IETF Logo Mail Archive

Re: [v6ops] SLAAC security concerns

Gert Doering <gert@space.net> Wed, 05 August 2020 18:27 UTC

Return-Path: <gert@space.net>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC40F3A0E1F for <v6ops@ietfa.amsl.com>; Wed, 5 Aug 2020 11:27:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=space.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yz-9EUieWPpS for <v6ops@ietfa.amsl.com>; Wed, 5 Aug 2020 11:27:25 -0700 (PDT)
Received: from gatekeeper1-relay.space.net (gatekeeper1-relay.space.net [IPv6:2001:608:3:85::38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F1A73A0E00 for <v6ops@ietf.org>; Wed, 5 Aug 2020 11:27:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=space.net; i=@space.net; q=dns/txt; s=esa; t=1596652045; x=1628188045; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=8z5ktaCNYWR12hieGmqfi/m8N8RGof0f3svlXNt0Bn8=; b=cqoQdZo39S7th9eJMvlqN65vWkba7Fs+fXsLY2wEwRSHWDrt9nvv0CuE vmTD9Hh2V+L8nkdNjE4ifIjqzKQnds7NtphtyPdyP5VI2fSuNQm9E8ruK Uwe7Ketrt6z9x7F596H5o51CwMHjisJMw28kcY3QReokhXS+xSWJfL/Ud NgjkhKQTd7LZ0CIplHNmKlNEtV0XyhEweMbyM/WviUZN2LW0tSVxL2DSm DO6Bd/MnIDAprt/LvrRsoUyel0aSQDdZE5bUskJGgPz7iQnE5+eKO18Sx 5rH1U+Z8NFKr9RTsqjQXD0Vf4y0ENirhY4dpqUTKfwTC5izK/RpmUWoS/ Q==;
IronPort-SDR: jMoDGOZyyZ7Pf1YDUC/0NNpf2UnOOZ82+nMCSKoF2d/pThZeuS2TP3pEgTx2SUwyMh/pG6hQkA ZzJ6VjvEhlGqq1WGtjVxhbxqpu4+x7pTW7RvR90WjZrvHWeHRbfNrjK2cAGi3nlJe/sKOf3DBe gNNSNDXq8xB2UPBsS5olcoqGV6r8AtqVhomUmtQ6jpFrvzWowZk/gevzIGdEjBoAOeIUWUGD62 Y+bPYvTZU38Jl5S1L3riDhNkqy9aKb6M7PZAuGAi+tkUwDalh0637XjZuVQds6DTv1TA3MqOpL snU=
X-SpaceNet-SBRS: None
Received: from mobil.space.net ([195.30.115.67]) by gatekeeper1-relay.space.net with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Aug 2020 20:27:22 +0200
X-Original-To: v6ops@ietf.org
Received: from mobil.space.net (localhost [IPv6:::1]) by mobil.space.net (Postfix) with ESMTP id 5356842058 for <v6ops@ietf.org>; Wed, 5 Aug 2020 20:27:22 +0200 (CEST)
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
Received: from moebius4.space.net (moebius4.space.net [IPv6:2001:608:2:2::251]) by mobil.space.net (Postfix) with ESMTP id 0A69442052; Wed, 5 Aug 2020 20:27:22 +0200 (CEST)
Received: by moebius4.space.net (Postfix, from userid 1007) id 07E95B171C; Wed, 5 Aug 2020 20:27:22 +0200 (CEST)
Date: Wed, 05 Aug 2020 20:27:21 +0200
From: Gert Doering <gert@space.net>
To: Vasilenko Eduard <vasilenko.eduard@huawei.com>
Cc: Gert Doering <gert@space.net>, Mark Smith <markzzzsmith@gmail.com>, Michael Richardson <mcr+ietf@sandelman.ca>, 6man <ipv6@ietf.org>, v6ops list <v6ops@ietf.org>
Message-ID: <20200805182721.GG2485@Space.Net>
References: <f52c4463862f44b5ba2a9d41db86d231@huawei.com> <20200804194448.GA2485@Space.Net> <7105a04994d045b890d04b49ef72c31c@huawei.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="GiETXi+8pDm5NoBR"
Content-Disposition: inline
In-Reply-To: <7105a04994d045b890d04b49ef72c31c@huawei.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/Y7wVS1S42vvxeCPcTveWanCROCc>
Subject: Re: [v6ops] SLAAC security concerns
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 05 Aug 2020 18:27:27 -0000

Hi,

On Wed, Aug 05, 2020 at 06:26:54AM +0000, Vasilenko Eduard wrote:
> Hi Gert,
> SLAAC dependency on multicast is so huge that it is not possible to make it worse by 1 additional function.
> If L2 would lose ND packets, then many things in SLAAC would not work.

Yes.  Been there, cursed the vendor of the day, resorted to static ND
entries and/or got a software upgrade and/or found the necessary twiddle
to make that device well-behave.

Multicast for ND sucks about as hard as LLAs for BGP next-hops with a
TCP session over GUA.

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Michael Emmer
Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444         USt-IdNr.: DE813185279

v2.23.0 | Report a Bug | By Email