Subject: [v6ops] Microsoft Win10 source address selection woes

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 7 Sep 2017 12:53:40 +0200 (CEST)

I am finding interesting behavior with my fully updated Win10. It seems to 
prefer "public" address over temporary, which doesn't seem to follow 
RFC6724. These addresses are all in the same /64, I am running with A=1.

(obfuscated some fields)

>netsh int ipv6 sho addr

Interface 6: Ethernet

Addr Type  DAD State   Valid Life Pref. Life Address
---------  ----------- ---------- ---------- ------------------------
Temporary  Deprecated    5d2h5m1s         0s PREFIX:8403:XYZ:f15e:d720
Temporary  Preferred    6d2h3m27s    2h1m57s PREFIX:a910:XYZ:ef8e:3484
Public     Preferred  29d23h57m11s 6d23h57m11s PREFIX:c16d:XYZ:XYZ:a45c
Other      Preferred     infinite   infinite fe80::c16d:fb79:XYZ:XYZ%6

Now, when I use web browsers (firefox/chrome/edge) they all use the public 
address for outgoing connections. This is not what I expected (and not 
what I see on my MacOS machine).

RFC6724 rule 7 seems it should indicate that temporary address should be 
chosen. However, RFC3484 says public addresses should be chosen over 
temporary ones, unless specific API calls are made.

Does this mean Windows 10 doesn't implement RFC6724 but instead implements 
3484?

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Erik Kline <[email-masked]>
Date: Thu, 7 Sep 2017 20:08:45 +0900

Is it expected that apps should make use of some
https://tools.ietf.org/html/rfc5014 API?

On 7 September 2017 at 19:53, Mikael Abrahamsson <[email-masked]> wrote:
> address for outgoing connections. This is not what I expected (and not what
> I see on my MacOS machine).
>
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops

---

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 7 Sep 2017 13:10:50 +0200 (CEST)

> https://tools.ietf.org/html/rfc5014 API?

Another twist is that the person who initially brought this to my 
attention now said that if his application sends UDP packets, it will by 
default use the temp address.

Very confusing. Different APIs, different defaults?

---

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 7 Sep 2017 19:35:06 +0200 (CEST)

On Thu, 7 Sep 2017, Mikael Abrahamsson wrote:

> Does this mean Windows 10 doesn't implement RFC6724 but instead 
> implements 3484?

I have now done more tests. It seems this problem only occurs when windows 
has two temporary addresses, one of which is deprecated and has 0 
preferred time.

So as long as it has single temp address, the temp address is used for 
outgoing browser connections.

When it has two temp addresses, it starts using the public address.

People at Microsoft has been notified about my findings.

---

From: Lorenzo Colitti <[email-masked]>
Date: Fri, 8 Sep 2017 19:57:18 +0900

On Sep 8, 2017 02:35, "Mikael Abrahamsson" <[email-masked]> wrote:

That's amusing. Perhaps the OS thinks privacy is good, but only if you
don't have too much of it ;-)

---

From: Sourav Das <[email-masked]>
Date: Thu, 14 Sep 2017 05:57:51 +0000

Windows does implements RFC 6724 and prefers temporary addresses over public address (per rule 7) . This happens for the 1st temporary address generated by the stack when the interface gets enabled (as mentioned below). However due to a bug in our code for subsequently re-generated temporary addresses (when the 1st gets deprecated), the public address is unintentionally preferred over them. We are working on a fix to address this. Thanks for bringing this to our notice.

-----Original Message-----
From: Mikael Abrahamsson [mailto:[email-masked]] 
Sent: Thursday, September 7, 2017 10:35 AM
To: [email-masked]
Subject: Re: [v6ops] Microsoft Win10 source address selection woes

> Does this mean Windows 10 doesn't implement RFC6724 but instead 

I have now done more tests. It seems this problem only occurs when windows has two temporary addresses, one of which is deprecated and has 0 preferred time.

So as long as it has single temp address, the temp address is used for outgoing browser connections.