Description
Implement the IPv6 prefix-aggregation policy specified by Task 2.5 (#53)
in the DISC-NG IP-diversity scoring code path. Today the IPv6 IP-tree
operates at full 128-bit granularity, which lets a dual-stack attacker
bypass the IPv4 /24 cap via many addresses within a single IPv6 /64 or
/48.
This issue covers the implementation half of the work. The
specification half — selecting the prefix length(s) and the treatment
of non-routable address ranges — is tracked as Task 2.5 (#53).
Scope
- Update
netutil.IPTracker (or the DISC-NG-specific IP accounting in
p2p/discover/topicindex/) to aggregate IPv6 addresses at the
prefix length recommended by Task 2.5.
- Apply consistent treatment to link-local / ULA / Teredo / 6to4
addresses per the Task 2.5 recommendation.
- Update
regBucket.ips and searchBucket.ips to use the same
policy.
- Tests covering: IPv6 same-/64 cap behaviour; IPv6 same-/48 cap
behaviour (per recommendation); transitional-address treatment;
IPv4-only behaviour unchanged.
Deliverables
- Code changes implementing the prefix policy.
- Unit tests covering the new behaviour.
- Documentation update if the existing comments / docs reference
"/128" or assume per-address granularity.
Dependencies
Phase
Phase 2 (implementation work).
Related
Description
Implement the IPv6 prefix-aggregation policy specified by Task 2.5 (#53)
in the DISC-NG IP-diversity scoring code path. Today the IPv6 IP-tree
operates at full 128-bit granularity, which lets a dual-stack attacker
bypass the IPv4 /24 cap via many addresses within a single IPv6 /64 or
/48.
This issue covers the implementation half of the work. The
specification half — selecting the prefix length(s) and the treatment
of non-routable address ranges — is tracked as Task 2.5 (#53).
Scope
netutil.IPTracker(or the DISC-NG-specific IP accounting inp2p/discover/topicindex/) to aggregate IPv6 addresses at theprefix length recommended by Task 2.5.
addresses per the Task 2.5 recommendation.
regBucket.ipsandsearchBucket.ipsto use the samepolicy.
behaviour (per recommendation); transitional-address treatment;
IPv4-only behaviour unchanged.
Deliverables
"/128" or assume per-address granularity.
Dependencies
and the non-routable-address policy before implementation can start.
Phase
Phase 2 (implementation work).
Related
docs/disc-ng-compliance.md§3.2 — gap statement in the compliancereport