Subject: [homegate] UDP in torrents

From: <[email-masked]>
Date: Mon, 8 Feb 2010 08:45:14 +0100

This may be old news for the most of you, and even of topic, so feel free to ignore this mail or hit me over the head.

Bit torrent (which is quite popular in the Nordic countries at least) is starting to move over to preferring UDP.  This is relevant to NAT and firewall tables within the CPE's.  Since there is no fin/rst mechanism in UDP the CPE needs to rely on timeout for all UDP connections.  And since UDP within bit torrent is lighter on the endpoints we probably will see an increase of UDP over what the equivalent TCP would have been for a given PC.  Depending on the NAT/firewall implementation this can lead to a single PC on a LAN hogging all connections and thereby denying others internet access or indeed other services the ISP provide.

Just a heads up for those of you which are hands on the CPE's.

And yes, there are issues with the current scaling of bit torrent and tcp, but my gut feeling is that this is going to be turned up a notch.

http://lifehacker.com/5463421/utorrent-20-brings-performance-updates-bandwidth-control-udp-support-and-more

http://forum.utorrent.com/viewtopic.php?id=65482

-Erik Taraldsen

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 8 Feb 2010 10:05:23 +0100

On 8 feb 2010, at 8:45, <[email-masked]> wrote:

> Bit torrent (which is quite popular in the Nordic countries at least) is starting to move over to preferring UDP.  This is relevant to NAT and firewall tables within the CPE's.

So it's important to do something reasonable when the translation tables are full. Both killing long-lived sessions and making new ones (DNS queries...) impossible is suboptimal.

But in practice there doesn't have to be a big problem, because most BitTorrent users have a port mapping that allows them to receive incoming sessions. So if packets matching such a port mapping are translated without using space in the translation table this isn't an issue. This may or may not be the way things are currently implemented in any given implementation, though.

---

From: Lars Eggert <[email-masked]>
Date: Mon, 8 Feb 2010 11:56:54 +0200

Hi,

On 2010-2-8, at 9:45, [email-masked] wrote:
> Bit torrent (which is quite popular in the Nordic countries at least) is starting to move over to preferring UDP.

thanks for the note. The IETF is well aware of this, and we chartered a working group in the transport area in order to specify a congestion control scheme for "background traffic" for further experimentation, based on the BitTorrent mechanism: http://www.ietf.org/dyn/wg/charter/ledbat-charter

>  This is relevant to NAT and firewall tables within the CPE's.  Since there is no fin/rst mechanism in UDP the CPE needs to rely on timeout for all UDP connections.  And since UDP within bit torrent is lighter on the endpoints we probably will see an increase of UDP over what the equivalent TCP would have been for a given PC.  Depending on the NAT/firewall implementation this can lead to a single PC on a LAN hogging all connections and thereby denying others internet access or indeed other services the ISP provide.

I think the particular scenario you describe is one instance of a larger problem: that most SOHO NAT boxes lack adequate overload management schemes that kick in when they run out of resources (CPU, memory, etc.) I agree that his could be an area where HOMEGATE could make a recommendation or refer to an existing suitable recommendation of another standards body.

Lars

---

From: "Duncan Bees" <[email-masked]>
Date: Mon, 8 Feb 2010 08:14:59 -0800

Just to let you know that HGI has a draft requirements document in this area
(home gateway requirements for handling TCP/UPD sessions including some
overload management requirements). It follows from observations made by
service providers about problems with current home gateways related to the
impact of bit torrents. 

Though not yet in the public domain, we would for sure appreciate review by
members of this group -- at the moment any member of HGI can see the latest
draft HGI01041R09 which will soon be sent for ballot. As soon as it is in
the public domain I will send the link to this group.

Cheers
Duncan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Lars Eggert
Sent: February-08-10 1:57 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [homegate] UDP in torrents

Hi,

> Bit torrent (which is quite popular in the Nordic countries at least) is
starting to move over to preferring UDP.

thanks for the note. The IETF is well aware of this, and we chartered a
working group in the transport area in order to specify a congestion control
scheme for "background traffic" for further experimentation, based on the
BitTorrent mechanism: http://www.ietf.org/dyn/wg/charter/ledbat-charter

>  This is relevant to NAT and firewall tables within the CPE's.  Since
there is no fin/rst mechanism in UDP the CPE needs to rely on timeout for
all UDP connections.  And since UDP within bit torrent is lighter on the
endpoints we probably will see an increase of UDP over what the equivalent
TCP would have been for a given PC.  Depending on the NAT/firewall
implementation this can lead to a single PC on a LAN hogging all connections
and thereby denying others internet access or indeed other services the ISP
provide.

I think the particular scenario you describe is one instance of a larger
problem: that most SOHO NAT boxes lack adequate overload management schemes
that kick in when they run out of resources (CPU, memory, etc.) I agree that
his could be an area where HOMEGATE could make a recommendation or refer to
an existing suitable recommendation of another standards body.

Lars

---

From: james woodyatt <[email-masked]>
Date: Mon, 8 Feb 2010 10:25:55 -0800

> But in practice there doesn't have to be a big problem, because most BitTorrent users have a port mapping that allows them to receive incoming sessions. So if packets matching such a port mapping a…

To protect against the SQL slammer worm, most NAT gateways use Address-Port Dependent Filtering, not Endpoint Independent filtering.  Despite what the BEHAVE working group recommends.  As a result, every edge representing a UDP flow between an interior host/port and an exterior host/port consumes a state table record in the NAT.  Having a redirection rule in place doesn't make any difference, because it doesn't stop consumption of the critical resource: the state table space.

There is a reason BEHAVE recommends Endpoint Independent filtering as well as translation, but sadly, a lot of NAT vendors don't read the fabulous RFC series and there is no logo certification test for NAT gateways that would require them to pass any conformance tests.  Sigh.

The situation is not improving with IPv6.  We recommend a default simple firewall, but the IPv6 Ready tests are typically performed with the firewall disabled.  If the firewall were enabled, then many of the tests would fail.

--
james woodyatt <[email-masked]>
member of technical staff, communications engineering

---

From: Mark Baugher <[email-masked]>
Date: Mon, 8 Feb 2010 10:49:39 -0800

> The situation is not improving with IPv6.  We recommend a default simple firewall, but the IPv6 Ready tests are typically performed with the firewall disabled.  If the firewall were enabled, then m…

EIF is a 'should' in your document IIRC.  When is the simple security (aka firewall) document going to published?

Mark

> _______________________________________________
> homegate mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homegate

---

From: james woodyatt <[email-masked]>
Date: Mon, 8 Feb 2010 11:42:12 -0800

> EIF is a 'should' in your document IIRC.  When is the simple security (aka firewall) document going to published?

I'm still up to my eyeballs in alligators, and I haven't revised to deal with the most recent round of criticism that came in at Stockholm.  Sigh.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 8 Feb 2010 20:47:44 +0100

On 8 feb 2010, at 19:25, james woodyatt wrote:

> To protect against the SQL slammer worm, most NAT gateways use Address-Port Dependent Filtering, not Endpoint Independent filtering.

?? How does that help?

> The situation is not improving with IPv6.  We recommend a default simple firewall, but the IPv6 Ready tests are typically performed with the firewall disabled.  If the firewall were enabled, then m…

I hope they make the IPv6 filtering suck worse than IPv4 filtering ever sucked. That way, people will turn it off.

Iljitsch

---

From: <[email-masked]>
Date: Fri, 12 Feb 2010 11:27:24 +0100

________________________________________
Fra: [email-masked] [[email-masked]] p&#229; vegne av Iljitsch van Beijnum [[email-masked]]
Sendt: 8. februar 2010 20:47
Til: james woodyatt
Kopi: [email-masked]
Emne: Re: [homegate] UDP in torrents

On 8 feb 2010, at 19:25, james woodyatt wrote:

> > The situation is not improving with IPv6.  We recommend a default simple firewall, but the IPv6 Ready
> > tests are typically performed with the firewall disabled.  If the firewall were enabled, then many of the tests would fail.
>

This discussion is (as always) going a bit off topic. Here is my contribution to the off topicness:

Any particular reason for not wanting IPv6 firewall pr default?  My gut feeling is that the typical mom and dad users would benefit from a firewall.  Techie users could do as they like (firewall off, strict, spesific rules etc).  The mom's and dad's out there would not be able to identify that they could benefit from a firewall and thus never turning it on.

-Erik

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 12 Feb 2010 11:31:18 +0100

> Any particular reason for not wanting IPv6 firewall pr default?  My gut feeling is that the typical mom and dad users would benefit from a firewall.  Techie users could do as they like (firewall of…

Then why does it say "firewall" on the outside of all these boxes?

No, people are scared into wanting firewalls. Unfortunately, most of them don't realize the harm that firewalls cause so they can't make a rational tradeoff between the advantages (slim to none) and the disadvantages (mysteriously breaking applications, more work for people like us).

---

From: Ole Troan <[email-masked]>
Date: Fri, 12 Feb 2010 11:55:17 +0100

Erik,

> Any particular reason for not wanting IPv6 firewall pr default?  My gut feeling is that the typical mom and dad users would benefit from a firewall.  Techie users could do as they like (firewall of…

we discussed this quite a bit when we wrote the IPv6 CE router requirements draft.
with modern IPv6 stack (and by definition almost all of them are) what benefits do a firewall by default give me?

and I'm not trying to be obnoxious I can think of all the disadvantages, but I have a really hard time seeing what I need a firewall for... perhaps I'd like IPS, but a vanilla firewall?

cheers,
Ole

---

From: <[email-masked]>
Date: Fri, 12 Feb 2010 12:01:36 +0100

________________________________________
Fra: Iljitsch van Beijnum [[email-masked]]

> No, people are scared into wanting firewalls. Unfortunately, most of them don't realize the 
> harm that firewalls cause so they can't make a rational tradeoff between the advantages 
> (slim to none) and the disadvantages (mysteriously breaking applications, more work for people like us).

I agree that there is some issues sourounding firewalls and breaking apps. Sure. Absolutely.  

But I dissagree on your opinion of "slim to none" on the advantages.  Telenor operates in different markets as an ISP.  One market has in the past had a bridge solution for the end users. No NAT, no firewall.  The other major marked has used a FW/NAT solution pr default.  The bridge market had 10 times the virus traffic compared to the FW/NAT marked even though beeing half the size.  So a rough guestimate indicates that you are 20 times more likely to have a virus if you don't have a propper firewall.  (DPI statistics from border/core).

This might change when IPv6 is dominant, but for now I'm voteing for firewalls.

-Erik

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 12 Feb 2010 12:10:46 +0100

On 12 feb 2010, at 12:01, <[email-masked]> wrote:

> The bridge market had 10 times the virus traffic compared to the FW/NAT marked even though beeing half the size.  So a rough guestimate indicates that you are 20 times more likely to have a virus if you don't have a propper firewall.

Unless I'm mistaken there is no longer new malware that uses open ports as an attack vector.

An issue with bridging could also be ARP poisoning and then traffic interception, for instance for the purpose of DNS spoofing.

> This might change when IPv6 is dominant, but for now I'm voteing for firewalls.

We're talking about IPv6, because firewalls in home gateways are very rare for IPv4, unless you count NAT as firewalling.

---

From: <[email-masked]>
Date: Fri, 12 Feb 2010 12:22:28 +0100

________________________________________
Fra: Iljitsch van Beijnum [[email-masked]]
Sendt: 12. februar 2010 12:10
Til: Taraldsen Erik (Fixed)
Kopi: [email-masked]
Emne: Re: SV: SV: [homegate] UDP in torrents

> Unless I'm mistaken there is no longer new malware that uses open ports as an attack vector.

My numbers are aprox two years old, so they may not represent todays situation.  But is it not possible that those kind of attacs may resurface if given the opertunity?  I.e. the ISP stop provideing NAT/FW to the end users?

> We're talking about IPv6, because firewalls in home gateways are very rare for IPv4, unless you count NAT as firewalling.

The situation may be different in the market you and I operate, but in the nordics I have not seen a nat home gateway since 2003 which did not also include a full statefull firewall.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 12 Feb 2010 12:58:17 +0100

> My numbers are aprox two years old, so they may not represent todays situation.  But is it not possible that those kind of attacs may resurface if given the opertunity?

Operating systems need to be able to operate securely in an environment where others can connect to the machine, for instance with a 3G connection or when connected to a wifi hotspot. As such the situation where Windows would open up all kinds of insecure protocols by default isn't likely to return.

---

From: Mark Baugher <[email-masked]>
Date: Fri, 12 Feb 2010 05:09:46 -0800

> Unless I'm mistaken there is no longer new malware that uses open ports as an attack vector.

http://www.cert-in.org.in/virus/win32_conficker.htm

> We're talking about IPv6, because firewalls in home gateways are very rare for IPv4, unless you count NAT as firewalling.

Yes, there is a firewall in front of the NAT, which has the side effect of opening a pinhole when a NAT port mapping is installed.

Mark

---

From: james woodyatt <[email-masked]>
Date: Fri, 12 Feb 2010 10:43:20 -0800

> and I'm not trying to be obnoxious I can think of all the disadvantages, but I have a really hard time seeing what I need a firewall for... perhaps I'd like IPS, but a vanilla firewall?

That should be fairly obvious, but you almost never see anyone explain it in simple terms.

Residential gateway simple security doesn't actually do much to stop botnets and other malware, c.f. the ubiquity of both residential IPv4/NAT firewalls and the vast numbers of compromised hosts behind them.  Being modeled on the behavior of IPv4/NAT, IPv6 simple security won't be any different in this regard.

The essential purpose of residential gateway firewalls is actually to prevent hosts located behind the firewall from participating efficiently in peer-to-peer applications without the assistance of easily identified and attacked rendezvous services located outside the firewall.  They strongly encourage people to run only those applications that communicate primarily with server pools in fixed data centers operated by medium to large enterprises, and they discourage people from running frivolous applications that communicate mainly with large networks of peers located primarily behind other residential gateways.  You know: things that service providers can't use to extract additional revenues, and must therefore treat as network abuse, e.g. torrents.

Summarizing: why do you need a residential firewall?  To make sure the residents only use your network in ways that allow you to get a piece of the charges for application service.

---

From: Richard Bennett <[email-masked]>
Date: Fri, 12 Feb 2010 10:55:00 -0800

Leaving aside the nefarious motives of profit-seeking network operators 
to protect <H|B|M>ollywood's intellectual property for the moment, the 
main reason that most unskilled users should have a firewall is the 
relative insecurity of the default setup of Microsoft home networking. 
It's common for home networks to offer printers and shares without 
passwords, or with weak passwords, and the default sharing mode for 
Windows Media Player is probably flaky as well. Firewalls hide these 
things from casual attackers. Botnets relentlessly probe first mile 
networks for exposed ports and vulnerabilities. It's wise to have 
multiple lines of defense because everybody's software has bugs, even 
when users follow best practices.

RB

On 2/12/2010 10:43 AM, james woodyatt wrote:
> james woodyatt<[email-masked]>

-- 
Richard Bennett
Research Fellow
Information Technology and Innovation Foundation
Washington, DC

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 12 Feb 2010 20:02:51 +0100

On 12 feb 2010, at 19:55, Richard Bennett wrote:

> is the relative insecurity of the default setup of Microsoft home networking.

Still, after how things blew up in their faces in the early 2000s?

> Botnets relentlessly probe first mile networks for exposed ports and vulnerabilities.

Good luck with than on IPv6.

> It's wise to have multiple lines of defense because everybody's software has bugs,

That is orthogonal to the issue. If a user runs a service, the user wants the service to be reachable, exposing bugs, if any. If the user doesn't want to run a service, the service shouldn't be reachable, so bugs aren't exposed.

The "crunchy outside, soft inside" approach to local networking doesn't work for mobile devices such as laptops, and all common operating systems also run on mobile devices. Every host must be able to hold its own against the big bad world.

---

From: james woodyatt <[email-masked]>
Date: Fri, 12 Feb 2010 11:06:43 -0800

On Feb 12, 2010, at 10:55, Richard Bennett wrote:
> 
> Leaving aside the nefarious motives of profit-seeking network operators.

I would be very careful not to describe the motives of service providers to engineer traffic on their networks as nefarious.

> Botnets relentlessly probe first mile networks for exposed ports and vulnerabilities.

The simple security regime modeled on IPv4/NAT is neither necessary to stop worms from propagating through network-layer vulnerability probing, c.f. RFC 4864, nor sufficient to stop malware of all sorts from propagating through trojans and application layer viruses, c.f. the vast numbers of compromised hosts.

---

From: Richard Bennett <[email-masked]>
Date: Fri, 12 Feb 2010 11:06:40 -0800

In the real world, Iljitsch, home networks are not maintained by IETF 
participants, they're configured by somebody who knows just enough to 
create a share and nothing at all about security.  Default gateway 
configurations should work for people with the default level of 
knowledge and the default crappy OS.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 12 Feb 2010 20:10:41 +0100

On 12 feb 2010, at 20:06, Richard Bennett wrote:

> Default gateway configurations should work for people with the default level of knowledge and the default crappy OS.

Which OSes are we talking about? People aren't going to run IPv6 on XP SP1. Probably very few of them will run IPv6 on Windows XP of any kind. I assume and hope that Vista and 7 (and of course all non-win OSes) are not crappy in this regard.

The price of real security is already too high, let alone the price of imaginary security.

---

From: "Erichsen, Kirk" <[email-masked]>
Date: Fri, 12 Feb 2010 14:10:58 -0500

There is nothing which precludes an SP from defining, in agonizing detail, exactly how they wish for a firewall to behave for a given application. This may not be the right forum to define what could quickly morph into what amounts to a product spec. If the goal is a common set of functionality, perhaps it will suffice to simply describe a common scenario in which a firewall might be present and how it could behave, but without making requirement declarations. 

It's my view we can probably avoid defining the firewall and harm nothing. The inverse case is a slippery slope and even if we excericse some modicum of restraint and caution tends to have operational, performance, hardware and cost impacts that are predicated on certain assumptions that may not be universally held. I'd prefer to see us stay out of the SPI firewall weeds if at all possible.

-KE

________________________________________
From: [email-masked] [[email-masked]] On Behalf Of james woodyatt [[email-masked]]
Sent: Friday, February 12, 2010 11:43 AM
To: [email-masked]
Subject: Re: [homegate] UDP in torrents

_______________________________________________
homegate mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/homegate
This E-mail and any of its attachments may contain Time Warner
Cable proprietary information, which is privileged, confidential,
or subject to copyright belonging to Time Warner Cable. This E-mail
is intended solely for the use of the individual or entity to which
it is addressed. If you are not the intended recipient of this
E-mail, you are hereby notified that any dissemination,
distribution, copying, or action taken in relation to the contents
of and attachments to this E-mail is strictly prohibited and may be
unlawful. If you have received this E-mail in error, please notify
the sender immediately and permanently delete the original and any
copy of this E-mail and any printout.

---

From: Richard Bennett <[email-masked]>
Date: Fri, 12 Feb 2010 11:15:06 -0800

Every carrier spec for a home gateway I've ever seen (and I've seen most 
of them) has a firewall requirement, and I don't see IPv6 changing that.

RB

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 12 Feb 2010 20:15:37 +0100

On 12 feb 2010, at 20:10, Erichsen, Kirk wrote:

> It's my view we can probably avoid defining the firewall and harm nothing. The inverse case is a slippery slope and even if we excericse some modicum of restraint and caution tends to have operational, performance, hardware and cost impacts

The problem is that various statements from within the IETF have been construed to mean that IPv6 home gateways SHOULD have a stateful firewall. Even more so than NAT, which breaks stuff by accident, firewalls, which break stuff on purpose, have the potential to be incredibly harmful when they misbehave. As such, it's important to specify what they should do, or rather, what they shouldn't do.

Unfortunately James' efforts to create a document that does exactly this haven't met with smooth progress.

---

From: Mark Baugher <[email-masked]>
Date: Fri, 12 Feb 2010 11:30:04 -0800

This is the real point.  We can debate the technical considerations all we want.  At the end of the day, no vendor is going to ship a retail gateway product without a firewall enabled by default.  I find the pros and cons interesting, but the real question is how to open pinholes.  NAT-PMP and UPnP NAT Traversal do it for IPv4.  Something will undoubtedly be needed for IPv6. 

Mark

On Feb 12, 2010, at 11:15 AM, Richard Bennett wrote:

> Every carrier spec for a home gateway I've ever seen (and I've seen most of them) has a firewall requirement, and I don't see IPv6 changing that.
> 
> RB
>

---

From: Martin Focazio <[email-masked]>
Date: Fri, 12 Feb 2010 15:09:35 -0500

On Fri, Feb 12, 2010 at 2:06 PM, Richard Bennett <[email-masked]>wrote:

> participants, they're configured by somebody who knows just enough to create
> a share and nothing at all about security.  Default gateway configurations
> should work for people with the default level of knowledge and the default
> crappy OS.
>

A wholehearted endorsement of this stance.

IETF folks are smart, and are well versed in the concepts and practices of
networking. IETF folks are a tiny minority of the potential users of an IPv6
residential gateway.

Consider for a moment how many open WiFi access points you can find in any
given apartment building Consider for a moment how often you encounter
unpatched systems among friends and family. Think about the security
practices of ordinary computer users.

Now, consider for a moment the utter absurdity of insisting that these same
people - the ones who can't seem to manage to remember the password for
their email accounts - are expected to make sure each device connected to
their shiny new IPV6 wonder-box is - as a peer device on the big bad
internet - adequately protected. That is a crazy idea.
A firewall is a must, from day 1.

---

From: David R Oran <[email-masked]>
Date: Fri, 12 Feb 2010 15:17:25 -0500

On Feb 12, 2010, at 3:09 PM, Martin Focazio wrote:

> On Fri, Feb 12, 2010 at 2:06 PM, Richard Bennett <[email-masked]> wrote:
> In the real world, Iljitsch, home networks are not maintained by IETF participants, they're configured by somebody who knows just enough to create a share and nothing at all about security.  Default gateway configurations should work for people with the default level of knowledge and the default crappy OS.
> 
> IETF folks are smart, and are well versed in the concepts and practices of networking. IETF folks are a tiny minority of the potential users of an IPv6 residential gateway. 
> 
> Consider for a moment how many open WiFi access points you can find in any given apartment building
With the open wifi network right in the chewy center behind the crunchy firewall that's supposed to help?

> Consider for a moment how often you encounter unpatched systems among friends and family. Think about the security practices of ordinary computer users. 
> 
> Now, consider for a moment the utter absurdity of insisting that these same people - the ones who can't seem to manage to remember the password for their email accounts - are expected to make sure each device connected to their shiny new IPV6 wonder-box is - as a peer device on the big bad internet - adequately protected. That is a crazy idea.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 12 Feb 2010 21:17:47 +0100

On 12 feb 2010, at 21:09, Martin Focazio wrote:

> Consider for a moment how many open WiFi access points you can find in any given apartment building Consider for a moment how often you encounter unpatched systems among friends and family. Think about the security practices of ordinary computer users. 

> A firewall is a must, from day 1. 

From the same base principles, I reach the exact opposite conclusion. Exactly because so many networks are open, an approach that requires networks to be closed is doomed to failure. And exactly because we can't expect users to reconfigure their home gateway, it is paramount that it comes out of the box in a state that allows applications to work. Which means that incoming sessions must be supported for peer-to-peer applications. The simplest way to do that is to have no firewall at all, because as we saw re open networks, hosts much be able to fend for themselves anyway.

But if the marketing people insist that they can't sell a device without the word "firewall" on the box we need to make things such that despite any firewalling going on, the peer-to-peer apps still work.

---

From: Martin Focazio <[email-masked]>
Date: Fri, 12 Feb 2010 15:34:00 -0500

On Fri, Feb 12, 2010 at 3:17 PM, Iljitsch van Beijnum <[email-masked]>wrote:

>
> From the same base principles, I reach the exact opposite conclusion.
> Exactly because so many networks are open, an approach that requires
> networks to be closed is doomed to failure. And exactly because we can't
> expect users to reconfigure their home gateway, it is paramount that it
> comes out of the box in a state that allows applications to work. Which
> means that incoming sessions must be supported for peer-to-peer
> applications. The simplest way to do that is to have no firewall at all,
> because as we saw re open networks, hosts much be able to fend for
> themselves anyway.
>
> But if the marketing people insist that they can't sell a device without
> the word "firewall" on the box we need to make things such that despite any
> firewalling going on, the peer-to-peer apps still work.

I see your point. But - for all that you guys seem to utterly hate NAT and
are dismissive of "security through obscurity" - in the IPv4 world, I can
hang a relatively simple device (think DVR or a music server) on a home
network and - yes this is bad - pretty much ignore it. It does not need that
much "hardening" and, although a NAT is hardly "security" it makes scanning
everything in the home a whole lot harder (and often impossible). I mean,
really, think about it - what if I hang a networked printer off my home
network and it's got some obscure, but exploitable hack that actually only
matters if the printer is "visible" to the network at large. I remember this
little story: http://news.cnet.com/8301-27080_3-10356806-245.html

Hmm...at tax time, it sure would be interesting to sniff for printers and
intercept the print job of tax returns. Unless, of course, the printer has a
decent internal firewall...with a unique setup and all that means.

---

From: "STARK, BARBARA H (ATTLABS)" <[email-masked]>
Date: Fri, 12 Feb 2010 17:20:54 -0500

The requirements for IPv6 firewalling, inside my company, did not come
from the Marketing side. It came from the people who have to minimize
Help Desk calls, and the Security people.

And the reason they have all concluded they need this firewall, is RFC
4864.

>From RFC 4864:   "To implement simple security for IPv6 in, for example,
a DSL or cable
   modem-connected home network, the broadband gateway/router should be
   equipped with stateful firewall capabilities.  These should provide a
   default configuration where incoming traffic is limited to return
   traffic resulting from outgoing packets (sometimes known as
   reflective session state).  There should also be an easy interface
   that allows users to create inbound 'pinholes' for specific purposes
   such as online gaming."

Perhaps this capability in the broadband gateway/router is really
nothing but a feel-good placebo. That's not for me to say. I'm not the
expert. But the author list of RFC 4864 does have some experts. Which
causes RFC 4862 to be referenced all over the place as being the
definitive recommendation on security.

So, good or bad, the IETF has created the perception that this
capability is a good thing. If it is a good thing, please finish up the
simple-security draft. If it isn't a good thing, then the IETF needs to
publish a different RFC that says what really, really is recommended.

If the IETF decides to pursue the route of changing its recommendation,
then the IETF needs to provide the complete picture for protecting the
home network and all of the devices in it. Not some simplistic statement
about how the recommendations in simple-security are no good or useless
and all hosts need to be responsible for their own security. That's
completely unhelpful. Tell us: What should hosts do? How should sharing
be done? How should network resources, like printers, be secured, but
easy for people to use and configure? Be complete. Think it all through.
And then convince us that RFC 4864 was wrong.
Barbara

*****

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers. GA622

---

From: Richard Bennett <[email-masked]>
Date: Fri, 12 Feb 2010 19:22:16 -0800

When the Wi-Fi access point and the home gateway are the same box, the 
AP itself can be preconfigured for WPS. That's the way the gateways that 
the major carriers are shipping are put together, and that's the reason 
WPS was invented in the first place - to make WiFi secure while making 
it easy to provision new devices.

There are obstacles to doing this, such as the WHQL waiver you need to 
get from MS because they want all APs to be "open" by default. But it's 
best current carrier practice and getting MS to fall into line is a 
priority.

I think the example was meant to illustrate the way the mass public 
approaches network security, BTW.

RB

On 2/12/2010 12:17 PM, David R Oran wrote:
>> On Fri, Feb 12, 2010 at 2:06 PM, Richard Bennett<[email-masked]>  wrote:

---

From: Mark Baugher <[email-masked]>
Date: Sat, 13 Feb 2010 09:35:22 -0800

I'm skeptical that WPS is widely used by people to configure WPA on their APs.  I don't think WPS has been all that successful in terms of widespread use and would appreciate any information to the contrary.  Based mostly on anecdotal evidence, the most common method is through the gateway installation program.  It is unlikely that the great majority of users ever choose to reconfigure their gateway once it's installed.  It's more likely that reconfiguration happens once at installation time to enable WLAN security in geographies where Wi-Fi is popular.  Practically all of the gateway products I have used ship with a well-known password or equivalent to make installation easy.  This is much worse than running an open wireless LAN in my view since all the products I have evaluated will work plug-and-play, meaning that they will operate with a well-known system password or equivalent open access to the system configuration.  

I think it's safe to say that malware is a much bigger threat than war drivers or free riders.  Thus, the current practice of shipping a gateway with no access controls by default to ease configuration of wlan security is a cure that's worse than the disease.

I know of at least one vendor that ships their gateways with WLAN security enabled by default.  But this default setting can be very expensive since it results in many service calls for what is often a very low margin product.  Besides that, it does nothing to prevent interior malware.

Mark

On 12/02/2010, at 7:22 PM, Richard Bennett wrote:

> When the Wi-Fi access point and the home gateway are the same box, the AP itself can be preconfigured for WPS. That's the way the gateways that the major carriers are shipping are put together, and that's the reason WPS was invented in the first place - to make WiFi secure while making it easy to provision new devices.
> 
> There are obstacles to doing this, such as the WHQL waiver you need to get from MS because they want all APs to be "open" by default. But it's best current carrier practice and getting MS to fall into line is a priority.
> 
> I think the example was meant to illustrate the way the mass public approaches network security, BTW.
> 
> RB
>

---

From: Richard Bennett <[email-masked]>
Date: Mon, 15 Feb 2010 03:57:13 -0800

I can't say how widely used WPS is yet, but I would consider it a best 
practice in any event; at least WPA2 is a best practice in the absence 
of a RADIUS server.

The gateway vendor I used to work for sold systems to two of the three 
major U. S. telcos, and both of them were secure by default with unique 
passwords. The password for each unit was printed on the label, and if 
customer changed it and forgot it, he could reset the box and go back 
the unique factory setting. The WLAN was also secure by default, 
unfortunately using WEP in one instance because the customer is always 
right. The retail gateways are the ones that are really messed up 
because the vendors just don't want their phones to ring and pretty much 
couldn't care less about the ecosystem.

I agree that malware and botnets are the major threats; they're the 
fruits of the end-to-end assumption that users are smart and network 
operators are dumb.  But that doesn't mean they're the only threats, or 
even the only significant ones. The issue ultimately is how we secure 
personal information for people who aren't too sharp.

Firewalls are horrible, I agree entirely with that. And unmediated 
attacks are worse, so what are you going to do?

RB

---

From: Jason Livingood <[email-masked]>
Date: Mon, 15 Feb 2010 11:10:24 -0500

A security service on a device can be helpful in preventing access from
outside the home LAN that the user did not initiate and/or request.  That is
indeed a major concern.  I recall in early broadband days having issues with
people printing offensive materials on their neighbor's printers and
browsing their file shares and so on.

But Mark is also correct that malware is also a big threat which a service
service on a device won't really help with.  In North American, between 5%
and 10% of all users have a malicious bot.  In some other parts of the
world, that number is much higher (I recall a survey that indicated one
European country was in the 25%+ range.)

These are simply data points to keep in mind for later.

Jason

PS - Shameless I-D plug: feel free to review/comment on my draft @
http://tools.ietf.org/html/draft-oreirdan-mody-bot-remediation-07

On 2/13/10 12:35 PM, "Mark Baugher" <[email-masked]> wrote:

> I think it's safe to say that malware is a much bigger threat than war drivers
> or free riders.  Thus, the current practice of shipping a gateway with no
> access controls by default to ease configuration of wlan security is a cure
> that's worse than the disease.
> 
> I know of at least one vendor that ships their gateways with WLAN security
> enabled by default.  But this default setting can be very expensive since it
> results in many service calls for what is often a very low margin product.
> Besides that, it does nothing to prevent interior malware.
> 
> Mark
> 
>> When the Wi-Fi access point and the home gateway are the same box, the AP
>> itself can be preconfigured for WPS. That's the way the gateways that the
>> major carriers are shipping are put together, and that's the reason WPS was
>> invented in the first place - to make WiFi secure while making it easy to
>> provision new devices.
>> 
>> There are obstacles to doing this, such as the WHQL waiver you need to get
>> from MS because they want all APs to be "open" by default. But it's best
>> current carrier practice and getting MS to fall into line is a priority.
>> 
>>>> configurations should work for people with the default level of knowledge
>>>> and the default crappy OS.
>>>> 
>>>> networking. IETF folks are a tiny minority of the potential users of an
>>>> IPv6 residential gateway.
>>>> 
>>>> given apartment building
>>>> Consider for a moment how often you encounter unpatched systems among
>>>> friends and family. Think about the security practices of ordinary computer
>>>> users.
>>>>

---

From: Jason Livingood <[email-masked]>
Date: Mon, 15 Feb 2010 11:25:58 -0500

> personal information for people who aren't too sharp.

I don't mean to single Richard out but, I often hear that sentiment
expressed by many people and while I understand it, I think we (the
collective 'we' in technology industries) ultimately fail because of this
assumption.  

It's not necessarily that people aren't smart, it's simply that they don't
have the time to pay attention to it, don't see the benefit of learning what
to do and why, etc.  That's ultimately a user experience, user education,
and/or technical design failure IMHO.

I think this is partly why the Apple suite of products is so successful.
The average user just wants to plug devices together and they just magically
work, integrate nicely with other things, tend not to crash, and you needn't
open a manual to figure things out.  By the same token, I think end users
simply expect us all to ensure they have some basic level of security and
that "it just works" - be that on their host or in their network. (with the
ability to configure something 'better' if they want to invest the time)
 
But I digress.  Don't forget to RSVP for the meeting!  :-)

http://event.pingg.com/HomeGateLondonMtg

Jason

---

From: Mark Townsley <[email-masked]>
Date: Tue, 23 Feb 2010 00:14:19 +0100

So far the only major bug I have had in my native IPv6 setup at home 
from my service provider was related to badly acting firewall enabled on 
a PC doing the wrong thing with ICMPv6 messages. Please don't think for 
a moment that a firewall makes life easier for a home user. In general, 
a firewall is there to limit packets from being forwarded, and 
applications, firewall control protocols, etc. have to figure out how to 
work *in spite* of that. No applications developer enjoys this.

I think users do not want to endure any more security than is necessary 
for them to feel safe. For some users, seeing the line of people being 
padded down at an airport makes them feel safe, for others it is just 
annoying and gets in the way of getting to the airplane on time.

At the end of the day, what we are really talking about is risk 
assessment. Of what value are the IPv6 stacks and the devices that are 
connected in my home worth, not so much to me, but to the potential 
attackers out there? That, and how expensive is it for them to 
compromise my system in a way that can bring them reward? Since Apple 
was brought up, certainly most folks who have one today do not run an 
antivirus program and do not get infected with viruses. This is perhaps 
in small part because the unix underpinning and less diverse application 
environment is inherently more secure, but it is arguably more because 
the reward for breaking into a device with 10% market share is less 
valuable than breaking into a device with 80% market share (or 
thereabouts).

I think IPv6 is sitting at a similar, even earlier, point in its 
evolution. It is, by far, a less valuable target than IPv4. Also, the 
devices it runs on today have a stronger underpinning for security 
(i.e., think about how much less vigilant one would have to be with IPv4 
security if all Windows XP and Windows 95 computers could be removed 
from the equation). Every major commercial OS that comes with IPv6 
enabled by default not only has a built-in local firewall, but a tether 
back to the vendor for regular security updates.

So, how many people run virus software on their Mac just because Windows 
has virus problems? Some, but not many. Why? Not because people do not 
want to be secure, but because, in general, security comes at direct 
opposition to ease-of-use. The same is true of firewalls. If you are 
looking for that Apple "ease of use" experience on the Internet, a 
firewall will do little to help.

- Mark

---

From: Mark Townsley <[email-masked]>
Date: Tue, 23 Feb 2010 00:45:54 +0100

Hi Barbara,

Despite the fact that this is an RFC, it does not represent IETF 
consensus. It is Informational, and as the second sentence in the 
document states, "It does not specify an Internet standard of any kind."

But, as you say, it is authored by a set of experts. I've cc'd them 
here, along with the shepherding area director at the time.

RFC 4864 opens with text that says there is a "perception that other 
benefits [to NAT] exist" and that the document intends to show "how 
Network Architecture Protection (NAP) using IPv6 can provide the same or 
more benefits without the need for NAT." It also says that there are 
"many serious disadvantages" to NAT. Given that context, I find it very 
hard to see how the quoted text below becomes an actual recommendation 
for an IPv6 firewall for a residential user.

But, let's let the experts speak for themselves.

Gunter, Tony, Ralph, Brian, Eric, David,

Your document is being heralded as the primary reason at least one very 
large service provider in the US, perhaps along with others, have 
decided to firewall their residential IPv6 users. Was that your 
intention with this document? Could you please comment on that here?

Thanks,

- Mark

---

From: james woodyatt <[email-masked]>
Date: Mon, 22 Feb 2010 16:09:30 -0800

On Feb 22, 2010, at 15:45, Mark Townsley wrote:
> 
> Your document is being heralded as the primary reason at least one very large service provider in the US, perhaps along with others, have decided to firewall their residential IPv6 users. Was that your intention with this document? Could you please comment on that here?

I don't think it matters much today what their intentions were back in the day.

The fact is the draft is now widely interpreted as representative of the consensus of the IETF working group comprising our best experts in IPv6 operations, and it's in line with the consensus of the IPv6 service provider community at large.  The document says what it says, and it speaks for itself.  It will continue to be interpreted as representing IETF consensus until it is updated or obsoleted to argue differently.

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 23 Feb 2010 13:15:19 +1300

Mark,

As you say, this is an Informational document, which means that
it has no particular authority. The v6ops WG is still debating
"Recommended Simple Security Capabilities in Customer Premises
Equipment for Providing Residential IPv6 Internet Service"
(draft-ietf-v6ops-cpe-simple-security-09), but that too is
marked Informational as well as still being in draft.

My *personal* opinion is that given the fact that most home
users either don't bother about security or don't get it
right, some sort of protection by default is desirable, but
that should be a decision taken by each ISP for commercial,
legal and ethical reasons in their own environment.

It's also my personal opinion that home users should be able
to switch off such protection if they want to. The great
thing about IPv6 is that this issue is completely orthogonal
to port mapping, so a user who decides to allow incoming
port 80 for example will be able to run as many HTTP servers
as s/he wants.

You will definitely get a lot of opinions about this if
you raise it on v6ops...

    Brian

On 2010-02-23 12:45, Mark Townsley wrote:
>> The information transmitted is intended only for the person or entity
>> to which it is addressed and may contain confidential, proprietary,
>> and/or privileged material. Any review, retransmission, dissemination
>> or other use of, or taking of any action in reliance upon this
>> information by persons or entities other than the intended recipient
>> is prohibited. If you received this in error, please contact the
>> sender and delete the material from all computers. GA622
>>
>>

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 23 Feb 2010 11:23:06 +0100

On 23 feb 2010, at 0:14, Mark Townsley wrote:

> So, how many people run virus software on their Mac just because Windows has virus problems? Some, but not many. Why? Not because people do not want to be secure, but because, in general, security comes at direct opposition to ease-of-use.

It's even worse than that. Often security comes at direct opposition of security measures. If you make users jump through too many hoops they'll circumvent the security measures.