Re: I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

[Fernando Gont <[e-mail]>]

Hi, Jen,

On 10/19/18 2:22 PM, Jen Linkova wrote:
> Speaking as a network operator: the more I think about this draft the
> more I like it.
> It looks like the main concern is potential attack vectors. However...
> 
> 1) IPv6-Only network (== the network which is configured by the
> network administrator as Ipv6-only): I do not see any security issues
> here. Actually  signalling hosts that IPv4 could be disabled might
> even reduce the attack vector (one less protocol to be attacked from
> onlink).

Depends on the pov: removes a vector if you don't employ v4, creates one
if you do.



>  Attacker might send a rogue RA and *enable* Ipv4 on hosts but
> obviously RA Guard should be deployed on v6-only networks. 

If only RA-Guard implementations had been fixed as described in RFC7113.
As far as I know, most haven't.



> In other
> words, there is nothing which could be done with that flag which could
> not be done w/o it.

If you have v4 security in place, but no v6 securty in place, you *can*
do something that otherwise couldnt.


> 3) IPv4-only network. This is most tricky part.
> 3.1)  A device accidentally configured as an IPv6-only sends an RA
> with GUA PIO and advertised itself as a default gateway. Happy
> Eyeballs might help for systems which support them;
> 3.2) An attacker intentionally sets up an IPv6 router on IPv4-only
> network. It should be noted that in case of an intentional attack
> Happy Eyeballs would not help at all, as nothing would prevent an
> attacker to respond, for example, to TCP SYN. 

That assumes that you have "hijacked" the RDNSS in the first place. And
that you can get a copy of what the victim sends (unicast) on the
network -- can be done, but ned not be the case.


>  It's even worse if you
> think about RDNSS etc. Basically,  intentional RA_based attacks on
> v4-onoy networks are mugh worse than just 'turn off v4 anyway';

But yes, this is a problem, indeed. See e.g.:  RFC7359



> 3.3) A device accidentally configured as an IPv6-only sends an RA with
> v6-only flag set.  Well, not as bad as 3.2, worse than 3.1. However it
> would require an explicit action from the device admin (as the flag
> need to be explicitly configured). And the easy solution? Routers in
> v4-only networks need to support v6 and send RAs with the flag set to
> 0 (as well as zero default router lifetime) - might help with rogue
> RAs too..

If the network si meant to be ipv4 only, you better drop v6 at layer 2.




> Other thing: it looks like there is a real need to implement IPv6
> security even on v4-only networks. Sounds like v6ops-scope draft (or
> maybe there is one? I'm happy to craft smth if it does not exist).

It does: RFC7123 :-)

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492