[v6ops] Feedback on draft-collink-v6ops-ent64pd-01

[Fernando Gont <[e-mail]>]

Folks,

Some feedback:

Introduction;
> At the very least, a host can be expected to have one
>    link-local address, one stable global address and one privacy
>    address.  

This is no longer the case. As per RFC8981, host can also do temporary only.

Note: I'd also use the terminology in RFC7721 (or similarly in RFC8981), 
and not use the term "privacy addresses" but rather "temporary addresses".

Intro:
>  Devices
>    running containers/namespaces would need even more addresses per
>    physical host.

This seems to imply that containers get exposed on different addresses 
each, which is not what typically happens with e.g. Kubernetes.


Section 3:
>    *  The allocated /64 is installed into the first-hop router routing
>       table as a route pointing to the client's link-local address.  For
>       the router and all other infrastructure devices that prefix is
>       considered off-link, so no traffic to that prefix does not trigger
>       any ND packets.

It's Friday night, but, of the top of my head, this would lead to a 
bunch of ICMPv6 Redirects (one for each address in use). So one might 
wonder why not, e.g., have routers send RIOs to allow for more direct 
communication where possible?


Section 3:
>    *  The host uses /64 to allocate addresses to its interfaces,
>       containers etc.

Did you mean "the leased /64"? --- one way or another, please clarify 
this.  Additionally, the plural might be confusing... it would seem to 
me that the leased /64 would be employed to assign addresses on *this* 
network interface (the one receiving the lease), rather than on any 
interfaces....


Section 8:
>    *  When the network supports both /64 per host and SLAAC as address
>       assignment methods, it's highly desirable for the host NOT to use
>       SLAAC and only use the prefix delegated via DHCPv6-PD. 

Strictly speaking, even that of configuring link-local addresses (e.g. 
with RFC7217) is considered "SLAAC" -- so you probably want to rephrase 
the text a bit.


Section 9:
>    *  If all devices support this mode of operation, it is possible to
>       remove the global /64 prefix from the interface completely,
>       reducing the attack surface for Neighbor Discovery attacks
>       described in [RFC6583].

Could you please elaborate on this one?

Thanks!

Regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494