Subject: RE: (ngtrans) shipworm and anycast Was: Review ofdraft-ietf-ngtrans-shipworm-03.txt

From: "Christian Huitema" <[email-masked]>
Date: Sun, 10 Feb 2002 10:53:31 -0800

> I do not see anything in your list about security, for instance
> a number of points that were made in the original review
> about the UDP tunnels facilitating packet laundering.

There are already a number of provisions in the draft to cover the
packet laundering issue: the client and server specifications both
mandate source address verification, i.e. check that the source IPv6
address is properly correlated with the source IPv4 address. These
provisions can clearly be bypassed if the hacker forges both the IPv4
and the IPv6 address, but little can be done about that.

> It is not an adequate security response to say that shipworm
> has vulnerabilities, but so does 6to4.

I argue that there is nothing specific to UDP here: all tunnel solutions
have the same class of vulnerabilities. 

> > 7) Added a "deployment" paragraph that explicitly says that this is
a
> > "last resort" option, that any other form of IPv6 connectivity
should be
> > preferred, and that we expect a "sunset" of Teredo as IPv6 gets
> > deployed.
> 
> The previous draft said this, but wishing a sunset does not make
> it happen.
> 
> If a user is established and getting service from a shipworm
> server not coordinated with those who maintain their infrastructure,
> what would cause them to switch when their own infrastructure
> provides the more preferred alternatives?   Shipworm states a goal
> of having users need no management to get IPv6 service, through
> discovery and cached tunnels.  What would change the usage of
established
> shipworm users at "sunset" when they have better choices?

This is actually detailed: the Teredo service is not started if another
solution is available. The client implementation is listening for IPv6
router advertisements, which inform the client that a plain IPv6
solution is available. When the infrastructure is upgraded, the client
will start receiving these advertisements, and stop using the service.

-- Christian Huitema

---

From: Keith Moore <[email-masked]>
Date: Sun, 10 Feb 2002 15:21:31 -0500

> and the IPv6 address, but little can be done about that.

I don't see any way to put a forwarder of arbitrary v6 packets in the 
network, and make it available for anyone to use, and not have that
forwarder be usable for packet laundering.

I conclude that any such forwarder is going to be a significant security 
risk.  I can think of a few ways which might help to ameliorate this risk:

- the forwarder needs to provide the same level of tracability as exist 
  for IP packets that arrived through other paths (perhaps by including 
  the original source address as an IP option).

- the forwarder needs to require authentication, and restrict access to 
  authorized parties who can be held accountable for abuse.

but with the current proposal, I don't think the level of risk is
acceptable.

Keith

---

From: "Tony Hain" <[email-masked]>
Date: Mon, 11 Feb 2002 10:44:44 -0800

> will start receiving these advertisements, and stop using the service.

Actually it is even simpler than this. Fix
draft-ietf-ipngwg-default-addr-select-06.txt to include a precedence
between 2002::/16 & ::/96 for the Teredo prefix. I realize some would
argue to put it after ::/96 for technical optimization, but for
realistic deployments it makes more sense to try Teredo before the
likely-to-fail (due to lack of multicast) compatible address.

Tony