Re: [v6ops] Fwd: New Version Notification for draft-collink-v6ops-ent64pd-01.txt

[Martin Huněk <[e-mail]>]

Hi,

Dne čtvrtek 22. prosince 2022 2:50:39 CET, Fernando Gont napsal(a):
> Hi,
> 
> On 21/12/22 13:13, Martin Huněk wrote:
> > 
> > On 21. 12. 22 5:02, Brian E Carpenter wrote:
> >> On 21-Dec-22 13:19, Martin Huněk wrote:
> >>> Hi Brian,
> >>>
> >>> Dne pondělí 19. prosince 2022 21:59:12 CET, Brian E Carpenter napsal(a):
> >>>> On 19-Dec-22 23:30, Martin Huněk wrote:
> >>>>
> >>>>> Furthermore, this address has to be predictable for an 
> >>>>> ISP/netadmin, so it is possible to make an AAAA record for it
> >>>>
> >>>> Er, no, the creation of such an AAAA record should be automated 
> >>>> (subject to some kind of authorization).
> >>>
> >>> I would certainly not want arbitrary (BYOD) connected devices to be 
> >>> allowed to manipulate DNS records in my domain by the DDNS. There are 
> >>> security reasons for that. If I know the DUID of the device providing 
> >>> some service to the Internet users and the IID where the device 
> >>> listens is known, I can make static prefix delegation, and then I can 
> >>> make an AAAA record for it. Without it, I can run only IPv4 services 
> >>> there.
> >>
> >> Completely understood. But the bad old days of using the MAC address 
> >> to create the IID are gone, and numbering hosts from 1 upwards would 
> >> be extremely helpful for some kinds of attack.
> > 
> > Again, I do not suggest that it should, by default, number 
> > hosts/services from 1 upwards. I'm saying that when (and only when) the 
> > device is providing service to the Internet, the IID on which the 
> > service is listening should be predictable.
> 
> No. It does not need to be predictable -- that's one of the reasons for 
> which you have the DNS. If anything, it needs to be stable, to avoid the 
> hassle (and glitches) to perform DNS updates regularly.

That's precisely why it must be predictable, so the admin is actually able to put it into the DNS. Or at least it needs to be predictable to the admin.

As a network admin, I know the following:
- Client's DUID
- Client's Link-local address
- Delegated prefix
- Maybe the MAC address

I do not know the IID, so I cannot know the IPv6 address needed to make an AAAA record. This I know with DHCPv6, and I knew that back in the days when only EUI-64 was used with SLAAC. Also, in the draft, there is no stability requirement.

Please compare it with the IPv4 situation:

In IPv4, I know:
- MAC address
- IPv4 address

So it is easy to make an A record from it.

Long story short, if we keep overlooking the need for autoconfiguration predictability in the name of privacy, we will end up with hosts with privately generated addresses that will use IPv4 only, as there would be no IPv6 autoconfigured services in the DNS.

Even with stable privacy addresses, I cannot know the IID generated by the host with SLAAC (it uses internal values for generating IID). Currently, I have got just three options:
1) Force clients to use EUI-64.
2) Use DHCPv6 and force users to report DUID manually.
3) Use static configuration, losing all benefits autoconfiguration has.

What happened at our university (fully dual-stack) was that when the IPv6 was deployed, there was only EUI-64 we had made, for every registered device in the network, both A and AAAA records. When the privacy extension came, we had to abandon the idea of making automated EUI-64-based AAAA records. The AAAA records are made only manually, so the majority of devices have only A records now - they are running IPv4-only services on a fully dual-stack host. This is one of the biggest setbacks of the IPv6 deployment for us. The DHCPv6-PD configured host address would not help with that.

I'm not saying that IID has to be a fixed value known to everybody. It can be, for example (just to illustrate an idea): SHA256(Client DUID + Delegated prefix) and use first n bits where n is length of IID. The DUID is a fixed number known to the user, and the delegated prefix is known to the administrator (fixed or it may change). The Internet would not know the DUID (and also IID), but an administrator may publish an AAAA in the DNS.

Privacy at any cost means no IPv6 utilization, and some devices have no use for privacy.

Martin