Subject: [manet] DLEP-15: Link-Local Addressing ONLY ??

From: RJ Atkinson <[email-masked]>
Date: Tue, 14 Jul 2015 09:53:58 -0400

All,

It seems to me that the discussion on the “Security Considerations”
thread has (inadvertently) raised the question of whether the
WG-as-a-whole would like to constrain DLEP implementations 
to only use non-routable link-local IP address types.

This probably merits further discussion, so I’m creating a
separate email thread for this topic.

BACKGROUND:

For IPv6, support for link-local addressing was built-in and
seems to be universally supported.  So I don’t think that 
limiting IPv6 DLEP sessions to non-routable link-local
IPv6 addresses would be problematic operationally or from
a coding perspective.

For IPv4, support for link-local addressing (169.254/16) appears 
to first have been added in RFC-3927 (May 2005), which is 25 years
after RFC-791 (Sept 1981) specified IPv4.  It is not obvious
to me that both router and host support for IPv4 link-local
addressing is really universal today (10 years after RFC-3927).
Data in actual support for IPv4 link-local unicast addressing
in specific systems (e.g. Linux, MS-Windows, MacOS X, Solaris,
QNX, VxWorks, and so forth) would be very welcome.

For IPv4, the 224.0.0.0/24 multicast block is designated as 
the “Local Network Control Block”.  For IPv6, there is a
designated “IPv6 Link-Local Scope Multicast Address Block”.
Those 2 blocks probably ought to be used for DLEP multicast.

** I’m very interested to hear what other folks think about
this question.  Please follow-up on-list. **

Yours,

Ran

---

From: Henning Rogge <[email-masked]>
Date: Tue, 14 Jul 2015 15:58:20 +0200

Hi,

I would be okay with this... I only would suggest we add a
"identifier" in front of our TCP streams, similar to the "DLEP" 4
octet ID we send in front of the UDP packets.

This would allow us to define a "DLEP over (D)TLS with routed
addresses" later by using a different ID (similar to the "STARTTLS"
mechanism of other protocols).

A "not (D)TLS aware" implementation would filter away such
connections, both because of the different ID or because of routable
IP addresses.

Later we could do better when we are sure we understand all the
implications of encrypted/authenticated DLEP.

Henning Rogge

On Tue, Jul 14, 2015 at 3:53 PM, RJ Atkinson <[email-masked]> wrote:
> _______________________________________________
> manet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/manet