Re: [v6ops] Reminder: draft-ietf-v6ops-tunnel-loops WGLC

On 2011-04-11 22:30, Mark Townsley wrote:
> 
> I think we should have much stronger language here that filtering of protocol 41 packets breaks 6to4, along with pointers to the relevant documents discussed in v6ops as to why this causes problems. It's more than "may not be suitable for scenarios where IPv4 connectivity is essential on all interfaces" as this action can have real adverse affects on unsuspecting users. 
>

+1

In fact this issue is specifically mentioned in several places
in draft-ietf-v6ops-6to4-advisory, and is summarized in the Security
Considerations as:

   A blanket recommendation to block Protocol 41 is not compatible with
   mitigating the 6to4 problems described in this document.

This is part of a balanced recommendation; elsewhere the draft says:

   The strategic
   solution is to deploy native IPv6, making Protocol 41 redundant.

     Brian

> 
> 3.2.1.1.  Filtering IPv4 Protocol-41 Packets
> 
>    In this measure a tunnel router may drop all IPv4 protocol-41 packets
>    received or sent over interfaces that are attached to an untrusted
>    IPv4 network.  This will cut-off any IPv4 network as a shared link.
>    This measure has the advantage of simplicity.  However, such a
>    measure may not always be suitable for scenarios where IPv4
>    connectivity is essential on all interfaces.
> 
> 
> Further, I believe we should be very clear in the abstract that this is an attack vector for which there are (at the time of writing) no known reports of any malicious attacks  utilizing said vector.
> 
> - Mark
> 
> 
> On Apr 6, 2011, at 7:59 AM, Fred Baker wrote:
> 
>> On Mar 31, 2011, at 11:30 AM, Fred Baker wrote:
>>
>>> This is to initiate a one week working group last call of draft-ietf-v6ops-tunnel-loops; it will close a week from Friday. The IESG reviewed the document and asked for changes; we need to be sure we are comfortable with the changes. The diff from the version sent to the IESG last November is at http://tinyurl.com/6dhowhf
>>>
>>> Please read it now. If you find nits (spelling errors, minor suggested wording changes, etc), comment to the authors; if you find greater issues, such as disagreeing with a statement or finding additional issues that need to be addressed, please post your comments to the list.
>> WGLC closing Sunday. Any comments on the draft?
>> _______________________________________________
>> v6ops mailing list
>> v6ops@ietf.org
>> https://www.ietf.org/mailman/listinfo/v6ops
> 
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops