Re: [OPSEC] Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets Review

["Panos Kampanakis (pkampana)" <[e-mail]>]

Thank Fernando.

> I ended up referencing DHCPv6-Shield rather than ND-Shield, since the goal here is to prevent attackers from enabling "global IPv6 connectivity" -- ND-Shield, on the other hand mitigates Neighbor Cache sppofing attacks, which is not the subject of this section.

Agreed.


For Teredo, as also Eric Vyncke pointed out, I was thinking IPS or Pattern type matching in UDP payloads. Or even proxies that can understand and inspect the Teredo communication. These are not the traditional ACL filtering of course.

Rgs,
Panos




-----Original Message-----
From: Fernando Gont [mailto:[e-mail]] 
Sent: Tuesday, August 14, 2012 8:02 AM
To: Panos Kampanakis (pkampana)
Cc: [e-mail]
Subject: Re: [OPSEC] Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets Review

Hi, Panos,

While trying to address your feedback, I came up with additional comments. Please do let me know what you think...

On 08/13/2012 05:52 PM, Panos Kampanakis (pkampana) wrote:
> - I see that you are mentioning RA-Guard for SLAAC-based attacks. Is 
> the ND-Shield worth mentioning for L2 attacks?

I ended up referencing DHCPv6-Shield rather than ND-Shield, since the goal here is to prevent attackers from enabling "global IPv6 connectivity" -- ND-Shield, on the other hand mitigates Neighbor Cache sppofing attacks, which is not the subject of this section.


> - In 6to4 subsection, a couple of protections state "(embedded in the
> IPv4 payload)". This is not our traditional ACL filtering. It requires 
> equipment that can look and inspect the encapsulated packet, or match 
> on specific fields of the packet payload, or actually understand 6 in 
> 4 encapsulation in order to be able to filter. Maybe it would be worth 
> the put a sentence to clarify that to prevent readers from think this 
> is traditional ACL filtering.

I've added a clarification about this. Additionally, I added a note mentioning that an attacker might fragment its 6to4 packets into tiny fragments such that the filtering device does not really have access to the embedded IPv6 Addresses.



> - For Teredo, would it be worth mentioning that blocking UDP packets 
> with embedded IPv6 addresses 2001::/32 on a device that can 
> match/"understand"/inspect Teredo encapsulation is another mitigation 
> option (as in 6to4 "(embedded in the IPv4 payload)")?

The problem here is that, IIRC (and of the top of my head), no specific UDP port numbers are used for the "data" packets, and hence you cannot really tell to which UDP packets you should apply these filtering rules.

Does this make sense?

As a result, I have not yet added any text regarding filtering Teredo packets based on the embedded IPv6 addresses. But please do let me know if you feel otherwise.

Thanks!

Best regards,
--
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492