IPv6 happy eyeballs breaks connection to secure sites

Question

Level 1

0 points

IPv6 happy eyeballs breaks connection to secure sites

OSX / Safari seems to choose protocol IPv4 or IPv6 based on best network performance (syn-ack roundtrip time ?). What is even worse, the browser toggles protocol within a secure SSL session (e.g. banking). Most sites that contain sensitive information will break the connection for security reasons if the IP address changes.

In my opinion, Safari should give IPv6 a preference, and should only fallback to IPv4 if the connection is really bad. Moreover, the number of switchovers should be limited since it is almost impossible to finish a secure transaction sequence.

As most Internet providers do not yet support IPv6, IPv6 enabled networks do so by tunneling, which makes the IPv6 network slightly slower than the IPv4 network. Still I believe we should give IPv6 a preference.

Please Apple, dont discourage early IPv6 adopters and correct this behavior. By the way: Chrome on OSX suffers from the same problem.

Jan C.

One additional note: the IPv6 tunnel is not terminated on my Macs, but on the network vdsl2 gateway device

macbook air, Mac OS X (10.6.6)

Posted on Mar 13, 2013 3:50 AM

Reply

Answer 1

jcolg Author

Level 1

0 points

Mar 13, 2013 3:54 AM in response to jcolg

By the way, I can solve the problem by adding a blackhole ipv4 route to the bank website:

sudo route add www.mybank.com 0.0.0.0

Reply

Answer 2

jcolg Author

Level 1

0 points

Mar 15, 2013 3:27 AM in response to jcolg

Seems like in 10.8.3, Apple kind of solved this problem: Safari and Chrome do not switch anymore between IPv6 and IPv4, but seem to prefer IPv4 (in my case the shortest roundtrip time).

I still believe Apple should give preference to IPv6, but at least I can access the secure sites again without adding blackhole routes.

Reply

Answer 3

jcolg Author

Level 1

0 points

Mar 15, 2013 4:06 AM in response to jcolg

Correction: 10.8.3 still suffers from this problem. I was too early with my conclusion.

Reply

Answer 4

Lexiepex

Level 6

14,108 points

Mar 15, 2013 5:31 AM in response to jcolg

in ML System Preferences/Network/Advanced/TCP-IP tab:

set "Configure IPv6" to "link-local only" .

See if that helps.

Reply

Answer 5

jcolg Author

Level 1

0 points

Mar 15, 2013 9:31 AM in response to Lexiepex

I dont want to disable IPv6. I use and need IPv6, so your solution does not solve my problem. I prefer my temporary solution of blackholing the IPv4 routes to some sites.

Reply