Subject: RFC 2462: Possible Denial of Service Attack

From: "Powell, Ken" <[email-masked]>
Date: Wed, 23 Feb 2000 09:15:23 -0500

I recently ran some experiments in our lab to see how our IPv6
implementation responds to sudden network topology changes.
In the course of these experiments, I caused the prefix from one
LAN (LAN A) to be advertised on the other LAN (LAN B). As expected,
all communications between LAN A and LAN B died immediately. The
hosts on LAN B treated the hosts on LAN A as on-link. I could not
restore communications until both the preferred and valid LAN A
prefix lifetimes expired on LAN B's host systems.

I was able to force the preferred lifetime to zero by reconfiguring
a router to send advertisements with near-zero lifetimes, but the
valid lifetime couldn't be reduced below two hours. This behavior
follows RFC 2462 section 5.5.3:

 1) If the received Lifetime is greater than 2 hours or greater
    than StoredLifetime, update the stored Lifetime of the
    corresponding address.

 2) If the StoredLifetime is less than or equal to 2 hours and the
    received Lifetime is less than or equal to StoredLifetime,
    ignore the prefix, unless the Router Advertisement from which
    this Prefix Information option was obtained has been
    authenticated (e.g., via IPSec [RFC2402]). If the Router
    Advertisement was authenticated, the StoredLifetime should be
    set to the Lifetime in the received option.

 3) Otherwise, reset the stored Lifetime in the corresponding
    address to two hours.

Obviously I could easily reset IPv6 on each of the three hosts
in our lab to clear this problem. I'm concerned about something
like this happening on a corporate network where LAN B has 
hundreds of client nodes connected to servers that reside on
LAN A. Assuming nobody bothered to configure ipsec on the
network yet, a malicious attacker could disrupt all the clients
by sending a router advertisement on LAN B with LAN A's prefix.
I know of nothing a network administrator can do to recover in
less than two hours short of resetting IPv6 on each of the
client systems (probably with reboots).

The above rules from RFC 2462 were intended to block a denial of
service attack where a single router advertisement could be used
to cause all prefixes to expire. It looks like these same rules
make the attack I outlined more effective than it otherwise would
be.

Ken

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Matt Crawford" <[email-masked]>
Date: Wed, 23 Feb 2000 13:06:44 -0600

> client systems (probably with reboots).

You could mitigate the damage by having your routers provide proxy
neighbor discovery service for the other prefixes.

				Matt