IETF Logo Mail Archive

Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

"Fred Baker (fred)" <fred@cisco.com> Thu, 14 November 2013 06:07 UTC

Return-Path: <fred@cisco.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03D7111E8106 for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 22:07:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -110.441
X-Spam-Level:
X-Spam-Status: No, score=-110.441 tagged_above=-999 required=5 tests=[AWL=0.158, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TMz4Al+o2h0k for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 22:07:30 -0800 (PST)
Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by ietfa.amsl.com (Postfix) with ESMTP id 7D61F21E81B4 for <v6ops@ietf.org>; Wed, 13 Nov 2013 22:07:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2025; q=dns/txt; s=iport; t=1384409249; x=1385618849; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=e2kZDSdedj1vP5fLgamNv33AXC0pkmSvZi7Hp8OOLS0=; b=LzV4a9z9y5oMGpaBLCL2rYqtc6bfzDAHkHfpyKAAgyXphhOUwd/y1ksM hwXOHB34p2MyGKOiQ6TZa0OvKxpULz0xxvzQpkBC8XbfvLICp70U3OoWr mr/E+SoB59uYWTEsICz/DFd7oDOZk2XI7enN7dgnaQkU86UO9lYSDVd2/ w=;
X-Files: signature.asc : 195
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgoFABZohFKtJXG//2dsb2JhbABZgweBC78sgSkWdIIlAQEBAwFlFAULAgEIDgouMiUCBA4FDodtBr9lj18HgyCBEQOQMIEwhjCSDIMogio
X-IronPort-AV: E=Sophos; i="4.93,697,1378857600"; d="asc'?scan'208"; a="281611065"
Received: from rcdn-core2-4.cisco.com ([173.37.113.191]) by rcdn-iport-9.cisco.com with ESMTP; 14 Nov 2013 06:07:29 +0000
Received: from xhc-aln-x06.cisco.com (xhc-aln-x06.cisco.com [173.36.12.80]) by rcdn-core2-4.cisco.com (8.14.5/8.14.5) with ESMTP id rAE67SVV023976 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 14 Nov 2013 06:07:28 GMT
Received: from xmb-rcd-x09.cisco.com ([169.254.9.122]) by xhc-aln-x06.cisco.com ([173.36.12.80]) with mapi id 14.03.0123.003; Thu, 14 Nov 2013 00:07:28 -0600
From: "Fred Baker (fred)" <fred@cisco.com>
To: Mikael Abrahamsson <swmike@swm.pp.se>
Thread-Topic: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
Thread-Index: AQHO4P/Lxg/cd6lkIUaP++DWdjK9IQ==
Date: Thu, 14 Nov 2013 06:07:28 +0000
Message-ID: <5FC5FC3F-B933-4ACE-A7A9-00A1E275B4EF@cisco.com>
References: <201311101900.rAAJ0AR6025350@irp-view13.cisco.com> <CAB0C4xOfz_JAjEEJZ-Zz7MBEyZhVzrAE+8Ghf1ggC3+9pyHmNg@mail.gmail.com> <989B8ED6-273E-45D4-BFD8-66A1793A1C9F@cisco.com> <alpine.DEB.2.02.1311130329180.26054@uplift.swm.pp.se> <CAB0C4xOd-ryBXe4O3XoLTLDw-XuOV==X0nkRg5y3aPXCtf+Gow@mail.gmail.com> <alpine.DEB.2.02.1311140639140.5805@uplift.swm.pp.se>
In-Reply-To: <alpine.DEB.2.02.1311140639140.5805@uplift.swm.pp.se>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [10.19.64.121]
Content-Type: multipart/signed; boundary="Apple-Mail=_B3F3800A-B99B-47FD-9091-4C4FDB118B1C"; protocol="application/pgp-signature"; micalg="pgp-sha1"
MIME-Version: 1.0
Cc: "v6ops@ietf.org WG" <v6ops@ietf.org>
Subject: Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Nov 2013 06:07:40 -0000

On Nov 13, 2013, at 9:42 PM, Mikael Abrahamsson <swmike@swm.pp.se>
 wrote:

> On Wed, 13 Nov 2013, Marc Lampo wrote:
> 
>> Hence, in my opinion, the security (and privacy) of IPv6 users is best served by keeping unsolicited traffic out.
> 
> You and me have a very different opinion what unsolicited is. If the host accepts connections on a port, then it has by definition accepted to handle the connection. There is no reason access control can't be handled on the host.

The question here, if I understand Marc, is who sent the first packet. If the TCP SYN (or counterpart in whatever protocol) was sent by the host within the domain, an RFC 6092 firewall will permit traffic in response. If the TCP SYN was sent by the peer to that host, an RFC 6092 firewall will prevent that and everything following. Having the host say to the firewall that it is willing to accept unsolicited communications is quite a bit different than initiating those communications.

> I would rather see a mechanism that the host can use to say "please protect me, I'm helpless" and then the gateways will filter traffic to the device (ie if the host says nothing then default policy is open) than what you're proposing which is "default close".

What about a host that is so helpless that it doesn't say so?

v2.23.0 | Report a Bug | By Email