Re: [v6ops] Fwd: (IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)

[Fernando Gont <[e-mail]>]

Hi, Ted,

Thanks for weighing in! In-line....

On 7/2/23 10:33, Ted Lemon wrote:
> This seems like fairly iffy advice, which is perhaps not surprising 
> given that the discussion you’re trying to ameliorate seems unrealistic. 
> Thanks for trying to do something to improve it!

At the very least, the intent is to document the challenges and constraints.



> Block lists for ip addresses might be useful, but I suspect are more 
> likely to cause operational issues—eg I’ve had addresses i use blocked 
> because someone did something nefarious from them previously.

Agreed on this. Part of the motivation for this document is that, aside 
from the usual challenges of IP reputation (like the one you describe), 
there are new considerations when this is done for the IPv6 case....



> Where they are appropriate, it is likely because the owner of the full 
> delegation is untrustworthy, in which case it would make sense to block 
> the whole range, or even refuse whatever route they publish.
> 
> It doesn’t make sense to try to use DHCPv6 or disable temporary 
> addresses in order to enable the continued use of single-address block 
> lists, and mentioning it in an IETF document seems harmful. 

The question here is: can you implement ACLs for just a single /128?  Or 
is the only option to implement ACLs with e.g. a /64 granularity?


> The problem 
> is that the operator who would be motivated to do this doesn’t control 
> the address space that is the source of the problem, so they can’t force 
> the owner of that address space to use DHCPv6 or disable temporary 
> addresses.

Probably the text was clear enough: this part of the text is mean to 
discuss ACLs for your own resources. e.g., I control a GCP and an AWS 
VPC... is there a way to do /128 ACLs, or should I just use /64 ACLs?

e.g., in my case, my addresses have manual or DHCPv6 configuration -- 
and hence /128 ACLs are possible.



> Instead, this advice will likely be taken to mean that the use of SLAAC 
> is generally bad, and should be prevented. This would be a very bad 
> outcome.

We might want to note that we're actually discussing stable vs temporary 
addresses. -- it just happens that SLAAC temporary addresses are widely 
supported and deployed, whereas DHCPv6 temporary addresses aren't.
Hence, DHCPv6 typically results in only stable addresses, even when, in 
theory, that need not be the case.



> Similarly, your observations about /56 delegations making it possible 
> for a host to pretend to be multiple hosts are likely to discourage ISPs 
> from offering delegations larger than /64, which again would be an 
> unfortunate outcome.

Well, but... is the observation technically incorrect?



> The simple advice which I think is appropriate for the context you 
> described is simply to point out that with IPv6, prefixes are the 
> identifier, not individual addresses. The rest is too much.

Then the next obvious question is: what prefix size?

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494