[JIRA] Commented: (SSPCPP-447) Extension of consistentAddress for IPv6

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-447?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14032#comment-14032 ] 

Scott Cantor commented on SSPCPP-447:
-------------------------------------

The last point doesn't really lead anywhere but to turning off address checking. There's nothing I could take into account to accomodate addresses changing.

One wonders, then, if this is worth the work. I know they're saying it's mostly not hourly, but "mostly" isn't "not". If some IPv6 stacks are going to be changing addresses more often, that's going to break address checking, and it won't matter if we allow for this.

> Extension of consistentAddress for IPv6
> ---------------------------------------
>
>                 Key: SSPCPP-447
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-447
>             Project: Shibboleth SP - C++
>          Issue Type: Improvement
>            Reporter: Lukas Haemmerle
>            Assignee: Scott Cantor
>
> With the increased usage of IPv6 we get more and more user reports from
> users that frequently lose their Shibboleth sessions at SPs although the
> inactivity between subsequent requests to the same SP is only a few
> minutes. This then also often forces them to re-authenticate at the IdP
> (after the default inactivity timeout of 30 min is over). Currently,
> it's mostly Mac OS X 10.7 (Lion) users.
> We found that the cause of this behavior has to to with the
> consistentAddress check and the availability of IPv6 and IPv4.
> If the client and the server both support the two protocols, then issues
> like the one described above may occur with certain OS and browsers
> because these send requests once with IPv4 and some time later with
> IPv6. The algorithm used for the connection setup is nicknamed Happy
> Eyeballs [1]. It is supposed to improve the connectivity/responsiveness
> of IPv6 networks. The behavior of Mac OS X 10.7.x clients is a bit
> different from the one used in Chrome and Firefox 10 that also use the
> Happy Eyeballs algorithm. Mac OS does not prefer IPv6 but uses the
> destination/protocol with the lowest round trip time. Depending on
> routing and network load, this may be the IPv4 address at one time and a
> few minutes later the IPv6 address.
> Possible solutions against this Happy Eyeballs side effect with
> consistentAddress="true" (default) are:
> - Disable IPv6 on client
> - Disable IPv6 on server
> - Disable consistentAddress (consistentAddress="false")
> All of the above solutions have their limitations and drawbacks.
> Another possible solution could be to extend the SP to auto-accept and store 
> one address for IPv4 and IPv6 each per session (identified by session cookie). 
> This may mitigate the issue described above. 
> One drawback here could be that this may degrade the security of
> the extended consistentAddress feature as an attacker probably could
> misuse it. So we are wondering what developers think of this?
> Also to note: With IPv6 sometimes comes a privacy extension [2] that
> will change the user's IPv6 regularly on some clients. Although this IP
> change seems to be rather daily than hourly according to our IPv6
> specialists, it still should be taken into account.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira