Re: [v6ops] Mitigation against IPv6 Router Advertisements flooding - draft-moonesamy-ra-flood-limit-00

[Fernando Gont <[e-mail]>]

On 07/16/2013 05:57 AM, S Moonesamy wrote:
> 
> I was not aware of that draft or that it was presented In Orlando.  I
> took a quick look at  your draft and I see that it mentions
> CVE-2010-4669 and the limit being enforced in OpenBSD 4.2.
> 
> Here's the background that led to the draft.  There was an advisory
> published in 2011 about the IPv6 Router Advertisements flooding attack. 
> One of the workarounds suggested was to disable IPv6 if the workaround
> (see Section 2 of draft-moonesamy-ra-flood-limit-00) was not available. 

Suggested in that advisory, or where?


> There are multiple reasons for why the workaround was not implemented on
> different platforms (see advisory for some of the details)

Sloppy coding?


> even though
> the problem is documented in RFC 6104. 

RFC6104 describes rogue RA, rather than RA floods. They are two
unrelated issues: RA flooding is about enforcing basic checks such that
your data structures cannot grow without bounds. Rogue RA is about how
to deal with malicious RAs in the absence of authentication.


> draft-moonesamy-ra-flood-limit-00 is about documenting the workaround
> that has been implemented in NetBSD and OpenBSD.
> 
> Someone mentioned to me that it is a short draft.  The draft is a small
> effort so that I do not have to hear the "turn off IPv6" argument. :-) 

It is not unlikely for people to give that option in security advisories
when no workaround is available.


> It is also about trying to address a known problem affecting a node in a
> timely manner.  I'll invite you to join the small effort as co-author of
> draft-moonesamy-ra-flood-limit.

I don't object to co-authoring (always happy to contribute).

But I'd note that implementations also fail to enforce limits on:

* the number of default routers
* size of the NC
* number of routes

etc., etc.

That's why I personally believe it is better to provide comprehensive
implementation advice, such as that in draft-gont-opsec-nd-security

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492