Network Working Group H. Singh
Internet-Draft W. Beebee
Intended status: Standards Track Cisco Systems, Inc.
Expires: March 4, 2008 September 2007
ND On-link and Off-link Determination
draft-wbeebee-on-link-and-off-link-determination-00
Status of this Memo
By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on March 4, 2008.
Copyright Notice
Copyright (C) The IETF Trust (2007).
Abstract
RFC 2461 [ND] describes host data forwarding and address resolution.
However, nine years after the ND protocol became an RFC, IPv6 hosts
still do not fully comply with RFC 2461 [ND]. In particular, hosts
incorrectly implement on- vs. off-link data forwarding. This
document clarifies host behavior and associated router behavior to
define explicitly on-link and off-link determination.
Singh & Beebee Expires March 4, 2008 [Page 1]
Internet-Draft ND On-link Determination September 2007
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Host Models . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1. RA Sets the M bit but does not Include the PIO . . . . . . 6
2.2. RA Advertises a Prefix with the On-link(L) Bit Set . . . . 6
2.2.1. When the Valid Lifetime Expires . . . . . . . . . . . 8
2.3. RA Advertises a Prefix with the On-link(L) Bit Clear . . . 8
3. Router Models . . . . . . . . . . . . . . . . . . . . . . . . 8
3.1. Aggregation Router Deployment Model . . . . . . . . . . . 9
4. Redirect Clarifications . . . . . . . . . . . . . . . . . . . 10
5. Security Considerations . . . . . . . . . . . . . . . . . . . 10
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 10
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
8.1. Normative References . . . . . . . . . . . . . . . . . . . 10
8.2. Informative References . . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 11
Intellectual Property and Copyright Statements . . . . . . . . . . 13
Singh & Beebee Expires March 4, 2008 [Page 2]
Internet-Draft ND On-link Determination September 2007
1. Introduction
IPv6 host data forwarding and address resolution is complex. For
example, RFC 2461 [ND] (section 3.1) implies that if the RA received
by the host does not advertise any prefix, then the host must send
all non-link-local data to the default router. This section of the
RFC also implies that no address resolution is to be performed in
this case. Sections 5.2 and 7.2.2 imply that the host performs
address resolution before transmitting a packet if the destination of
the packet is on the same link as the host. Some current host
implementations perform address resolution in all cases even when the
destination is not clearly on-link. However, RFC 2461 [ND] section
6.3.4 implies that hosts must clearly determine that a destination is
on-link before performing address resolution.
These implications in RFC 2461 [ND] need to be made explicit.
Failure of host implementations to comply can result in lack of IPv6
connectivity. One example, included in
draft-wbeebee-nd-implementation-problems-00
[I.D.nd-implementation-problems], follows: a host receives an RA with
no prefix advertised and incorrectly decides to perform address
resolution when the host should have sent all traffic to the default
router. The router does not respond to the address resolution and
the layer 2 driver of the host stops transmitting IPv6 packets.
Host address resolution has implications for router design and
deployment. First, host behavior is clarified in the Host Models
section. Second, a router deployment model is described in the
Router Models section. Third, Redirects are clarified for both
routers and hosts in the Redirect Clarifications section.
Where behavior has not changed between RFC 2461 [ND] and
draft-ietf-ipv6-2461bis-11 [NDbis] and behavior has not changed
between RFC 2462 [ADDRCONF] and draft-ietf-ipv6-rfc2462bis-08
[ADDRCONFbis], this document only refers to RFC 2461 [ND] and RFC
2462 [ADDRCONF] respectively. Where behavior has changed, this
document refers to both the original and the new version.
2. Host Models
A correctly implemented IPv6 host MUST adhere to the following rules:
1. On-link determination and addresses acquired using DHCPv6 SHOULD
NOT persist across IPv6 interface initializations. Note that
section 5.7 of draft-ietf-ipv6-rfc2462bis-08 [ADDRCONFbis]
describes the use of stable storage for addresses acquired with
stateless address autoconfiguration with a note that the
Singh & Beebee Expires March 4, 2008 [Page 3]
Internet-Draft ND On-link Determination September 2007
Preferred and Valid Lifetimes must be retained if this approach
is used.
2. The on-link definition in section 2.1 of
draft-ietf-ipv6-2461bis-11 [NDbis] describes the only means for
on-link determination. DHCPv6 or any other configuration on the
host MUST NOT be used for on-link determination. Manual
configuration of a host introduces its own set of security
considerations and is beyond the scope of this document. Note
that the on-link definition as specified by
draft-ietf-ipv6-2461bis-11 [NDbis] does not include manual
configuration.
3. The host MUST NOT add a directly connected route to the prefix
from an assigned address, independent of the information about
the prefix received from the sources described in section 2.1 of
draft-ietf-ipv6-2461bis-11 [NDbis].
4. In the absence of other sources of on-link information, including
Redirects, if the RA advertises a prefix with the on-link(L) bit
set and the Valid Lifetime expires, the host MUST then consider
the prefix to be off-link, as suggested by the Prefix Information
Option (PIO) paragraph of section 6.3.4 of
draft-ietf-ipv6-2461bis-11 [NDbis]. However, if the RA
advertises a prefix with the on-link bit set, the host MAY ignore
the on-link indication from the RA and treat the prefix as off-
link. Subsections which follow describe this behavior in further
detail.
5. Newer host implementations MUST issue NS(DAD)s for all of its
acquired unicast addresses except when the host interface has
DupAddrDetectTransmits variable set to zero. Section 5.4 of RFC
2462 [ADDRCONF] erroneously relaxes this requirement and suffers
from a manual configuration problem as illustrated by the
following example:
Host1 uses EUI-64 to configure a Link Local Address (LLA)
using MAC1 and manually configures a Global Unicast Address
(GUA) that is equal to an address configured using EUI-64 and
MAC2. Host1 completes an NS(DAD) for both its LLA and GUA in
compliance with RFC 2462 [ADDRCONF]. Then, Host2 uses EUI-64
to configure both a LLA and a GUA using MAC2. Host2 completes
an NS(DAD) for the LLA and does not send an NS(DAD) for its
GUA in compliance with RFC 2462 [ADDRCONF]. Now Host1 and
Host2 have the same GUA on the same link.
Therefore, this exception in section 5.4 of RFC 2462 [ADDRCONF]
SHOULD be ignored. Note that draft-ietf-ipv6-rfc2462bis-08
Singh & Beebee Expires March 4, 2008 [Page 4]
Internet-Draft ND On-link Determination September 2007
[ADDRCONFbis] refers to an extensibility concern with new
implementations and states in section 5.4:
"Whereas this document does not invalidate such
implementations, this kind of 'optimization' is NOT
RECOMMENDED, and new implementations MUST NOT do that
optimization."
6. The host SHOULD issue only a single NS(DAD) for each address.
The default value for DupAddrDetectTransmits variable is
specified as one in section 5.1 of RFC 2462 [ADDRCONF]. Note,
however, that link-specific documents can modify this default.
For instance, PPP specifies DupAddrDetectTransmits to be zero in
RFC 2472 [PPPv6].
7. Newer implementations, which are compliant with
draft-ietf-ipv6-rfc2461bis-11 [NDbis] MUST adhere to the
following rules. Older implementations, which are compliant with
RFC 2461 [ND] but not draft-ietf-ipv6-rfc2461bis-11 [NDbis] may
remain as is. If the Default Router List is empty and there is
no other source of on-link information about any address or
prefix:
1. The host MUST NOT assume that all destinations are on-link.
2. The host MUST NOT perform address resolution for non-link-
local addresses.
3. Since the host cannot assume the destination is on-link, and
off-link traffic cannot be sent to the default router (since
the Default Router List is empty), address resolution has
failed. As specified in the last paragraph of section 7.2.2
of draft-ietf-ipv6-rfc2461bis-11 [NDbis], when address
resolution fails, the host SHOULD send an ICMPv6 Destination
Unreachable message.
On-link information concerning particular addresses and prefixes
can make those specific addresses and prefixes on-link, but does
not change the default behavior mentioned above for addresses and
prefixes not specified. draft-ietf-v6ops-onlinkassumption-04
[I.D.ietf-v6ops-onlinkassumptions] provides justification for
these rules.
The type of RA received can further determine host behavior.
Singh & Beebee Expires March 4, 2008 [Page 5]
Internet-Draft ND On-link Determination September 2007
2.1. RA Sets the M bit but does not Include the PIO
Section 3.1 of RFC 2461 [ND] describes intended behavior when a host
receives an RA without an advertised prefix:
"Multiple prefixes can be associated with the same link. By
default, hosts learn all on-link prefixes from Router
Advertisements. However, routers may be configured to omit some
or all prefixes from Router Advertisements. In such cases hosts
assume that destinations are off-link and send traffic to routers.
A router can then issue redirects as appropriate."
An IPv6 router sends an RA with no prefix advertised and the M bit
set, does not send any Redirects, nor any NA or ND messages for non-
link local addresses. On receipt of the RA, the host uses DHCPv6 to
acquire an IPv6 address. After completing IPv6 address acquisition,
the host MUST obey RFC 2461 [ND], section 3.1. In this case, since
the RA is the only authority to a host for on-link determination and
this RA does not advertise any prefix, the host cannot determine that
a destination is on-link. Therefore, the host MUST adhere to the
following rules:
1. The host MUST NOT assume any default prefix length.
2. The host MUST send all non-link-local traffic to the default
router.
3. The host MUST NOT issue an NS to resolve a destination other than
a link-local address.
In the presence of Redirects, only the on-link behavior of the
destination addresses of the original packets for which the Redirects
were sent change from what is specified in the rules above. These
destination addresses are considered to be on-link and the host MAY
now send non-link-local traffic destined to the destination addresses
directly without sending it first to the default router. Since the
Redirect contains all the information necessary to resolve the
address of the destination host, the source host MUST NOT issue an NS
to resolve a destination other than a link-local address.
2.2. RA Advertises a Prefix with the On-link(L) Bit Set
Security consequences of RFC 2461 [ND] imply that hosts MAY send all
traffic to the default router without performing address resolution
first even when a PIO has been received advertising an on-link
prefix, regardless of whether the host performs DHCPv6 and/or
stateless autoconfiguration.
Singh & Beebee Expires March 4, 2008 [Page 6]
Internet-Draft ND On-link Determination September 2007
Section 4.6.2 of RFC 2461 [ND] defines the Valid Lifetime in the PIO
as:
"The length of time in seconds (relative to the time the packet is
sent) that the prefix is valid for the purpose of on-link
determination."
Section 11 of RFC 2461 [ND] mentions the following denial of service
attack:
"An example of denial of service attacks is that a node on the
link that can send packets with an arbitrary IP source address can
both advertise itself as a default router and also send 'forged'
Router Advertisement messages that immediately time out all other
default routers as well as all on-link prefixes."
The same security risk is also described in section 5.5.3 of RFC 2462
[ADDRCONF]. This section allows hosts to ignore the Valid Lifetime
stored in an RA in order to prevent denial of service attacks.
Section 6.3.4 of RFC 2461 [ND] mentions that hosts MAY send all
traffic to the default router without performing address resolution
first:
"Stateless address autoconfiguration RFC 2462 [ADDRCONF] may in
some circumstances increase the Valid Lifetime of a prefix or
ignore it completely in order to prevent a particular denial of
service attack. However, since the effect of the same denial of
service targeted at the on-link prefix list is not catastrophic
(hosts would send packets to a default router and receive a
Redirect rather than sending packets directly to a neighbor) the
Neighbor Discovery protocol does not impose such a check on the
prefix lifetime values."
Consider the following scenario with one rogue node and two other
hosts on the same link. The rogue sends a malicious RA with an on-
link prefix with a Valid Lifetime of zero. Host1 correctly
implements section 5.5.3 of RFC 2462 [ADDRCONF] and resets its
StoredLifetime (or RemainingLifetime in draft-ietf-ipv6-rfc2462bis-08
[ADDRCONFbis]) to two hours and avoids the denial of service attack.
Host1 tries to send traffic to Host2, but cannot trust its own two
hour StoredLifetime. For instance, a legitimate operator may have
tried to time out the prefix due to an impending renumbering. Host1
decides to send all of its traffic to the on-link authority, the
default router, even though the destination prefix is on-link.
IF the host decides to send all traffic (including on-link traffic)
to the default router, then the host MUST follow the following rule:
Singh & Beebee Expires March 4, 2008 [Page 7]
Internet-Draft ND On-link Determination September 2007
1. The host MUST NOT issue an NS to resolve a destination other than
a link-local address.
2.2.1. When the Valid Lifetime Expires
In the absence of other sources of on-link information, including
Redirects, regardless of whether the host performs DHCPv6 and/or
stateless autoconfiguration, the host MUST adhere to the following
rules for addresses contained within the advertised prefix with the
on-link bit set and an expired Valid Lifetime:
1. The host MUST NOT issue an NS to resolve a destination other than
a link-local address.
2. The host MUST send all non-link-local traffic to the default
router.
In the presence of Redirects, only the on-link behavior of the
destination addresses of the original packets for which the Redirects
were sent change from what is specified in the rules above. These
destination addresses are considered to be on-link and the host MAY
now send non-link-local traffic destined to the destination addresses
directly without sending it first to the default router. Since the
Redirect contains all the information necessary to resolve the
address of the destination host, the source host MUST NOT issue an NS
to resolve a destination other than a link-local address.
2.3. RA Advertises a Prefix with the On-link(L) Bit Clear
An on-link bit of clear indicates nothing regarding on-link
determination. In section 6.3.4 of draft-ietf-ipv6-rfc2461bis-11
[NDbis]":
"...a Prefix Information Option with on-link flag set to zero
conveys no information concerning on-link determination and MUST
NOT be interpreted to mean that addresses covered by the prefix
are off-link.... Prefixes with the on-link flag set to zero would
normally have the autonomous flag set and be used by [ADDRCONF]."
3. Router Models
The Redirect Clarifications section clarifies RFC 2461 [ND] host and
router behavior for an aggregation router deployment.
The Aggregation Router Deployment Model section presents a possible
aggregation router deployment model for IPv6 and discusses its
properties with respect to ND. Aggregation routers can service more
Singh & Beebee Expires March 4, 2008 [Page 8]
Internet-Draft ND On-link Determination September 2007
than 100,000 subscribers. Due to scaling considerations, any NS for
global address resolution from any host to any other host should not
reach the aggregation router.
3.1. Aggregation Router Deployment Model
A property of routed aggregation networks is that hosts cannot
directly communicate with each other even if they share the same
prefix. Physical connectivity between the aggregation router and the
modems prevents hosts behind modems to communicate directly with each
other. Hosts send their traffic to aggregation router. This design
is motivated by scaling and security considerations. If every host
could receive all traffic from every other host, then the
subscriber's privacy would be violated and the amount of bandwidth
available for each subscriber would be very small. That is why hosts
communicate between each other through the aggregation router, which
is also the IPv6 first-hop router.
For scaling reasons, any NS to resolve any address other than that of
the default router should not reach the aggregation router.
+-----+
| |
|Aggre+----(Rtr CPE)----Host1
Core----WAN----+gator|
| Rtr |
| +----(Br CPE)----(Cust Rtr)----Host2
+-----+
Figure 1.
In the figure above, the customer premises equipment (CPE) is managed
by the ISP and is deployed behind an aggregation router that is an
IPv6 first-hop router and also a DHCPv6 relay agent. IPv6 CPEs are
either IPv6 routers (Rtr CPE) or IPv6 bridges (Br CPE). If the
customer premises uses a bridge CPE, then a router (Cust Rtr) is
needed. All hosts reside behind a router CPE or a customer router.
No NS to resolve any address other that that of the default router
will reach the aggregation router from any device on the customer
side of the aggregator. CPEs do not communicate with each other in
this deployment model since a CPE does not run any applications that
need to communicate with other CPEs. Hosts do communicate with each
other, but every host is off-link to any other host on the
aggregation router.
Singh & Beebee Expires March 4, 2008 [Page 9]
Internet-Draft ND On-link Determination September 2007
4. Redirect Clarifications
Redirects are not sent by aggregation routers except when two hosts
behind the same bridge CPE, with no router between the host and the
aggregation router, communicate with each other. The aggregation
router sends a Redirect to a source host which communicates with a
destination host behind the same bridge CPE if the router can make a
determination that the two hosts lie behind the same bridge CPE.
Since the Redirect contains all the information necessary to resolve
the address of the destination host, the source host MUST NOT issue
an NS to resolve the destination contained within the Redirect.
5. Security Considerations
The Host Models section of this document describes valid host
behavior in response to a security threat where a rogue node can send
RAs with a Valid Lifetime of zero. Host Models also describes a
problem with section 5.4 of RFC 2462 [ADDRCONF] that can allow two
hosts with the same address to avoid DAD and come online on the same
link.
6. IANA Considerations
None.
7. Acknowledgements
Thanks (in alphabetical order) to Adeel Ahmed, Jari Arkko, Ralph
Droms, Alun Evans, Dave Forster, Prashanth Krishnamurthy, Suresh
Krishnan, Josh Littlefield, Madhu Sudan, Bernie Volz, and Vlad
Yasevich for their consistent input, ideas and review during the
production of this document.
8. References
8.1. Normative References
[ADDRCONF]
Thomson, S. and T. Narten, "IPv6 Address autoconfiguration
(IPv6)", RFC 2462, December 1998.
[ND] Narten, T., Nordmark, E., and W. Simpson, "Neighbor
Discovery for IP Version 6 (IPv6)", RFC 2461,
December 1998.
Singh & Beebee Expires March 4, 2008 [Page 10]
Internet-Draft ND On-link Determination September 2007
[PPPv6] Haskin, D. and E. Allen, "IP Version 6 over PPP",
RFC 2472, December 1998.
8.2. Informative References
[ADDRCONFbis]
Thomson, S., Narten, T., and T. Jinmei, "IPv6 Address
autoconfiguration (IPv6)",
draft-ietf-ipv6-rfc2462bis-08 (Work In Progress),
May 2005.
[I.D.ietf-v6ops-onlinkassumptions]
Roy, S., Durand, A., and J. Paugh, "IPv6 Neighbor
Discovery On-Link Assumption Considered Harmful (IPv6)",
draft-ietf-v6ops-onlinkassumption-04 (Work In Progress),
January 2007.
[I.D.nd-implementation-problems]
Singh, H. and W. Beebee, "Known ND Implementation Problems
(IPv6)", draft-wbeebee-nd-implementation-problems-00 (Work
In Progress), September 2007.
[NDbis] Narten, T., Nordmark, E., Simpson, W., and H. Soliman,
"Neighbor Discovery for IP Version 6 (IPv6)",
draft-ietf-ipv6-2461bis-11 (Work In Progress), March 2007.
[SEND] Nikander, Ed., P., Kempf, J., and E. Nordmark, "IPv6
Neighbor Discovery (ND) Trust Models and Threats",
RFC 3756, May 2004.
Authors' Addresses
Hemant Singh
Cisco Systems, Inc.
1414 Massachusetts Ave.
Boxborough, MA 01719
USA
Phone: +1 978 936 1622
Email: shemant@cisco.com
URI: http://www.cisco.com/
Singh & Beebee Expires March 4, 2008 [Page 11]
Internet-Draft ND On-link Determination September 2007
Wes Beebee
Cisco Systems, Inc.
1414 Massachusetts Ave.
Boxborough, MA 01719
USA
Phone: +1 978 936 2030
Email: wbeebee@cisco.com
URI: http://www.cisco.com/
Singh & Beebee Expires March 4, 2008 [Page 12]
Internet-Draft ND On-link Determination September 2007
Full Copyright Statement
Copyright (C) The IETF Trust (2007).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgment
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).
Singh & Beebee Expires March 4, 2008 [Page 13]