Subject: Re: [76attendees] Rogue IPv6 RA

From: Arifumi Matsumoto <[email-masked]>
Date: Mon, 9 Nov 2009 23:33:16 +0900

Hi,
let me CC to 6man ML,

Per RFC4861,

6.3.4.  Processing Received Router Advertisements
...
       - If the address is already present in the host's Default Router
         List and the received Router Lifetime value is zero,  
immediately
         time-out the entry as specified in Section 6.3.5.
...
6.3.5.  Timing out Prefixes and Default Routers

    Whenever the invalidation timer expires for a Prefix List entry,  
that
    entry is discarded.  No existing Destination Cache entries need be
    updated, however.  Should a reachability problem arise with an
    existing Neighbor Cache entry, Neighbor Unreachability Detection  
will
    perform any needed recovery.

    Whenever the Lifetime of an entry in the Default Router List  
expires,
    that entry is discarded.  When removing a router from the Default
    Router list, the node MUST update the Destination Cache in such a  
way
    that all entries using the router perform next-hop determination
    again rather than continue sending traffic to the (deleted) router.

I'm not sure what does "immediately time-out the entry as specified
in Section 6.3.5." mean.
Does it mean both paragraphs in 6.3.5. or just the latter paragraph ?

If the latter paragraph only should be executed, the address given
by rogue RA remains, right ?

On 2009/11/09, at 19:55, Yuji Sekiya wrote:

> At Mon, 9 Nov 2009 19:52:48 +0900,
> Arifumi Matsumoto wrote:
>
>> IIRC, routerlifetime and address lifetime is not correlated.
>>
>> So, that address can be used for the source address for
>> outgoing sessions, right ?
>
> I think some of implementation bind prefix and its default
> router, so default router is expired, the prefix is not
> selected as source address.
>
> -- Yuji Sekiya

---

From: Erik Kline <[email-masked]>
Date: Tue, 10 Nov 2009 01:43:54 +0000

> by rogue RA remains, right ?

My reading would be that on receipt of a 0-lifetime RA that only the
second paragraph would be executed (lifetime timeout).  However, all
hosts receiving the 0-lifetime RA would then have to recompute the
next-hop, which in /some/ cases may require sending a RS (which the
rogue RA node would presumably hear and re-answer).  (Of course I
haven't verified this against any implementation :)

---

From: Arifumi Matsumoto <[email-masked]>
Date: Tue, 10 Nov 2009 10:51:04 +0900

Erik,

On 2009/11/10, at 10:43, Erik Kline wrote:

> second paragraph would be executed (lifetime timeout).

Second to that.

>  However, all

I fail to get your point.
Requiring sending a RS leads to ... ?

Even if that RS fails, it does not have any effect on the given
addressby rogue RA, right ?

---

From: Erik Kline <[email-masked]>
Date: Tue, 10 Nov 2009 02:27:12 +0000

> addressby rogue RA, right ?

I was contemplating the case where you might want to run a
rogue-ra-killer on a node that listens for RAs, knows which one are
valid, and sends 0-lifetimes for all the rogues.  My point was that if
a node decides it needs to re-RS then the rogue RA node probably
continues to reply (as does the rogue-ra-killer).  Maybe this doesn't
actually happen though because most/all nodes would have also received
the valid RA and would just update next-hop information using that
data.

Just me speculating idly on a weird situation...
-Erik