Re: [v6ops] Please review the No IPv4 draft

[Fernando Gont <[e-mail]>]

On 04/30/2014 02:36 AM, Lorenzo Colitti wrote:
> On Wed, Apr 30, 2014 at 1:09 PM, Mikael Abrahamsson <[e-mail]
> <mailto:[e-mail]>> wrote:
> 
>     Nick, if you're not doing this today you're exposing your customers
>     to MITM attacks and all kinds of other bad things. What this
>     proposal is doing is adding one more reason to implement proper L2
>     security. You're already screwed, this mechanism just adds one more
>     way you're screwed.
> 
> 
> Today, you're not too badly screwed if your first-hop security supports
> IPv4 and your network only provides IPv4.
> 
> Yes, it's true that a rogue RA can still blackhole or MITM your traffic,
> but happy eyeballs will protect you to some degree against blackholing,

Not necessarily. For instance, you can send an RA with RDNSS, and then
spoof DNS responses, and not even advertise a single A record.

Or spoof RAs and DHCP-server packets and advertise yourself as the
recursive DNS server.

Or just be very fast to respond to the IPv6-based SYN, such that IPv6
wins the HappyEyeballs race.

Cheers,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1