Re: [BEHAVE] NAT64: Security issues with funny addresses

On Nov 20, 2010, at 4:42 AM, Simon Perreault wrote:

> In draft-ietf-behave-v6v4-xlate-23, there is the following in the
> Security Considerations section:
> 
>   There are potential issues that might arise by deriving an IPv4
>   address from an IPv6 address - particularly addresses like broadcast
>   or loopback addresses and the non IPv4-translatable IPv6 addresses,
>   etc.  The [I-D.ietf-behave-address-format] addresses these issues.
> 
> I cannot find information on these issues in the referenced document
> (nor in RFC 6052).

We must have been looking at an earlier version of the document when we wrote that.

> So what should implementors do? Block them?

I would expect that the biggest issue is the fact of a replicated IPv4 address space. For example, Verizon says it has 70 instances of 10.0.0.0/8 in its network. Using a stateless translator, one could imagine it connecting them as 2001:dba:nnaa:bbcc:dd00::, where nn is an instance number and aa.bb.cc.dd (except converted to decimal) is the IPv4 address. This of course works just fine within the IPv6 part of the network or between IPv6 hosts in such a network and IPv4 hosts within any one of those IPv4 domains - they are completely separate addresses in IPv6. But it's not at all obvious how a computer (handset) in one of those domains addresses a computer in another using IPv4, and if it thinks it is doing so it has a good chance of talking to the wrong instance of that address. This is of course a primary failing of IPv4 NAT in general, it just happens to be under discussion in an IPv4/IPv6 scenario.

I don't know that I would recommend blocking them. I would simply recognize that there are some things that I won't be able to do, or won't be able to readily do, in a network that has replicated address space.

> It could be a major security issue in practice. Just thinking of this
> makes me nervous:
> 
> $ ssh 64:ff9b::127.0.0.1
> 
> Simon
> -- 
> DTN made easy, lean, and smart --> http://postellation.viagenie.ca
> NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
> STUN/TURN server               --> http://numb.viagenie.ca
> _______________________________________________
> Behave mailing list
> Behave@ietf.org
> https://www.ietf.org/mailman/listinfo/behave