Subject: Re: (ngtrans) Shipworm Issues

From: "Michael Cole" <[email-masked]>
Date: Tue, 1 Oct 2002 5:4:49 -0400

A lot of modern networking hardware that is intended to be installed 
between a LAN and the Internet does some amount of packet snooping because of a 
built-in firewall. Whether a hardware or software firewall will allow IPv6 
within IPv4 is another matter. You can always get the job done by using 
IPv4 IPsec in transport mode, which encrypts everything including the IPv6 
headers. However, things should not need to be that complicated unless you need 
to encrypt everything such as over a satellite link or the wireless portion of a 
LAN.

Firewalls are a necessary beast for any gateway or NAT that is in between a 
LAN and the outside world. You definitely do not want a router that is so 
transparent that outsiders can ping any workstation. One of the advantages of a 
NAT is that it is opaque enough to make a LAN look like a single computer to the 
Internet - a firewall can fully stealth the system enough that it is hard to 
tell that there is even a computer there. I have tested Tiny Personal Firewall 
against a security testing website and the site tells me that for all practical 
purposes my computer isn't even there. The site also has a test Trojan 
to test the firewall's internal security and TPF passes that test too.

There are also combined NAT+firewall+gateway products out there and the 
state of the art in IPv4 security technology is very good.

One of the doubts that I have about the current shipworm proposal is that 
it uses one address to set up the link and another to carry the data - this 
would NOT work well with firewalls. The allowance for the number 
of attempts and total time that the relay allows does not account that many 
firewalls require manual intervention to set up a new filtering rule. When 
downloading something I sometimes get a request from a different IP address 
because the FTP server is bypassing the HTML server.   Imagine if you 
had to call one number to set up a long distance telephone call and used another 
to do the actual talking. (Actually, that was how long distance worked before #4 
crossbar. You called the long distance operator, gave them your own number and 
the number of the person you wanted to reach, and then the operator called 
you back later when the connection was set up.) It would be a LOT simpler if the 
setup server and the transport relay used the same address. In order for a 
firewall to work the Shipworm server bank would need to have a common IPv4 
address that the server bank ALWAYS presents to the firewall.

----- Original Message ----- 

From: Caitlin 
Bestler  

To: Randy Bush 
Cc: [email-masked] 

Sent: 10/1/2002 3:58:13 AM 

Subject: Re: (ngtrans) Shipworm 
obfuscation

On 9/28/02, Randy Bush wrote:

   A docsis cable modem is layer 2 device that is SNMP

   controllable via an IP stack, and which can perform

   layer 4 filtering of packets.

 that there is a l3 control path is a side issue.  that 
it

 snoops and can filter at l3 is a data path issue and is

 the meat of the matter.  i.e. one has to configure it 
to

 allow any l3 traffic not planned and provisioned by the

 isp(s).

The intent of the filter is to block all traffic not

specifically approved. Legitimate purposes include

preventing the Cable Modem from introducing forged packets

to the network. All source IP addresses will match a known

Cable Modem, and hence can be traced to a specific customer.

 so, are the l3 snooping filters and the head ends capable

 of being configured for ipv6?

The MIBs allow for IPv6 addresses.

However, it would be prudent to assume that the QA process

was more thorough when testing with IPv4 addresses.

Because Cable Modems can forward non-IP traffic, such as

IPX. There is a very good chance that virtually all CMs can

be enabled to forward *all* IPv6 traffic even if there is a

flaw in their IPv6 packet filtering.

Caitlin Bestler

--- Michael Cole

--- [email-masked] 

--- EarthLink: It's your Internet.

---

From: "Christian Huitema" <[email-masked]>
Date: Tue, 1 Oct 2002 08:14:40 -0700

> One of the doubts that I have about the current shipworm proposal 
> is that it uses one address to set up the link and another to carry 
> the data - this would NOT work well with firewalls. 

Where did you get that impression? Teredo does not in fact "set up a
link", and then the host always use the same some address.

There are basically two types of firewalls: the "home router" that has
some firewall function as a side effect of being a port mapping NAT, and
the "enterprise firewall" in which an IT manager configures an explicit
set of rule designed to enforce the local policy. Teredo is designed to
cross the former, not the latter. Indeed, a lot of that is linked to
implementation, but our own implementation tries hard to provide
controls so that Teredo will NOT run if running it is against the local
policy.

Specifically, Teredo relies on the NAT-firewall having one of the
following three configurations:

* "Cone": if an internal host sent a packet from internal address and
port IA:ip to any outside party, the NAT maps IA:ip to the external
address an port XA:xp, and authorize any outside host to send a response
to XA:xp.

* Restricted cone: if an internal host sent packets from IA:ip, the NAT
maps IA:ip to the external address an port XA:xp regardless of the
outside destination, but the NAT will only authorize responses from the
outside address and port OA:op if traffic was previously sent from XA:xp
to OA:xx, where xx need not be equal to op.

* Port restricted cone: same as restricted cone, except the NAT requests
that traffic was previously sent from XA:xp to OA:op.

Combinations of these three configurations are used in the vast majority
of home gateways.

-- Christian Huitema

---

From: "Michael Cole" <[email-masked]>
Date: Tue, 1 Oct 2002 19:29:28 -0400

What I should have written is that MOST people would want to have a 
firewall in place. I understand that you are not most people. Richard Stallman 
is not a believer in computer security either, but I like to know if somebody is 
probing my system. I am even paranoid enough to put kill_cih.exe into my 
autoexec.bat file. If I were suddenly rich enough to have a DSL and a laptop, I 
certainly would not want a war driver to be freeloading off of me.

Before I had a firewall, there were some instances where an spammer would 
stake out a web site and when I tried to use the website, I got a kajillion 
pop-ups that were NOT authorized by the website. As result the website was not 
accessible. One of these jackasses was none other than General Motors 
Finance. I filled out their form and gave my name as Mr. StopTheSpam. Sure 
enough, I got an email credit offer addressed to Mr. StopTheSpam.

----- Original Message ----- 

From:  

To: Michael Cole 

Sent: 10/1/2002 7:06:24 AM 

Issues

On Tue, 1 Oct 2002, Michael Cole wrote:

  Firewalls are a necessary beast for any gateway or NAT that is 
in

  between a LAN and the outside world. You definitely do not want 
a

  router that is so transparent that outsiders can ping any 
workstation.

Michael,

I understand that you would want that situation, but I would not.

I want no firewalls, NATs or filtering routers, and outsiders can ping 
any

of my workstations all the time. One of the strengths (and beauties) of 
IP

is that it lets you make one decision and me make another - and the

primary reason I'm so active trying to deploy IPv6 is to prevent a 
future

where I'm forced to make what for me is the wrong decision.

Bill.

--- Michael Cole

--- [email-masked]