[JIRA] Commented: (SSPCPP-447) Extension of consistentAddress for IPv6

[Kaspar Brand (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-447?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14034#comment-14034 ] 

Kaspar Brand commented on SSPCPP-447:
-------------------------------------

Re: IPv6 privacy extensions - 1 day is actually the recommended default as per RFC 4941:

   TEMP_PREFERRED_LIFETIME -- Default value: 1 day.  Users should be
   able to override the default value.

Unless you're tuning the settings of your IP stack (which very few people do, I'd assume), 1 day is what you get on a standard Windows, OS X, Linux etc. box.

Having the mechanism of "auto-accept the other type of IP address once [and lock]" seems like a useful enhancement for improving compatibility with the Happy Eyeballs algorithm without having to completely sacrifice the additional cookie protection provided by consistentAddress.

> Extension of consistentAddress for IPv6
> ---------------------------------------
>
>                 Key: SSPCPP-447
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-447
>             Project: Shibboleth SP - C++
>          Issue Type: Improvement
>            Reporter: Lukas Haemmerle
>            Assignee: Scott Cantor
>
> With the increased usage of IPv6 we get more and more user reports from
> users that frequently lose their Shibboleth sessions at SPs although the
> inactivity between subsequent requests to the same SP is only a few
> minutes. This then also often forces them to re-authenticate at the IdP
> (after the default inactivity timeout of 30 min is over). Currently,
> it's mostly Mac OS X 10.7 (Lion) users.
> We found that the cause of this behavior has to to with the
> consistentAddress check and the availability of IPv6 and IPv4.
> If the client and the server both support the two protocols, then issues
> like the one described above may occur with certain OS and browsers
> because these send requests once with IPv4 and some time later with
> IPv6. The algorithm used for the connection setup is nicknamed Happy
> Eyeballs [1]. It is supposed to improve the connectivity/responsiveness
> of IPv6 networks. The behavior of Mac OS X 10.7.x clients is a bit
> different from the one used in Chrome and Firefox 10 that also use the
> Happy Eyeballs algorithm. Mac OS does not prefer IPv6 but uses the
> destination/protocol with the lowest round trip time. Depending on
> routing and network load, this may be the IPv4 address at one time and a
> few minutes later the IPv6 address.
> Possible solutions against this Happy Eyeballs side effect with
> consistentAddress="true" (default) are:
> - Disable IPv6 on client
> - Disable IPv6 on server
> - Disable consistentAddress (consistentAddress="false")
> All of the above solutions have their limitations and drawbacks.
> Another possible solution could be to extend the SP to auto-accept and store 
> one address for IPv4 and IPv6 each per session (identified by session cookie). 
> This may mitigate the issue described above. 
> One drawback here could be that this may degrade the security of
> the extended consistentAddress feature as an attacker probably could
> misuse it. So we are wondering what developers think of this?
> Also to note: With IPv6 sometimes comes a privacy extension [2] that
> will change the user's IPv6 regularly on some clients. Although this IP
> change seems to be rather daily than hourly according to our IPv6
> specialists, it still should be taken into account.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira