Subject: Re: (ngtrans) Re: RFC 3056

From: Pekka Savola <[email-masked]>
Date: Mon, 4 Feb 2002 11:55:49 +0200 (EET)

On Mon, 4 Feb 2002 [email-masked] wrote:
> I'm still confused about the outcome of the discussion: is it true that
> a 6to4 router MUST use the V4ADDR (from the IPv6 source
> 2002:V4ADDR:....) as the IPv4 source address (even if it uses another
> outgoing interface or even when the itf corresponding to V4ADDR itself
> is down)?

According to the specification, yes.

Whether this should be changed, and if so, how, is another discussion.

(being pedantic, it isn't a "MUST" but rather "will use ...")

> Pekka Savola wrote:
> > 
> > On Sun, 3 Feb 2002, Brian E Carpenter wrote:
> > > > The security rules should in fact be rewritten as follow:
> > > >
> > > > 1) If the IPv6 source address is in a 2002::/16 domain, the IPv4 source
> > > > address should be consistent with it.
> > 
> > I note that if source is 2002, destination will not be checked.
> > 
> > As my draft put it (decapsulation rules) [I added some explanation here]:
> > 
> >     if dst=2002                        1) or 2)
> >         dst MUST match dst_v4
> >             if src=2002                1)
> >                 src MUST match src_v4
> >             fi
> >     elif src=2002                      3)
> >         src MUST match src_v4
> >     else
> >         drop
> >     fi
> >     accept
> > 
> > 1) 6to4 router -> 6to4 router
> > 2) 6to4 relay -> 6to4 router
> > 3) 6to4 router -> 6to4 relay
> > 
> > --
> > Pekka Savola                 "Tell me of difficulties surmounted,
> > Netcore Oy                   not those you stumble over and fall"
> > Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords
> 
> 

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: [email-masked]
Date: Mon, 04 Feb 2002 10:53:40 +0100

dirk

-- 
Dirk Ooms                       mailto:[email-masked]
                                tel:+32 3 2404732
Network Strategy Group (NSG)    http://aww.alcatel.com/nsg
Alcatel                         http://www.alcatel.com

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 05 Feb 2002 11:48:50 +0100

I believe Pekka is correct (for 6to4 routers, not for 6to4 relay routers)
but indeed since it deliberately isn't a MUST in the RFC, it isn't a 
conformance requirement. It's written as it is ("will use") because it's
a simple statement of fact in normal operation. As far as I can see, if the 
interface owning V4ADDR is down, you could legitimately send a 6to4 packet 
from a different interface, using that interface's IPv4 address as the source, 
but of course any reply packet sent to V4ADDR will be blackholed anyway. 

   Brian

---

From: Pekka Savola <[email-masked]>
Date: Thu, 7 Feb 2002 17:06:39 +0200 (EET)

> but of course any reply packet sent to V4ADDR will be blackholed anyway. 

I think this is just a matter of preferred "exit path": when you have a 
failed configuration, do you want to:

 1) have your own local node report it somehow
 2) have packets be sent out and silently discarded

I prefer 1), but IMO there's no grounds to force this with a MUST _as
long_ it's understood that those packets with wrong IPv4 source address
will get dropped (and that will not be "fixed").

Agree?

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 08 Feb 2002 09:30:08 +0100

> will get dropped (and that will not be "fixed").

Yes

   Brian