Re: [OPSEC] Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets Review

[Fernando Gont <[e-mail]>]

Hi, Panos,

While trying to address your feedback, I came up with additional
comments. Please do let me know what you think...

On 08/13/2012 05:52 PM, Panos Kampanakis (pkampana) wrote:
> - I see that you are mentioning RA-Guard for SLAAC-based attacks. Is
> the ND-Shield worth mentioning for L2 attacks?

I ended up referencing DHCPv6-Shield rather than ND-Shield, since the
goal here is to prevent attackers from enabling "global IPv6
connectivity" -- ND-Shield, on the other hand mitigates Neighbor Cache
sppofing attacks, which is not the subject of this section.


> - In 6to4 subsection, a couple of protections state "(embedded in the
> IPv4 payload)". This is not our traditional ACL filtering. It
> requires equipment that can look and inspect the encapsulated packet,
> or match on specific fields of the packet payload, or actually
> understand 6 in 4 encapsulation in order to be able to filter. Maybe
> it would be worth the put a sentence to clarify that to prevent
> readers from think this is traditional ACL filtering.

I've added a clarification about this. Additionally, I added a note
mentioning that an attacker might fragment its 6to4 packets into tiny
fragments such that the filtering device does not really have access to
the embedded IPv6 Addresses.



> - For Teredo, would it be worth mentioning that blocking UDP packets
> with embedded IPv6 addresses 2001::/32 on a device that can
> match/"understand"/inspect Teredo encapsulation is another mitigation
> option (as in 6to4 "(embedded in the IPv4 payload)")? 

The problem here is that, IIRC (and of the top of my head), no specific
UDP port numbers are used for the "data" packets, and hence you cannot
really tell to which UDP packets you should apply these filtering rules.

Does this make sense?

As a result, I have not yet added any text regarding filtering Teredo
packets based on the embedded IPv6 addresses. But please do let me know
if you feel otherwise.

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492