Subject: (ngtrans) Re: RFC 3056

From: Pekka Savola <[email-masked]>
Date: Fri, 1 Feb 2002 18:57:26 +0200 (EET)

Note: moved to ngtrans.

On Fri, 1 Feb 2002, Brian E Carpenter wrote:
> I'm not sure about Pekka's answer, because I'm not sure what the question is.
> 
> The outer IPv4 packet is just a normal packet from the 6to4 router, so its
> IPv4 source address is the IPv4 address of the sending interface on the
> 6to4 router. 

I disagree: I think it's quite essential that IPv4 address (for 6to4 
_router_, naturally) be set to the same as the embedded IPv6 address (for 
security checks, for example).

For example: assume 6to4 router has two interfaces: 1.2.3.4 and 5.6.7.8 
and only one prefix 2002:0102:0304::/48.  (In this case, to get 
redundancy, one should have two 6to4 pseudo-interfacs with two addresses.)

I think, from RFC3056 chapter 3 (second last sentence) it's required that
sending IPv4 address be set to 1.2.3.4 _even if_ interface 1.2.3.4 is down
and the packet would be sent through 5.6.7.8.
 
> The inner IPv6 packet has an IPv6 source address which is that
> of the originating IPv6 host. If the router is a normal 6to4 router, that
> will be an IPv6 address starting with 2002:v4addr where v4addr is the source
> IPv4 address of the 6to4 router. If the router is a 6to4 relay router,
> the IPv6 source address could be any valid unicast IPv6 address (except for 
> a few odd cases such as link local).
> 
> As Pekka says, this is an ngtrans topic.
> 
>    Brian
> 
> 
> Pekka Savola wrote:
> > 
> > On Fri, 1 Feb 2002 [email-masked] wrote:
> > > When reading RFC 3056 (6 to 4 strategy), I have 2 questions I could not
> > > get answered. Consider the router that originates the IPv4 tunnel. Which
> > > IP address should this router use as the source IP addres in its IPv4
> > > encapsulation header:
> > >
> > > * Should this address be the router id of this router?
> > > Or
> > 
> > If router-id is V4ADDR in 2002:V4ADDR.
> > 
> > > * Should the source IPv4 address be derived from the source IPv6 address
> > > Or
> > > ...?
> > 
> > Yes.
> > 
> > See RFC3056 Chapter 3:
> > 
> >    IPv6 packets are transmitted in IPv4 packets [RFC 791] with an IPv4
> >    protocol type of 41, the same as has been assigned [MECH] for IPv6
> >    packets that are tunneled inside of IPv4 frames.  The IPv4 header
> >    contains the Destination and Source IPv4 addresses.  One or both of
> >    these will be identical to the V4ADDR field of an IPv6 prefix formed
> >    as specified above (see section 5 for more details).  The IPv4 packet
> >    body contains the IPv6 header and payload.
> > 
> > (btw, this is ngtrans, rather than ipng, material)
> > 
> > --
> > Pekka Savola                 "Tell me of difficulties surmounted,
> > Netcore Oy                   not those you stumble over and fall"
> > Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords
> 

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: "Tony Hain" <[email-masked]>
Date: Fri, 1 Feb 2002 11:15:29 -0800

> and the packet would be sent through 5.6.7.8.

What is the point in sending a packet with the src set to an interface
that is down? If the other end tries to return a packet it will be
routed to the dead interface.

Tony

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 03 Feb 2002 12:15:58 +0100

> and the packet would be sent through 5.6.7.8.

Hadn't thought about that case, I must admit. Probably a sufficient condition
is to say 
  The outer IPv4 packet is just a normal packet from the 6to4 router, so its
  IPv4 source address is the IPv4 address of *a* sending interface on the
  6to4 router.

    Brian

---

From: Pekka Savola <[email-masked]>
Date: Sun, 3 Feb 2002 16:21:21 +0200 (EET)

>   IPv4 source address is the IPv4 address of *a* sending interface on the

My opinion is that the current specification is best: that way, you'll 
always get proper return routability, and receiving nodes never drop 
packets due to failing security checks.

That is, if you have multiple addresses, or rather: multiple interfaces, 
making the 6to4 router multi-homed, you should really use two 
pseudointerfaces or at least two 6to4 addresses too.