[v6ops] Heads up: 6man poll for adoption of RA-Guard/firewalling/monitoring-related I-Ds

Fernando Gont <fgont@si6networks.com> Wed, 13 June 2012 14:00 UTC

Message-ID: <4FD898DA.3070505@si6networks.com>
Date: Wed, 13 Jun 2012 10:42:50 -0300
From: Fernando Gont <fgont@si6networks.com>
Organization: SI6 Networks
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:12.0) Gecko/20120430 Thunderbird/12.0.1
MIME-Version: 1.0
To: IPv6 Operations <v6ops@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Subject: [v6ops] Heads up: 6man poll for adoption of RA-Guard/firewalling/monitoring-related I-Ds
Precedence: list

Folks,

Just wanted to send a heads up regarding two 6man wg polls that have
just been started for adoption of these documents:

* draft-gont-6man-oversized-header-chain-02 (Security and
Interoperability Implications of Oversized IPv6 Header Chains)

* draft-gont-6man-nd-extension-headers-03 (Security Implications of the
Use of IPv6 Extension Headers with IPv6 Neighbor Discovery)

draft-gont-6man-oversized-header-chain-02 requires that when packets are
fragmented, the first fragment must contain the entire IPv6 header
chain. This is important for a number of reasons: it allows for
stateless filtering (both at firewalls and at RA-Guard-like devices),
prevents stateless translators from breaking, etc.

draft-gont-6man-nd-extension-headers-03 forbids the use of fragmentation
with Neighbor Discovery. This essentially enables Neighbor Discovery
monitoring in IPv6, thus providing feature parity with IPv4 (think about
arpwatch and the like) -- not to mention that it obviously mitigates
fragmentation-based attacks against Neighbor Discovery and SEND.

IMO, these two I-Ds propose small spec updates which could result in
concrete operational and security benefits.

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: fgont@si6networks.com
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

[v6ops] Heads up: 6man poll for adoption of RA-Gu… Fernando Gont