Subject: Re: [Dhcpv6bis] Change to [dhcpv6bis] #152 (XML 3315): Prefix lifetime is 0

From: "Bernie Volz (volz)" <[email-masked]>
Date: Thu, 7 Jan 2016 15:56:31 +0000

Hi Tim:

I’ve expanded to dhcpv6bis just to make sure that others are aware.

See Jinmei’s (& my) discussions on the DHC WG mailing list. You might even want post on this issue to the ML.

This can also be a nasty Denial of Service attack … especially if not using SeND … and if there are conflicting RAs? And, are we really the experts to deal with this issue (as it may be something to take to a wider audience – 6man)?

I’m of course happy to punt this to another document … though it does have wider implications than just for CE-Router/Homenet.

I think if you have some explicit suggestions for what we should add to the bis document and it was small and “safe” (i.e., didn’t introduce DoS and similar attacks – think of 100s of clients on a LAN segment all getting these RAs), we might be willing to reopen. But I also view this as a more general issue with deprecating prefixes.

Perhaps a suggestions could be something along the lines of “While a client should generally only initiate a RENEW (or REBIND) at the T1 (or T2) times, it MAY [SHOULD?] initiate a RENEW if it receives notification that a prefix (containing an address it configured via DHCP) is being deprecated. However, a client MUST take steps to … [something about rate limited or trigger renews too frequently].” (We should likely also think about adding some jitter into when clients initiate the RENEW to avoid a storm of messages to the server all at once.)

We could incorporate this when I look into reworking some of the text around T1/T2 times and RENEW/REBIND (ticket #131) – this is to better describe how to handle RENEW/REBIND as the RFC 3315 text is too IA_* specific (assumed single IA_* case).

And, there could already be some text related to the “rate limiting” / DoS that can be referenced for when to accept “deprecation” notifications and how to handle them for SLAAC? And, there’s always the question of whether that document (if it exist) should mention something about DHCPv6 assigned addresses (or perhaps already does)?

-          Bernie

From: Timothy Winters [mailto:[email-masked]]
Sent: Thursday, January 07, 2016 10:19 AM
To: Bernie Volz (volz) <[email-masked]>
Subject: Re: Change to [dhcpv6bis] #152 (XML 3315): Prefix lifetime is 0

Hi Bernie,

I wasn't on the call for this, but I've been the comments on the list.  I think this will still have issues in the field but I'm not really sure what to do about it at the moment.  I'm thinking this should probably show up in some way in CE-Router/Homenet document.

Regards,
Tim

On Wed, Jan 6, 2016 at 9:13 AM, Bernie Volz (volz) <[email-masked]<mailto:[email-masked]>> wrote:
Tim:

Not sure if you were on the bis team call when this one was discussed, but
we feel that we do not want to do anything about this particular issue
(we’ve changed it to “Won’t fix”).

- Bernie

On 1/6/16, 8:10 AM, "dhcpv6bis issue tracker"
<[email-masked]<mailto:[email-masked]>> wrote:

>#152: Prefix lifetime is 0
>
>Changes (by [email-masked]<mailto:[email-masked]>):
>
> * status:  new => closed
> * resolution:   => wontfix
>
>
>--
>----------------------------------+-------------------------
> Reporter:  [email-masked]<mailto:[email-masked]>  |       Owner:
>     Type:  task                  |      Status:  closed
> Priority:  P1 blocker            |   Milestone:
>Component:  XML 3315              |  Resolution:  wontfix
> Keywords:                        |    Due Date:  31/12/2015
>----------------------------------+-------------------------
>
>Ticket URL:
><http://trac.tools.ietf.org/group/dhcpv6bis/ticket/152#comment:3>
>dhcpv6bis <http://tools.ietf.org/group/dhcpv6bis/>
>

--

Timothy Winters
UNH-IOL Senior Executive, Software and IP Networking
Please note we've moved!
21 Madbury Rd, Suite 100, Durham, NH 03824
603-421-4987