Re: [v6ops] DAD again [was: draft-ietf-v6ops-host-addr-availability discussion]

[Owen DeLong <[e-mail]>]

> 
> This is starting to diverge from the case I originally intended this discussion to
> examine. The case I am interested in is as follows:
> 
> - Node N receives a /64 prefix delegation for prefix P over interface eth0.
> - N assigns P to the lo interface as a /64 route. This is done to black-hole
>   unused portions of P.
> - N configures address A from prefix P, and assigns it to eth0.

N inherently cannot do this because ETH0 is the interface on which it received the DHCPv6 PD
delegation of the /64 in question.

Therefore it volates:

> [the requesting router MUST NOT assign any delegated prefixes or subnets from the delegated prefix(es) to the link through which it
> received the DHCP message from the delegating router.]


> - N need not perform DAD for A over eth0, because the delegating router
>   has made sure that the routing system will route all packets with a
>   destination address from P to node N, and not to any other node.

In any case, N should not perform DAD for A over eth0 because A is not assigned to eth0.

However, I’m not sure how one can claim that a delegating router can ensure anything
about the behavior of other routers in the routing system.

It’s unclear to me why A would assign P to eth0 anyway. Why not just have the delegating
router assign addresses to other hosts on eth0? Why would A act as a gateway leading to
the delegating router on the same subnet?

I am finding your example more confusing that perhaps is intended.

Owen

> 
> In this way, N can function as an ordinary host according to the strong end
> system model even though it acted as a "requesting router" in procuring a
> prefix from the delegating router. No other node X on the same link as
> N can therefore configure an address from P and have the routing system
> return packets to X. In fact, any node X that configures an address from P
> can be considered an "attacker", and the use or non-use of DAD has no
> way of preventing that. In fact, the use of DAD could give X a clue as to
> which addresses from P are ripe for attacking. So, it is in fact better to
> NOT do DAD.
> 
> Thanks - Fred
> [e-mail] <mailto:[e-mail]>
> 
>> Hemant
>> 
>> 
>> 
> 
> _______________________________________________
> v6ops mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/v6ops <https://www.ietf.org/mailman/listinfo/v6ops>