Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt

["Templin, Fred L" <[e-mail]>]

Hi Dusan,

I created a -15 version of ‘draft-templin-v6ops-pdhost’ to resolve your points.
Please have a look and let me know if you have any further comments:

https://datatracker.ietf.org/doc/draft-templin-v6ops-pdhost/

Thanks - Fred

From: Mudric, Dusan (Dusan) [mailto:[e-mail]]
Sent: Wednesday, October 11, 2017 11:37 AM
To: Templin, Fred L <[e-mail]>; Lorenzo Colitti <[e-mail]>
Cc: [e-mail]; [e-mail]
Subject: RE: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt

Hi Fred,

Thanks for further clarifying the router and host behaviors.

Questions about the latest “-14” updates:


-          General questions:

o   Should the new definitions for the ‘individual prefix’ be in draft-ietf-v6ops-unique-ipv6-prefix-per-host document?

o   In the Security section, can you add more about:

§  DAD security benefits (e.g. when a node does not use DAD, so it cannot be attached with DAD),

§  NCE security benefits (e.g. when a number of NCE entries is limited to one per advertised prefix, or so),

§  Malicious redirects (e.g. when the redirect is not required, so a node cannot be attached with redirects), and

§  and rogue RAs?



These clarifications will help define when nodes should not use DAD, redirect, …



-          ‘individual prefix’






The router that advertises the prefix can consider the prefix as on-link or


not on-link. In the former case, the router performs address


resolution so that it only forwards those packets that match one


of the node's configured addresses.”


You introduced extra flexibility for the unique prefix. What is the motive for the on-link prefix, that requires extra address resolution and NCEs? To “prevent unwanted IPv6 packets from reaching the node”? And, provide security benefits of stable and private addresses?. Can these benefits be added to ‘individual prefix’ definition? Should these benefits go into the ‘unique ipv6 prefix per host’ draft?



-          7. IPv6 Neighbor Discovery Implications

“When a node receives a shared or individual prefix, it is required to
use the IPv6 ND address resolution function over the upstream
interface to determine the link-layer address of a neighbor”

The address resolution is done for ‘Send’ algorithm. Why is it needed for the prefix assignment?

Why is the address resolution required for the ‘individual’ prefix? Should not the node using the individual prefix send the packets to the first hop router (the on-link neighbor has a different ‘individual’ prefix and that prefix is not in the node’s prefix list)?

“For delegated prefixes and individual prefixes that are not
considered on-link, the router delivers all packets that match the
prefix”
To where? Node’s link-layer unicast address?

Thanks a lot for your help,
Dusan.

From: Templin, Fred L [mailto:[e-mail]]
Sent: Wednesday, October 11, 2017 12:52 PM
To: Mudric, Dusan (Dusan); Lorenzo Colitti
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: RE: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt

Hi Dusan,

Thanks again for your useful comments - I updated ‘pdhost’ to resolve your questions
(see below). Please review and let me know if your points are addressed.

Thanks - Fred



-----Original Message-----
From: I-D-Announce [mailto:[e-mail]] On Behalf Of [e-mail]<mailto:[e-mail]>
Sent: Wednesday, October 11, 2017 9:49 AM
To: [e-mail]<mailto:[e-mail]>
Subject: I-D Action: draft-templin-v6ops-pdhost-14.txt





A New Internet-Draft is available from the on-line Internet-Drafts directories.





        Title           : IPv6 Prefix Delegation for Hosts

        Author          : Fred L. Templin

                Filename        : draft-templin-v6ops-pdhost-14.txt

                Pages           : 12

                Date            : 2017-10-11



Abstract:

   IPv6 prefixes are typically delegated to requesting routers which

   then use them to number their downstream-attached links and networks.

   This document considers the case when the requesting router is a node

   that acts as a host on behalf of its local applications and as a

   router on behalf of any downstream networks.





The IETF datatracker status page for this draft is:

https://datatracker.ietf.org/doc/draft-templin-v6ops-pdhost/<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dtemplin-2Dv6ops-2Dpdhost_&d=DwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=Eb5XUfV0A6sClwFnQpF5SxJ_Gak1PdPgbP9tLj33U9k&s=oQyz4ZL7nRjl4w-UOFD__FEq9BAVOErk4zKfvNKywB8&e=>



There are also htmlized versions available at:

https://tools.ietf.org/html/draft-templin-v6ops-pdhost-14<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dtemplin-2Dv6ops-2Dpdhost-2D14&d=DwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=Eb5XUfV0A6sClwFnQpF5SxJ_Gak1PdPgbP9tLj33U9k&s=t7h-qAzKyeNXj52Bd1ocM55trXAM-ULOYOm9iZ2zj-k&e=>

https://datatracker.ietf.org/doc/html/draft-templin-v6ops-pdhost-14<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_html_draft-2Dtemplin-2Dv6ops-2Dpdhost-2D14&d=DwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=Eb5XUfV0A6sClwFnQpF5SxJ_Gak1PdPgbP9tLj33U9k&s=S0EAFQmdkX8K5N4Yw3j_zskqWcKgjxJRPdNwKKRZzX4&e=>



A diff from the previous version is available at:

https://www.ietf.org/rfcdiff?url2=draft-templin-v6ops-pdhost-14<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_rfcdiff-3Furl2-3Ddraft-2Dtemplin-2Dv6ops-2Dpdhost-2D14&d=DwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=Eb5XUfV0A6sClwFnQpF5SxJ_Gak1PdPgbP9tLj33U9k&s=YGvZUUnvUW8TAoMb0lR163KBfGBXY_QXFnvkEmYOQV0&e=>





Please note that it may take a couple of minutes from the time of submission

until the htmlized version and diff are available at tools.ietf.org.



Internet-Drafts are also available by anonymous FTP at:

ftp://ftp.ietf.org/internet-drafts/<https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.ietf.org_internet-2Ddrafts_&d=DwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=Eb5XUfV0A6sClwFnQpF5SxJ_Gak1PdPgbP9tLj33U9k&s=t5HXG7Zhdj3axBFViESNpLbI0Hnc5WtFi3i1CpmpvOg&e=>



_______________________________________________

I-D-Announce mailing list

[e-mail]<mailto:[e-mail]>

https://www.ietf.org/mailman/listinfo/i-d-announce<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_i-2Dd-2Dannounce&d=DwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=Eb5XUfV0A6sClwFnQpF5SxJ_Gak1PdPgbP9tLj33U9k&s=HLsphMfYQJWMfLeqogtP5AjCpZMwq9aukzt2zk94jRc&e=>

Internet-Draft directories: http://www.ietf.org/shadow.html<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ietf.org_shadow.html&d=DwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=Eb5XUfV0A6sClwFnQpF5SxJ_Gak1PdPgbP9tLj33U9k&s=0dssRxnxQaRH8ufnu48Y41lXLOs83K2I2LSPNIOTp3w&e=>

or ftp://ftp.ietf.org/ietf/1shadow-sites.txt<https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.ietf.org_ietf_1shadow-2Dsites.txt&d=DwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=Eb5XUfV0A6sClwFnQpF5SxJ_Gak1PdPgbP9tLj33U9k&s=HAzlvpqBO4auAT3RoRaJyqI0mDMZS6nRNGQQi-eY0TY&e=>


From: v6ops [mailto:[e-mail]] On Behalf Of Templin, Fred L
Sent: Wednesday, October 11, 2017 8:46 AM
To: Mudric, Dusan (Dusan) <[e-mail]<mailto:[e-mail]>>; Lorenzo Colitti <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt

Hi Mudric,

Thanks for the comments, and see below for responses. I will work new
text into the ‘pdhost’ draft and post a new version soon.

Fred

From: Mudric, Dusan (Dusan) [mailto:[e-mail]]
Sent: Wednesday, October 11, 2017 8:34 AM
To: Templin, Fred L <[e-mail]<mailto:[e-mail]>>; Lorenzo Colitti <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: RE: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt

Hi Fred,


Good point. Can you please provide some text explaining the security advantages of 2) and 3) over 1)?



>   Yes, I can work on this and add something to the draft.



'draft-templin-v6ops-pdhost' defines "shared", "individual", and "delegated" prefixes, where "individual” prefixes are introduced by ietf-v6ops-unique-ipv6-prefix-per-host. This draft should clearly state when and why some “individual” prefix algorithms are, and are NOT, run (i.e. DAD, neighbor discovery, …). This will clarify the impact of this draft on hosts.



>   The draft currently talks about DAD and ND considerations for item 3), but can be

>   extended to compare with DAD/ND considerations for the other options.



Thanks,

Dusan.


From: Templin, Fred L [mailto:[e-mail]]
Sent: Friday, October 06, 2017 11:08 AM
To: Mudric, Dusan (Dusan); Lorenzo Colitti
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: RE: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt

Hi Dusan,

To my understanding, we have 1) shared prefixes, 2) individual (“unique”) prefixes and 3) delegated prefixes.
‘ietf-v6ops-unique-ipv6-prefx-per-host’ talks about 1) and 2), while ‘templin-v6ops-pdhost’ talks about 3).

Do you want to also consider delegated prefixes?

Thanks - Fred

From: Mudric, Dusan (Dusan) [mailto:[e-mail]]
Sent: Friday, October 06, 2017 7:48 AM
To: Lorenzo Colitti <[e-mail]<mailto:[e-mail]>>; Templin, Fred L <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: RE: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt

Hi Fred,

Should it be mentioned that even though a ‘shared’ prefix with L=0 makes hosts send packets over the first hope router, the unique prefix per host is preferred mechanism in the environments where security is of a concern?

Thanks,
Dusan.

From: v6ops [mailto:[e-mail]] On Behalf Of Lorenzo Colitti
Sent: Wednesday, September 13, 2017 6:04 PM
To: Templin, Fred L
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt

I would instead say the opposite, i.e., call attention to what is in fact one of the the main benefits of this document. Suggested text:

The practices described in this document make it very simple for networks to implement robust isolation between clients at layer 2. The network can simply ensure that devices cannot send packets to each other except through the first-hop router. This will automatically provide robust protection against attacks between devices that rely on link-local ICMPv6 packets, such as DAD reply spoofing, ND cache exhaustion, malicious redirects, and rogue RAs. This form of protection is much more scalable and robust than alternative mechanisms such as DAD proxying, forced forwarding, or ND snooping.



On Wed, Sep 13, 2017 at 2:12 PM, Templin, Fred L <[e-mail]<mailto:[e-mail]>> wrote:
Please add the following to Security Considerations:

  "While the practices described herein encourage L3 operations that would
    forward all traffic through a provider managed First Hop Router, peer to peer
    communications are still possible unless L2 mechanisms are also employed
    in some fashion outside the scope of this document."

Thanks - Fred

> -----Original Message-----
> From: v6ops [mailto:[e-mail]<mailto:[e-mail]>] On Behalf Of [e-mail]<mailto:[e-mail]>
> Sent: Wednesday, September 13, 2017 7:04 AM
> To: [e-mail]<mailto:[e-mail]>
> Cc: [e-mail]<mailto:[e-mail]>
> Subject: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the IPv6 Operations WG of the IETF.
>
>         Title           : Unique IPv6 Prefix Per Host
>         Authors         : John Jason Brzozowski
>                           Gunter Van De Velde
>       Filename        : draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt
>       Pages           : 9
>       Date            : 2017-09-13
>
> Abstract:
>    This document outlines an approach utilising existing IPv6 protocols
>    to allow hosts to be assigned a unique IPv6 prefix (instead of a
>    unique IPv6 address from a shared IPv6 prefix).  Benefits of unique
>    IPv6 prefix over a unique service provider IPv6 address include
>    improved host isolation and enhanced subscriber management on shared
>    network segments.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-v6ops-unique-ipv6-prefix-per-host/<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dv6ops-2Dunique-2Dipv6-2Dprefix-2Dper-2Dhost_&d=DwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=PlXnFjk4NtNYXkaHFxRI86HSymtz8QLmdZMdwJQhLUY&s=Z0NT1ldV3az-PlcrolYWmpzjzXI-e9gIFUUG7GqakVA&e=>
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-v6ops-unique-ipv6-prefix-per-host-08<https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Dv6ops-2Dunique-2Dipv6-2Dprefix-2Dper-2Dhost-2D08&d=DwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=PlXnFjk4NtNYXkaHFxRI86HSymtz8QLmdZMdwJQhLUY&s=iwcdOKuejV0qgA7XtQEwy-NPAasakqiys1hP46IrLVs&e=>
> https://datatracker.ietf.org/doc/html/draft-ietf-v6ops-unique-ipv6-prefix-per-host-08<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_html_draft-2Dietf-2Dv6ops-2Dunique-2Dipv6-2Dprefix-2Dper-2Dhost-2D08&d=DwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=PlXnFjk4NtNYXkaHFxRI86HSymtz8QLmdZMdwJQhLUY&s=JGWGoSnzdqBvDMseLJY0jyuaFE1nd-c6bZD9ehddnQo&e=>
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-v6ops-unique-ipv6-prefix-per-host-08<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_rfcdiff-3Furl2-3Ddraft-2Dietf-2Dv6ops-2Dunique-2Dipv6-2Dprefix-2Dper-2Dhost-2D08&d=DwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=PlXnFjk4NtNYXkaHFxRI86HSymtz8QLmdZMdwJQhLUY&s=KKbJOoGAffY7kkEZ1sT7fHIl09DX2kdlChL3_Ox38mY&e=>
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org<https://urldefense.proofpoint.com/v2/url?u=http-3A__tools.ietf.org&d=DwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=PlXnFjk4NtNYXkaHFxRI86HSymtz8QLmdZMdwJQhLUY&s=7APWKVKyyoeqrSUx4M-UUhMlzxXL3hkgcCmZSRUxoPI&e=>.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/<https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.ietf.org_internet-2Ddrafts_&d=DwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=PlXnFjk4NtNYXkaHFxRI86HSymtz8QLmdZMdwJQhLUY&s=AxI18cu2PadGwT3HHZOGQbNC7idjhV_I_q466Ssm15E&e=>
>
> _______________________________________________
> v6ops mailing list
> [e-mail]<mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/v6ops<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_v6ops&d=DwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=PlXnFjk4NtNYXkaHFxRI86HSymtz8QLmdZMdwJQhLUY&s=gfIYhPTUIDst9iCDPwjpqx-FJKKNJ9ney-huyDVfwy4&e=>


_______________________________________________
v6ops mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/v6ops<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_v6ops&d=DwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=PlXnFjk4NtNYXkaHFxRI86HSymtz8QLmdZMdwJQhLUY&s=gfIYhPTUIDst9iCDPwjpqx-FJKKNJ9ney-huyDVfwy4&e=>