Re: you have running code ... I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

[Bob Hinden <[e-mail]>]

Hi,

> On Nov 6, 2018, at 2:37 AM, Brian E Carpenter <[e-mail]> wrote:
> 
> On 2018-11-06 00:15, Nick Hilliard wrote:
>> Brian E Carpenter wrote on 05/11/2018 07:38:
>>> And yes, a host MAY ignore it (that's the complement to the SHOULD
>>> in the draft). We've never said anything else.
>> 
>> yes, but you have stated "On an IPv6-Only link, IPv4 might be used for
>> malicious purposes and pass unnoticed by IPv6-Only monitoring mechanisms".
>> 
>> If you want ipv6only-flag to be advisory, then you need to remove this
>> bullet-point from the document because the presence or absence of an RA
>> with ipv6only-flag set will not have any effect on malicious use of ipv4
>> on an otherwise "ipv6-only" network.
> 
> Yes, you're correct. There is a slight mitigation effect - hosts that *do*
> use the flag to shut down IPv4 operations will not see any malicious IPv4
> traffic.

To clarify, the draft says that hosts SHOULD do what the flag specifies.  It doesn’t say it is advisory.   RFC2119 defines SHOULD as:

3. SHOULD   This word, or the adjective "RECOMMENDED", mean that there
   may exist valid reasons in particular circumstances to ignore a
   particular item, but the full implications must be understood and
   carefully weighed before choosing a different course.

This discussion would be better if we used the words that are in the draft in the discussion.

I do agree that a node that doesn’t support IPv4 will not see IPv4 traffic, this needs to be clarified in the current draft.

Thanks,
Bob





> 
> Some rewording is needed.
> 
>> You cannot use security to justify something unless the proposal
>> provides a mechanism for enforcement; if you have no means of
>> enforcement, it's fluff, not security.
>> 
>> Nick
> 
> Thanks
>   Brian
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------