Subject: Re: Draft 6man minutes from IETF102

From: George Michaelson <[email-masked]>
Date: Thu, 2 Aug 2018 13:45:38 +1000

I've been on leave, just back online. This is almost certainly OBE.

My sense of this was, that the constraint on a fabric, the extent to
which a given layer-2 substrate does or doesn't do something is really
not that clear to me.

So, IFF (and I guess I do mean the if and only if statement) the
layer-2 model can exclude all v4 encoded packetforms: ARP/ICMP/IPv4
then, a signal in IPv6 packetforms to say "there is no IPv4 here" in a
secure, trustable manner, makes perfect sense.

If the underlying substrate isn't trusted, can't exclude the packets,
then this is no different to the rogue-RA problem in Ipv4 networks
when a new IPv6 host pops up: whats the meaning of a 'foreign'
protocol, if you can't exclude the packets?

I guess there is value in a signed, trustable assertion 'do not
believe any IPv4 you see here' from the IPv6 component, but it has to
be *signed* or otherwise verifiable. Otherwise, its just another
attack vector: disclaim IPv4, sucker all the IPv6 to come to 'you' as
the one true route.

I used the hypothetical risk of an attack on LAT or on Novell Netware,
in the sense we've lived through this before: we had this, transiting
from older protocols, wedged into our kernels, on large systems in the
past.

But as I said: I suspect this is all moot.

-G

On Sat, Jul 21, 2018 at 3:55 AM, Brian E Carpenter
<[email-masked]> wrote:
> There are three places where I apparently said nothing. Without checking the
> audio, I can't be sure, but I've inserted below what I think I said,
> or at least what I would have said if I had thought:
>
>> slides: "IPv6 Router Advertisement IPv6-Only Flag"
>> (https://datatracker.ietf.org/meeting/102/materials/slides-102-6man-ipv6-router-advertisement-ipv6-only-flag-00)
>>
>>     Brian Carpenter stepped through the slides.
>>
>>     George Michaelson: There are many attack vectors. Why do we need this
>>     bit? I don't get it. But I don't want to say don't do this. I'm
>>     trying to think of the model.
>>
>>     Brian:
>
> [I believe that was in response to this line on slide3:
> "Possible use of IPv4 for malicious traffic"]
>
> Brian: We aren't talking about any specific attacks. It's just
> a reduction of the attack surface.
>
>>     Lorenzo Colitti: I think you should clarify what it means.
>>
>>     Brian:
>
> [I think this was about the "6" bit itself.]
>
> Brian: Please send details of what isn't clear.
>
>>     Lee Howard: Trying to get drivers installed for protocols was
>>     challenging. This is changing default behaviors.
>>
>>     Jen Linkova: I think it could prevent some attack vectors.
>>
>>     Brian:
>
> Brian: We agree.
>
>>     Lorenzo: There is no way to make this secure. We can never turn off
>>     DHCPv4 to the end of time.
>
> [I don't think I replied to that, but it's true: we can't *force*
> hosts to respect the "6" bit.]
>
> Regards
>    Brian
>
>
> On 20/07/2018 02:29, Bob Hinden wrote:
>> Hi,
>>
>> The draft minutes for Monday’s 6man session can be found at:
>>
>> https://datatracker.ietf.org/meeting/102/materials/minutes-102-6man
>>
>> Please review and let know if we didn’t capture you comments correctly.
>>
>> Many thanks to Barbara Stark for her fine minutes!
>>
>> Thanks,
>> Bob & Ole
>>
>>
>>
>>
>> --------------------------------------------------------------------
>> IETF IPv6 working group mailing list
>> [email-masked]
>> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>> --------------------------------------------------------------------
>>
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 3 Aug 2018 12:03:27 +1200

George,

> attack vector: disclaim IPv4, sucker all the IPv6 to come to 'you' as

That could only happen if all the IPv6 routers on the link were
malicious, since the 6 bit is only effective if all routers set
it. So in that case the link would already be in deep trouble.

Regards
   Brian

---

From: Bob Hinden <[email-masked]>
Date: Mon, 13 Aug 2018 13:35:31 -0700

Minutes are now updated.

Bob

> On Jul 20, 2018, at 10:55 AM, Brian E Carpenter <[email-masked]> wrote:
>