Re: I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

[Jen Linkova <[e-mail]>]

On Sat, Oct 20, 2018 at 3:42 AM Sander Steffann <[e-mail]> wrote:
> My main fear is for SMB networks which often are still IPv4-only (which also needs to be fixed, but that's a separate issue), don't have managed switches or WiFi controllers with no RA Guard etc. There are many of such networks. Those networks are vulnerable to rogue RAs already, but happy eyeballs can mitigate the impact of someone messing with that. If this flag can kill IPv4 on the network then hosts become completely disconnected and happy eyeballs won't be able to mitigate anymore.
>
> Yes, a serious attacker can do more harm even without this flag. This flag could however make it possible for kids/students/disgruntled employees/me/etc to bring down the network with a single packet.

All those people can take the whole network (almost) down with a
single packet w/o the v6-only flag anyway.
How about this:
- kids/students/disgruntled employees/you can send an RA with GUA PIO
and RDNSS option;
- hosts start sending IPv6 traffic to IPv6-enabled destinations to the
rogue host;
- it would be enough for the attacker to respond with SYN/ACK to TCP
handshake to take Happy Eyeballs out of the picture for TCP traffic;
- the attacker can also answer DNS requests and make the situation
even worse (if the victims prefer to use RDNSS servers);

>Such networks have no capacity for debugging anyway, and because of the low number of packets necessary to sustain the attack won't know what hit them. ISPs will get calls about the internet being broken, ICT consultants will spend hours searching for the cause of the problem, they will all blame "that annoying IPv6 thingy" etc etc etc. Let's avoid all of that.

I agree we shall avoid all of that. But the way to do this is not by
setting/unsetting some flags in RAs but by implementing proper IPv6
security.


--
SY, Jen Linkova aka Furry