IETF Logo Mail Archive

Re: [v6ops] Security issues in RFC8754 and related/subsequent drafts?

Brian E Carpenter <brian.e.carpenter@gmail.com> Mon, 25 October 2021 21:44 UTC

Return-Path: <brian.e.carpenter@gmail.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 739AC3A040D for <v6ops@ietfa.amsl.com>; Mon, 25 Oct 2021 14:44:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.429
X-Spam-Level:
X-Spam-Status: No, score=-5.429 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, NICE_REPLY_A=-3.33, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UvQGICjtD5hy for <v6ops@ietfa.amsl.com>; Mon, 25 Oct 2021 14:44:43 -0700 (PDT)
Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 676543A05C7 for <v6ops@ietf.org>; Mon, 25 Oct 2021 14:44:39 -0700 (PDT)
Received: by mail-pl1-x633.google.com with SMTP id s24so4846199plp.0 for <v6ops@ietf.org>; Mon, 25 Oct 2021 14:44:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=1wSzHADLsMcjU0ubFtO/lwMRXYDIcQ+QCfI2osxeNTQ=; b=pyD5Niw+sv3ngjdYEHpR5aEsbd7gPfktUG9WSFrE8mQTr5muxbQSrpKI7cx1Ee6Gfy Ms38JvGSwyPBwVkqt5hjKDE96VKpmF3ufc/3Z0+RtBwLWHcJroF6QwT9H4G41S1D8I9v gKRNpdWBzl5x8W2H5BoteGKzAPmGCTgNdgsrTTNQrCPMNxgMM+Os4tegCkXC6NY6eI5N vzFOyZlbkvOPMzkIIHut8ySkvCP5jA9CFVanjIo6aWDbZrZ1nSyM2a7RnJpzUkoE/MzQ FAqS2fhSU5pF4pFJAZT/K9tZTYauxut/BRJQXaGHLMuJQ0xWvrzAcg3oPSdVSYx+OnJR D3GQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=1wSzHADLsMcjU0ubFtO/lwMRXYDIcQ+QCfI2osxeNTQ=; b=KLTs0o6/TybONy+fnCFcWsGRllmh7Te+PUY5zOkWVDbk8tVBEIk4vxNXdLsf4c4v5b BTxW6Wx7JZKiLALquNeLBVsHGXFkK3ON22jhRJLKUFCml1tzhva5YMit+XTqJ/lJxrdf sYTlcW4gNuUcN3sriq7nZ5nsS/0HSAq3sd8nYLVkcHv2U3aTFI9kUTJ1mSNS6EVyLncv 467G49P2dHfa0dZ+kdC1ZKNAfGm/HUEZzzLKuInLQE8p9RV8GN4KwFfRL/BLzS9JQL+4 wOEKoqMYdfkRZfd2Qt0TtiTpahZ8DasEsvE/7mBU2vJn5IU9oBGF6OxoRpEOv2SFmGmn o2DA==
X-Gm-Message-State: AOAM5305p6F1S4nRTdGJxIGpVsm9dp0k6IsJvx2/XOCeuzJY8JuweJxx nk7hwrmIQwnrHeZr7goZTtPalK6U5UMBXA==
X-Google-Smtp-Source: ABdhPJxTEUGg9Gya46CQ4vJ9bupQfF7IKUKwZbYCaimxXj+B9XpLYzZrl9y92WdWHTjWzwiKnOawfw==
X-Received: by 2002:a17:90a:d489:: with SMTP id s9mr17486180pju.101.1635198277099; Mon, 25 Oct 2021 14:44:37 -0700 (PDT)
Received: from ?IPv6:2406:e003:102d:e801:db7:d041:a2d:ce65? ([2406:e003:102d:e801:db7:d041:a2d:ce65]) by smtp.gmail.com with ESMTPSA id h19sm22948231pfv.81.2021.10.25.14.44.35 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 25 Oct 2021 14:44:36 -0700 (PDT)
To: Gert Doering <gert@space.net>, Warren Kumari <warren@kumari.net>
Cc: "v6ops@ietf.org" <v6ops@ietf.org>
References: <CB45220A-ECE6-492A-8A37-D189A71CDA2B@liquidtelecom.com> <CAHw9_iJy_OjSwRDRx5cbB6yhau7XzNUKTi49sHhi0CnmRARQUA@mail.gmail.com> <1F31CC6F-8471-4B50-AE3F-9E5FC76BB447@employees.org> <CAHw9_iKU5--mFq3swhSbGJHV9Y5H52cKcgeF=nBf1rqZeBMRJQ@mail.gmail.com> <YXciHYMNa6KJUohp@Space.Net>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Message-ID: <ff55bdc4-9274-adc5-ef09-0d398b52342a@gmail.com>
Date: Tue, 26 Oct 2021 10:44:32 +1300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.10.0
MIME-Version: 1.0
In-Reply-To: <YXciHYMNa6KJUohp@Space.Net>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/SOWFr6e2HPJHaIoOqXZsnWQbEMM>
Subject: Re: [v6ops] Security issues in RFC8754 and related/subsequent drafts?
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Oct 2021 21:44:45 -0000

On 26-Oct-21 10:31, Gert Doering wrote:
> Hi,
> 
> On Mon, Oct 25, 2021 at 05:20:51PM -0400, Warren Kumari wrote:
>> I somewhat like the idea of having a well known prefix for "limited
>> domains"

fc00::/7 works well. RFC8994 is a worked example.

    Brian

> - if everyone used $prefix, we could default to filtering it on
>> external links, and, just like MPLS/OSPF/IS-IS/<whatever>, consciously
>> decide to allow it between consenting adults. This is far from perfect --
>> it requires more routes in my IGP, etc, but it's better than nothing.
> 
> Indeed, that would be a good start.
> 
> Implementors would have to ensure that decapsulation of "things" only
> happen for packets destined to this prefix, and not "outside of this
> domain" interfaces (IXPs, customer attachment circuits, etc).
> 
> Gert Doering
>          -- NetMaster
>

v2.30.2 | Report a Bug | By Email | System Status