Re: draft-ietf-6man-slaac-renum: Heuristics to deprecate stale information

[Ted Lemon <[e-mail]>]

Actually the case I’m thinking of is where the router goes down, and another router just announces another prefix. In this case, following Eduard’s heuristic, hosts on the link would immediately stop using addresses on the old prefix. Although actually I think he said they’d deprecate that prefix, not unconfigure it, so maybe I’m worried over nothing. In that case, existing connections would continue to function, and when the router came back, the prefix would be un-deprecated.

Sent from my iPad

> On Aug 12, 2022, at 2:35 PM, Michael Richardson <[e-mail]> wrote:
> 
> 
> Ted Lemon <[e-mail]> wrote:
>> RS, they seem low-cost. I am somewhat concerned that a cleverly-timed
>> attack while a router is known to be down could result in bogus
>> prefixes being preferred on the link until the router comes back, and
>> that this could break connections on the link that would otherwise
>> survive. But this seems like a fairly useless denial-of-service attack.
> 
> If I understand the attack you are thinking about,  it would depend on the
> addresses expiring from the nodes while the router is down and can not renew
> the prefix lifetimes.
> 
> The attacker deprecates the addresses, by impersonating the router, and
> nodes kill connections.    One answer, I think, is that any existing sockets
> that are using those addresses can just continue to use them.
> New connections/sockets would not use those addresses.
> 
> I know that my browsers all seem to notice when there is an address change
> and they restart connections.  I'm not entirely sure if this is just based
> upon opening the routing socket and listening, or if there is a lower
> overhead mechanism... I'd sure like to be able to toggle a socket option on a
> bind()/connect()'ed socket (both TCP and UDP) to get an error if the
> addresses involved go into deprecated state.
> 
> The sockets might actually break if they are connections to the Internet, but
> they would break anyway in that case.  If they are just across the link, then
> they would just continue working.
> 
> 
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>           Sandelman Software Works Inc, Ottawa and Worldwide
> 
> 
> 
>