Hi,
Hmm.
What do you think about of Section 9 in RFC3484 and Section 4.2 in RFC4443?
Is it better to check this affair at the mailing lists of ipv6 wg and mip6 wg?
Best regards
---
Kiyoaki KAWAGUCHI
"Nicolas Dichtel <nicolas.dichtel@6wind.com>" wrote:
> Hi,
>
> please, see my comments inline
>
> K.Kawaguchi wrote:
> > Hi,
> >
> > I think that we should consider that the packet which reached the
> > anycast address reached the unicast address relevant to the anycast
> > address. Therefore, Rule 1 should be applied in RFC3484.
> Rule 1 is:
> "Rule 1: Prefer same address.
> If SA = D, then prefer SA. Similarly, if SB = D, then prefer SB."
> In my understanding, rule 1 just says to use the destination address
> as source address, if the router owns the destination address.
> So rule 1 doesn't match.
>
> Regards,
> Nicolas
> >
> > Also, replying with the address which does not have relation in the
> > anycast address has exposed the information on a node carelessly.
> >
> >
> > RFC3484
> > ------------------------------------------------------------------------
> > 5. Source Address Selection
> >
> > (snip)
> >
> > Rule 1: Prefer same address.
> > If SA = D, then prefer SA. Similarly, if SB = D, then prefer SB.
> >
> >
> > 9. Security Considerations
> >
> > (snip)
> >
> > Note that most source address selection algorithms, including the one
> > specified in this document, expose a potential privacy concern. An
> > unfriendly node can infer correlations among a target node's
> > addresses by probing the target node with request packets that force
> > the target host to choose its source address for the reply packets.
> > (Perhaps because the request packets are sent to an anycast or
> > multicast address, or perhaps the upper-layer protocol chosen for the
> > attack does not specify a particular source address for its reply
> > packets.) By using different addresses for itself, the unfriendly
> > node can cause the target node to expose the target's own addresses.
> >
> > ------------------------------------------------------------------------
> >
> >
> > I think that the following is a description better than RFC3775 about
> > the source address selection to the anycast address.
> >
> >
> > RFC4443 (Internet Control Message Protocol (ICMPv6) for the Internet
> > Protocol Version 6 (IPv6) Specification)
> > ------------------------------------------------------------------------
> > 4.2. Echo Reply Message
> >
> > (snip)
> >
> > An Echo Reply SHOULD be sent in response to an Echo Request message
> > sent to an IPv6 multicast or anycast address. In this case, the
> > source address of the reply MUST be a unicast address belonging to
> > the interface on which the Echo Request message was received.
> >
> > ------------------------------------------------------------------------
> >
> >
> > RFC3775
> > ------------------------------------------------------------------------
> > 10.5.1. Receiving Router Advertisement Messages
> >
> > (snip)
> >
> > A home agent receiving a
> > Home Agent Address Discovery Request message that serves this subnet
> > SHOULD return an ICMP Home Agent Address Discovery Reply message to
> > the mobile node with the Source Address of the Reply packet set to
> > one of the global unicast addresses of the home agent.
> >
> > ------------------------------------------------------------------------
> >
> >
> > Best regards
> > ---
> > Kiyoaki KAWAGUCHI
> >
> >
> >
> > "Nicolas Dichtel <nicolas.dichtel@6wind.com>" wrote:
> >> Hi,
> >>
> >> sorry for my late reply. Please, see inlines.
> >>
> >> K.Kawaguchi wrote:
> >>> Hi,
> >>>
> >>> I think that processing of your HA is a little rough.
> >>>
> >>> Home Agent should choose a suitable address.
> >>> It is necessary to choose a suitable address as the reply
> >>> to the anycast address. It depends on RFC2526.
> >>>
> >>> "1. Introduction
> >>>
> >>> IP Version 6 (IPv6) defines a new type of address, known as an
> >>> "anycast" address, that allows a packet to be routed to one of a
> >>> number of different nodes all responding to the same address [2, 3].
> >>> The anycast address may be assigned to one or more network interfaces
> >>> (typically on different nodes), with the network delivering each
> >>> packet addressed to this address to the "nearest" interface based on
> >>> the notion of "distance" determined by the routing protocols in use."
> >> This paragraph talk about incomming packets, not outgoing.
> >>
> >>>
> >>> The address of the interface related with anycast address
> >>> should be used. The address of the interface which is not
> >>> related with anycast address should not be used.
> >>> That is, not one of the addresses of all of the HA, but one
> >>> of the interfaces related with anycast address of the HA is
> >>> used.
> >> RFC 3484 (Default Address Selection for Internet Protocol version 6
> >> (IPv6))) Section 4:
> >> "It is RECOMMENDED that the candidate source addresses be the set of
> >> unicast addresses assigned to the interface that will be used to send
> >> to the destination. (The "outgoing" interface.) On routers, the
> >> candidate set MAY include unicast addresses assigned to any interface
> >> that forwards packets, subject to the restrictions described below."
> >>
> >> In test 7_1_2 and 7_1_4, Link1 is used to send the DHAAD Reply. In
> >> section 5, rules for the source address selection are described and our
> >> DHAAD Reply matchs rule #5 (Prefer outgoing interface).
> >>
> >> So, I didn't understand why this source address is wrong.
> >>
> >> Best regards,
> >> Nicolas
> >>>
> >>> Best regards
> >>> ---
> >>> Kiyoaki KAWAGUCHI
> >>>
> >>>
> >>>
> >>> "Nicolas Dichtel <nicolas.dichtel@6wind.com>" wrote:
> >>>> Hmm, sorry I've inverted Link0 and Link1.
> >>>> So, my RUT sends a DHAAD reply with the source address
> >>>> sets to RUT(Link1, global).
> >>>> However, this seems to be compliant with RFC3775 Section 10.5:
> >>>>
> >>>> "A home agent receiving a
> >>>> Home Agent Address Discovery Request message that serves this subnet
> >>>> SHOULD return an ICMP Home Agent Address Discovery Reply message to
> >>>> the mobile node with the Source Address of the Reply packet set to
> >>>> one of the global unicast addresses of the home agent."
> >>>>
> >>>> Am I wrong ?
> >>>>
> >>>>
> >>>> Regards,
> >>>> Nicolas
> >>>>
> >>>> Le 10.10.2007 11:54, K.Kawaguchi a ecrit :
> >>>>> Hello,
> >>>>>
> >>>>> I am sorry. I did not find your pre-mail.
> >>>>>
> >>>>> The home agent should use the source address relevant to home prefix for
> >>>>> the home agents anycast address. Therefore, the address (Link0, global)
> >>>>> must be good. And the address (Link1, global) must be fail.
> >>>>>
> >>>>> Now I tested on the 4.0.4 and the newest 4.0.6, but the tester fault was
> >>>>> not found although checked. The HA replyed the HAAD reply with the source
> >>>>> address (Link0, global), and the testers judged PASS.
> >>>>>
> >>>>> If you can, please send your test results to me or mipv6_support@v6pc.jp.
> >>>>>
> >>>>> Best Regards.
> >>>>>
> >>>>>
> >>>>> Best regards
> >>>>> ---
> >>>>> Kiyoaki KAWAGUCHI
> >>>>>
> >>>>>
> >>>>>
> >>>>> "Nicolas Dichtel <nicolas.dichtel@6wind.com>" wrote:
> >>>>>> Hi,
> >>>>>>
> >>>>>> I didn't get any answer, so I resend an explanation.
> >>>>>> As described below, in test 7_1_2 and 7_1_4 TAHI expects
> >>>>>> to receive the DHAAD reply with source address sets to
> >>>>>> RUT(Link1, global).
> >>>>>> However, RFC3775 Section 10.5 says:
> >>>>>>
> >>>>>> "A home agent receiving a
> >>>>>> Home Agent Address Discovery Request message that serves this subnet
> >>>>>> SHOULD return an ICMP Home Agent Address Discovery Reply message to
> >>>>>> the mobile node with the Source Address of the Reply packet set to
> >>>>>> one of the global unicast addresses of the home agent."
> >>>>>>
> >>>>>> In addition, in section 6.9.1.2.1 and 6.9.1.2.2 of the specification
> >>>>>> (http://www.ipv6ready.org/pdf/mipv6_ha_testspec_phase2_r3_1_5.pdf), the
> >>>>>> expected source address of the DHAAD Reply is RUT(Link0, global).
> >>>>>>
> >>>>>> So, maybe these tests are too strict. Any comments ? Should I submit a patch ?
> >>>>>>
> >>>>>>
> >>>>>> Regards,
> >>>>>> Nicolas
> >>>>>>
> >>>>>> Le 16.03.2007 11:32, Nicolas DICHTEL a ñÄrit :
> >>>>>>> Hi,
> >>>>>>>
> >>>>>>> what's the status about this "problem" ?
> >>>>>>>
> >>>>>>> Nicolas
> >>>>>>>
> >>>>>>> Le 26.01.2007 16:18, Nicolas DICHTEL a ñÄrit :
> >>>>>>>> Hello,
> >>>>>>>>
> >>>>>>>> I've tested the new release of TAHI HA (ct-mip6-ha-4.0.4).
> >>>>>>>> In test 7_1_2, 7_1_4, my HA uses RUT(Link0, global) as source address to
> >>>>>>>> send DHAAD reply (as described in the HTML page), but
> >>>>>>>> TAHI expects to receive a DHAAD reply with source address
> >>>>>>>> set to RUT(Link1, global). So test is FAIL.
> >>>>>>>> Is it an error ? If not, why is it mandatory to use RUT(Link1, global)
> >>>>>>>> and
> >>>>>>>> not RUT(Link0, global) ?
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> Regards,
> >>>>>>>> Nicolas
> >>>>>>>
> >>>>
> >>
> >>
> >>
> >>
> >
> >
> > Best regards
> > ---
> > Kiyoaki KAWAGUCHI
> >
>
>
>
>
Best regards
---
Kiyoaki KAWAGUCHI