Subject: (ngtrans) 6to4 anycast experiences

From: Pekka Savola <[email-masked]>
Date: Mon, 27 Aug 2001 14:00:01 +0300 (EEST)

Hi,

I've been playing with 6to4 relay router w/ anycast a little.  It would be
interesting to know if anyone has really even used it ... at least the
prefix is not being advertised in IPv4 EGP (it's still useful as an IGP
mechanism, though, of course).

Problem with this is that it's implied that you only have one 6to4 prefix
(6to4 spec is meticulous to mention the possibility for more, but how many
implementations really support this?).  If you wanted to run old-fashioned
6to4 and anycast 6to4 on the same box, some security considerations would
have to be re-thought (keeping in mind that non-anycast will be used in
the future too, no matter what).

I hope I'll have time to write a short summary of all the possible
configurations and how you could do sanity checks there, as I don't recall
seeing one around (pointers welcome!).

That aside, anycast 6to4 routers have to assign IPv6 anycast address
2002:c058:6301:: on the pseudo-interface.  The address MUST not be used as
a source address.  This means that packets sourced from relay routers
towards 6to4 routers must have either:
 1) "regular" 6to4 prefix (if you are a "regular" relay too), or
 2) native IPv6 address
as the IPv6 source address.

1) had problems, at least if you're concerned with security/implementation
(these could be thought out, of course), and 2) seems a little hackish, as
the destination addresses of these are always 6to4-only nodes.

Sure, the traffic gets through, and their responses are routed through the
"default" route towards the relay (not the 2002::/16 sending rule), but
still.

What I'm also wondering is, is there enough justification for using _IPv6_
anycast in addition to IPv4?  It seems to me that IPv6 anycast might only
gain you additional benefits, compared to e.g. an assigned number
"2002:c058:6301::1", if there is more than one relay router in the same
physical network medium, e.g. LAN.

(As a side note: there is a potential good side to using IPv6 anycast: it
can be used to locate the real IPv6 address of the relay, if you get the
relay to send packets to you directly, e.g. with traceroute, as the 6to4
anycast address can't be used as a source address)

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 27 Aug 2001 09:56:34 -0500

Pekka Savola wrote:
...
> If you wanted to run old-fashioned

We know there is a risk of spoofed native IPv6 source addresses arriving via
a 6to4 relay - do you think this risk is any different if the relay is using
the anycast address?

  Brian

---

From: Pekka Savola <[email-masked]>
Date: Mon, 27 Aug 2001 20:12:58 +0300 (EEST)

> a 6to4 relay - do you think this risk is any different if the relay is using

Not that much different.  One detail comes to mind, though.  The
implementation might verify that IPv4 source address of the packets
arriving from the relay must be equal to the address used as the default
route towards relay.

In this scenario, you could attack the 6to4 router directly, as you would
know that it expects the packets to originate from IPv4 anycast, not some
less obvious IPv4 address.

IPv4 anycast prefix must be special cased, creating a well-known
"backdoor", which may be rather hard to back-trace.

But the main points were:
 1) I believe most implementations only support 1 prefix (source address
selection between the two (IPv4) is another issue if coupled with strict
security checks)
 2) 6to4/Shipworm/... security consideration haven't been presented on a
"practical level" AFAIK