Re: [v6ops] A common problem with SLAAC in "renumbering" scenarios

[Lorenzo Colitti <[e-mail]>]

On Mon, Feb 25, 2019 at 7:33 PM Richard Patterson <[e-mail]>
wrote:

> The Valid Lifetime cannot be zeroed or shortened below 2 hours, but
> the Preferred Lifetime can.  So we can't invalidate the prefix, but we
> can deprecate it so it's not used for new outbound sessions.   This is
> what we've implemented in our CPEs, after an unavoidable change in
> prefix, and it seems to have mitigated (or reduced the impact of) the
> issue.
>
> RFC4862 §5.5.3
>
> e)  If the advertised prefix is equal to the prefix of an address
>       configured by stateless autoconfiguration in the list, the
>       preferred lifetime of the address is reset to the Preferred
>       Lifetime in the received advertisement.
>

Have we considered simply removing this paragraph and allowing routers to
send RA lifetimes of 0? On an IPv6-capable network, an attacker that is
able to send RAs can do way more damage than just this sort of DOS attack -
they can collect/monitor traffic, selectively block destinations or
sources, etc. etc.