Subject: RE: draft-ietf-ipv6-2461bis-05

From: "Vishwas Manral" <[email-masked]>
Date: Sun, 27 Nov 2005 19:45:54 -0800

Hi Stig,

You said "There is no difference between a tunnel link and any other
link media I think." 

That is the exact issue in my case for ND messages. If we just send a
packet tunneled, the TTL check for ND messages fails as we can send a
packet from multiple hops away by just adding another layer of
encapsulation.

That is the reason I suggested the text "The default behavior SHOULD be
to not allow ND packets over tunnels, unless explicitly so configured."

Thanks,
Vishwas
-----Original Message-----
From: Stig Venaas [mailto:[email-masked]] 
Sent: Monday, November 28, 2005 1:31 AM
To: Vishwas Manral
Cc: IPv6
Subject: Re: draft-ietf-ipv6-2461bis-05

On Thu, Nov 17, 2005 at 02:21:01AM -0800, Vishwas Manral wrote:
> Hi,
> 
>  
> 
> While going through the draft, I noticed there is no talk of tunneled
ND
> message in the entire draft.
> 
>  
> 
> The draft states: -
> 
>  
> 
>    By setting the Hop Limit to 255, Neighbor Discovery is immune to
>    off-link senders that accidentally or intentionally send ND
messages.
>  
> However if we send a basic ND message in IP-in-IP tunneled packet and
> send the packet across, we can easily send ND messages off-link. A
> solution I can think of is that by default we SHOULD NOT allow ND
> packets inside tunneled packets unless explicitly configured to do so.

> Am I missing the point?

I'm wondering if I'm missing the point, because to me it seems obvious.
If you have a tunnel, the tunnel is the link, and the packet would not
be forwarded off that link. And even if it was, the hop limit is
decremented, so it would be discarded since hop limit < 255. There is
no difference between a tunnel link and any other link media I think.

Stig

> Thanks,
> Vishwas

> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Ole Troan <[email-masked]>
Date: Mon, 28 Nov 2005 15:25:15 +0900

Vishwas,

> packet from multiple hops away by just adding another layer of

the ND hop limit check does not fail. the ND packet is not forwarded
outside of the link. the tunnel link that is.

> to not allow ND packets over tunnels, unless explicitly so configured."

I disagree with this proposal.

/ot

---

From: Pekka Savola <[email-masked]>
Date: Mon, 28 Nov 2005 23:23:54 +0200 (EET)

> outside of the link. the tunnel link that is.

I think what Vishwas is failing to see is that you can't just tunnel 
an arbitrary packet to an arbitrary host.  The packet will be 
discarded -- not decapsulated -- unless you can spoof it correctly to 
match an existing tunnel that has been set up at the target node.

Maybe Vishwas has those (IMHO broken) implementations in mind which 
accept any kind of IPv6-in-IPv4 or IPv6-in-IPv6 tunnel packet..

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings