Subject: Re: [v6ops] Practical question about MLD join for LL multicast

From: Enno Rey <[email-masked]>
Date: Sun, 3 Apr 2016 11:10:50 +0200

Hi,

On Thu, Mar 03, 2016 at 09:00:00AM +1300, Brian E Carpenter wrote:
> I'm sorry to distract the group with a practical question, but I'm a bit stumped.
> My question is below.
> 
> In the thread "Further Mitigating Router ND Cache Exhaustion DoS Attacks Using Solicited-Node Group Membership (-01)", on
> 24/02/2016 08:07, Brian E Carpenter wrote:
> > On 24/02/2016 07:53, [email-masked] wrote:
> >>>> MLD joins for the solicited node multicast address has turned out to have little practical purpose. I am thinking of going the other way and stop sending joins for link-local multicast groups.
> >>>
> >>> Yes. What is the possible use of a link-local "join"?  The packets are just there
> >>> on the link anyway, so "joining" is entirely an internal matter for each node.

I'd like to add that several MLD Querier implementations do not even store FF02:-scoped groups.
When we did some testing a while ago (details here: https://www.its.fh-muenster.de/doc/Security_Implications_of_MLD_in_IPv6_Networks.pdf) the Cisco router involved (running IOS 15.4.3) didn't show anything on "show ipv6 mld groups" even after (Win|Linux|BSD) on the local link had sent their reports for solicited-node.

best

Enno

-- 
Enno Rey

ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de
Tel. +49 6221 480390 - Fax 6221 419008 - Cell +49 173 6745902 

Handelsregister Mannheim: HRB 337135
Geschaeftsfuehrer: Enno Rey

=======================================================
Blog: www.insinuator.net || Conference: www.troopers.de
Twitter: @Enno_Insinuator
=======================================================

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 4 Apr 2016 08:28:25 +1200

>>>>> on the link anyway, so "joining" is entirely an internal matter for each node.

Of course, when I wrote that I completely overlooked the layer violation implemented
on many switches.

> When we did some testing a while ago (details here: https://www.its.fh-muenster.de/doc/Security_Implications_of_MLD_in_IPv6_Networks.pdf) the Cisco router involved (running IOS 15.4.3) didn't show…

But did it actually forward the packets?

    Brian

---

From: Enno Rey <[email-masked]>
Date: Sun, 3 Apr 2016 22:42:19 +0200

Brian,

> But did it actually forward the packets?

it did, at least where it was involved in inter-domain multicast forwarding (no need for a router to forward packets to solicited-node at any point or do I overlook sth here?).
point is that draft-smith-v6ops-mitigate-rtr-dos-mld-slctd-node assumes/relies on the routers/MLD queriers actually knowing the solicited-node groups of the individual nodes on the adjacent link which might be a questionable assumption (which, admittedly, is discussed in Relaxed Mitigation Mode section).

best

Enno

-- 
Enno Rey

---

From: Mark Smith <[email-masked]>
Date: Mon, 4 Apr 2016 08:24:57 +1000

Hi,

On 4 Apr 2016 06:42, "Enno Rey" <[email-masked]> wrote:
> > > When we did some testing a while ago (details here:
https://www.its.fh-muenster.de/doc/Security_Implications_of_MLD_in_IPv6_Networks.pdf)
the Cisco router involved (running IOS 15.4.3) didn't show anything on
"show ipv6 mld groups" even after (Win|Linux|BSD) on the local link had
sent their reports for solicited-node.
> it did, at least where it was involved in inter-domain multicast
forwarding (no need for a router to forward packets to solicited-node at
any point or do I overlook sth here?).
> point is that draft-smith-v6ops-mitigate-rtr-dos-mld-slctd-node
assumes/relies on the routers/MLD queriers actually knowing the
solicited-node groups of the individual nodes on the adjacent link which
might be a questionable assumption

So haven't come across anywhere where it permits MLD routers to ignore
slctd Node group membership in MLD announcements, which is why I've said
that MLD routers act as per RFC2710 or RFC3810 without modification to
discover on link slctd node multicast groups (excepting that multicast
forwarding doesn't need to be enabled)

If they are ignoring them, they're actively choosing to, so if implementing
what I've proposed, that bit of code would need to be disabled.

(which, admittedly, is discussed in Relaxed Mitigation Mode section).

Relaxed Mitigation Mode is about tolerating listeners that don't send MLD
for slctd Node groups, or for when MLD multicasts might not be reliable
(although that might be a smaller problem than mcast ND NS or mcast RS
and/or RA loss)

Regards,
Mark.

> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops