Subject: Re: IPv6 ingress filtering early access

From: Pekka Nikander <[email-masked]>
Date: Thu, 03 Jan 2002 11:32:05 +0200

Francis Dupont wrote:

> I have written a draft about IPv6 ingress filtering (with home address
> option considerations). It is not finished (some editing is needed) but
> I have put it for early access on (sorry for the long line):
> 
> ftp://ftp.ipv6.rennes.enst-bretagne.fr/pub/draft-dupont-ipv6-ingress-filtering-00.txt

The draft is quite nice, thanks for writing it.  There are a few problems,
though, that I see.  Firstly, I really do find it unrealistic to assume
that each and every site in the world would understand AAA, and change their
ingress filtering rules based on AAA information.  Thus, that leaves changing
the Binding Cache into hard state (instead of being cache) the only option, i.e.
requiring that the CNs check the HAO against the Binding information.

Secondly, such a the proposed practice would basically foil all of the
designed zero-configuration nature of IPv6.  That is, the reason for IPv6
stateless autoconfiguration is to allow hosts to be plugged in to a IPv6
network without any prior configuration.  IMHO, such a practice would be
very good in many environments, even in public access WLANs.  (I know that
some people disagree with me.)

Thirdly, if we consider most current DDoS attacks, the majority of hosts
used to launch those attacks seem to be badly administered PCs that belong
to home users, careless university labs, etc.  When we move to IPv6, there
will continue to be organizations with little administrative knowledge
(e.g. home users) or little money (e.g. some universities).  It is exactly
those kinds of organizations that are likely to continue having hosts that
can be broken in and used in DDoS attacks.  Now, the point is that those
are also exactly the organizations that are most _unlikely_ to use advanced
ingress filtering methods, or AAA at all.  Thus, relying on AAA and advanced
ingress filtering will most probably secure those parts of IPv6 internet that
already have relatively secure hosts (e.g. mobile handsets or PDAs), and
not those parts of the IPv6 internet that have insecure hosts.

--Pekka Nikander

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pekka Nikander <[email-masked]>
Date: Thu, 03 Jan 2002 11:32:05 +0200

--Pekka Nikander

---

From: Francis Dupont <[email-masked]>
Date: Thu, 14 Feb 2002 15:20:59 +0100

In your previous mail you wrote:

   > option considerations). It is not finished...
   
=> note the draft was finished and published.
   
   The draft is quite nice, thanks for writing it.

=> thanks for reading it.

   There are a few problems,
   though, that I see.  Firstly, I really do find it unrealistic to assume
   that each and every site in the world would understand AAA, and change their
   ingress filtering rules based on AAA information.

=> I assume you use AAA in its traditional meaning, i.e. network access
control with something like RADIUS. Please don't make the confusion between
network addresse control and full AAA with infrastructure, etc.

   Thus, that leaves changing
   the Binding Cache into hard state (instead of being cache) the only option,
   i.e. requiring that the CNs check the HAO against the Binding information.

=> there are other options (look at the mobile-ip list) but it seems
the two detailed proposals are ingress filtering using some kind/level
of network access control and binding cache entry check.

=> I agree the zero-configuration is very fine and I don't believe into
DHCPv6, i.e. something which tries to impose its idea of your address to you.
But I make a distinction between to allow hosts to be plugged in and
to allow hosts to freely access to the Internet.
The device which provides the step between is the network access control.
I don't want to enter into details about how to do it, the important
notion is the trust/responsability, i.e. if you give some access to
a node and something is going wrong, you accept to take the responsability
to take care of the problem. IMHO this is more important than ingress
filtering itself: without trust/responsability, the bad guy has no need
to do source address spoofing.
So, as I am perhaps (:-) in the people who disagree with you, what you
propose if you get the role of a public access WLAN manager?

   Thirdly, if we consider most current DDoS attacks, the majority of hosts
   used to launch those attacks seem to be badly administered PCs that belong
   to home users, careless university labs, etc.

=> this proves ingress filtering reachs its limits when an action is
required...

   When we move to IPv6, there
   will continue to be organizations with little administrative knowledge
   (e.g. home users) or little money (e.g. some universities).  It is exactly
   those kinds of organizations that are likely to continue having hosts that
   can be broken in and used in DDoS attacks.

=> I agree: network access control doesn't imply good administration
but usually it is simply part of a at least minimal administration
(always better than nothing). For instance location of compromised hosts
can be possible.

   Now, the point is that those
   are also exactly the organizations that are most _unlikely_ to use advanced
   ingress filtering methods, or AAA at all.  Thus, relying on AAA and advanced
   ingress filtering will most probably secure those parts of IPv6 internet
   that already have relatively secure hosts (e.g. mobile handsets or PDAs),
   and not those parts of the IPv6 internet that have insecure hosts.
   
=> the issue is in the target: you'd like to secure the Internet, this
is an admirable idea but, for some reasons you have just explained,
not really feasible. My purpose is to get back to the previous situation,
i.e. current IPv4 ingress filtering, so I prefer to stress the trust/
responsability stuff (what I called the "responsible usage of the network")
because in fact the places where advanced ingress filtering won't work are
the places where ingress filtering itself won't work.
 I have a lot of other arguments but they are already in the zillion of
previous messages about the HAO security... BTW the design team proposed
a recommendation based on the FUD against mobile IPv6 and selected the
BCE check solution. I am very pessimist about the future of mobile IPv6
because the improvements over mobile IPv4 fully rely on the routing
optimization: as someone explained, there are only two kinds of common
correspondent nodes: web servers, but to deal with routing optimization
with its security, hard state binding cache, etc, is too expensive so
shan't be done, and mobile terminals (handsets, PDAs, (robust) laptops),
the problem is the design team didn't consider this special case (aka
mobile to mobile)... We are trying to save something but most of the
marvellous promises of mobile IPv6 can already be considered as hype.

Regards

[email-masked]

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 14 Feb 2002 16:26:34 +0100 (CET)

> I am very pessimist about the future of mobile IPv6

Francis,

I don't share you pessimism.

I think the claim that there are only two types of CNs that matter for
mobile IPv6 (Web servers and mobile terminals) is a bit odd.

That is similar to saying that since most of the traffic on the internet
is http why don't be build an http network instead of an IP network?

The point is that the value of the Internet comes from service/application
independence - people can build new services and applications and have
them run on the Internet today - no need to upgrade things in the middle to
deploy new things.

So building a http + voip network is the wrong thing to do and
the above statement sounds like it would be the right approach which is
why I disagree with it rather strongly.

  Erik

---

From: Francis Dupont <[email-masked]>
Date: Thu, 14 Feb 2002 17:48:39 +0100

=> I'd prefer to be wrong...

=> this is not my claim but this is clearly the vision of the Internet
by many players in Europe (worse in France where the Internet is the
super Minitel, brrr...)

=> Brian Carpenter argues this can become the future of the Internet.
Of course we don't want that, but remember I've begun by "I am pessimistic"
and there is somthing named SOAP...

=> you don't need to convince me and I'm afraid the folks we should
convince don't read these lists.

=> if you replace http by WAP (not an improvement) this is exactly
what they are trying to do (I don't add a smile because this is *not* funny).

=> there is what we'd like and there is what it is (look better in French)...

Regards