Subject: RE: Routing loop attacks using IPv6 tunnels

From: "Templin, Fred L" <[email-masked]>
Date: Fri, 12 Mar 2010 13:13:05 -0800

Hi Dmitry,

> -----Original Message-----
> From: Dmitry Anipko [mailto:[email-masked]]
> Sent: Friday, March 12, 2010 12:54 PM
> To: Templin, Fred L; Gabi Nakibly; v6ops
> Cc: [email-masked]; [email-masked]
> Subject: RE: Routing loop attacks using IPv6 tunnels
> 
> Hello,
> 
> I wanted to follow up on Fred's comment earlier in this thread:
> 
> >> OK. That will greatly simplify the checks needed for new
> automatic tunneling protocols that have a format other
> than ip-proto-41.
> 
> For the designers of new tunneling protocols, shall perhaps a recommendation on best practices be
> included into the draft or another document, that for the new tunnels a different protocol value /
> format should be used?

Are you are referring here to 'draft-nakibly-v6ops-tunnel-loop-01'?
If so, IMHO this document would be the natural location for such a
recommendation. 

> Examples of such protocol / formats could include using a different next-protocol value, potentially
> with some multiplexing schema if just using different next-protocol values is not scalable, or
> possibly some other format.

Yes, I think it would be very good to declare ip-proto-41 as
fully-developed and recommend that new tunneling protocols use
a different ip protocol number and/or TCP/UDP port number. This
would greatly reduce the concern for having to go back and
revisit tunneling implementations that perform src/dst checks
if a new tunneling protocol happens to emerge. Gabi - do you
have any thoughts on this?

Thanks - Fred
[email-masked]

> Thank you,
> Dmitry
> 
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Templin, Fred L
> Sent: Friday, August 28, 2009 1:25 PM
> To: Gabi Nakibly; v6ops
> Cc: [email-masked]; [email-masked]
> Subject: RE: Routing loop attacks using IPv6 tunnels
> 
> Gabi,
> 
> > -----Original Message-----
> > From: Gabi Nakibly [mailto:[email-masked]]
> > Sent: Friday, August 28, 2009 12:07 PM
> > To: Templin, Fred L; v6ops
> > Cc: [email-masked]; [email-masked]
> > Subject: Re: Routing loop attacks using IPv6 tunnels
> >
> > Correct. All the attacks rely on the fact that the ISATAP router
> encapsulates/decapsulates a packet
> > the 6to4 relay decapsulates/encapsulates, respectively. So the two
> tunnels must have the same
> > encapsulation type.
> 
> OK. That will greatly simplify the checks needed for new
> automatic tunneling protocols that have a format other
> than ip-proto-41.
> 
> Fred
> [email-masked]
> 
> > ----- Original Message ----
> > > From: "Templin, Fred L" <[email-masked]>
> > > To: Gabi Nakibly <[email-masked]>; v6ops <[email-masked]>
> > > Cc: [email-masked]; [email-masked]
> > > Sent: Friday, August 28, 2009 7:23:03 PM
> > > Subject: RE: Routing loop attacks using IPv6 tunnels
> > >
> > > Gabi,
> > >
> > > Correct me if I am wrong, but if there were a new version
> > > of ISATAP that did not use ip-proto-41 encapsulation but
> > > instead used a different kind of encapsulation, then it
> > > need not concern itself with routing loop interactions
> > > with 6to4 relays since 6to4 relays only know about
> > > ip-proto-41. Does that match your understanding?
> > >
> > > Thanks - Fred
> > > [email-masked]
> >
> >
> >
> >
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: "Templin, Fred L" <[email-masked]>
Date: Fri, 12 Mar 2010 13:13:05 -0800

Hi Dmitry,

Thanks - Fred

---

From: Gabi Nakibly <[email-masked]>
Date: Tue, 16 Mar 2010 12:23:26 -0700 (PDT)

Dmitry and Fred,
Indeed using different values in the Protocol field for different automatic tunnel protocols can help in mitigating the routing loops. It is useful when the two victims employ _different_ tunneling protocols. However, this measure will not be useful for mitigating routing loops between two nodes that employ the same tunneling protocol. In think that this may reduce the motivation to apply this measure.
In addition, making such a change to the semantics of the Protocol field is a big step that should be considered thoroughly.

Gabi

----- Original Message ----
> To: Dmitry Anipko <[email-masked]>; Gabi Nakibly <[email-masked]>; v6ops <[email-masked]>
> Cc: "[email-masked]" <[email-masked]>; "[email-masked]" <[email-masked]>
> Sent: Fri, March 12, 2010 11:13:05 PM

> From: Dmitry Anipko 
> [mailto:> href="mailto:[email-masked]">[email-masked]]
> 
> Cc: > href="mailto:[email-masked]">[email-masked]; > ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]
> Subject: RE: Routing 
> I 
> wanted to follow up on Fred's comment earlier in this thread:
> 
> 
> than 
> ip-proto-41.
> For the designers of new tunneling protocols, 
> shall perhaps a recommendation on best practices be
> included into the 
> draft or another document, that for the new tunnels a different protocol value 
> /
> format should be used?

Are you are referring here to 
> 'draft-nakibly-v6ops-tunnel-loop-01'?
If so, IMHO this document would be the 
> natural location for such a
recommendation. 

> Examples of such 
> protocol / formats could include using a different next-protocol value, 
> potentially

Yes, I think it would be very good to declare ip-proto-41 
> as
a 
> different ip protocol number and/or TCP/UDP port number. This
would greatly 
> reduce the concern for having to go back and
revisit tunneling 
> implementations that perform src/dst checks
if a new tunneling protocol 
> happens to emerge. Gabi - do you

Thanks - 
> Fred
> href="mailto:[email-masked]">[email-masked]

> From: > href="mailto:[email-masked]">[email-masked] [mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]] On Behalf Of 
> Templin, Fred L
> To: Gabi 
> Nakibly; v6ops
> Cc: > href="mailto:[email-masked]">[email-masked]; > ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]
> Subject: RE: Routing 
> > From: Gabi Nakibly [mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]]
> > Sent: 
> > Cc: > href="mailto:[email-masked]">[email-masked]; > ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]
> > Subject: Re: 
> > Correct. All 
> the attacks rely on the fact that the ISATAP router
> 
> > the 6to4 relay 
> decapsulates/encapsulates, respectively. So the two
> tunnels must have 
> the same
> > encapsulation type.
> 
> OK. That will greatly 
> > ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]
> 
> 
> > > From: "Templin, Fred 
> L" <> href="mailto:[email-masked]">[email-masked]>
> 
> > > To: Gabi Nakibly <> href="mailto:[email-masked]">[email-masked]>; v6ops <> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]>
> > > 
> Cc: > href="mailto:[email-masked]">[email-masked]; > ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]
> > > Sent: 
> > > > ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]
> 
> >
> >
> >
> >
> 
> > href="mailto:[email-masked]">[email-masked]
> Administrative Requests: 
> > >https://www.ietf.org/mailman/listinfo/ipv6
>