model has
significant implications for Internet of Things.

Do we want to import that language into our IPv6 requirements docs?

Thanks - Fred

---

From: Timothy Winters <[email-masked]>
Date: Wed, 20 Sep 2017 10:56:16 -0400

Hi Fred,

The first thing that came to mind reading your email is your are talking
about a CE Router (RFC 7084).   Acts as a Host on the WAN, but a Router on
the LAN interface.

I would not be in favor of trying to document that behavior in node
requirements.  I would prefer to keep it simple, or are you thinking of a
case that's not covered in RFC 7084?

Regards,
Tim

On Wed, Sep 20, 2017 at 10:50 AM, Templin, Fred L <[email-masked]
> wrote:

> > I’d suggest RFC1812 could be reviewed/cited in
> draft-ietf-v6ops-ipv6rtr-reqs-00, something for Russ to consider.
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

-- 

Now offering testing for SDN applications and controllers in our SDN switch
test bed. Learn more today http://bit.ly/SDN_IOLPR

---

From: "Templin, Fred L" <[email-masked]>
Date: Wed, 20 Sep 2017 15:29:28 +0000

Hi Tim,

The specific case I am considering is documented here:

https://datatracker.ietf.org/doc/draft-templin-v6ops-pdhost/

But in general the RFC1122 considerations for hosts that act as routers,
including what is meant by “weak end system” and “strong end system”,
should probably be discussed in the IPv6 docs.

Thanks - Fred

From: Timothy Winters [mailto:[email-masked]]
Sent: Wednesday, September 20, 2017 7:56 AM
To: Templin, Fred L <[email-masked]>
Cc: Tim Chown <[email-masked]>; Russ White <[email-masked]>; [email-masked]
Subject: Re: I-D Action: draft-ietf-6man-rfc6434-bis-01.txt

Hi Fred,

The first thing that came to mind reading your email is your are talking about a CE Router (RFC 7084).   Acts as a Host on the WAN, but a Router on the LAN interface.

I would not be in favor of trying to document that behavior in node requirements.  I would prefer to keep it simple, or are you thinking of a case that's not covered in RFC 7084?

Regards,
Tim

On Wed, Sep 20, 2017 at 10:50 AM, Templin, Fred L <[email-masked]<mailto:[email-masked]>> wrote:
Hi Tim,

> From: Tim Chown [mailto:[email-masked]<mailto:[email-masked]>]
> To: Templin, Fred L <[email-masked]<mailto:[email-masked]>>
> Cc: [email-masked]<mailto:[email-masked]>; Russ White <[email-masked]<mailto:[email-masked]>>
> > On 19 Sep 2017, at 18:23, Templin, Fred L <[email-masked]<mailto:[email-masked]>> wrote:
> >

Thanks - Fred

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]<mailto:[email-masked]>
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

--

Now offering testing for SDN applications and controllers in our SDN switch test bed. Learn more today http://bit.ly/SDN_IOLPR

---

From: Bob Hinden <[email-masked]>
Date: Wed, 20 Sep 2017 10:40:24 -0700

Fred,

> On Sep 20, 2017, at 8:29 AM, Templin, Fred L <[email-masked]> wrote:
> 
> Hi Tim,
> 

Seems to me that a “hosts that acts as routers” are routers.  It’s not some different class of device.  The definition from RFC8200 is:

   router       a node that forwards IPv6 packets not explicitly
                addressed to itself.  (See Note below.)

   host         any node that is not a router.  (See Note below.)

   ….

   Note: it is possible for a device with multiple interfaces to be
   configured to forward non-self-destined packets arriving from some
   set (fewer than all) of its interfaces and to discard non-self-
   destined packets arriving from its other interfaces.  Such a device
   must obey the protocol requirements for routers when receiving
   packets from, and interacting with neighbors over, the former
   (forwarding) interfaces.  It must obey the protocol requirements for
   hosts when receiving packets from, and interacting with neighbors
   over, the latter (non-forwarding) interfaces.

I don’t think changing these definitions in node requirements is appropriate.

Bob

> On Wed, Sep 20, 2017 at 10:50 AM, Templin, Fred L <[email-masked]> wrote:
> Hi Tim,
>

---

From: "Templin, Fred L" <[email-masked]>
Date: Wed, 20 Sep 2017 18:17:50 +0000

Hi Bob,

> From: Bob Hinden [mailto:[email-masked]]
> Sent: Wednesday, September 20, 2017 10:40 AM
> Cc: Bob Hinden <[email-masked]>; Timothy Winters <[email-masked]>; Russ White <[email-masked]>; IPv6 List
> <[email-masked]>

I hear you, and I am not suggesting any change in the host and router
definitions. However, an end system that acts as both a router and a
host has to do something slightly different than an ordinary router
would.

If the end system receives a packet with a destination that does
not match one of its own delegated prefixes, it needs to drop the
packet and send "Destination Unreachable - No route to destination"
instead of forwarding the packet to another node (e.g., to a default
router). This is necessary to avoid a reflection attack where the attacker
attempts to abuse the end system by making it do work to forward
packets it should not be handling.

Whether/not you agree that the term "end system" should be used
to describe these, I still see value in importing the weak/strong ES
discussion from RFC11222 because the same concepts apply to IPv6.

Thanks - Fred
[email-masked]

> > I would not be in favor of trying to document that behavior in node requirements.  I would prefer to keep it simple, or are you
> thinking of a case that's not covered in RFC 7084?
> >
> > Regards,
> > Tim
> >

---

From: "Manfredi, Albert E" <[email-masked]>
Date: Wed, 20 Sep 2017 18:42:03 +0000

-----Original Message-----
From: ipv6 [mailto:[email-masked]] On Behalf Of Templin, Fred L

> I hear you, and I am not suggesting any change in the host and
> router definitions. However, an end system that acts as both a
> router and a host has to do something slightly different than
> an ordinary router would.

This is the typical case for any "dual-homed host," in my experience. An end system connected redundantly, for reliability/survivability reasons. They are routers, but configured to not forward packets and not announce routes (e.g. using RIP or OSPF). Very common in some environments, and frequently problematic.

> Whether/not you agree that the term "end system" should be
> used to describe these, I still see value in importing the
> weak/strong ES discussion from RFC11222 because the same
> concepts apply to IPv6.

I think this issue also relates to what an IP address refers to. I'm under the impression that in IPv6, we insist this must be the address of an interface, rather than a host. In IPv4, it's more ambiguous, which is also problematic (IMO). If we insist that IPv6 addresses belong to interfaces, then the weak model would not apply to IPv6, no?

(This is also similar to MAC addresses, whether they should apply to a host or to an interface. A debate from a previous era.)

Bert

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 21 Sep 2017 08:29:10 +1200

On 21/09/2017 06:42, Manfredi, Albert E wrote:
>> weak/strong ES discussion from RFC1122 because the same
>> concepts apply to IPv6.

Not exactly. We discuss this a bit in RFC 8028, specifically
https://tools.ietf.org/html/rfc8028#section-1.1 , and there
are some subtle differences.

Personally I would prefer that we don't add dependencies on IPv4
documents. We might want to make all of those Historic in a few years.
 
> I think this issue also relates to what an IP address refers to. I'm under the impression that in IPv6, we insist this must be the address of an interface, rather than a host. In IPv4, it's more am…

Again, see RFC 8028.
 
> (This is also similar to MAC addresses, whether they should apply to a host or to an interface. A debate from a previous era.)

But it doesn't really matter for IPv6. As long as the MAC address is unique
on each link, everything works.

    Brian

---

From: "Manfredi, Albert E" <[email-masked]>
Date: Wed, 20 Sep 2017 20:49:16 +0000

-----Original Message-----
From: Brian E Carpenter [mailto:[email-masked]] 

>> I think this issue also relates to what an IP address refers to.
>> I'm under the impression that in IPv6, we insist this must be the
>> address of an interface, rather than a host. In IPv4, it's more
>> ambiguous, which is also problematic (IMO). If we insist that IPv6
>> addresses belong to interfaces, then the weak model would not apply
>> to IPv6, no?
>
> Again, see RFC 8028.

A somewhat different emphasis, because RFC 8028 talks about a host's individual interface with multiple prefixes, as opposed to a hosts two interfaces, each with only one prefix. Still, seems to me that RFC 8028 is advocating a strong model:

   In a multi-prefix network with multiple
   exits, the host's characterization of each default router SHOULD
   include the prefixes it has announced (extending Section 6.3.4 of
   [RFC4861]).  In other words, the PIO is reinterpreted to also imply
   that the advertising router would be a reasonable first hop for any
   packet using a source address in any advertised prefix, regardless of
   Default Router Preference.

This says that a host would transmit packets, with a given prefix, via a router that announces that prefix. The problems occur when a multi-homed host, using the weak model, lies about its source interface. It forms a packet with the "wrong" IP source address.

Bert

---

From: "Templin, Fred L" <[email-masked]>
Date: Wed, 20 Sep 2017 21:11:25 +0000

Hi Brian,

> Sent: Wednesday, September 20, 2017 1:29 PM
> To: Manfredi, Albert E <[email-masked]>; Templin, Fred L <[email-masked]>
> Cc: IPv6 List <[email-masked]>
> > This is the typical case for any "dual-homed host," in my experience. An end system connected redundantly, for
> reliability/survivability reasons. They are routers, but configured to not forward packets and not announce routes (e.g. using RIP or
> OSPF). Very common in some environments, and frequently problematic.
> >

I don't mind citing the strong/weak discussion in RFC8028, and I think

> documents. We might want to make all of those Historic in a few years.

I would still like to see node requirements cite RFC1122, if even as just
historical.

Thanks - Fred

> > I think this issue also relates to what an IP address refers to. I'm under the impression that in IPv6, we insist this must be the address
> of an interface, rather than a host. In IPv4, it's more ambiguous, which is also problematic (IMO). If we insist that IPv6 addresses
> belong to interfaces, then the weak model would not apply to IPv6, no?
> 
> Again, see RFC 8028.
> 
> >

---

From: Lorenzo Colitti <[email-masked]>
Date: Fri, 22 Sep 2017 22:40:31 +0900

> packets it should not be handling.

Wait, what? Where is this documented?

---

From: "Templin, Fred L" <[email-masked]>
Date: Fri, 22 Sep 2017 20:23:51 +0000

Hi Lorenzo,

No, my understanding is now lined up with Bob’s guidance as well as
with some off-list guidance I received. It is just an ordinary router, and
whether/not it would do anything special to block potential reflection
attacks is simply a matter of local policy configuration.

It is a security consideration yes, but it is still just an ordinary router.

Thanks - Fred

From: Lorenzo Colitti [mailto:[email-masked]]
Sent: Friday, September 22, 2017 6:41 AM
To: Templin, Fred L <[email-masked]>
Cc: Bob Hinden <[email-masked]>; Russ White <[email-masked]>; IPv6 List <[email-masked]>
Subject: Re: I-D Action: draft-ietf-6man-rfc6434-bis-01.txt

On Thu, Sep 21, 2017 at 3:17 AM, Templin, Fred L <[email-masked]<mailto:[email-masked]>> wrote:
I hear you, and I am not suggesting any change in the host and router
definitions. However, an end system that acts as both a router and a
host has to do something slightly different than an ordinary router
would.