Subject: RE: (ngtrans) shipworm, 6to4 and anycast [...]

From: "Christian Huitema" <[email-masked]>
Date: Wed, 30 Jan 2002 16:31:44 -0800

> > Packets going from a 6to4 relay back to a 6to4 server have as a
source
> > address the proper (non-anycast) IPv4 address of the relay.
> 
> Non-anycast address could be used, but this is not the assumed
scenario
> by the RFC author *), at least.  With _IPv4_ anycast, I don't see why
you
> couldn't (and wouldn't, to identify that the packet came from a relay)
use
> the address corresponding to the 6to4 IPv6 anycast address also as
source.
> 
> *) When the author was suggesting modifying 6to4 security checks such
that
> any packet coming from IPv4 anycast address would be interpreted to
come
> from the relay; he automatically seemed made the assumption that
existing
> relays would do this and would require no modifications.

Uh, please let this author be precise. RFC 3076 does not say anything
about the relaying of packets from the IPv6 Internet to 6to4 nodes; this
behavior is specified in RFC 3056. RFC 3056 specifies the classic hot
potato behavior: IPv6 packets are dumped to the 6to4 relay router
nearest to the IPv6 source, and move from there along the shortest IPv4
path. 

The discussion Pekka alludes too reflects the contradictions between
ingress filtering and tunneling, between ingress filtering at the IPv4
layer and ingress filtering at the IPv6 layer. RFC 3056 specifies this
in its security section:

   By default, 6to4 traffic will be accepted and decapsulated from any
   source from which regular IPv4 traffic is accepted.  If this is for
   any reason felt to be a security risk (for example, if IPv6 spoofing
   is felt to be more likely than IPv4 spoofing), then additional source
   address based packet filtering could be applied.  A possible
   plausibility check is whether the encapsulating IPv4 address is
   consistent with the encapsulated 2002:: address.  If this check is
   applied, exceptions to it must be configured to admit traffic from
   relay routers (Section 5).  2002:: traffic must also be excepted from
   checks applied to prevent spoofing of "6 over 4" traffic [6OVER4].

In short, in order to prevent address spoofing, you check that the IPv4
source address is consistent with the IPv6 source address, or that the
source address "is a relay router." The small problem here is that
because of hot potato routing, relays have absolutely no way to tell
that the IPv4 source address is that of a router. I observed that they
could tell if the relay routers used the 6to4 anycast address
192.88.99.1 as their source address; this convention would make IPv6
ingress filtering possible. However, as Thomas pointed out, this
convention will make IPv4 level address filtering problematic, since the
source address 192.88.99.1 could very well appear from arbitrary
interfaces.

This is why I asked the question about the locality of ingress
filtering. If we only performed address filtering at the "first ISP
router", then using the anycast address as a source address would not be
much of an issue. If we performed address filtering at peering points
between ISP networks, then we would indeed run into problems. I
personally believe we should not perform such filtering at peering
points, because of the high risk of interference between that and hot
potato routing. But I would really like to hear about the actual
practice.

-- Christian Huitema

---

From: Alain Durand <[email-masked]>
Date: Wed, 30 Jan 2002 18:01:49 -0800

I understand this business about relay routers using the anycast IPv4
address 192.88.99.1 as source address is a direct result of a discussion
that started at the London IETF on the potential abuse of 6to4
routers as packet anonymizer in DDOS.

To refresh the context, an attacker send a packet with

IPv4 src = attacker valid src
IPv4 dst = a 6to4 router
IPv6 src = TARGET
IPv6 dst = a well known host in the abused 6to4 domain

The valid IPv4 src guaranties that the attacker ISP will not filter it out.

The 6to4 router will decapsulate the packet and forward it to the
well known host. At this point the IPv4 src information is lost.
The 6to4 well known host will answer by sending a packet to TARGET.

Under that scenario, the 6to4 router and the 6to4 well known host
are acting as anonymizer and packet reflectors.

To prevent this, it has been suggested to perform some sort of
ingress filtering at the 6to4 router.
If IPv6 src is a 6to4 address, we can check that IPv4 src address
correspond to the embedded IPv4 address in IPv6 src address
in the 6to4 format.

But what if the packet is not coming from another 6to4 domain/host
but from a 6to4 relay? In that case, IPv6 src will be a global, non 6to4
address and the  above check can not be perform here.
So what some people have proposed and obviously implemented
is that their 6to4 relay will sent packet using 192.88.99.1 anycast
as IPv4 src, so their 6to4 routers can say:
"If IPv6 dst is not 6to4, then IPv4 src must be 192.88.99.1"

Of course, this rely on ISPs only performing ingress filtering
near the 6to4 relay.

This, again, is undocumented but obviously deployed by someone.

    - Alain.

---

From: Pekka Savola <[email-masked]>
Date: Thu, 31 Jan 2002 10:00:13 +0200 (EET)

> This, again, is undocumented but obviously deployed by someone.

To be precise, there are a few levels of deployment:

1) using 192.88.99.1 as source for "because you can" and it works
(you have to have 192.88.99.1 configured anyway.)

2) making the requirement:
"If IPv6 dst is not 6to4, then IPv4 src must be 192.88.99.1"
in 6to4 routers.

1) can be done today, 2) can't -- 2) would require _every single_ 6to4 
relay in the Internet would perform 1).  A bit unrealistic to change that 
for 6to4 ...

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Pekka Savola <[email-masked]>
Date: Thu, 31 Jan 2002 15:45:05 +0200 (EET)

On Thu, 31 Jan 2002, Erik Nordmark wrote:
> I think you meant "If IPv6 src ...".
> 
> The IPv6 destination for
> a packet coming from a 6to4 relay to a 6to4 router should always 
> be a 6to4 address.

src, naturally.. I just cut'n'pasted it from Alain without looking.

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 31 Jan 2002 14:40:32 +0100 (CET)

The IPv6 destination for

  Erik

---

From: Alain Durand <[email-masked]>
Date: Thu, 31 Jan 2002 10:39:44 -0800

> src, naturally.. I just cut'n'pasted it from Alain without looking.

You're right, my typo.

    - Alain.