Re: I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

Speaking as a network operator: the more I think about this draft the
more I like it.
It looks like the main concern is potential attack vectors. However...

1) IPv6-Only network (== the network which is configured by the
network administrator as Ipv6-only): I do not see any security issues
here. Actually  signalling hosts that IPv4 could be disabled might
even reduce the attack vector (one less protocol to be attacked from
onlink). Attacker might send a rogue RA and *enable* Ipv4 on hosts but
obviously RA Guard should be deployed on v6-only networks. In other
words, there is nothing which could be done with that flag which could
not be done w/o it.

2) Dual-stack networks. As in such a network there will be at least
one router sending RA w/o that flag - I could not see an attack vector
here.

3) IPv4-only network. This is most tricky part.
3.1)  A device accidentally configured as an IPv6-only sends an RA
with GUA PIO and advertised itself as a default gateway. Happy
Eyeballs might help for systems which support them;
3.2) An attacker intentionally sets up an IPv6 router on IPv4-only
network. It should be noted that in case of an intentional attack
Happy Eyeballs would not help at all, as nothing would prevent an
attacker to respond, for example, to TCP SYN.  It's even worse if you
think about RDNSS etc. Basically,  intentional RA_based attacks on
v4-onoy networks are mugh worse than just 'turn off v4 anyway';
3.3) A device accidentally configured as an IPv6-only sends an RA with
v6-only flag set.  Well, not as bad as 3.2, worse than 3.1. However it
would require an explicit action from the device admin (as the flag
need to be explicitly configured). And the easy solution? Routers in
v4-only networks need to support v6 and send RAs with the flag set to
0 (as well as zero default router lifetime) - might help with rogue
RAs too..

Obviously, this draft does not make the situation worse for the
malicious/rougue router scenario. An attacker can easily do more
damage w/o this flag if RA Guard is not deployed. The only concerning
case seems to be accidentally configured devices.  Maybe it would help
to say that the host SHOULD ignore the flag if the RA does not contain
GUA PIO?

Other thing: it looks like there is a real need to implement IPv6
security even on v4-only networks. Sounds like v6ops-scope draft (or
maybe there is one? I'm happy to craft smth if it does not exist).

On Wed, Oct 17, 2018 at 12:40 PM Brian E Carpenter
<brian.e.carpenter@gmail.com> wrote:
>
> Hi,
>
> We've attempted in this version to respond to the comments received during WGLC.
>
> The most important change is this:
>       *  Reorganized text about problem statement and applicability
> We hope the new text makes it clear how the solution relates to other
> solutions (layer 2 filtering or using a DHCPv4 option).
>
> There are a number of other changes:
>       *  Added note about shortage of flag bits
>       *  Clarified text about logging configuration error in Section 6
>       *  Editorial changes.
>
> Regards
>     Brian + Bob
>
>
>
> -------- Forwarded Message --------
> Subject: I-D Action: draft-ietf-6man-ipv6only-flag-03.txt
> Date: Tue, 16 Oct 2018 16:09:31 -0700
> From: internet-drafts@ietf.org
> Reply-To: internet-drafts@ietf.org, ipv6@ietf.org
> To: i-d-announce@ietf.org
> CC: ipv6@ietf.org
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the IPv6 Maintenance WG of the IETF.
>
>         Title           : IPv6 Router Advertisement IPv6-Only Flag
>         Authors         : Robert M. Hinden
>                           Brian Carpenter
>         Filename        : draft-ietf-6man-ipv6only-flag-03.txt
>         Pages           : 12
>         Date            : 2018-10-16
>
> Abstract:
>    This document specifies a Router Advertisement Flag to indicate to
>    hosts that the administrator has configured the router to advertise
>    that the link is IPv6-Only.  This document updates RFC5175.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-6man-ipv6only-flag/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-6man-ipv6only-flag-03
> https://datatracker.ietf.org/doc/html/draft-ietf-6man-ipv6only-flag-03
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-6man-ipv6only-flag-03
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> I-D-Announce mailing list
> I-D-Announce@ietf.org
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

-- 
SY, Jen Linkova aka Furry