Re: I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

[Brian E Carpenter <[e-mail]>]

Sander,

A single packet containing a forged RA with the v6-only flag set cannot take
down a network. The condition is that a host sees *only* RAs with the flag
set. The opposite applies: a single RA with the v6-only flag *clear* tells
all hosts that they may try IPv4 as much as they want.

As the draft says, if a bad actor takes over all IPv6 routers on the link,
then they can break IPv4, but so what? They can break anything.

Regards
   Brian

On 2018-10-20 06:09, Sander Steffann wrote:
> Hi,
> 
>> All those people can take the whole network (almost) down with a
>> single packet w/o the v6-only flag anyway.
>> How about this:
>> - kids/students/disgruntled employees/you can send an RA with GUA PIO
>> and RDNSS option;
>> - hosts start sending IPv6 traffic to IPv6-enabled destinations to the
>> rogue host;
>> - it would be enough for the attacker to respond with SYN/ACK to TCP
>> handshake to take Happy Eyeballs out of the picture for TCP traffic;
> 
> And here you go beyond "a single packet".
> 
>> - the attacker can also answer DNS requests and make the situation
>> even worse (if the victims prefer to use RDNSS servers);
> 
> Same here.
> 
>>> Such networks have no capacity for debugging anyway, and because of the low number of packets necessary to sustain the attack won't know what hit them. ISPs will get calls about the internet being broken, ICT consultants will spend hours searching for the cause of the problem, they will all blame "that annoying IPv6 thingy" etc etc etc. Let's avoid all of that.
>>
>> I agree we shall avoid all of that. But the way to do this is not by
>> setting/unsetting some flags in RAs but by implementing proper IPv6
>> security.
> 
> The world of SMBs and home networks is not like that... The vast majority of SMBs don't even have a manageable switch.
> 
> Cheers
> Sander
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
> .
>