Re: [v6ops] Please review the No IPv4 draft

[Ted Lemon <[e-mail]>]

On Apr 22, 2014, at 10:11 AM, Philip Homburg <[e-mail]> wrote:
> "   -  When the goal is to turn off IPv4, having to maintain and operate
> "      an IPv4 infrastructure (routing, ACLs, etc.) just to be able to
> "      send negative responses to DHCPv4 requests is not productive.
> "      Having the option transported in IPv6 allows the ISP to focus on
> "      operating an IPv6-only network.
> 
> This one makes sense. So what do we want? A very small amount of code can
> can send and receive DHCPv4 messages or all of the security problems
> associated with the alternatives?

You are saying this as if there are no security problems associated with DHCPv4, but of course DHCPv4 has very similar security problems.   In order to prevent DHCPv4-based attacks on the local wire, you must filter bad DHCPv4 packets.   If you are filtering bad DHCPv4 packets on the wire, filtering bad RA packets is doable as well.  And you should be doing it, because RAs on an IPv4-only wire are a dead simple way to set up MiTM attacks.

I already addressed this point and the others you made in previous comments.   This conversation has gotten extremely repetitive.  I think if you want to make these points again and make sure they have been addressed, the way to do it is to open up an issue tracker for this draft, and continue the discussion on the sunset4 mailing list.   Otherwise we're just spamming v6ops, and I'm sure the people on v6ops who don't care about sunset4 would really like it if we stopped doing that.