Subject: Re: [homenet] FW: New Version Notification for draft-grundemann-homenet-hipnet-00.txt

From: Chris Grundemann <[email-masked]>
Date: Fri, 1 Mar 2013 20:36:23 +0000

Very good point Erik, thank you. We will certainly take that into
consideration going forward. This is also why we are proposing a mix of
two to three CER/ISP Edge determining characteristics (e.g. Including the
CER_ID option as well as the /48 prefix check, etc.).

Cheers,
~Chris

On 2/25/13 8:08 PM, "Erik Kline" <[email-masked]> wrote:

>WRT to Section 4.1, I think the "/48 check" may not be a good idea.
>It may work for /your/ deployment models, but it doesn't necessarily
>work for all.  Furthermore, if this were widely adopted it would
>effectively enforce that deployment model all providers, needlessly I
>think.
>
>Consider a deployment model that I believe I first heard from Lorenzo:
>a customer is allocated a prefix AND the "zero-numbered" /64 from that
>prefix is advertised in the RA toward the customers home gateway.
>(Really any <64 customer prefix and any single /64 would work, like
>the "all ones" /64--it doesn't particularly matter.)  I'm not aware of
>anything that technically precludes this nor do I think we should move
>to preclude it now.
>
>(Note: there may be some home gateways that are not be smart enough to
>recognize that one of the prefixes delegated to it is in use already
>on one of its interfaces (e.g. WAN), but homenet can require such
>intelligence.)
>
>So, your text could try to recognize that IF there is only one
>allocated prefix in the home && IF an interface is not number from
>that prefix THEN it must be an edge.  That's fine.  But being numbered
>from within the allocated prefix does not necessarily mean that it's
>an interior router.

---

From: Erik Kline <[email-masked]>
Date: Mon, 4 Mar 2013 09:23:34 +0900

> CER_ID option as well as the /48 prefix check, etc.).

Yeah, well about that: I don't see any discussion of the security of
this CER_ID option.  If a hipnet device were operating in an
environment in which such a thing could be spoofed then it would be
trivial to punch open a hipnet network.

Furthermore, it will be bad press when someone inevitably publishes an
article documenting that your ISP can punch open your hipnet network
if they so choose just by publishing a CER_ID to you.  Really bad
press.

Maybe this is discussed in the CER_ID doc and you intended to pull its
security considerations in by transitive closure, I don't know.

---

From: Chris Grundemann <[email-masked]>
Date: Tue, 5 Mar 2013 17:21:39 +0000

>security considerations in by transitive closure, I don't know.

Right, this is something that would be addressed in the CER_ID draft
itself. While I don't doubt that spoofing or other malicious activity is
possible, I am not sure I see how the possibility is any greater or more
sever than it is today with existing DHCPv6 (and ND for that matter)
messages. Are you simply saying that this is a possibility, or are you
inferring that this option would introduce a more serious threat? Either
way we should likely take this discussion off-list or onto the DHC list,
since it is directly relevant to the CER_ID draft and only indirectly
associated with the home network architecture more generally.

Thanks,
~Chris

---

From: Mark Townsley <[email-masked]>
Date: Wed, 6 Mar 2013 05:00:18 +0100

> associated with the home network architecture more generally.

If Homenet is going to use the CER_ID, we need to agree on the use of it 
here. DHC is there largely to make sure it's formatted correctly and such, 
not "semantic content". 

http://datatracker.ietf.org/wg/dhc/charter/:

"Generally speaking, the DHC WG will not be responsible for evaluating the 
semantic content of  proposed options. Similarly, the ownership of specifications 
typically belongs the relevant working group that needs more functionality from 
DHCP, not the DHC WG. The DHC WG coordinates reviews of the proposed 
options together with those working groups. It is required that those 
working groups have consensus to take on the work and that the work is 
within their charter."

- Mark

> 
> Thanks,
> ~Chris
> 
> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet

---

From: Chris Grundemann <[email-masked]>
Date: Thu, 7 Mar 2013 15:59:26 +0000

>here. DHC is there largely to make sure it's formatted correctly and

Thanks for the clarification Mark, I misunderstood that relationship. It
sounds like we may need to present/discuss the CER_ID draft in the future,
if there is interest in pursuing it within homenet.

Cheers,
~Chris