Re: [v6ops] Last Call: <draft-ietf-v6ops-ra-guard-implementation-04.txt> (Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)) to Best Current Practice

["Marc Lampo" <[e-mail]>]

Hello,

Just focussing on this rule #4 :
Seems to me that packets that would match this rule
might be theoretically valid, but in practice : questionable/dubious
packets.

If a packet is constructed is such a way that, before the end of the first
fragment is reached, one cannot determine if it is a RA,
I do have my questions about the nature (malicious ?) of this packet.

Compare it to IPv4 "options" : I always configured my routers to drop
IPv4 packets that had any options.  Not needed for any "production
traffic".
(unfortunately, such a simple solution does not exist, for IPv6 ...)


(out of scope for this document, but in reply to statement made)
About IPv6 not being broken by security devices :
I wonder how many security devices actually implement some kind of
security for IPv6 and if, to what extend.
Fact is that most vendors I had contact with claim to support IPv6,
but when starting to ask some further questions, it is usually
"back to some guru in the back office", with usually a "not yet"
response afterwards.


Kind regards,

Marc Lampo
Security Officer
EURid


-----Original Message-----
From: RJ Atkinson [mailto:[e-mail]] 
Sent: 30 May 2012 03:03 AM
To: Fernando Gont
Cc: [e-mail]
Subject: Re: [v6ops] Last Call:
<draft-ietf-v6ops-ra-guard-implementation-04.txt> (Implementation Advice
for IPv6 Router Advertisement Guard (RA-Guard)) to Best Current Practice


...

I know of lots of folks who'd be interested in RA-Guard, if the
specification weren't broken in a way that can cause valid IPv6 packets
that are not RA packets to be dropped.  So they would prefer the inversion
of Rule 4.

One of the main advantages of IPv6 is that it is not currently broken by
lots of mis-specified (pseudo-)security devices.  Please change this
document so that it won't cause valid IPv6 non-RA packets to be dropped.
Please don't break IPv6.

Yours,

Ran