Re: rfc4941bis: temporary addresses as "outgoing-only"?

[Fernando Gont <[e-mail]>]

On 10/2/20 19:17, Brian E Carpenter wrote:
> On 11-Feb-20 09:46, Mark Smith wrote:
>>
>>
>> On Tue, 11 Feb 2020, 03:13 Fernando Gont, <[e-mail] <mailto:[e-mail]>> wrote:
>>
>>      Folks,
>>
>>      Since we are at it, I wonder if rfc4941bis should say anything about the
>>      use of temporary addresses for incoming connections. (see
>>      https://tools.ietf.org/html/draft-gont-6man-address-usage-recommendations-04#section-4.3).
>>      (e.g., "an implementation MAY....")
>>
>>      Particularly for connection-oriented protocols, hosts that prevent
>>      incoming connections on temporary addresses reduce exposure even when
>>      their temporary addresses become "exposed" by outgoing sessions.
>>
>>      i.e., if the model is that temporary addresses are employed for outgoing
>>      connections, unless a host uses temporary-only, there's no reason to
>>      receive incoming connections on temporary addresses. (e.g., browsing the
>>      web or sending email should not be an invitation for folks to e.g.
>>      port-scan you).
>>
>>
>> This would prevent peer-to-peer connections between end-user devices, as it means devices become clients only, and they therefore cannot provide a temporary server/service.
> 
> If a node has a stable address as well as a temporary address, that isn't the case. 

That's what I had in mind.


> However, I think it is rather out of scope for 6man to regulate this point. What might be good, but is also probably out of scope,
> is a socket option to allow/disallow incoming connections to temp addresses, and a socket error code if they are disallowed and an upper layer tries to bind a socket to a temp address.

The thing here is that, unless the address has been generated upon 
request of an app (something not possible at the time of this writing), 
apps share addresses and thus no app has authority over any address...

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492