Re: [dhcwg] WGLC for draft-ietf-dhc-addr-notification - Respond by September 13, 2023

[Alan DeKok <[e-mail]>]

On Sep 25, 2023, at 10:07 AM, Mark Smith <[e-mail]> wrote:
> DHCPv6 isn't a solution when you think about what the security requirements are.
> 
> The Stateful DHCPv6 Myth. No, it doesn't record IPv6 addresses in use. Neither does DHCPv4.
> https://ipv6tao.blogspot.com/2021/09/the-stateful-dhcpv6-myth-no-it-doesnt.html?m=1

  I don't buy the arguments in that blog post.  The claim is at best misleading.

  Two systems can always use out-of-band methods to communicate, and the upstream network won't know, because it's not involved.  It's not productive to imply that's a problem.  Because it means that the network is being asked to track information which is unaccessible to it.

  Think of a firewall vendor being asked to filter out packets which aren't sent to the firewall.  This isn't a failure of the firewall.  No amount of tweaking the firewall will fix the problem.  It is simply not appropriate to demand such behaviour from the firewall.

  As Ole points out, SAVI addresses the bulk of the concerns of the network.  Failure of the network to enforce correct IP usage is a policy failure.  That failure can be addressed by implementing the missing policies.

  Maybe my attitude here is different because I've been doing RADIUS for a while.  RADIUS is nothing but policies, so I see this issue not as a failure of DHCP, but as a failure of the network to enforce the correct policies.  And it's a failure to demand that the network enforce policies which are impossible to enforce.

  Alan DeKok.