Thoughts and comments on draft-linkova-6man-grand-01

[Mark Smith <[e-mail]>]

Hi,

Some thoughts and comments on draft-linkova-6man-grand-01.

Firstly, I think this is a good solution.

I initially was concerned about an increase in multicasts, which I think we
need to remember to try to minimise because of how common Wifi is. However,
I've since realised that these gratuitous unsolicited ND NAs towards
routers are generally replacements for the ND NSes the routers would be
sending, so it probably isn't going to result in an increase in multicasts,
or at least be a significant increase in multicasts. It might be worth
mentioning this in the ID.

It is also probably worth mentioning that if the link layer devices are
performing MLD snooping per RFC4541, then these unsolicited NAs towards the
link's routers will only be sent to the routers on the link rather than
flooded to all nodes due to being sent to the all-routers multicast
address. This is a mitigation to the Security Considerations 3rd paragraph
concern about announcing new host addresses.

As the number of routers on a link is likely and usually small, the node
could perform the multicast packet replication itself for each router and
then link-layer unicast the unsolicited NA to each router, per RFC6086,
"Address Mapping of IPv6 Multicast Packets on Ethernet". I think this
should probably be a recommendation way to send these gratuitous ND NAs, as
it not only avoids link-layer multicasts entirely for these gratuitous NAs,
it also mitigates the security issue described in the Security
Considerations 3rd paragraph regarding hosts announcing their new
addresses. It's a better mitigation than MLD snooping because that's a
capability that needs to be available and switched on, where as link-layer
unicast is of course inherent. (It's not a perfect prevention though
because of the possibility of link-layer Unknown DA frame flooding.)

This mechanism would only be needed if there are routers on the link, so
sending gratuitous unsolicited NAs to all routers could be made dependent
on routers being present on the link. It could and probably should be even
be more narrowly limited to only being used when the host can send traffic
off-link. For example, a host might have received RAs, however if the RAs
Router Lifetimes are Zero (so they're not announcing default routers), and
those RAs don't contain RA Route Information Options for off-link
destinations, then these gratuitous NAs don't need to be sent.

As this is effectively a simple address registration mechanism for hosts to
register their new addresses with routers, it also further assists with
mitigating ND cache exhaustion DoS attacks as described in RFC3756, 4.3.2.,
so it is probably worth mentioning this further mitigation assistance and
referencing that RFC.



"As hosts willing to speed up their network stack
   configuration are most likely to be affected by the problem outlined
   in this document it seems reasonable for such hosts to advertise
   their optimistic GUAs by sending unsolicited NAs."

This problem can of course happen with ULAs too, so it might be better to
just say something more general, such as "their optimistic non-link local
addresses by sending unsolicited NAs."


I was going to do some more thorough reading and comments on the text for
this email however I don't think I'll get to it now before the end of this
weekend, so I'll send this feedback now.

Regards,
Mark.