Subject: draft-ietf-ipv6-2461bis-05

From: "Vishwas Manral" <[email-masked]>
Date: Thu, 17 Nov 2005 02:21:01 -0800

Hi,

While going through the draft, I noticed there is no talk of tunneled ND
message in the entire draft.

The draft states: -

   By setting the Hop Limit to 255, Neighbor Discovery is immune to
   off-link senders that accidentally or intentionally send ND messages.
 
However if we send a basic ND message in IP-in-IP tunneled packet and
send the packet across, we can easily send ND messages off-link. A
solution I can think of is that by default we SHOULD NOT allow ND
packets inside tunneled packets unless explicitly configured to do so. 
 
Am I missing the point?
 
Thanks,
Vishwas
 
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Thu, 17 Nov 2005 12:40:18 +0200 (EET)

> packets inside tunneled packets unless explicitly configured to do so.

How would those tunnel packets be decapsulated?  They're part of a 
tunnel (be it a 6to4 tunnel, IPv6-in-IPv6 point-to-poin tunnel, etc.). 
If they're part of the tunnel, they must be processed (because you 
should be able to run neighbor discovery on top of such tunnels).  If 
the host has no matching tunnel, the packet needs to be discarded.

It's up to the tunneling mechanism to do appropriate verifications if 
necessary.  See RFC3964 section 4.1.1 and 4.2.1 for examples.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Stig Venaas <[email-masked]>
Date: Sun, 27 Nov 2005 21:01:25 +0100

> packets inside tunneled packets unless explicitly configured to do so. 

I'm wondering if I'm missing the point, because to me it seems obvious.
If you have a tunnel, the tunnel is the link, and the packet would not
be forwarded off that link. And even if it was, the hop limit is
decremented, so it would be discarded since hop limit < 255. There is
no difference between a tunnel link and any other link media I think.

Stig