IETF Logo Mail Archive

Re: [v6ops] SLAAC security concerns

Gert Doering <gert@space.net> Wed, 05 August 2020 18:27 UTC

Return-Path: <gert@space.net>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FE7A3A0E02 for <ipv6@ietfa.amsl.com>; Wed, 5 Aug 2020 11:27:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=space.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e4bN4_txHSaS for <ipv6@ietfa.amsl.com>; Wed, 5 Aug 2020 11:27:24 -0700 (PDT)
Received: from gatekeeper1-relay.space.net (gatekeeper1-relay.space.net [IPv6:2001:608:3:85::38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBB7E3A0DE9 for <ipv6@ietf.org>; Wed, 5 Aug 2020 11:27:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=space.net; i=@space.net; q=dns/txt; s=esa; t=1596652044; x=1628188044; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=8z5ktaCNYWR12hieGmqfi/m8N8RGof0f3svlXNt0Bn8=; b=hLXGDm0KGRXNdAvERrix8ET06bqoVzp28WDvjCxbG77hLpfn+defoCcO Uu5OGBSaZU1Y4tVKbmvCEV5NMaqG5hrHOp0W2BJPt5JFQL85KI2dho7+R fzWuHHmYbWz638h3zPxgsLic8fF0GNRoJEvc6IgCDVMIpvY7xrULU3c1O dxLnE5jQ5YhRUwSROpWsApSk/JkVzVx9hETZUKRKXnroLEYslUtEYDZsU xy5SreX7O8caBexUXVsBO5OAAqfXdDkMos/j+XWPbvpns3fsIpizV48eY l6zXRs5cm7qhRPOgjjzUqLsdg1Hn6f0B7J0RHRGdUVphvnvlwHuS8DgN0 w==;
IronPort-SDR: bW3E0oXLNL5LaWgIKT2C27bQ8qbIljNaLIFyMazD585IW3Tw6ULnIIwNSiIwFUvXhK6PRTJ4c9 EObZd5zW9fPWVOazIGl7OMnyoMUl/PBAmy7o8w36SynZrW98AkxK1hW04Nfl9VnN6W38+tI1Qo uLJtb+9s6hfkcy9jO2DDLge3IAh0bNXiQ/QE+XiXgj1jvD+ra/Q1UMzWAs7BdGtdFrkGDY6uQp UJVl26J3YTMFan/8PlABfiViQWmQDlVvZEojigHFTyWKtEJq7g7lcpelfnh6mhAdQ7GR125Qgh Y1Q=
X-SpaceNet-SBRS: None
Received: from mobil.space.net ([195.30.115.67]) by gatekeeper1-relay.space.net with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Aug 2020 20:27:22 +0200
X-Original-To: ipv6@ietf.org
Received: from mobil.space.net (localhost [IPv6:::1]) by mobil.space.net (Postfix) with ESMTP id 5120242055 for <ipv6@ietf.org>; Wed, 5 Aug 2020 20:27:22 +0200 (CEST)
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
Received: from moebius4.space.net (moebius4.space.net [IPv6:2001:608:2:2::251]) by mobil.space.net (Postfix) with ESMTP id 0A69442052; Wed, 5 Aug 2020 20:27:22 +0200 (CEST)
Received: by moebius4.space.net (Postfix, from userid 1007) id 07E95B171C; Wed, 5 Aug 2020 20:27:22 +0200 (CEST)
Date: Wed, 05 Aug 2020 20:27:21 +0200
From: Gert Doering <gert@space.net>
To: Vasilenko Eduard <vasilenko.eduard@huawei.com>
Cc: Gert Doering <gert@space.net>, Mark Smith <markzzzsmith@gmail.com>, Michael Richardson <mcr+ietf@sandelman.ca>, 6man <ipv6@ietf.org>, v6ops list <v6ops@ietf.org>
Subject: Re: [v6ops] SLAAC security concerns
Message-ID: <20200805182721.GG2485@Space.Net>
References: <f52c4463862f44b5ba2a9d41db86d231@huawei.com> <20200804194448.GA2485@Space.Net> <7105a04994d045b890d04b49ef72c31c@huawei.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="GiETXi+8pDm5NoBR"
Content-Disposition: inline
In-Reply-To: <7105a04994d045b890d04b49ef72c31c@huawei.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipv6/FnWSO0P3wrT_MaD3KYg0mOe1tPU>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipv6/>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 05 Aug 2020 18:27:27 -0000

Hi,

On Wed, Aug 05, 2020 at 06:26:54AM +0000, Vasilenko Eduard wrote:
> Hi Gert,
> SLAAC dependency on multicast is so huge that it is not possible to make it worse by 1 additional function.
> If L2 would lose ND packets, then many things in SLAAC would not work.

Yes.  Been there, cursed the vendor of the day, resorted to static ND
entries and/or got a software upgrade and/or found the necessary twiddle
to make that device well-behave.

Multicast for ND sucks about as hard as LLAs for BGP next-hops with a
TCP session over GUA.

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Michael Emmer
Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444         USt-IdNr.: DE813185279

v2.23.0 | Report a Bug | By Email