IETF Logo Mail Archive

Re: Disabling temporary addresses by default?

Ted Lemon <mellon@fugue.com> Tue, 28 January 2020 15:13 UTC

Return-Path: <mellon@fugue.com>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E83BF120124 for <ipv6@ietfa.amsl.com>; Tue, 28 Jan 2020 07:13:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PbvVwjgbppzw for <ipv6@ietfa.amsl.com>; Tue, 28 Jan 2020 07:13:41 -0800 (PST)
Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71841120122 for <ipv6@ietf.org>; Tue, 28 Jan 2020 07:13:41 -0800 (PST)
Received: by mail-qk1-x72c.google.com with SMTP id w25so7969806qki.3 for <ipv6@ietf.org>; Tue, 28 Jan 2020 07:13:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4OhSlGoQDsmJdIWb/RXRYYB4pVB/Z3CGZ0sqJPIMzUU=; b=lF+vs7dzt8YovLh4ymyiYgV67urllnt0UvIy1QVZKN0k1aniKUpNeE99o9h6FnxLE/ IeGzfST0pu7vbZ0ES84GZg4CC5mckPPjoPlu1n7btwLxm8pTE52Uklb/INIom/vHCodL EiNwvsMPfKy6tHSPD9LGLmTXgK/X38s5Yw2g+YqTD7cabR+HHojLG197Mk3ouQrTx/Ez p6Y8TADtJtH1PxA93uOW2tE+z5CukIe9Lsgu25tCYpwpOkJvlYhoxHkKaXWX8zJbrdm9 jt+uvXJqGOuAVUXVHolG8Xxj0FzETXqos6vDeLQqt8+/D1y6ETUGBDKEQ23OBiTBfqok h9Ug==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4OhSlGoQDsmJdIWb/RXRYYB4pVB/Z3CGZ0sqJPIMzUU=; b=Nz4B3ontnEMPPJbF/b8x46ezv2lmmrr2wWV0LhHTvHwv7Z3JKOs776wxVOHEVSTeoH D4f2Z4RUlHSs/ONqbZ3vXyy58u18zG5NrYu0FO29bBZ8gDChEQ/SeLN0aZ9PecLa0R4+ M46LnsrDshyE8n4t8zOGaGc8nMA+6FRZh0d5H21PosagwTJvHtW5WjbTi03p3TVVdAtb 8fIkcBRrcXbpTD5Pku7SDzWyQe/hZUcWhsO68XMvCpo97/RlpsUN5cpAhxZKL176/GAr ETO2IxtJrEFOk/1X+H8RbqB9bNaeQu1og5C3wMRDdo+7XVx6UJD5GvWtx1iyvPqI1YWz AuDQ==
X-Gm-Message-State: APjAAAUc3XPrfPzLkbDpGbREI+UUWZIAKLzk/jfiivveHiHXHBtYVa3S 27bM0XMU1ZfDYKyVu0CPPPxDbQu2L6o4TA==
X-Google-Smtp-Source: APXvYqwLNKtl2J3Udi1oRCilrS0gfOP9Iv6MPRlmf2JkHDAzHwAIaPIfWUMWIB1EwSv8nTxkMmgD1w==
X-Received: by 2002:a05:620a:6b6:: with SMTP id i22mr21921967qkh.301.1580224420408; Tue, 28 Jan 2020 07:13:40 -0800 (PST)
Received: from ?IPv6:2601:18b:300:36ee:28e6:2936:576c:ee40? ([2601:18b:300:36ee:28e6:2936:576c:ee40]) by smtp.gmail.com with ESMTPSA id m23sm13778235qtp.6.2020.01.28.07.13.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Jan 2020 07:13:39 -0800 (PST)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.13.2.1\))
Subject: Re: Disabling temporary addresses by default?
From: Ted Lemon <mellon@fugue.com>
In-Reply-To: <CAKD1Yr11_SSUkCBuQ3-h+eRg0LPZQdhe+h7f0YZy9TiyRWj6mw@mail.gmail.com>
Date: Tue, 28 Jan 2020 10:13:38 -0500
Cc: Ole Troan <otroan@employees.org>, 6man WG <ipv6@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <18823BB6-557F-4E05-A3D0-9E8495C49275@fugue.com>
References: <03C832CE-7282-4320-BF1B-4CB7167FE6BE@employees.org> <DE7B0688-230F-4A5C-8E24-9EAED9FD9FEB@puck.nether.net> <AFEBAD7D-DF24-4924-8B9A-60DF22BA1953@consulintel.es> <c42affce-fbd3-23ec-c9ff-4f05cdf38630@si6networks.com> <41173152-A8E8-4241-9DE7-376AA7AFB813@consulintel.es> <c4166907-b6c9-a4ef-fd59-cf539bbe0405@si6networks.com> <43D76C96-C16B-4BEB-B9B8-C68D53BCE63F@fugue.com> <fb5b8377-892d-2777-ef9b-4f9ddefa6c93@si6networks.com> <CAKD1Yr034_tu7ZoJ1FCfDYhNSN6igm-ZQyR4u3U+UDMr=huGOw@mail.gmail.com> <1af0b06d-f9d7-5ea1-27f3-b417eb9148fa@si6networks.com> <7606A049-318D-4526-917D-F2A801BF7050@cisco.com> <CAKD1Yr1d9kORFdoOJr22J_UDJ9hLPr6AQLyWuh7=bAQKa+aXGw@mail.gmail.com> <MN2PR11MB356588FC3E8A6410B725D159D80A0@MN2PR11MB3565.namprd11.prod.outlook.com> <CAKD1Yr35meRGh_POo_2jrHA_oazO1xUOG5G_rx43xNLFYHQsMQ@mail.gmail.com> <MN2PR11MB356526F01CAE1CADEF8E4472D80A0@MN2PR11MB3565.namprd11.prod.outlook.com> <CAKD1Yr0-rmyzz3y1d+pCpA0+tGuhSdjojaJovXUzVuyx6UdeLA@mail.gmail.com> <98179a48-8d86-4673-6c82-fc0022988862@foobar.org> <F84FEFAF-1F78-47D4-B3E0-981DCFD0CB58@employees.org> <CAKD1Yr11_SSUkCBuQ3-h+eRg0LPZQdhe+h7f0YZy9TiyRWj6mw@mail.gmail.com>
To: Lorenzo Colitti <lorenzo=40google.com@dmarc.ietf.org>
X-Mailer: Apple Mail (2.3608.80.13.2.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipv6/bSPVQDjnGUyU7tL4Wa4rxZTTCeU>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipv6/>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Jan 2020 15:13:44 -0000

I suspect this has been considered before, but I’m curious if it just died because NAT66==evil: why not have the obfuscation happen at the first hop?

The way this would work is that you’d just do SLAAC and get an address.   If you want to receive connections, they come to that address; nothing need be done.  According to local policy, outgoing connections could be mapped, so that at the first hop router, the source address is translated from the fixed source address to a temporary per-flow address.  Or they could be not mapped, depending on the host policy.  This would require added functionality on the router, and obviously doesn’t give the same privacy characteristics on the first hop link, but also doesn’t require multicast defense of every temporary address.

v2.23.0 | Report a Bug | By Email