Re: [v6ops] SLAAC security concerns

[Vasilenko Eduard <[e-mail]>]

Bad vendor problem is rare in Enterprise in Carrier. Because:
1. Carrier do test all equipment heavily before any big purchase. Some Enterprise test too.
2. They both have big influence on vendor (he is interested in other sales) - vendors would fix problems promptly
Unfortunately, even such situation could create pressure on Operational, but it is a different story.

Vendor would not care too much about home user.
Ed/
-----Original Message-----
From: Gert Doering [mailto:[e-mail]] 
Sent: 4 августа 2020 г. 23:29
To: Ted Lemon <[e-mail]>
Cc: Gert Doering <[e-mail]>; Vasilenko Eduard <[e-mail]>; Michael Richardson <[e-mail]>; v6ops list <[e-mail]>; 6man <[e-mail]>
Subject: Re: [v6ops] SLAAC security concerns

Hi,

On Tue, Aug 04, 2020 at 04:15:22PM -0400, Ted Lemon wrote:
> On Aug 4, 2020, at 3:44 PM, Gert Doering <[e-mail]> wrote:
> > There is too many broken switch vendors out there that show again 
> > and again that "implementing multicast is hard", breaking IPv6 ND in 
> > the process.
> 
> Why don???t you return that switch for a refund?
> 
> (I???ve never run into a switch that had trouble with IPv6 multicast, 
> but admittedly I only have four different switches in my house, so 
> that???s not a very big sample.)

$20 switches tend to be not affected.

It's the more expensive ones where developers intended to "do the right thing with multicast!" and never came around to actually implement it.

Or where you need to turn on - or *off* - MLD to make link-local multicast work, but the default is the wrong way around.

I have seen this on devices from three different vendors - Extreme, Juniper, and "something that DECIX was using like 15 years ago" - and of course not all models or all firmware versions are affected.  But when it happens, it's life time you won't get back.


If I were to return every device in my network where a developer messed up something the IETF made too complex in protocol design, I would have a very secure, and very power-efficient result - but no network anymore.

(And your response very nicely demonstrates why operators get fed up trying to participate in IETF)

Gert Doering
        -- NetMaster
--
have you enabled IPv6 on something today...?

SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Michael Emmer
Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
Tel: [phone]         USt-IdNr.: DE813185279