Re: [v6ops] Fwd: New Version Notification for draft-collink-v6ops-ent64pd-01.txt

[Martin Huněk <[e-mail]>]

On 21. 12. 22 5:02, Brian E Carpenter wrote:
> On 21-Dec-22 13:19, Martin Huněk wrote:
>> Hi Brian,
>>
>> Dne pondělí 19. prosince 2022 21:59:12 CET, Brian E Carpenter napsal(a):
>>> On 19-Dec-22 23:30, Martin Huněk wrote:
>>>
>>>> Furthermore, this address has to be predictable for an ISP/netadmin, so it is possible to make an AAAA record for it
>>>
>>> Er, no, the creation of such an AAAA record should be automated (subject to some kind of authorization).
>>
>> I would certainly not want arbitrary (BYOD) connected devices to be allowed to manipulate DNS records in my domain by the DDNS. There are security reasons for that. If I know the DUID of the device providing some service to the Internet users and the IID where the device listens is known, I can make static prefix delegation, and then I can make an AAAA record for it. Without it, I can run only IPv4 services there.
> 
> Completely understood. But the bad old days of using the MAC address to create the IID are gone, and numbering hosts from 1 upwards would be extremely helpful for some kinds of attack.

Again, I do not suggest that it should, by default, number hosts/services from 1 upwards. I'm saying that when (and only when) the device is providing service to the Internet, the IID on which the service is listening should be predictable. However, even if it would be ::1, an attacker would still need to guess the prefix part which is still a lot for /96. Walking the DNS zone would be easier.

The draft lists as one of its benefits: "DHCP-PD logs and first-hop routers routing tables provide complete information on IPv6 to MAC mapping", but for the use case when the device is providing a service, and there is a need for AAAA record, it is not better than SLAAC right now.

Martin
> 
>> Is there some existing solution for it other than that? Open, not vendor specific.
> 
> I doubt it, this is too new, but I'm no expert. It would be a use case for the ANIMA autonomic work.
> 
>      Brian
> 
>>>
>>> An IID cannot be zero, since that value is reserved (https://www.iana.org/assignments/ipv6-interface-ids/ipv6-interface-ids.xhtml). There are reasonable arguments why it should be pseudo-random, even for a server.
>>
>> Sorry, I've missed that zero is not allowed.
>>
>> Anyway, network administrator predictable IID would be a huge help in providing IPv6 services from it (without resolving it by static configuration). I see no such arguments if the prefix doesn't leave a single device and when this predictable IID is used only when it is configured with a service that needs to be reachable from outside.
>>
>> By the way, in this case, the admin predictable IID source is even the DUID, and that is not predictable for the rest of the Internet.
>>>
>>>      Brian
>>> _______________________________________________
>>> v6ops mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/v6ops
>>>
>>