Subject: [secdir] Secdir review of draft-ietf-opsec-ipv6-implications-on-ipv4-nets-03

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Tue, 16 Apr 2013 20:43:00 +0000

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

I consider this document ready with issues described below.  

draft-ietf-opsec-ipv6-implications-on-ipv4-nets-03 discusses issues with IPv6 running on networks that have incomplete security controls (firewall and IDS) for IPv6.    It basically describes what you need to filter on to filter out IPv6 traffic and tunneling technologies.   This seems like mostly useful information, however its not clear to me if you implement all the controls in the document if you would not still have a problem form IPv6 on a local link or IPv6 tunneled through some non-standard means.  It seems the document should at least mention this risk in the security considerations since hosts on these networks may be IPv6 enabled.    One related issue I have seen is in end host configuration where a host based firewall is configured with IPv4 rules and left silent on IPv6 with varying results.   I don't recall seeing any discussion of this in the document, but it might also be worth covering in security considerations as well. 

Cheers,

Joe

---

From: Fernando Gont <[email-masked]>
Date: Tue, 16 Apr 2013 18:06:40 -0500

Hi, Joseph,

Thanks so much for your review! -- Please find my comments in-line....

On 04/16/2013 03:43 PM, Joseph Salowey (jsalowey) wrote:
> draft-ietf-opsec-ipv6-implications-on-ipv4-nets-03 discusses issues
> with IPv6 running on networks that have incomplete security controls
> (firewall and IDS) for IPv6.    It basically describes what you need
> to filter on to filter out IPv6 traffic and tunneling technologies.
> This seems like mostly useful information, however its not clear to
> me if you implement all the controls in the document if you would not
> still have a problem form IPv6 on a local link 

This is discussed in the "native IPv6 section"

> or IPv6 tunneled
> through some non-standard means.

How about adding this a the end of Section 3:

"We note that this document covers standardized IPv6 tunneling
mechanisms, but does not aim to cover non-standard tunneling mechanisms
nor that of IPsec-based or SSL/TLS-based tunneling of IPv6 packets".

?

> It seems the document should at
> least mention this risk in the security considerations since hosts on
> these networks may be IPv6 enabled.    One related issue I have seen
> is in end host configuration where a host based firewall is
> configured with IPv4 rules and left silent on IPv6 with varying
> results.   I don't recall seeing any discussion of this in the
> document, but it might also be worth covering in security
> considerations as well.

Isn't this covered in the "native ipv6" section?

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Wed, 17 Apr 2013 14:38:48 +0000

> This is discussed in the "native IPv6 section"

[Joe] Yes.  I might have chosen to include a stronger statement about"you are not going to be able to filter out all IPv6 attacks" in the security considerations section, but the first paragraph pretty much says this.  

> nor that of IPsec-based or SSL/TLS-based tunneling of IPv6 packets".

[Joe] OK

> Isn't this covered in the "native ipv6" section?

[Joe]  I was thinking of having some text that is a bit more host centric.   Currently the text reads more oriented towards network devices.  THere is some discussion on disabling IPv6 in extreme circumstances.  Would it be useful to recommend that IP filters on IPV6 end hosts be configured to apply controls to IPv6 as well as IPv4 since there is a fair chance that the hosts services may be listening on an IPv6 address as well?