IETF Logo Mail Archive

Re: But are we talking IPv6 only? That's how I read the draft. (Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03)

Mark Smith <ipng@69706e6720323030352d30312d31340a.nosense.org> Mon, 01 September 2008 21:20 UTC

Return-Path: <owner-v6ops@ops.ietf.org>
X-Original-To: ietfarch-v6ops-archive@core3.amsl.com
Delivered-To: ietfarch-v6ops-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0876828C10D for <ietfarch-v6ops-archive@core3.amsl.com>; Mon, 1 Sep 2008 14:20:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.425
X-Spam-Level: *
X-Spam-Status: No, score=1.425 tagged_above=-999 required=5 tests=[AWL=-1.498, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_EQ_AU=0.377, RDNS_NONE=0.1, RELAY_IS_203=0.994]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UYBF9-Sdx7qB for <ietfarch-v6ops-archive@core3.amsl.com>; Mon, 1 Sep 2008 14:20:29 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 7BB5C28C105 for <v6ops-archive@lists.ietf.org>; Mon, 1 Sep 2008 14:20:28 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-v6ops@ops.ietf.org>) id 1KaGfy-000Ns7-Nl for v6ops-data@psg.com; Mon, 01 Sep 2008 21:11:06 +0000
Received: from [203.6.132.66] (helo=smtp2.mail.adnap.net.au) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.69 (FreeBSD)) (envelope-from <ipng@69706e6720323030352d30312d31340a.nosense.org>) id 1KaGfu-000NrL-B1 for v6ops@ops.ietf.org; Mon, 01 Sep 2008 21:11:04 +0000
Received: from 219-90-184-193.ip.adam.com.au ([219.90.184.193] helo=mail.nosense.org) by smtp2.mail.adnap.net.au with esmtp (Exim 4.69 (FreeBSD)) (envelope-from <ipng@69706e6720323030352d30312d31340a.nosense.org>) id 1KaGTS-0001NN-Nq; Tue, 02 Sep 2008 06:28:10 +0930
Received: from ubu.nosense.org (localhost.localdomain [127.0.0.1]) by mail.nosense.org (Postfix) with SMTP id 80C47C343; Tue, 2 Sep 2008 06:40:39 +0930 (CST)
Date: Tue, 02 Sep 2008 06:40:39 +0930
From: Mark Smith <ipng@69706e6720323030352d30312d31340a.nosense.org>
To: james woodyatt <jhw@apple.com>
Cc: IPv6 Operations <v6ops@ops.ietf.org>
Subject: Re: But are we talking IPv6 only? That's how I read the draft. (Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03)
Message-Id: <20080902064039.83c0d711.ipng@69706e6720323030352d30312d31340a.nosense.org>
In-Reply-To: <7682B170-BD98-47DB-BBE0-2FB6922C47B3@apple.com>
References: <20080824204553.08131c65.ipng@69706e6720323030352d30312d31340a.nosense.org> <48B1CCE8.1070305@gmail.com> <01af01c9065b$b4602440$c2f0200a@cisco.com> <48B23391.1090503@gmail.com> <01cd01c90672$a57c8790$c2f0200a@cisco.com> <48B31DA3.6080001@gmail.com> <07d201c906f7$50a85e30$c2f0200a@cisco.com> <48B32B43.5010103@gmail.com> <084c01c906fe$f9bf1840$c2f0200a@cisco.com> <48B33430.40704@gmail.com> <A31EB889-2BD9-4283-A408-AB6DCC1D568A@suspicious.org> <08be01c90712$d876cd40$c2f0200a@cisco.com> <20080827194713.23271bd1.ipng@69706e6720323030352d30312d31340a.nosense.org> <CD947C45-58F7-47F1-807F-A276490B1E39@apple.com> <20080828071200.212c7910.ipng@69706e6720323030352d30312d31340a.nosense.org> <7682B170-BD98-47DB-BBE0-2FB6922C47B3@apple.com>
X-Mailer: Sylpheed 2.5.0 (GTK+ 2.12.11; i686-pc-linux-gnu)
X-Location: Lower Mitcham, South Australia, 5062
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk
List-ID: <v6ops.ops.ietf.org>

Hi James,

On Wed, 27 Aug 2008 15:20:37 -0700
james woodyatt <jhw@apple.com> wrote:

> On Aug 27, 2008, at 14:42, Mark Smith wrote:
> > Only permitting inbound authenticated tunneling protocols like  
> > IPsec, l2tp or pptp would easily defeat that.
> 
> IPsec is not necessarily authenticated.
> 

I had thought of that. Couldn't the statefulness/negotiated identity of
unauthenticated IPsec (and other stateful tunnelling protocols) at
least be the minimum threshold of what is allowed blindly?

Regards,
Mark.

v2.23.0 | Report a Bug | By Email