Source Address Selection for the Multicast Listener Discovery (MLD) Protocol
updates
- rfc-2710 — Multicast Listener Discovery (MLD) for IPv6
Extracted elements (10)
The unspecified address (::) is permitted as a source address for MLD Report/Done messages because a node performing Duplicate Address Detection (DAD) for its link-local address has no valid link-local address available, yet must still join multicast groups to complete DAD. Without this allowance, several implementations skipped MLD Reports during DAD, causing switches performing MLD snooping to not forward DAD messages to all nodes, allowing address collisions.
Nodes that join multicast groups other than the link-local solicited-node group prior to obtaining a link-local address may experience a temporary black hole if RFC 2710 implementations discard their Reports sent with :: source; this resolves once the node acquires a valid link-local address.
RFC 2710 implementations receiving MLD messages with source address :: may drop them if they do not consider the unspecified address to be link-local in scope. This is acceptable because the unspecified address is only used when joining the link-local solicited-node multicast group during DAD, so dropping has no effect on the sender's operation.
If a node receives a Query message with an IPv6 source address set to the unspecified address (::), it MUST silently discard the message and SHOULD log a warning.
MLD Query messages MUST be sent with a valid link-local address as the IPv6 source address.
MLD Report and Done messages are sent with a link-local address as the IPv6 source address if a valid address is available; if not, they MUST be sent with the unspecified address (::).
Once a valid link-local address is available, a node SHOULD generate new MLD Report messages for all multicast addresses joined on the interface.
Routers receiving an MLD Report or Done message with the unspecified address as the IPv6 source address MUST silently discard the packet without taking any action on the packet's contents.
Snooping switches MUST manage multicast forwarding state based on MLD Report and Done messages sent with the unspecified address (::) as the IPv6 source address.
All received MLD messages from an unspecified source address are silently discarded by hosts and routers, consistent with RFC 2710; this document introduces no new security impacts for those devices. For snooping switches that do maintain forwarding state from unspecified-source messages, the security vulnerabilities are analogous to those from forged MLD messages as described in RFC 2710.