Reporting IPv6 router advertisement processing bug on Mac OS X
Summary of this issue
Mac OS X on MacBook Pro with a certain Broadcom hardware/firmware removes IPv6 addresses when it receives router advertisements. IPv6 packets are lost during this process, i.e., after the removal and before the reassignment. Moreover, things are going to be worse when we use (non-EUI-64) temporary addresses. Since the reassigned temporary address becomes new (i.e., different) address, TCP connections (e.g., ssh) are lost and applications hang up until their timeout.
Specific firmware affected
We investigated the causes of this issue by testing four MacBook Pros. Here, we would like to thank our colleagues for letting us use their laptops.
- Affected
- AirPort: Broadcom BCM43xx 1.0 (5.10.131.16.1)
on Mac OS X 10.6.4 (10F569) - Not affected
- AirPort: Broadcom BCM43xx 1.0 (5.10.91.27)
- AirPort: Atheros 5416: 2.0.19.10
- Ethernet ports
- Not tested for others than the above
Detailed description on this issue
Issue of IPv6 address removal for EUI-64 address
EUI-64 IPv6 address is removed when the wireless interface that corresponds to the affected firmware receives IPv6 router advertisements. Just after the removal, it reassigns same EUI-64 IPv6 address to the interface. Therefore, you might not recognize this issue even though some packets would be lost during the reassignment procedure.
Issue of IPv6 address removal for temporary addresses
As we have pointed out in our page, we can enable temporary addresses for protecting our privacy. However, we must meet a huge problem with temporary addresses caused by the issue of IPv6 address removal. After the removal, Mac OS X assigns a new temporary address which is different from the removed one. So, all the sessions, for example TCP connections, can be no longer kept because my IPv6 address has changed. For instance, an SSH session via IPv6 hangs up after this issue (i.e., the IPv6 address removal when it receives router advertisements) until the timeout.
Regression
Avoiding using temporary addresses regresses this issue. All IPv6 connectivities are lost during the reassignment procedure, but TCP connections would be recovered after its recovery because EUI-64 address is identical to the interface.
Conclusion
We have already reported this bug to Apple's bug report site. Hopefully, this issue would be resolved soon by software updates.
Postscript
Bug fix update
This bug has been stealthily fixed in the update HT4250. This update has been provided since Nov. 10, 2010 (Nov. 11, 2010 in JST). We strongly recommend IPv6 users using the firmware Broadcom BCM43xx 1.0 (5.10.131.16.1) to update your firmware.
We note that new version of the firmware is Broadcom BCM43xx 1.0 (5.10.131.36.1) on Mac OS X 10.6.5 (10H574).
Related information
A new bug related to AirPort interface was discovered and reported. For greater detail, please refer to the article [AirPort interface down/up bug on Mac OS X (version 10.6.6)].