Subject: SRC address for packets over Virtual Link

From: Mukesh Gupta <[email-masked]>
Date: Mon, 31 Mar 2003 17:59:39 -0600

Hi All,

This is related to draft draft-ietf-ospf-ospfv3-auth-00.txt. Abhay Roy brought this point up to me so I wanted to start a discussion on this in the mailing list.

The draft suggests to install the following rule for virtual links.
=====
interface      source       destination      protocol      action
   any         src/128       dst/128           OSPF         apply
=====

In order to secure the packets that are exchanged over virtual links, the end point IP addresses must be predictable.

Page 41 of OSPFv3 RFC (2740) says the following about finding the dst address
===
      When the router added to the area routing table in this
      step is the other end of a virtual link, the virtual neighbor's IP
      address is set as follows: The collection of intra-area-prefix-
      LSAs originated by the virtual neighbor is examined, with the
      virtual neighbor's IP address being set to the first prefix
      encountered having the "LA-bit" set.
===

But when it comes to finding the src addr, it simply says "one of the router's own site-local or global IPv6 addresses".

So with the currect specs, it is not possible to provide security to virtual links reliably.

The solution of the problem is to make the end point IP addresses predictable by mandating using "first prefix with LA-bit set in our own intra-area-prefix-LSAs", as src address. Basically use the address as src, what other endpoint will use as dst.

I am planning to put this as a mandatory item in draft-ietf-ospf-ospfv3-auth-00.txt.

Would appreciate comments from everyone.

regards
Mukesh