Re: 6renum alive again? [A common problem with SLAAC in "renumbering" scenarios]

[Fernando Gont <[e-mail]>]

Hello, Tim,

On 21/2/19 07:51, Tim Chown wrote:
>> On 20 Feb 2019, at 19:44, 神明達哉 <[e-mail]
>> <mailto:[e-mail]>> wrote:
>>
>> At Wed, 20 Feb 2019 02:03:52 -0300,
>> Fernando Gont <[e-mail] <mailto:[e-mail]>>
>> wrote:
>>
>> > 10.1.  Address Configuration
>> >
>> >    o  RA Prefix Lifetime Limitation
>> >
>> >       Section 5.5.3 of [RFC4862] states "If the received Valid Lifetime
>> >       is greater than 2 hours or greater than RemainingLifetime, set the
>> >       valid lifetime of the corresponding address to the advertised
>> >       Valid Lifetime."  So when renumbering, if the previous
>> >       RemainingLifetime is longer than two hours, it is impossible to
>> >       reduce a prefix's lifetime to less than two hours.  This
>> >       limitation is to prevent denial-of-service attacks.
>> >
>> > This seems a flaw in RFC4862 to me. Me, I think ND security boils down
>> > to: modulo some basic sanity checks, you trust the RAs, or you don't.
>> > There's not much of a point in sanitizing the Prefix Lifetimes and then
>> > honoring Router Lifetimes of 0, or even blindly trusting RAs that would
>> > make you configuring addresses from invalid prefixes, RAs that might
>> > override your preferred router with one with higher preference, etc.
>>
[....]
> 
> The two hour rule way predates RFC 6104/6105 and the "RA Guard"
> functionality common in at least enterprise switches today.  And it says
> "two hours unless the RA is authenticated", so the "impossible" quoted
> above isn't strictly true, but in practice, we also see how widespread
> the required SeND deployment to do that is...).  

:-)



> With RA Guard on the table, whether you'd want to relax the two hour
> rule would presumably depend on how important you feel it is to protect
> against misconfigurations of genuine RAs.

If we were enforcing the same sort of policy for all fields, this might
require some thinking. But as an attacker, I'm always going to use
whatever vectors I have available that "just works". Put another way: if
one of entries to a fortress is protected by a door made of steel, but
the others just have a curtain... what's the point?

Besides, since we want the default valid lifetime to be well under 2
hours, we really need to update this bit of RFC4862, too.


-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492