Subject: [NDP] Router autoconfiguration with RS/RA

From: "Silviu VLASCEANU" <[email-masked]>
Date: Fri, 6 Jun 2008 14:28:51 +0200

Hello,

I have been trying to figure out a response for the following questions, but
I have only suppositions and I haven't found (yet) a document that
accurately talks about. So I am asking here.

Why wouldn't a router be authorized to send Router Sollicitation messages?
Moreover, why couldn't a router autoconfigure its egress interface based on
Router Advertisements received on this interface? The same question for
autoconfiguring the prefix it advertises on its subnets.

The only answer that comes in my mind is because an attack over these
messages could render not only a host unreachable, but maybe a whole subnet.
But apart this, is there really any other reason for not allowing this?

Thank you in advance for the answers.

Best regards,
-- 
Silviu
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Remi Denis-Courmont <[email-masked]>
Date: Fri, 6 Jun 2008 15:02:23 +0200

On Fri, 6 Jun 2008 14:28:51 +0200, "Silviu VLASCEANU"
<[email-masked]> wrote:
> Moreover, why couldn't a router autoconfigure its egress interface based
> on Router Advertisements received on this interface?

That would be useless. Lets ignore security issues. And lets even assume a
hierarchical network.

A router could learn what is "upstream" router is using RS/RA. But what's
the point? It would still not be able to route. Something needs to
configure the downstream prefixes from the downstream router to the
upstream router.
In other words, you need:
 - prefix delegation,
 - static configuration, or
 - a real routing protocol.

Once you have one of these, RS/RA is effectively useless.

> The same question for autoconfiguring the prefix it advertises on its
subnets.

You cannot do that statelessly. That's why.

-- 
Rémi Denis-Courmont
http://www.remlab.net

---

From: Remi Denis-Courmont <[email-masked]>
Date: Fri, 6 Jun 2008 15:02:36 +0200

subnets.

-- 
Rémi Denis-Courmont
http://www.remlab.net

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Fri, 6 Jun 2008 09:27:51 -0400

Silviu,
 
A router can receive an RA on the router's upstream and use this RA to
autoconfigure the ipv6 address on interface(s) of the router. Such a
router interface configuration is no different from how a host interface
statelessly autoconfigures as per ND RFC 4861 and 4862. However, ND
RFC's do not mandate what does a router implementation do for sending
RA, configuring network prefixes in the router downstream direction -
these are conceptual variables that a router vendor is left to do what
they want to do.
 
As to answering your question which was:
 
"Why wouldn't a router be authorized to send Router Sollicitation
messages?"
 
here is my reply.
 
As far as the interface on the router has no RA configured, and the
interface is configuring an IPv6 address using stateless
autoconfiguration or even manual configuration, this interface is OK to
send an RS in the router downstream. However, soon as any RA
configuration for router downstream is configured on the network
interface, then ND prohibits a router to send any RS. 
 
Furthermore, I totally agree with Remi on his reply to this question of
yours:
 
"The same question for autoconfiguring the prefix it advertises on its
subnets."
 
You cannot mix router upstream and downstream operations in random
fashion. IPv6 stateless autoconfiguration does not support prefix and
router configuration of an upstream router. One should be careful
discussing router downstream vs. router upstream directions for address
configuration, routing configuration, and IPv6 ND RA configuration.
 
Hemant

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Silviu VLASCEANU
Sent: Friday, June 06, 2008 8:29 AM
To: [email-masked]
Subject: [NDP] Router autoconfiguration with RS/RA

Hello,

I have been trying to figure out a response for the following questions,
but I have only suppositions and I haven't found (yet) a document that
accurately talks about. So I am asking here.

Why wouldn't a router be authorized to send Router Sollicitation
messages?
Moreover, why couldn't a router autoconfigure its egress interface based
on Router Advertisements received on this interface? The same question
for autoconfiguring the prefix it advertises on its subnets.

The only answer that comes in my mind is because an attack over these
messages could render not only a host unreachable, but maybe a whole
subnet. But apart this, is there really any other reason for not
allowing this?

Best regards,
-- 
Silviu

---

From: "Silviu VLASCEANU" <[email-masked]>
Date: Fri, 6 Jun 2008 17:01:13 +0200

I thank you both for the quick reaction. I generally agree. However, I have
some inline comments.

2008/6/6 Hemant Singh (shemant) <[email-masked]>:

> autoconfigure the ipv6 address on interface(s) of the router. Such a router
> interface configuration is no different from how a host interface
> statelessly autoconfigures as per ND RFC 4861 and 4862.
>

I agree and I also thought that this should be possible.

> However, ND RFC's do not mandate what does a router implementation do for
> sending RA, configuring network prefixes in the router downstream direction
> - these are conceptual variables that a router vendor is left to do what
> they want to do.
>

Noticed that too :)

> "Why wouldn't a router be authorized to send Router Sollicitation

My question was related to sending Router Sollicitations on the upstream
interface.

> interface is configuring an IPv6 address using stateless autoconfiguration
> or even manual configuration, this interface is OK to send an RS in the
> router downstream.
>

As I understand, a router could configure its "downstream" interfaces by RAs
received from other routers in the "downstream". Is it correct?
This way, the notion of up/downstream would loose its sense.

However, soon as any RA configuration for router downstream is configured on
> the network interface, then ND prohibits a router to send any RS.
>

But if the downstream interface would have already been configured as
discussed previously, where is the interest of having a prefix delegated for
this downstream interface to advertise?

> You cannot mix router upstream and downstream operations in random fashion.
> IPv6 stateless autoconfiguration does not support prefix and router
> configuration of an upstream router. One should be careful discussing router
> downstream vs. router upstream directions for address configuration, routing
> configuration, and IPv6 ND RA configuration.
>
>

Sorry for my English, probably not the best these days.
I try not to mess things up. The reason I wrote here is that I have seen a
solution (ICMPv6 Based Prefix
Delegation<http://www.join.uni-muenster.de/Dokumente/drafts/draft-rao-ipv6-prefix-delegation-01.txt>,
expired) for delegating prefixes with (modified) NDP. In one of the
reactions at this draft, it was mentioned that routers do not send RS
messages but it wasn't mentioned why wouldn't they.

I think that the approach is interesting. I don't know if you already have
an opinion on it.

> Hemant

Thanks.

--
Silviu

>
>  ------------------------------
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf Of
> *Silviu VLASCEANU
> *Sent:* Friday, June 06, 2008 8:29 AM
> *To:* [email-masked]
> *Subject:* [NDP] Router autoconfiguration with RS/RA
>
> Hello,
>

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 06 Jun 2008 23:16:57 +0200

Hemant Singh (shemant) wrote:
> Silviu,
> 
> A router can receive an RA on the router's upstream

Yes it can.  It uses it to report whether some things went wrong, log 
stuff, but don't act.

> and use this RA to autoconfigure the ipv6 address on interface(s) of
>  the router.

Usually no, it can not.  A particular case of a Mobile Router away from
home can auto-configure an address on its egress interface with
stateless autoconf.  But a non-mobile router (not implementing rfc3963)
can't and it shouldn't.

A router is something that forwards packets.  A linux router can't
auto-configure an address once one sets the forwarding=1.  A Cisco
router I have doubts, but it doesn't mean it follows rfc.

> Such a router interface configuration is no different from how a host
>  interface statelessly autoconfigures as per ND RFC 4861 and 4862. 
> However, ND RFC's do not mandate what does a router implementation do
>  for sending RA, configuring network prefixes in the router
> downstream direction - these are conceptual variables that a router
> vendor is left to do what they want to do.

Not sure what you mean left to vendors? there are some precisely defined
corner cases for configuring routers downstreams like DHCPv6-PD followed
eventually by Router Renumbering.

And, in most cases, assigning addresses to routers is part of a network
planning procedure performed by humans on paper, designed and
redesigned before being deployed; some call it architecting the
network.  That's a good reason for manually (or via SNMP, or other
proprietary tool) to configure addresses on routers, and not with
stateless autoconf.
> autoconfiguration or even manual configuration, this interface is OK
>  to send an RS in the router downstream. However, soon as any RA 
> Furthermore, I totally agree with Remi on his reply to this question
>  of yours:
> 
> "The same question for autoconfiguring the prefix it advertises on 
> its subnets."
> 
> discussing router downstream vs. router upstream directions for 
> address configuration, routing configuration, and IPv6 ND RA 
> configuration.

Well I wouldn't even talk upstream/downstream, just routers and maybe 
default-free routers are very special.

Alex

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 06 Jun 2008 23:20:00 +0200

Silviu VLASCEANU wrote:
> I thank you both for the quick reaction. I generally agree. However, I 
> have some inline comments.
> 
> 2008/6/6 Hemant Singh (shemant) <[email-masked] 
> <mailto:[email-masked]>>:
> 
>     Silviu,
>      
>     A router can receive an RA on the router's upstream and use this RA
>     to autoconfigure the ipv6 address on interface(s) of the router.
>     Such a router interface configuration is no different from how a
>     host interface statelessly autoconfigures as per ND RFC 4861 and 4862. 
> 
> 

What do you mean it _should_?  Do you want to write an implementation 
that should do it?  DO you want to modify the rfc?

>     However, ND RFC's do not mandate what does a router implementation
>     do for sending RA, configuring network prefixes in the router

Well I think RFCs tell very well how a router should send RAs, and they 
also say clearly a router shouldn't use the received RA to 
auto-configure a global address bases on the prefix in it.

Or has this changed recently?

> My question was related to sending Router Sollicitations on the upstream 

What does the RFC say?  Can a router send an RS?

>     to send an RS in the router downstream. 
> 
> 
> As I understand, a router could configure its "downstream" interfaces by 
> RAs received from other routers in the "downstream". Is it correct?

I don't think it's correct.

> This way, the notion of up/downstream would loose its sense.

I think RFCs don't use the terms up/downstream at all, no distinguishing 
between them usually.

Alex

---

From: "Ole Troan" <[email-masked]>
Date: Sat, 7 Jun 2008 00:47:48 +0200

> router I have doubts, but it doesn't mean it follows rfc.

a router can very well have an interface configured in host mode where
it uses normal host configuration mechanisms. it obviously can't
advertise any learnt information back out the same interface. I don't
see any reason why it couldn't also do forwarding on this interface.

router/host mode is a per interface property.

and has been said before the RS/RA mechanism for router
discovery/prefix discovery does not support prefix delegation. of
course you can invent a new protocol using RS/RA messages to do it,
but I haven't seen any convincing reason why we should. note that the
DHCP PD was triggered by a draft proposing using ICMP for PD. we
suggested using DHCP instead, since one eventually would have
reinvented lots of the DHCP machinery to make it work.

/ot

---

From: Alexandru Petrescu <[email-masked]>
Date: Sat, 07 Jun 2008 17:07:52 +0200

Ole Troan wrote:
>> Yes it can.  It uses it to report whether some things went wrong, 
>> log stuff, but don't act.
>> 
>>> and use this RA to autoconfigure the ipv6 address on interface(s)
>>>  of the router.
>> Usually no, it can not.  A particular case of a Mobile Router away 
>> from home can auto-configure an address on its egress interface 
>> with stateless autoconf.  But a non-mobile router (not implementing
>>  rfc3963) can't and it shouldn't.
>> 
> a router can very well have an interface configured in host mode 
> where it uses normal host configuration mechanisms. [...] I don't see
>  any reason why it couldn't also do forwarding on this interface.

Ok, but what does the RFC say?  Can a non-mobile router configure one of 
its interface in host mode, auto-configure an address from received RA 
on it, and still forward packets to/from that interface?

> router/host mode is a per interface property.

Well, I don't think a non-mobile router can have any one of its 
interfaces in 'host' mode - once at least one interface is in host mode 
it will no longer forward packets between any of its other interfaces.

> discovery/prefix discovery does not support prefix delegation.

Right...

> of course you can invent a new protocol using RS/RA messages to do 
> it, but I haven't seen any convincing reason why we should.

I agree.

> note that the DHCP PD was triggered by a draft proposing using ICMP
> for PD. we suggested using DHCP instead, since one eventually would
> have reinvented lots of the DHCP machinery to make it work.

A-ha.

Alex

---

From: Shin Miyakawa <[email-masked]>
Date: Sun, 08 Jun 2008 05:38:40 +0900 (JST)

Alexandru,

> Ok, but what does the RFC say?  

This is what we're talking recently in a draft / working group meetings.
I also think that we need to clarify that.

IMH, there are "host", "router" and "something in the middle" maybe :-)

> Can a non-mobile router configure one of 

I think so. 
Typical examples are CPE (Custmer Premises Equipment) router for ADSL / FTTH
and there are implementations.

> it will no longer forward packets between any of its other interfaces.

Again, there are many implementations, just like my good friend Ole Troan said.

And... for example, we can configure Microsoft Vista do this.

Shin Miyakawa
NTT Communications Corporation
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Sun, 8 Jun 2008 08:05:25 -0400

Alex,

See in line below between <hs> and </hs>.

-----Original Message-----
From: Alexandru Petrescu [mailto:[email-masked]] 
Sent: Friday, June 06, 2008 5:17 PM
To: Hemant Singh (shemant)
Cc: Silviu VLASCEANU; [email-masked]
Subject: Re: [NDP] Router autoconfiguration with RS/RA

<hs> I said in my first reply, I am talking about RFC4861 and 4862 -
core ND RFC's. The questions raised
     were discussing core ND RFC's, not any mobility or RFC3963.
Further, a router has to be configured for data
     forwarding/routing before the router forwards packets - it is this
router configuration that is the point 
     of discussion.
</hs>

> for sending RA, configuring network prefixes in the router downstream 
> direction - these are conceptual variables that a router vendor is 
> left to do what they want to do.

Not sure what you mean left to vendors? 

<hs>
I was referring to conceptual router variables from section 6.2.1 of
RFC4861. A router is supposed to provide
such variables as external configuration means, but how a router
implements the variables internally is left
to router vendors. 
</hs>

there are some precisely defined corner cases for configuring routers
downstreams like DHCPv6-PD followed eventually by Router Renumbering.

And, in most cases, assigning addresses to routers is part of a network
planning procedure performed by humans on paper, designed and redesigned
before being deployed; some call it architecting the network.  That's a
good reason for manually (or via SNMP, or other proprietary tool) to
configure addresses on routers, and not with stateless autoconf.

<hs>Ole also replied in this regard. An interface, in host mode, on a
router is legal to autoconfigure its IPv6 address 
    using stateless autoconfiguration. If the upstream RA advertised a
prefix and prefix length to the 
    interface, then interface is also legal to forward packets to that
prefix subnet. The reason is because a host 
    has to add the prefix to Prefix List if on-link L-bit was set in the
received RA. Traffic to host addresses
    that fall within the prefix for on-link is forwarded out by the
interface. Even traffic to an off-link address 
    is legal to send out this interface because the traffic is sent to a
default router. 
</hs>

<hs>The subject of this original discussion is configuration. 
The original discussion also asked a question as to why when a router
downstream sends RA's to hosts
to configure themselves, why couldn't such RA mechanisms be used for
router upstream direction to configure the
router or interface(s) on the router. That is why I raised (and Ole
commented on too) the router upstream vs.
downstream directions. Also, notice that ND RFC4861 and 4862 specify
details for router behavior for sending RA's
in router downstream and how hosts configure themselves on receiving
such RA's. RFC4861 is silent (and rightfully
so) about router behavior related to interactions between ipv6 address
configuration, routing configuration, and IPv6 ND 
RA configuration.
</hs>

Hemant

Alex