Re: [Int-area] Adam Roach's Discuss on draft-ietf-intarea-provisioning-domains-10: (with DISCUSS and COMMENT)

[Ted Lemon <[e-mail]>]

On Jan 22, 2020, at 10:53, Tommy Pauly <tpauly=[e-mail]> wrote:
> Network operators SHOULD restrict access to PvD Additional
> Information to only expose it to hosts that are connected to the local
> network... [this] can be implemented by
> whitelisting access from the addresses and prefixes that the router provides
> for the PvD, which will match the prefixes contained in the PvD Additional
> Information.

But does this help with the problem Adam is talking about?  The attack is coming from the RA. A rogue RA will not be in control of the network operator. So the mitigation has to be on the recipient of the RA, I think. 

So your suggestion to abandon the query of the host gets a bad answer sounds okay-ish, but probably we could do better by randomizing the query time on the client and the like. 

Beyond that, is there any way to limit the scope of the query so that the attack isn’t useful?  My first instinct about this is that the attack isn’t very useful because it requires an attacker on the local net, but we’ve seen the power of the Mira attack; this would be a significant increase in these attack’s effectiveness. 

Requiring the http listener to be local could make this pretty useless as an attack. It’s inconvenient, but probably doable. Is there a reason not to do it?