Re: [v6ops] DHCP Option 108 Issue with Mac and iOS devices

[Jeremy Duncan <[e-mail]>]

Ted, in most cases it was blocking ICMPv6 inbound. And these were enterprise managed Mac systems that we dealt with. So any number of 3rd party apps could trigger these block rules.


Semper Fi,
Jeremy Duncan
Sent from my cell
________________________________
From: Ted Lemon <[e-mail]>
Sent: Wednesday, November 15, 2023 5:57:38 PM
To: Nick Buraglio <[e-mail]>
Cc: Jeremy Duncan <[e-mail]>; v6ops <[e-mail]>
Subject: Re: [v6ops] DHCP Option 108 Issue with Mac and iOS devices

OK, but what actually installed the PF rules? Was this set up in System Settings? Looking at my System Settings app I don't see a way to turn off IPv6, so this seems like it had to have been done by a third-party app. The reason I'm asking about this is that figuring out that the app is blocking IPv6 then becomes rather difficult—I don't know how we'd do it automatically. I mean, I can /imagine/ writing some kind of pf rule analyzer that figures this out, or just probing to see what is going on, but it's non-trivial.

On Wed, Nov 15, 2023 at 5:47 PM Nick Buraglio <[e-mail]<mailto:[e-mail]>> wrote:
It was the pf based native firewall. We were able to see the rules with normal pf commands.

On Wed, Nov 15, 2023 at 4:46 PM Ted Lemon <[e-mail]<mailto:[e-mail]>> wrote:
Sure. And then the next question is, was the firewall part of the operating system, or some kind of third-party add-on?

On Wed, Nov 15, 2023 at 5:37 PM Jeremy Duncan <[e-mail]<mailto:[e-mail]>> wrote:

Yes, and it’s not as surprising as you would think for enterprise host-based security systems.





0101001101100101011011010111000001100101011100100100011001101001

Jeremy Duncan
IPv6 Architect, Managing Partner
Tachyon Dynamics, Inc
Phone: [phone] x 103
Fax: [phone]

https://www.tachyondynamics.com<http://www.tachyondynamics.com>



From: Ted Lemon <[e-mail]<mailto:[e-mail]>>
Sent: Wednesday, November 15, 2023 5:35 PM
To: Jeremy Duncan <[e-mail]<mailto:[e-mail]>>
Cc: v6ops <[e-mail]<mailto:[e-mail]>>
Subject: Re: [v6ops] DHCP Option 108 Issue with Mac and iOS devices



Do you mean that people came to the conference with devices that had internal firewalls that blocked ipv6?



Op wo 15 nov 2023 om 17:26 schreef Jeremy Duncan <[e-mail]<mailto:[e-mail]>>

Hi v6ops-



Nick and I were involved with the Supercomputing Conference this year and part of the decision was to provide a real-world network to experiment with IPv6 transition technologies in an IPv6-only state. So a part of the wireless network was configured with an IPv4 DHCP scope with Option 108 with a value of 3600. The IPv6 part was configured with IPv6 SLAAC only with RADNS options pointing to a DNS64 resolver that mapped to the 64:ff9b::/96 scope - where the intermediate upstream device has NAT64 functional.



As we expected, most Android and all later version Mac/iOS systems performed as expected:

  *   IPv4 DHCP request for option 108
  *   Response with 108, 3600
  *   Disable IPv4 functionality on the wireless NIC
  *   Spin up the CLAT/464XLAT functionality
  *   Happy IPv6-only-ing



Well, with one exception: organizations that provided misconfigured firewall rules (blocking all ICMPv6/IPv6) or disabling of the IPv6 stack entirely.



In this specific use case, the iOS/Mac would do exactly as instructed by the DHCP server, it would disable IPv4 and spin up its CLAT/464XLAT – but without any verification that IPv6 is functional before doing so.



As you are probably aware, this resulted in a total endpoint denial of service as it has a non-functional IPv6 stack, but the IPv4 stack (network) did not have the awareness of any issues therefore disabled IPv4 functionality.



The question for the v6ops group – is there something we can do to tighten up any kind of RFC that will require IPv6 stack capabilities and functionality?





0101001101100101011011010111000001100101011100100100011001101001

Jeremy Duncan
IPv6 Architect, Managing Partner
Tachyon Dynamics, Inc
Phone: [phone] x 103
Fax: [phone]

https://www.tachyondynamics.com<http://www.tachyondynamics.com>



_______________________________________________
v6ops mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/v6ops

_______________________________________________
v6ops mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/v6ops