Re: [v6ops] Security issues in RFC8754 and related/subsequent drafts?

[Gert Doering <[e-mail]>]

Hi,

On Fri, Oct 22, 2021 at 07:14:45AM +0000, Andrew Alston wrote:
> I don't disagree with your sentiments - however - be that as it
> may - if this stuff is going to exist, do we not have a responsibility
> to ensure that its not creating a situation that allows for wholesale
> security issues and the potential creation of some very nasty denial
> of service exploits that could affect us all? (See original email
> in this thread regarding smurf-v2 enabled by SRv6)

I read and fully understood what you've been saying - and I agree that
this sounds like a very real issue (without having tested it).

For the reasons you have listed I'm unsure whether there is a way 
to fix this (= it strengthens my resolve to not go there).


Trying to think up fixes

 - ACLs on ingress from all hosts that deny packets with SR EHs
 - ACLs on ingress from all hosts that deny packets *to* Routers that
   would decapsulate them (which requires that all router IPs come from
   a small number of subnets, nothing else is in there, and that you
   do not care about "ping router" for troubleshooting)
 - putting customer IPv6 into a 6PE VRF, preventing packets to be sent
   to the "real" control plane

none of these can be easily deployed in most networks, and worse, if you
actually want some hosts to participate in SR (which is, I think, the
kool-aid that has been sold to us on why SR is so great...), they all
fall apart.

Or you require RFC3514 adherence on the host, and filter on that.

(Wait, RFC3514 has never been updated to handle IPv6.  So this definitely
needs a -bis revision!)


Short summary: in the short time I spent on thinking through this, I see
no viable way to fix this class of attacks ("unrestricted egress tunnel
endpoints, reachable via an un-ACL-able protocol from malicious hosts").

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Michael Emmer
Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
Tel: [phone]         USt-IdNr.: DE813185279