Subject: draft-ietf-6man-slaac-renum: Honoring small Lifetime values

From: Fernando Gont <[email-masked]>
Date: Tue, 28 Jul 2020 10:17:43 -0300

Folks,

As discussed at the 6man meeting, and as suggested by the wg chairs, 
I'll be starting separate threads to discuss each of the proposals that 
we had in draft-gont-6man-slaac-renum.

This first one is discussed in 
https://tools.ietf.org/html/draft-gont-6man-slaac-renum-08#section-4.2

RFC4862 requires hosts to essentially disregard small PIO lifetimes 
(smaller than two hours). This was allegedly specified as such to 
mitigate a possible attack vector. However, if since RAs are normally 
not authenticated there are a plethora of other (non-mitigated) vectors 
an attacker could use (send RAs with a Router Lifetime of 0, and many 
others).

On the other hand, this prevents a router that positively knows that a 
prefix has become stale from signalling this condition.

Section 4.2 of 
https://tools.ietf.org/html/draft-gont-6man-slaac-renum-08#section-4.2 
proposes an update to RFC4862 such that small PIO Valid lifetimes are 
honored.

The specific text of the proposal is:

---- cut here ----
4.2.  Honor Small PIO Valid Lifetimes

    The entire item "e)" (pp. 19-20) from Section 5.5.3 of [RFC4862] is
    replaced with the following text:

       e) If the advertised prefix is equal to the prefix of an address
       configured by stateless autoconfiguration in the list, the valid
       lifetime and the preferred lifetime of the address should be
       updated by processing the Valid Lifetime and the Preferred
       Lifetime (respectively) in the received advertisement.

    NOTE:  "Processing" the Valid Lifetime and Preferred Lifetime
       includes capping the received values as specified in Section 4.1.2
       of this document.

    RATIONALE:

       *  This change allows hosts to react to the information provided
          by a router that has positive knowledge that a prefix has
          become invalid.

       *  Attacks aiming at disabling an advertised prefix via a Valid
          Lifetime of 0 are not really more harmful than other attacks
          that can be performed via forged RA messages, such as those
          aiming at completely disabling a next-hop router via an RA that
          advertises a Router Lifetime of 0, or performing a Denial of
          Service (DoS) attack by advertising illegitimate prefixes via
          PIOs.  In scenarios where RA-based attacks are of concern,
          proper mitigations such as RA-Guard [RFC6105] [RFC7113] should
          be implemented.
---- cut here ----

The aforementioned change has already been committed to the Linux kernel.

Do you have any comments/thoughts about this one?

Thanks!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492