Re: [dhcwg] Adoption Call for draft-wkumari-dhc-addr-notification-07- Respond by April, 20 2023

[Jen Linkova <[e-mail]>]

On Sun, Apr 9, 2023 at 5:03 AM Michael Richardson <[e-mail]> wrote:
> Jen Linkova <[e-mail]> wrote:
>     >> It seems that this will be in conflict with
>     >> draft-collink-v6ops-ent64pd, should it be adopted.
>
>     > I'm not sure it's the case, actually.  Let's say my DHCP server knows
>     > that clients on the link A should be delegated the prefixes from
>     > 2001:db8:a::/48.  Then if it receives ADDR-REG-INFORM from link A for
>     > an address in 2001:db8:a::/48, it shall be considered "appropriate for
>     > the link".  Or am I missing smth?
>
> So 2001:db8:a::/64 is the "LAN" onlink.
> And host 2001:db8:a::1234 has done a DHCP-PD and been delegated 2001:db8:a:0001::/64.
> It now sends a registration for 2001:db8:a:0001::babe/128.
> Does it send that from 2001:db8:a:0001::babe or from 2001:db8:a::1234?

Strictly speaking, in the deployment model described in
draft-collink-v6ops-ent64pd, the host SHOULD NOT
have an address from  2001:db8:a::/64 at all.
Even if it does, for some reason, got both  2001:db8:a:0001::babe and
from 2001:db8:a::1234, it would send two
registration messages, one per address.

> I prefer that it sends it from ::babe.
> I prefer that we don't try to associate the delegated /64 with the address
> that asked for it... because... a) the requesting address might change due to
> reasons (privacy, etc.)   b) OSPF might move the prefix around a bit.

You'd need to associate the PD pool with *the network segment*, not
individual addresses. I'd need to delegate different prefixes to
devices in my Guest network and to corporate workstation, the same way
I assign on-link /64s now.
So the server obviously would need to know  if the registration
message can come from the given *segment* (not host), or not.
You can not tell if the given host on that segment can send it or not
(but that's why the message shall be sent from the address being
registered).

>     >> Does the packet need to originate from the IP address which is being
>     >> registered?
>
>     > This is to prevent spoofing: the host would need "own" the address, if
>     > the infrastructure supports SAVI.
>
> So, the answer is yes, it must originate from the IP address which is being registered?

Ah sorry, I read your question as "does it *really* need to do this?".
Section 6.1:
"The host MUST send the packet from the address being registered."

-- 
SY, Jen Linkova aka Furry