Re: [v6ops] Stephen Farrell's No Objection on draft-ietf-v6ops-host-addr-availability-06: (with COMMENT)

[Lorenzo Colitti <[e-mail]>]

On Wed, May 4, 2016 at 5:25 PM, Stephen Farrell <[e-mail]>
wrote:

> - I think you're missing one other reason why people
> allocate /128's - in a hosting/VPS environment, the hoster
> might want to avoid VPS's that originate spam using many
> different source addresses over time so as to attempt to
> avoid IP address based (bad) reputation accruing to their
> outbound spam. Personally, I think associating such
> reputation scores with IPv6 prefixes or addresses is a bit
> dodgy, but this is I think something that is done in the
> wild, (no idea how frequently) so would be worth a mention.
> If you have good arguments as to why such a scheme is a bad
> idea, that'd be good to include as well.
>

Implementing DoS protection or rate limiting based on /128s is highly
inadvisable because any residential user with a /60 can create 2^68 state
table entries. Some hosting providers and even tunnel broker providers
offer /48s. That said, I think this is out of scope for this draft because
a server is not a general purpose host, and this document only applies to
general purpose hosts.

- I was a bit surprised to not see any mention here of
> ULAs. I've seen one DHCPv6 setup where my laptop was
> assigned a ULA with a very long lease in the hope of always
> having that connectivity to local systems that aren't all
> on the link. But having that plus real global addresses
> caused glitches as (I think) my OS (ubuntu) wasn't sure
> which of the addresses to use as the source for what.
> While I didn't explore what was going on there (I just
> zapped the lease:-), do you need to say how to handle cases
> where one has both real global and ULAs on an interface?
>

ULAs are different prefixes so they are covered by this text:

   it is RECOMMENDED that IPv6 network deployments provide
   multiple IPv6 addresses from each prefix to general-purpose hosts

We already have guidance on how applications should work in the presence of
ULAs - it's in RFC 6724. This does appear to work for me - I have a network
that provides both ULA and global, and Ubuntu 14.04 just seems to do the
right thing.

- I would have liked if you had said that, other things
> being equal, OSes SHOULD prefer to use privacy addresses as
> the source address or as a default. Is there a reason to
> not say that? (Just wondering, I'm not trying to strongly
> argue that you do.)
>

While I agree, I think this is out of scope for this document and this
working group. There is a lively debate going on in 6man around the topic
of address stability and privacy, and I think that is the right place for
this topic.

Cheers,
Lorenzo