- ipv6-wg - mailman.ripe.net

Re: [ipv6-wg] [Snac] [v6ops] "router cascade with DHCPv6-PD"
by Michael Richardson 21 Jan '23

21 Jan '23

Ole Trøan <otroan(a)employees.org> wrote: >>>> The lack of a standardized way to communicate DHCPv6-server PD to >>>> DHCPv6-relay, and the expectation that the relay would just *snoop* = >>>> on the >>>> DHCPv6-PD contents has bugged me for a long time. If we are going to >>>> recommend that they act as relays, then I'd like to fix that. >>> If DHCP is used for prefix assignment inside of a site, the relay does >>> not need to do route injection for the requesting router. The RR can >>> simply advertise the assigned prefix in routing. >> >> a) it's actually cross-site. > Elaborate please. We have three entities. 1) the STUB router or other downstream "home" router. 2) the CPE router which is at the "north" side of the home LAN, and on the south side of the WAN/DSL/CMTS link. 3) The ISP DHCP server which is somewhere inside the ISP, with a DHCP relay at the BMS or Cable Head end to send to it. If (2) treats a DHCP-PD request from (1) as a relay, then it would relay to (3), which would allocate a new prefix. That message would back through (3) [where it gets snooped on, and maybe, yes, injected into the ISP routing system]. Then it would relayed to (2), which would then relay it to (1). (2) has to do something to route the prefix to (1), which today, means snooping on the results. But, even if the (2) is operated by the ISP, it's not part of the ISPs site. The south side of (2) belongs to the home owner. The prefix needs to be routed from (2) to (1). There is no routing protocol in the home at this time(alas!), so there is nothing to "inject" it into. -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

1 0

Re: [ipv6-wg] [Snac] [v6ops] "router cascade with DHCPv6-PD"
by Michael Richardson 17 Jan '23

17 Jan '23

Ole Trøan <otroan(a)employees.org> wrote: >> The lack of a standardized way to communicate DHCPv6-server PD to >> DHCPv6-relay, and the expectation that the relay would just *snoop* on the >> DHCPv6-PD contents has bugged me for a long time. If we are going to >> recommend that they act as relays, then I'd like to fix that. > If DHCP is used for prefix assignment inside of a site, the relay does > not need to do route injection for the requesting router. The RR can > simply advertise the assigned prefix in routing. a) it's actually cross-site. > Ah, you don’t want to run a routing protocol? Well, there’s your problem. b) If you can find a way to deploy OSPFv3 (or BABEL) in every home network, then I'm game. -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

1 0

Re: [ipv6-wg] [Snac] [v6ops] "router cascade with DHCPv6-PD"
by Michael Richardson 17 Jan '23

17 Jan '23

(Hi Martin, I'm just the messenger, your questions are all pretty good. For others, I think it was not obvious that they are about draft-winters-v6ops-cpe-lan-pd-00. But, more than my brain can handle right now) Ted Lemon <mellon(a)fugue.com> wrote: >> Why not honor the IA_PD size requested by the requesting router? Do you >> expect that possible another cascade router would be switched to DHCPv6 >> relay mode? > What’s the use case for this behavior? And yes, we expect routers to act as > DHCPv6 relays. I think that actually we've created an ambiguity about whether they are DHCPv6 relays or if they are full DHCPv6 servers. There are arguments both ways, and in some cases the choice is transparent to the end system, but in other ways it is not. The lack of a standardized way to communicate DHCPv6-server PD to DHCPv6-relay, and the expectation that the relay would just *snoop* on the DHCPv6-PD contents has bugged me for a long time. If we are going to recommend that they act as relays, then I'd like to fix that. Either way, Tim's v6ops draft-winters-v6ops-cpe-lan-pd-00 should clarify. LPD-1 suggests the IPv6 CE Router is a server, not a relay. -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

2 1

"router cascade with DHCPv6-PD"
by Michael Richardson 15 Jan '23

15 Jan '23

(I guess the article is in German, but google translate did a good job on it) This relates to the desire to amend RFC7084 to support "southbound" DHCPv6-PD: https://datatracker.ietf.org/doc/draft-winters-v6ops-cpe-lan-pd/ >https://www.heise.de/select/ct/2023/2/2230709000622055021 > >Alexander Traud tested 29 CPEs and tried to understand how they react to prefix changes. Router cascade with DHCPv6-PD With routers connected in a cascade, the internal network can be divided into several zones. This is useful, for example, in shared apartments that want to share an Internet connection, but each resident should still have their own (W)LAN. To do this, the front router, which is directly connected to the Internet, must pass on part of the prefix it received from the provider (DHCPv6-PD, prefix delegation) and its DHCPv6 server must ideally be able to use DHCPv6 reconfigure. Only AVM and Wavlink offered both in the test field. -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

2 2

IPv6 martian filter-set
by Nia Provia 12 Jan '23

12 Jan '23

Hi all, we want to update our BGP filtering with ipv6 martians prefixes. Querying RIPE database I am seeing two different filter-set regarding martians v6 : fltr-martian6 --> last-modified : 2015-07-28T13:39:28 fltr-martian-v6 ---> last-modified: 2020-09-10T23:40:02 Is there any recommendation/suggestion whether I should use any of these filters ? and if yes , which one ? Regards Nia

3 2

Advice for IPv6 only network /Network elements
by Agshin N 02 Jan '23

02 Jan '23

Hello, To Whom it may concern, We are small group which planning to build IPv6-only network as ISP. Legal activity started. We did some internet research and network logic topology. Nevertheless are looking best practice IPv6-only network as deployment and therefore need advice who already did it. We may send drawing topology if needed for advising. May we ask someone who is good for IPv6-only Central (data center) part implementation as router (BGP, PLAT), NAT64/DNS64, DHCPv6 sever and Translation part as well as suggestions ? Access fully are going to be FTTH and as start 3K Houses planned Namely which hardware and Software needs for it ? With Happy New 2023 Year! -- Respectfully Agshin N Skype:nagshin UTC/GMT +4 hours - Classified as Confidential -

1 0

Windows 11 now implements RFC 7217 (stable privacy addresses)!
by Fernando Gont 13 Dec '22

13 Dec '22

Folks, After over 10 (yes, *ten*) years, we have finally addressed security/privacy issues in the generation of IPv6 stable addresses in most popular operating systems. The traditional scheme/algorithm to generate stable IPv6 addresses with SLAAC required that the underlying MAC address be employed to generate the Interface Identifier. That is, the underlying MAC address would be embedded in the lower bits of an IPv6 address. This scheme allowed for host-tracking (since MAC addresses are usually globally-unique), address scanning (since addresses will follow specific patterns) and a number of other issues. In 2011, I submitted an IETF Internet-Draft proposing a scheme for generating stable addresses with SLAAC, meant to replace the traditional scheme. The scheme could be summarized and simplified as: Interface_ID = Hash(Prefix, Secret). Thus, interface identifiers would be stable within the same subnet, but vary across subnets. [Replacing the traditional scheme with this new scheme was anything but easy -- if you're curious, please check the "IPv6 Addressing" section in <https://www.si6networks.com/2020/08/06/a-brief-history-of-recent-advances-i…> ] Over time, popular operating systems and packages adopted the proposed algorithm: the Linux kernel, NetworkManager, OpenBSD's slaacd, MacOS, etc. Eventually, virtually every popular OS had adopted the scheme.... except Windows. Based on a recent note by Brian Carpenter, I ended up testing Windows 11, and I can confirm that it does implement RFC 7217 / RFC 8064! Therefore, e.g. if multiple prefixes are employed on a subnet, the stable addresses for each of such prefixes will employ a different Interface Identifier, thus avoiding the security/privacy issues discussed above -- this is really good news! Unfortunately, Windows still generates temporary addresses with the algorithm specified in RFC 4941, thus resulting in all temporary addresses for a given interface employing the same Interface Identifier (!). This problem has been addressed in RFC 8981... but it's implementation is not yet widespread, yet (it has been incorporated in e.g. the Linux kernel, though). I just hope it doesn't take Windows and others yet another 10+ years to implement RFC 8981, to finally address the remaining security/privacy issues in IPv6 address generation! [Original article with screenshots: https://www.linkedin.com/posts/fernandogont_after-over-10-yes-ten-years-we-… ] Thanks! Regards, -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494

2 1

Minutes from RIPE 85 IPv6 WG
by Raymond Jetten 17 Nov '22

17 Nov '22

Dear list members, here are the draft minutes from RIPE 85 IPv6 wg. Please share your comments or remarks to the list so they can be adjusted. The minutes will otherwise be published in two weeks IPv6 Working Group Minutes - RIPE 85 Wednesday, 26 Oct 2022, 12:00-13:00 (UTC+2) WG co-Chairs: Benedikt Stockebrand, Raymond Jetten Scribe: Oleg Muravskiy Status: Draft Welcome, Etiquette, Approving Minutes, Co-Chair Selection IPv6 Working Group Co-Chairs Raymond reminded participants about the Code of Conduct. The RIPE 84 minutes were approved. Benedict announced that Raymond's term as co-chair had ended, but that he was happy to continue in that role. There were no further nominations or objections, so Raymond was re-appointed as co-chair. Path Tracing Pablo Camarillo, Cisco Systems This presentation is available at: https://ripe85.ripe.net/wp-content/uploads/presentations/76-20221026-RIPE85… Pablo described the recent implementation of an addition to the IPv6 packet header extension that records the path of packets in ECMP networks and presented the use cases that were enabled by this feature. Leandro Bertholdo, University of Twente, asked how this addition was different from the IPv4 registration option. Pablo replied that the main difference in this approach was that they recorded the information at the line speed of the basic packet forwarding pipeline, and used only 3 bytes for each node. Leandro asked the presenter if they recorded an ID of the router that the packet passed. Pablo replied that they recorded a sequence of interface ID. Leandro asked if it was for the input interface or the output. Pablo replied that they recorded an ID of the output interface at each one of the routers Alexander Azimov, Yandex, asked if this would work in the MPLS core. Pablo said that this was possible, but that for the moment it was only implemented for IPv6. Open Source NAT64 Implementations Nico Schottelius, ungleich This presentation is available at: https://ripe85.ripe.net/wp-content/uploads/presentations/74-ripe85-open-sou… Nico showed a comparison of different open source implementations of NAT64, and asked the audience to provide more feedback and point out implementations they missed. Jan Žorž, 6connect, asked Nico if they had tried a VPP implementation as it was very fast. Nico said that he hadn't but that it was nice to know about it. Urban Suhadolnik, University of Ljubljana, asked if the presenter knew of any CLAT implementation, possibly for Windows, as the user-space implementation of CLAT was missing. Nico said that he couldn't answer the question as he was not familiar with this the topic. Deploying IPv6-Mostly Access Networks Ondřej Caletka, RIPE NCC This presentation is available at: https://ripe85.ripe.net/wp-content/uploads/presentations/9-RIPE85-Deploying… Ondřej presented an "IPv6-mostly" network that was implemented at this RIPE Meeting, which combined IPv6 functionality only for devices that supported it, and traditional dual-stack for other devices, all in the same network. Leonard Wagner, IN-Berlin e.V, asked since which Android PREF64, DHCP option 108 and CLAT were supported. Ondřej replied that version 11 and above were supported by the vendor, but that he was not sure about older versions. Michael Richardson, one of the authors of the IPv4-only option, noted that when he developed this feature he never imagined that people would deploy it on DHCP servers and not change anything. He added that it was interesting to see how it worked because they assumed that DHCP servers would not allocate addresses and therefore would not run out of addresses in the pool. So it was cool to see that it just worked without doing that. He further said that for any connect, if the client was v4-only, and was just creating a v4-only UDP encapsulated thing that the local end of course had no idea what to do with, it had to be encapsulated in a v6 packet to send it. He added that he thought CLAT would be of no help but that it might work on Mac OS but not on other systems. He mentioned that IOS would never work until it went to v6 and that the Cisco people should be embarrassed about this. Veronika McKillop, UK IPv6 Council, asked which DHCP servers supported RFC8925. Ondřej replied that this was option 108 and that Kea, at least, did not support it. He added that there were two options. If you have enough addresses for the IPv4 pool, any server that allowed setting a custom option could be used. If there was any special support for this feature, the server would simply respond with option 108 and not allocate an address from the pool. He stated that he was not aware of such an implementation, as even Kea cannot be used in this way. He added that if the pool was empty, it would not even respond and that this was an interesting feature to implement for DHCP server producers. Jordi Palet Martínez, The IPv6 Company, said that it was worth mentioning that most of the CLAT implementations just used a default NAT64 prefix (the WKP). He added that there was only a single translation when using the CLAT and that two translations were only needed if there were no DNS64 (https://datatracker.ietf.org/doc/rfc8683). He said that even if your network was using NAT, NAT64 would also work well. Radek Zajic via Meetecho shared that the CLAT on iOS 16 also worked in apps requiring unix/raw sockets too (e.g. Hurricane Electric Network Tools can ping IPv4-only targets via the CLAT). Ondřej thanked Radek for his comment. Round Up and Thanks IPv6 Working Group Co-Chairs Raymond thanked all participants and the RIPE NCC and closed the session. For Internal Use Only

1 0

SLAAC and Broadcast RA
by Xuo Guoto 02 Nov '22

02 Nov '22

Dear WG, Apologies if this mail is off topic here. I have a question about BCOP-690 wrt SLAAC BCOP-690 says: Using a /64 prefix from a dedicated pool of IPv6 prefixes is the most common scenario and currently the best practice. A separate block of IPv6 space is allocated for the WAN links to the end customer CPEs, so that when CPE connects to the network and performs router discovery, a /64 prefix is used to number both ends of the connection. My understanding of this recommendation is that in an ISP scenario, each RG will be assigned a seperate /64 prefix for CPE WAN. The ISP BRAS or BNG is also expected to send periodic multicast RA. My question is how a multicast RA can be sent to a VLAN, in which each RG is expected to have a different /64 prefix? R-43 of TR-177 says: The BNG MUST be configurable to send multicast RA messages that do not contain a Prefix Information Option (PIO), in order to advertise the default router address. R-44 says: The BNG SHOULD support sending periodic and solicited multicast RA messages having the unicast MAC address of the RG or of the hosts behind a bridged RG (see RFC 6085 [26]). Reading these two together, is it correct to say that BNG should be sending out periodic multicast RA without PIO, but RA with PIO should be sent only as a reply to an RS message from RG, with multicast IPv6 destination address but with unicast link-layer address of RG. Thanks and Regards, X.

1 0

IPv6 for Dutch email servers
by Michael Richardson 28 Oct '22

28 Oct '22

A few years ago there was a presentation about getting IPv6 MX setup for various Dutch entities: Municipalities, Hospitals, etc. I couldn't find this in the agendas for the past ten RIPE meetings for IPv6. Maybe it was in a plenary. I think it was pre-pandemic. I wondered (I am suggesting) that maybe an update on this effort would be timely? -- Michael Richardson <mcr+IETF(a)sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =-

5 6