Re: [dhcwg] [v6ops] Combining IPv6 ND and DHCPv6 into a single, unified function

[Lorenzo Colitti <[e-mail]>]

On Wed, Nov 22, 2017 at 4:19 PM, Mark Smith <[e-mail]> wrote:

> Pushing layer 4+ configuration options into ND creates a dependency on
> router firmware for application deployment that doesn't exist today in
> either ND or DHCPV6.
>
> Another example of this trap. Remember that NTP amplification DoS from 3
> or 4 years ago? One place I'm aware of were using their PE routers to also
> provide customers with NTP time, and the router implementation was
> vulnerable. From memory, the vendor took around a week to release a fix.
> Then the next 6 to 8 weeks were spent organising high impact change
> controls because router firmware upgrades either required reboots or there
> was a hazard of one. The number of PE routers was in the 10s, imagine time
> and effort, and vulnerability exposure time if there were 100s or 1000s of
> PE routers providing NTP time to customers.
>
> Compare that to if the NTP service/application was not "in" the network,
> not "in" the routers' control planes, and as service reachable over the
> network. Only patches to the NTP servers would have been necessary, and
> there would have been far fewer of those.
>

These are all good reasons for ND being limited to only those options that
are strictly necessary for connectivity. There are those who argue that
even DHCPv6 is too low-level for that sort of thing and that
application-level configuration should be moved to another protocol.