Re: rfc4941bis: temporary addresses as "outgoing-only"?

[Fernando Gont <[e-mail]>]

On 10/2/20 23:10, Mark Smith wrote:
> 
> 
> On Tue, 11 Feb 2020, 09:17 Brian E Carpenter, 
> <[e-mail] <mailto:[e-mail]>> wrote:
> 
>     On 11-Feb-20 09:46, Mark Smith wrote:
>      >
>      >
>      > On Tue, 11 Feb 2020, 03:13 Fernando Gont, <[e-mail]
>     <mailto:[e-mail]> <mailto:[e-mail]
>     <mailto:[e-mail]>>> wrote:
>      >
>      >     Folks,
>      >
>      >     Since we are at it, I wonder if rfc4941bis should say
>     anything about the
>      >     use of temporary addresses for incoming connections. (see
>      >
>     https://tools.ietf.org/html/draft-gont-6man-address-usage-recommendations-04#section-4.3).
>      >     (e.g., "an implementation MAY....")
>      >
>      >     Particularly for connection-oriented protocols, hosts that
>     prevent
>      >     incoming connections on temporary addresses reduce exposure
>     even when
>      >     their temporary addresses become "exposed" by outgoing sessions.
>      >
>      >     i.e., if the model is that temporary addresses are employed
>     for outgoing
>      >     connections, unless a host uses temporary-only, there's no
>     reason to
>      >     receive incoming connections on temporary addresses. (e.g.,
>     browsing the
>      >     web or sending email should not be an invitation for folks to
>     e.g.
>      >     port-scan you).
>      >
>      >
>      > This would prevent peer-to-peer connections between end-user
>     devices, as it means devices become clients only, and they therefore
>     cannot provide a temporary server/service.
> 
>     If a node has a stable address as well as a temporary address, that
>     isn't the case. 
> 
> 
> True, however one of the goals of this update is to allow temporary 
> address only nodes, removing the assumption that hosts with temporary 
> addresses will also always have a stable address.

In that case,  one would expect that in temp-only scenarios, this policy 
would not be enforced.

That said, I guess that based on your other comments, it would best, if 
anything, to leave this for future work.

In that sense, would it make sense for this to be called out in the 
"Future work" section?

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492