Hi!

OpenBSD does SLAAC with variable prefix length now. It doesn't have to be /64, it can also be /60 or /68 for example.

<https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sbin/slaacd/engine.c#rev1.22

ciao,
Markus

---
* Origin: *** theca tabellaria *** (2:240/1661)

Hello Markus!

18 Mar 2018 11:41, Markus Reschke wrote to All:

OpenBSD does SLAAC with variable prefix length now. It doesn't have to
be /64, it can also be /60 or /68 for example.

note to whom breaks /64 will be blacklisted at spamhaus

there rule is /64 is a single user, /63 or less will be multispammers


Regards Benny

... there can only be one way of life, and it works :)

--- Msged/LNX 6.2.0 (Linux/4.9.76-gentoo-r1 (i686))
* Origin: I will always keep a PC running CPM 3.0 (1:261/38.20)

Hi Benny!

Mar 18 14:50 2018, Benny Pedersen wrote to Markus Reschke:

note to whom breaks /64 will be blacklisted at spamhaus

there rule is /64 is a single user, /63 or less will be multispammers

How would they figure out which prefix length I'm using for some subnet in my network? Anyway, that rule seems to be utter nonsense. Typical assignments are /48 and I have a /56 (dynamic) for my DSL.

ciao,
Markus

---
* Origin: *** theca tabellaria *** (2:240/1661)

Hello Markus,

On Sunday March 18 2018 11:41, you wrote to All:

OpenBSD does SLAAC with variable prefix length now. It doesn't have to
be /64, it can also be /60 or /68 for example.

I have mixed feelings about this.

+ It allows more flexibility. For example if your ISP just gives you
one /64, you can still have multiple subnets. E.g by cutting the
/64 in 65536 /80s. Should be enough for everyone.

- The providers can use this as an argument to just give you one /64.


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

On 2018-03-18 22:34, Michiel van der Vlist : Markus Reschke wrote:

Hello Markus,

On Sunday March 18 2018 11:41, you wrote to All:

OpenBSD does SLAAC with variable prefix length now. It doesn't have to be /64, it can also be /60 or /68 for example.

I have mixed feelings about this.

+ It allows more flexibility. For example if your ISP just gives you
one /64, you can still have multiple subnets. E.g by cutting the
/64 in 65536 /80s. Should be enough for everyone.

- The providers can use this as an argument to just give you one /64.

As long as the outside gets its own range (/64 or smaller) I think many
could survive with "only" 18446744073709551616 v6 ips to go, split into
several smaller nets, as long as their software handles it.

I think there was some ndp exhaustion attack where you were advised to
use something like /120 for link nets (not using SLAAC there of course)
in order for routers to not have to keep huge NDP tables for that link,
so in that sense most software should be able to think in smaller than
/64 nets and now, also for dynamic client configuration on obsd.

---
* Origin: nntp://news.fidonet.fi - Lake Ylo - Finland (2:221/6)

Hi Michiel!

Mar 18 22:34 2018, Michiel van der Vlist wrote to Markus Reschke:

MvdV> I have mixed feelings about this.

MvdV> + It allows more flexibility. For example if your ISP just gives
MvdV> you one /64, you can still have multiple subnets. E.g by cutting
MvdV> the /64 in 65536 /80s. Should be enough for everyone.

Another good point is the subnetting for PtP links. A link between two routers doesn't need SLAAC and a /64. All your links would fit in a /64 easily. There are several papers discussing the usage of much longer prefixes like /128.

MvdV> - The providers can use this as an argument to just give you one
MvdV> /64.

I don't think so. There are too much devices supporting only /64 with SLAAC. And OpenBSD isn't a widespread OS for end users.

ciao,
Markus

---
* Origin: *** theca tabellaria *** (2:240/1661)

Hello Janne!

Mar 19 09:59 2018, Janne Johansson wrote to Michiel van der Vlist:

I think there was some ndp exhaustion attack where you were advised
to use something like /120 for link nets (not using SLAAC there of course) in order for routers to not have to keep huge NDP tables for
that link, so in that sense most software should be able to think in smaller than /64 nets and now, also for dynamic client configuration
on obsd.

The ND exhaustion attack would be only possible for a directly connected network, e.g. a LAN. A xfer network for a link between routers isn't affected because ND should only accept local packets. Anyway, there are several solutions to limit/mitigate the problem for a LAN router.

ciao,
Markus

---
* Origin: *** theca tabellaria *** (2:240/1661)

On 2018-03-19 14:53, Markus Reschke : Janne Johansson wrote:

Hello Janne!

The ND exhaustion attack would be only possible for a directly connected network, e.g. a LAN. A xfer network for a link between routers isn't
affected because ND should only accept local packets. Anyway, there are several solutions to limit/mitigate the problem for a LAN router.

In the examples I saw, they just nmap'ed the range of a link network
and caused issues on routers when it's ndp/arp cache got filled with
tons of entries waiting to see if they could be resolved (which they
couldn't since no entity was there) and where you as an attacker could
figure out which network to attack just using traceroutes.

In that case, moving to a /120 (ie like a /24 in IPv4 terms) meant there
could be at most 256 entries to scan on that interface and it would
easily be accomodated in the router neighbor caches while still having
lots of room for whatever you need on that link.

---
* Origin: nntp://news.fidonet.fi - Lake Ylo - Finland (2:221/6)