Re: [v6ops] <draft-ietf-v6ops-464xlat-optimization-00.txt> - pre-(shepherd-writeup) review

[Jen Linkova <[e-mail]>]

On Fri, Jul 10, 2020 at 9:29 PM JORDI PALET MARTINEZ
<[e-mail]> wrote:
> [Jordi] If instead of the spoofing the AAAA, it is spoofed the A or even the AAAA (without this optimization), the result is the same. In my opinion it all depends on how and "where" the attack occurs, because the DNS cache may be poisoned in the CPE or the hosts, etc.


Sorry I should have clarified. The difference is that spoofing *one*
DNS response would affect *all* devices behind the CPE *even* if those
device are not using that CPE as a resolver and use DNS over [smth]
and/or DNSSEC. My laptop might build a secure tunnel to the DNS server
it's using and validate response using DNSSEC.
But it does not help because my TV asked for an A RR and the
corresponding AAAA was spoofed on the CPE, so now all devices in my
house can not reach that IPv4 address.

>     This is actually related to my point about 'when/how this feature gets
>     enabled'.  It's not just must be explicitly enabled by an operator, it
>     MUST be disabled if the roiter does not have IPv6 connectivity on the
>     uplink (and the question is 'how to define that').
>
> [Jordi] This nullifies the full purpose of the optimization. The idea is that the optimization is performed as easy and automatically as possible if the WAN is IPv6-only. I will say in the other way around. If, in an extreme situation, an operator has any "big" trouble with this optimization, they will use TR-069 or whatever to disable it by default.

Why can they not use TR-069 or whatever to enable it? Operators might
not have CDNs in their network, they might have enough capacity  etc -
so they might not need the optimisation at all.

>Clearly the optimization will be only enabled by the CPE if it is using 464XLAT because it has IPv6-only WAN. I'm happy to add a sentence or even a section to clarify that, but for me an optimization for 464XLAT only works if 464XLAT is working, not otherwise!

I do like the update to Section 5.2, thanks for that! However IMHO the
current version does not imply that the optimization is enabled only
if 464X:AT is enabled.
What if the device was not able to get an IPv4 address on the uplink
initially but eventually DHCPv4 succeeded?
Not sure there is any clear guidance for that.
That's why I was thinking that letting the operator make a decision if
they need this feature and enable it would make sense - those who
really need would know that they shall buy routers supporting this and
enable it. Those who do not care would not be negatively impacted.



-- 
SY, Jen Linkova aka Furry