IETF Logo Mail Archive

[v6ops] DHCP Option 108 Issue with Mac and iOS devices

Jeremy Duncan <jduncan@tachyondynamics.com> Wed, 15 November 2023 22:25 UTC

Return-Path: <jduncan@tachyondynamics.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44EA4C1516F8 for <v6ops@ietfa.amsl.com>; Wed, 15 Nov 2023 14:25:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.808
X-Spam-Level:
X-Spam-Status: No, score=-1.808 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, TRACKER_ID=0.1, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=tachyondynamics.onmicrosoft.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T-V5pVh0WWcK for <v6ops@ietfa.amsl.com>; Wed, 15 Nov 2023 14:25:52 -0800 (PST)
Received: from NAM11-DM6-obe.outbound.protection.outlook.com (mail-dm6nam11on2066.outbound.protection.outlook.com [40.107.223.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07B15C14F75F for <v6ops@ietf.org>; Wed, 15 Nov 2023 14:25:51 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dNnogV5XabdfATqT6TiXLUg0zb5B4KkKn/M872y/SCpYIon/pqcpilBSs+RB/rySppEkp20v0+z8HpU2tuU1KQACv+mNMNDV4b535fa3zW6twgaXuSEc8jLWyUYutTBgcu0IF39dJuKqeibZ/tdaaGOHQ7gTmo1KRj567gWlKmZE+GO5FtBmYivLPL8Fn+c5DeEv+5lmt8i0SjNjWlege91LT9NnLicE0CyPft+KC9RytVhjDvGICRC5x+/+V1O2JUS7wp3EvTVwi4N6z8He+VRi112shljUf8SxKJC8wCHtrrmDlUkiSYPQtGX2qD8WzLTJ0rIyO0jzHvErrJ8pjw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IW0Bs9PfMyti/wWeULVz62eFDA4gztGgYGZ96nY+iJ8=; b=g9SmxlKaNje+xIWlRXj8BQCHj0ZaKx8yQiM5vnhzJ3XSQSmFY4ongDexmdByiCwGPJI/ou01OewixlUAStg2FDo1VnDcfVV56Gx5xiEt2P3BUpm0Fa9hK888Tiku/yx++Jc3clT30wqEkiZS3DwiwrqeoQ91tQ2nW0kK1mZz5ujynOdrxgLtCzyHV3v1EiQEzIryu6PgGszf71ZJnx23ksJ4zDlq8ZvP7OIHbDRBfyXzLANKOAGthJnv+dLnPfXePNvowYI1czu9cLSqUWYnFQ02HFKWlx2ufDVIO0Blqd3/efzpw1xJEWTE+TM9DPqUvLQ81bNlKMIrr1lV36x7ZA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=tachyondynamics.com; dmarc=pass action=none header.from=tachyondynamics.com; dkim=pass header.d=tachyondynamics.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=TachyonDynamics.onmicrosoft.com; s=selector2-TachyonDynamics-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IW0Bs9PfMyti/wWeULVz62eFDA4gztGgYGZ96nY+iJ8=; b=I61WlQepurIL/GhWbLb44Vu0Pkpi0RX5JHXCr643W0CBfwHP8PVly/TkN6PZ51jK3DUnxKEH72a7dGXFCtclU1MbODPcUzh8IPulZ3Y0i4KX2eDwVzurx9SMsONl1x2VBHweXY1xEkdXMpV661E8TKmPxiL6n161F7SHjULpnuQ=
Received: from BL1PR18MB4277.namprd18.prod.outlook.com (2603:10b6:208:308::11) by PH0PR18MB4457.namprd18.prod.outlook.com (2603:10b6:510:ef::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6977.31; Wed, 15 Nov 2023 22:25:46 +0000
Received: from BL1PR18MB4277.namprd18.prod.outlook.com ([fe80::4469:4f7:146:d4bb]) by BL1PR18MB4277.namprd18.prod.outlook.com ([fe80::4469:4f7:146:d4bb%3]) with mapi id 15.20.7002.015; Wed, 15 Nov 2023 22:25:44 +0000
From: Jeremy Duncan <jduncan@tachyondynamics.com>
To: v6ops <v6ops@ietf.org>
Thread-Topic: DHCP Option 108 Issue with Mac and iOS devices
Thread-Index: AdoYEN5gnGAdvWBYSt+FuYzewN05Qg==
Date: Wed, 15 Nov 2023 22:25:44 +0000
Message-ID: <BL1PR18MB4277AAD4CFD760FC7DC413F2ACB1A@BL1PR18MB4277.namprd18.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=tachyondynamics.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: BL1PR18MB4277:EE_|PH0PR18MB4457:EE_
x-ms-office365-filtering-correlation-id: e38f27cd-f7d7-42b5-1251-08dbe629cf4e
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: XaDBJdFHkJiaED8IpbVs3h4zGxslboFB8xOYQzqRuNcjNgZBF5v8a9T0s1XcuLX/njsEpuYi4ymIBSvPVd7rHaf8OLA+/7yZ1pEBcK0R0QVe9SbThAN8s9bkZ8AMYvvlq1zBPgln7R5Lf/Q1q5Z08Bj6x248k8RuKwokNYqFhPHcrHP9wSnrVnJEJo8ENJBnsc9Mbe5kAxkG/9tLeIxBx3cd+ZTIC/KMcgETG/AXGDia/QeTCwo0e1D/ow7HyJ+IrtVjTtH2wdaEJj/0rU2WZzn51YgATqX951yi1M7Zvcuxbox7Oerhw3PZuUl7lWYIrGh1kR4A23neCyKbH3bPLma596k5dDzfhY3jsBut6AjyI2dGzMt/2UowFpPBedWL9zJ0Hlp6xm1K/hzLG5eQCAjJKWrCBCajVp6JI3RdIJfsS55LGNaBoC9csoxlcfrjBcBr3g5ptrxayfU3t6ZrHql1A9+A/Zzh9bXYXZ6APQNU071TYQi3bNA3T0D0qRmgQSAM+/+PQPRDBqApcZD/ZTI4xg5w74XvnKwx3/ONioVpg1rypOO3TX2p0V1fybiWEku5WODsx2IjSFDvQOCo1ev8x3dTWRVf4LkOPlnQ3XQ=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BL1PR18MB4277.namprd18.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230031)(136003)(376002)(346002)(366004)(39830400003)(396003)(230922051799003)(64100799003)(451199024)(1800799009)(186009)(38070700009)(966005)(316002)(33656002)(40140700001)(66476007)(76116006)(66556008)(6916009)(54906003)(64756008)(66446008)(66946007)(86362001)(8676002)(71200400001)(83380400001)(55016003)(8936002)(4326008)(2906002)(41300700001)(9686003)(52536014)(5660300002)(6506007)(7696005)(478600001)(38100700002)(122000001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: XwFbxQUHcCfdaRBlec6u3vZ/hjWpJdVZl7LvoVyy7gc9wG2Egqu3G03P0gsYqvW4Bb/8svHr42obdv40EOmPFOD/wZliN2jaTFUq/5ndDcibPJJvbuMfYT8KKQgrG1JDJ3AkrFDdVw9Zpltm8hFlPMuigKOKipiXXgiWrKFwk1ZdR932okVvgjAxcnEVOW25sFHx7QHFaoyDbMQOazJ4j7WDEMcclCr5XOd+toeKsNcNjSaqJ5UlaTJA5dRMvO5oHsmrU89ikPTnbNs9yllwczr4HWmA4tgZ/aksF+LBGCxet3TLzMO8WDB1Tewu8/MF3KzKW1G1qj7mjGnyBNXtXP/tAXtVXDLJCaGEzLzFEnhGlQ/hcGLjfaDkKy40nVq66jolDDyrxbvWkerG8UCtJend0wUsPu+Jxbb4Z+1DqDPQsuY56gJ0gMIOM3m7sYQqXJpjtLvC91St5vKY7qAUIvPxdrCg1PX5tBt9NsInNRUQl0rByQsAxRjIO100XifjKqsi5foUR5gC6kAkwA+LVjbwMZTR0mMICICd4Y+Ar4IzTr+/5jKMKyFbNHBldlBR6uzlRxC2bj7PRR5nfWTgVz/+mXFZWDBV2EsofDxAmz9r2gFxJeWIGTs8R9XX5K4FznnGFlhl8tRUalRNvwGF3/F+2vkaxf6deWNobBR9zXo99qB9fAyxwb92lO+zE2Fl7AB2LYONOdJkvUWej+VGEKGyGGeard98CYQeY1FTuEqD6a5fRGUG2JIhVtlfMDABH7WdNV7VP2OXFx5e3w2KthicCZ15etESbFLimRdFTOSDY6qlyb83abzlBteK9Nd+1OcNLg05DDKUx7F+CYBzsEKRevmCuIdY9Jns7SxBgGBPgZ0vINNX9vr7B7jF4ZSDwP0N8rbDVZSR29oC3cmansmXxfb2JzLLzJKd/WymGEjHKFqG6DCirr4w1amBy/5Z1XYoQ+9zC4PwB4SRENDcyiiaKuH3fuV8BwDlbcynQsKMeWtM1TowSbLHmRJIwLYLFGQV+HtECLg0dSf0K3l8UyscUGtwDNUW17dmkQB7QGsvwYZW3G+H6jYNsOr4E2P/7OvVXE14cNxK089CCtRGFnc0ql+rk+RhAPhPziRHqxU3G3LL6qEcM5QNeU4dOao8lUvqU9sPPRvjEnQ8o+POEMP42EKhdATSijYEKlXIx5xFzGTaK1C9KTXoObXw1l6vJLhtc4hbF1ZY30zncW50Iil+knWK/CHHU0BpGkjQQWI1UWIcwWd7qdb6qiCh+hDXLvooTXaiB2jC5TxGzpwHKCGW3CFkUZBmA8K6rlxOJ7swV01nNmRDelsvzvNjaS3Ur8u17iaZN5gwqyEB1RNTtK0zEK/nizJlF/Gabbmdi/n+JhSqcZFSlAthZj0lITIXvJafVmhSI0QPHO62GUX7MjTxyBoTOhryLHCWZLi0iuIkxGftfVzxizyBut2I2uYs3XiY7L31Vud7CDfrQ1zuyU5+eKzTDGBqTOxvcM9M+bHJ6ZiQMNSk8d/DmVi+rorT0WmrT2k/lcde/xVoorhoRPAdvuTlExdL1aqg95pG5B3V4H7YbdGm0MJYQqPvLK7g15jVwV0WbVnli3TtSjEE5FNoQYMkf0RhtQFWx72i6w+TsY1140mTNj9E4YLItXPNTZK954sc+HYm0hgWMPaO8A==
Content-Type: multipart/alternative; boundary="_000_BL1PR18MB4277AAD4CFD760FC7DC413F2ACB1ABL1PR18MB4277namp_"
MIME-Version: 1.0
X-OriginatorOrg: tachyondynamics.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BL1PR18MB4277.namprd18.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e38f27cd-f7d7-42b5-1251-08dbe629cf4e
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Nov 2023 22:25:44.8830 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 306ea27d-bb9d-47c1-a6ca-c70495fc7695
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: a44GFTPw1cZszhrsthGlQMywSJmeTYiGQLsC4AU5X3yeTMnsQkWA/obHLD4d97A9IPmwALBcgGEvXKhJ8NNIiVP8DygWd8jiNnOSI6p0qCA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR18MB4457
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/M1FwDCa8u_YJArR9tM751wGB5ys>
Subject: [v6ops] DHCP Option 108 Issue with Mac and iOS devices
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Nov 2023 22:25:57 -0000

Hi v6ops-

Nick and I were involved with the Supercomputing Conference this year and part of the decision was to provide a real-world network to experiment with IPv6 transition technologies in an IPv6-only state. So a part of the wireless network was configured with an IPv4 DHCP scope with Option 108 with a value of 3600. The IPv6 part was configured with IPv6 SLAAC only with RADNS options pointing to a DNS64 resolver that mapped to the 64:ff9b::/96 scope - where the intermediate upstream device has NAT64 functional.

As we expected, most Android and all later version Mac/iOS systems performed as expected:

  *   IPv4 DHCP request for option 108
  *   Response with 108, 3600
  *   Disable IPv4 functionality on the wireless NIC
  *   Spin up the CLAT/464XLAT functionality
  *   Happy IPv6-only-ing

Well, with one exception: organizations that provided misconfigured firewall rules (blocking all ICMPv6/IPv6) or disabling of the IPv6 stack entirely.

In this specific use case, the iOS/Mac would do exactly as instructed by the DHCP server, it would disable IPv4 and spin up its CLAT/464XLAT - but without any verification that IPv6 is functional before doing so.

As you are probably aware, this resulted in a total endpoint denial of service as it has a non-functional IPv6 stack, but the IPv4 stack (network) did not have the awareness of any issues therefore disabled IPv4 functionality.

The question for the v6ops group - is there something we can do to tighten up any kind of RFC that will require IPv6 stack capabilities and functionality?


0101001101100101011011010111000001100101011100100100011001101001

Jeremy Duncan
IPv6 Architect, Managing Partner
Tachyon Dynamics, Inc
Phone: (703) 259-8550 x 103
Fax: (703) 259-8548
https://www.tachyondynamics.com

v2.41.0 | Report a Bug | By Email | System Status