Subject: Fwd: New Version Notification for draft-ietf-6man-ipv6only-flag-05.txt

From: Bob Hinden <[email-masked]>
Date: Thu, 7 Mar 2019 15:57:56 -0800

Hi,

We posted a new version of IPv6 Router Advertisement IPv6-Only Flag.   The changes include:

      *  Added a host configuration option to Section 7 that controls if
         the host should process the IPv6-Only flag.  This provides
         local control over using the use of flag and reduces the
         ability of a bad actor to turn off IPv4 for hosts that support
         the flag.

      *  Changed Section 7 to specify that the host can ignore flag set
         to 1 if it has active IPv4 configuration obtained from the
         network (e.g., via DHCP).  Similar changes to Section 3 and
         Section 9

      *  Clarification in Section 6 to strengthen the text about the
         administrators intent.

      *  Added Bjoern Zeeb as an author.

      *  Updated information on FreeBSD implementation in Appendix A.1

      *  Editorial changes.

The authors believe this version address concerns raised in earlier discussion.  Please review and comment.

Thanks
Bob, Brian, Bjoern

> Begin forwarded message:
> 
> From: [email-masked]
> Subject: New Version Notification for draft-ietf-6man-ipv6only-flag-05.txt
> Date: March 7, 2019 at 3:51:41 PM PST
> To: "Bjoern A. Zeeb" <[email-masked]>, "Robert M. Hinden" <[email-masked]>, "Robert Hinden" <[email-masked]>, "Brian Carpenter" <[email-masked]>, "Bjoern Zeeb" <[email-masked]>
> 
> 
> A new version of I-D, draft-ietf-6man-ipv6only-flag-05.txt
> has been successfully submitted by Robert M. Hinden and posted to the
> IETF repository.
> 
> Name:		draft-ietf-6man-ipv6only-flag
> Revision:	05
> Title:		IPv6 Router Advertisement IPv6-Only Flag
> Document date:	2019-03-07
> Group:		6man
> Pages:		15
> URL:            https://www.ietf.org/internet-drafts/draft-ietf-6man-ipv6only-flag-05.txt
> Status:         https://datatracker.ietf.org/doc/draft-ietf-6man-ipv6only-flag/
> Htmlized:       https://tools.ietf.org/html/draft-ietf-6man-ipv6only-flag-05
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-ietf-6man-ipv6only-flag
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-ietf-6man-ipv6only-flag-05
> 
> Abstract:
>   This document specifies a Router Advertisement Flag to indicate to
>   hosts that the administrator has configured the router to advertise
>   that the link is IPv6-Only.  This document updates RFC4861 and
>   RFC5175.
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
>

---

From: Fernando Gont <[email-masked]>
Date: Thu, 7 Mar 2019 21:30:22 -0300

HI, Bob,

>          ability of a bad actor to turn off IPv4 for hosts that support

The question here is: what does this option default to?

* If it defaults to "off" (do not process the flag), the flag becomes
mostly useless

* If it defaults to "on" (process the flag) the security concerns stay
the same.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 8 Mar 2019 14:15:43 +1300

> * If it defaults to "off" (do not process the flag), the flag becomes

Not really. It becomes a management option on managed sites. For example,
where I work hundreds of PCs are "imaged" with the same o/s image in teaching
labs, and they would all inherit the flag setting decided by the IT Service
team.

If experience shows that the concerns are unimportant in practice,
the default can be flipped to "on".

> * If it defaults to "on" (process the flag) the security concerns stay

But if experience shows that those concerns are serious in practice,
the default can be flipped to "off".

Why is there no default in the draft? Because this seems like something
we could leave to vendors and operators. The correct default depends
on the deployment scenario and ultimately on experience.

   Brian