Re: [v6ops] Mitigation against IPv6 Router Advertisements flooding - draft-moonesamy-ra-flood-limit-00

[S Moonesamy <[e-mail]>]

Hi Fernando,
At 05:42 15-07-2013, Fernando Gont wrote:
>Isn't this already covered (together with a bunch of other ND-related
>stuff) in:
><http://tools.ietf.org/html/draft-gont-opsec-ipv6-nd-security>? :-)
>
>(this I-D was presented at the OPSEC meeting in Orlando)

I was not aware of that draft or that it was presented In Orlando.  I 
took a quick look at  your draft and I see that it mentions 
CVE-2010-4669 and the limit being enforced in OpenBSD 4.2.

Here's the background that led to the draft.  There was an advisory 
published in 2011 about the IPv6 Router Advertisements flooding 
attack.  One of the workarounds suggested was to disable IPv6 if the 
workaround (see Section 2 of draft-moonesamy-ra-flood-limit-00) was 
not available.  There are multiple reasons for why the workaround was 
not implemented on different platforms (see advisory for some of the 
details) even though the problem is documented in RFC 
6104.  draft-moonesamy-ra-flood-limit-00 is about documenting the 
workaround that has been implemented in NetBSD and OpenBSD.

Someone mentioned to me that it is a short draft.  The draft is a 
small effort so that I do not have to hear the "turn off IPv6" 
argument. :-)  It is also about trying to address a known problem 
affecting a node in a timely manner.  I'll invite you to join the 
small effort as co-author of draft-moonesamy-ra-flood-limit.

Regards,
S. Moonesamy