Re: Confirmation to advance: draft-ietf-6man-ipv6only-flag-05

[Brian E Carpenter <[e-mail]>]

Regards
   Brian Carpenter

On 10-May-19 04:47, David Farmer wrote:
> 
> 
> On Wed, May 8, 2019 at 5:30 PM Brian E Carpenter <[e-mail] <mailto:[e-mail]>> wrote:
> 
>     David,
> 
>     > A host that receives any RAs with the flag set to 1
> 
>     No! That must be
> 
>     A host that receives only RAs with the flag set to 1
> 
>     It is an absolute requirement that all routers must agree that the flag is 1, or else it has no effect.
> 
>     Otherwise I'm sympathetic to your rewrite, but I see little point in updating the draft until the WG Chair gives us a read-out on the rough consensus.
> 
> 
> Because with this flag now only being a secondary signal and the lack of any DHCPOFFERS is now the primary signal, 

That's been suggested, but not agreed. I'm reluctant to remove the requirement that all the default routers agree (in the case that there's more than one, of course), because disagreement signals that the network admins have screwed up somehow.

Fairly clearly, if a host observes DHCP(v4) traffic and also observes the IPv6-only flag, the flag loses. If the current wording isn't clear on that, we need changes such as Mikael or you have suggested. But I'm also reluctant to over-specify the heuristic that a host should apply, because different stack implementations are ... different.

    Brian

> it is safe to allow any RA set to 1 to trigger no longer auto-configuring an IPv4 Link-Local address, this only has an effect if the host also doesn't receive any DHCPOFFERS. So, if the host receives one RA with the flag set and one RA with the flag cleared, the host should continue sending DHCPDISCOVERS perodically and configure an IPv4 address if it gets any DHCPOFFER. However, if it never gets any DHCPOFFERS it should not auto-configure of an IPv4 Link-Local address, even though there are conflicting settings of this flag in the RAs.
> 
> This at least partially mitigates the malicious sending of an RA with the flag cleared on an IPv6-Only network, again the lack of DHCPOFFERS controls if the host configures an IPv4 address or not, this flag only says what to do if you don't receive any DHCPOFFERS and whether or not to continue sending periodic DHCPDISCOVERS. Further, you should only stop sending DHCPDISCOVERS if the flags in RAs received all agree.
> 
> Thanks.
> 
> -- 
> ===============================================
> David Farmer               Email:[e-mail] <mailto:[e-mail]>
> Networking & Telecommunication Services
> Office of Information Technology
> University of Minnesota  
> 2218 University Ave SE        Phone: [phone]
> Minneapolis, MN 55414-3029   Cell: 612-812-9952
> ===============================================