What Is Wrong with the Ipv6 RA Protocol ? – Some Analysis and Proposed Solutions –
Total Page：16
File Type：pdf, Size：1020Kb
What is wrong with the IPv6 RA protocol ? – Some analysis and proposed solutions – Manuel Grob, Erwin Hoffmann FH Frankfurt am Main April 2012 Abstract Within IPv6 Stateless Address Autoconfiguration (SLAAC) the Router Advertisement Pro- tocol plays an important rôle to provide the Prefix and the Default Gateway. We investigate the current state of the standard, the implementation on some OS and routers, investigate it’s weaknesses and discuss possible solutions. 1 The Router Advertisement 1. Message container [fig.1] Protocol as part of ICMPv6 ICMPv6 type 133 defines the Router So- licitation and the Unlike ICMP for IPv4, ICMPv6 [11] is an in- type 134 the Router Advertisement mes- dispensable part of the IPv6 protocol family. sage. ICMPv6 provides core functionalities for IPv6: 2. Mechanism Stateless Address Autoconfiguration Router Solicitation RS requested from a SLAAC [15] by means of the mecha- host for Prefix Discovery and answered nisms Neighbor Discovery and Router by a (solicited) Router Advertisement Advertisement. RA by a router and the Duplicate Address Detection DAD using Unsolicited Router Advertisement URA Neighbor Discovery. (periodically) send by router in the link Neighbor Unreachable Detection NUD, segment. again based on Neighbor Discovery. Routing Support. a ) b ) 18 1 6 2 4 3 2 1 8 1 6 2 4 3 2 Type=133 Code = 0 Checksum Type=134 Code = 0 Checksum These mechanisms are described within R e s e r v e d CHL M O R e s . R outer Lifetim e O ptions ... Reachable Tim e R etrans Tim er RFC 4861 [12] as part of IPv6 Neighbor Dis- O ptions ... covery. Here – and in the forthcoming discus- sion – we need to understand the dual rôle of Figure 1: Structure of a) Router Solicitation, ICMPv6 usage of Router Solicitation/Adver- b) Router Advertisement messages; CHL=Current tisements implementation used for Prefix and Hop Limit, M=Managed, O=Others flag Router discovery: 1 1.1 Options in RA messages 1.2 Prefix Discovery using Router Solicitations RA message include default information: In case a host is newly attached to a link seg- The Cur hop limit (CHL), typically set ment or after the interface has been restarted, to 64. a Router Solicitation RS message is sent from The Router lifetime – in case 0 is set, the that interface using the ICMPv6 message type router identifies itself to be a none-Default 133 as multicast to the All-Router group Gateway. ff02::2 while providing it’s link-local unicast The Reachable time, and the (LLU) address fe80::X as source [fig.2]. Retransmission timer; both may be 0. This procedure is part of the Neighbor Dis- covery ND. In order to support a quick Neigh- The additional Options carried out in the bor Discovery and to set up the Neighbor RA message depend on the mechanism: Cache immediately, in the Option field the MAC address of the sender is included in the Source Link-Layer Address (type 1) is the most usual option and typically is set RS message. in any RA (and RS) message. Prefix Discovery employs option of type L i n k 3 IPv6-A ddr = fe80::0a00:21ff:fe48:d461 R M A C-A ddr = 08-00-21-48-d4-61 3. In addition to the Prefix and the Prefix L ink 1 (E thernet) Length the lifetime of these parameters can R L i n k 2 be provided. Furthermore, the flag L de- 1 fines whether the prefix is (locally) available I P v 6 { S o u r c e -IP-A ddr = fe80::a00:21ff:fe48:d461, Target-IP-A ddr = ff02::1, on the segment, the flag A tells the host R A [..., R eachable T im e, R etrans T im er, 1 O p t i o n (Type=1, Source Link-Layer A ddr = 08-00-21-48-d4-61 ), to use Stateless Address Autoconfiguration O p t i o n (T ype=3, Link-Prefix), O p t i o n (Type=5, M TU Size)]} with this prefix, whereas M is managed flag, URA : U nsolicited R outer A dvertisem ent perhaps followed by the O (other) flag. Figure 2: Prefix Discovery by means of Router So- Routing (type 24) informs the host to send licitations any packets for this destination via this router. In order to allow load-balancing, a router may include a hint about the priority Though RFC 4861 [12] requires a particu- and route lifetime. lar validation of the received Router Adver- Since IPv6 requires packet fragmentation at tisement message (6.6.1) at the node, it is not the sending host the maximum packet size entirely clear how the advertising router en- can be announced by means of the MTU (type capsulated the RA message in the IPv6 packet 5) option. targeting the (potential) recipients. It states Recursive DNS Server (type 25) allows in section [12] 6.2.6: the router to include the IPv6 addresses of DNS forwarders. This option is often disre- "In addition to sending periodic, garded at the host. unsolicited advertisements, a router sends advertisements in response to The options potentially provided in RA valid solicitations received on an ad- messages can be used to set up an IPv6 net- vertising interface. A router MAY work almost entirely and relaxes the need for choose to unicast the response di- DHCPv6. rectly to the soliciting host’s address 2 (if the solicitation’s source address 2 The Operating System’s is not the unspecified address), but view on RA the usual case is to multicast the re- sponse to the all-nodes group." For any (none-router) hosts the following un- favourable situation is encountered: This situation can be depict from [fig.3] Employing RA messages targeting the where one router employs an All-Node multi- All-Nodes ff02::1 (upon solicitation) ad- cast in response to a Router Solicitation while dress is indistinguishable from a Unsolicited the other has chosen to use the host’s LLU Router Advertisement since no ’address cor- destination address in the IPv6 packet. relation’ is possible at the node side. Even worse, according to [12] section 6.2.6, the router is required to delay the ad- 1.3 Unsolicited Router Advertise- vertisement "within the range 0 through ments MAX_RA_DELAY_TIME". Thus, no In an IPv6 network the router attached to ’time correlation’ of the messages can be ac- the local segment might not to be ’silent’ but complished. rather multicast their configuration to all at- On the other hand, a host need to be pre- tached nodes. Since several router might exist pared to receive and process different in- in a network, they may send independent Un- formation (i.e. Link Prefixes) from differ- solicited Router Advertisement URA to the ent routers unless the implementation of the hosts. IPv6 stack picks up the option and "MAY The RA protocols requires to send chose not to store of the router addresses URA messages not strictly periodical, discovered via advertisements" ([12] section but rather randomly chosen between the 6.3.4). configured values MinRtrAdvInterval and In case of contradictory information "the MaxRtrAdvInterval. The advertising router most recently information is considered au- needs to care about it’s sending period in thoritative" ([12] section 6.3.4). terms of a state engine. In practice the IPv6 host – being targeted The following situations impact sending of by (multicast) Router Advertisements – has URA messages: little control upon the received information. We investigate now the workaround and so- The router or it’s interface becomes ac- lutions of the major operating systems. Unlike tive or a new configuration is to be pro- IPv4 – being based on the initial BSD socket cessed. Now the router sends up to interface – IPv6 has three independent imple- MAX_INITIAL_RTR_ADVERTISEMENTS. mentations: The router receives an Router Solicitation 1. The outcome of the WIDE/KAME [8, 18] from an host on the segment, triggering the project, which is the foundation of *BSD sending of a Router Advertisement. OS and MacOS X IPv6. The router is going to be de-actived. In this 2. The Linux IPv6 implementation [13]. case, a final Router Advertisement is multi- 3. The IPv6 interface available for the Win- casted announcing a Router lifetime of 0. dows operating systems [9]. 3 IPv6-A ddr = fe80::21e:90ff:fead:5e08 M A C-A ddr = 00-1e-90-ad-5e-08 IPv6-A ddr = fe80::a00:21ff:fe48:d461 IPv6-A ddr: X M A C-A ddr = 08-00-21-48-d4-61 R 2 M AC-Addr: a L i n k 1 R 1 L i n k 2 1 2 1 R outer Solicitation 3 2 3 R outer A dvertisem ent LL All-Router I P v 6 {Source-IPv6-A ddr = X , Target-IPv6-A ddr = ff02::2, M u l t i c a s t 1 R S [ . , O p t i o n (Type=1, Source Link-Layer A ddr = a)]} LL All-N ode I P v 6 { S o u r c e -IP-A ddr = fe80::a00:21ff:fe48:d461, Target-IP-A ddr = ff02::1, M u l t i c a s t R A [..., R eachable T im e, R etrans T im er, 2 O p t i o n (Type=1, Source Link-Layer A ddr = 08-00-21-48-d4-61 ), O p t i o n (T ype=3, Link-Prefix), O p t i o n (Type=5, M TU Size)]} L L I P v 6 { Source-IPv6-A ddr = fe80::21e:90ff:fead:fe08, Target -IPv6-A ddr = X , U n i c a s t R A [ .