IPv6 Transition/Co-existence Security Considerations draft-ietf-v6ops-security-overview-04.txt Elwyn Davies Suresh Krishnan Pekka Savola IETF-66, Montreal, 12 July 2006

12 July 2006 v6ops Security Overview - IETF 66 - Montreal2 Dealing with IESG Comments  IESG and secdir review generated a lot of comments ... and a larger amount of  Several comments are 'philosophical' Require clarification/disclaimers rather than substantive changes  Some editorial.. these will be fixed while recycling draft

12 July 2006 v6ops Security Overview - IETF 66 - Montreal3 IPv6 Specification Problems  Draft points out various problems with IPv6 specification  Suggests dropping traffic which is technically 'in specification' e.g., overlapped fragments  Two ADs disliked this but existence of problems acknowledged  Solution: Add general disclaimer

12 July 2006 v6ops Security Overview - IETF 66 - Montreal4 Disclaimer for Introduction "This memo identifies a number of situations where the current IPv6 standards allow for traffic which would potentially result in security vulnerabilities. The memo suggests measures which could be applied to detect or drop such traffic; in almost all cases these kinds of traffic would not result from correct, non-malicious use of the network. The hazards are pointed out in each case but administrators should be aware that existing or future applications might generate traffic that makes legitimate use of these capabilities."

12 July 2006 v6ops Security Overview - IETF 66 - Montreal5 Unusual Patterns of Padding  Agreed to add note that unusual patterns of option padding are legal but might be malicious  Add explanation of circumstances when maximum padding is 3

12 July 2006 v6ops Security Overview - IETF 66 - Montreal6 Tiny Fragments  Agreed to incorporate some extra text to reflect input in draft-manral-tiny-fragments-issues-02  Explain that s covers firewalls that reassembles packets before filtering  Suggest a sensible value for minimum size for non-final fragments (50% of guaranteed minimum MTU)

12 July 2006 v6ops Security Overview - IETF 66 - Montreal7 Unknown Extension Headers/Opts  Lengthy discussion of sensible practice for dropping these  Extensibility vs Security  Agreed that ultimately admins will choose safety over unthinking passing of all unknown options

12 July 2006 v6ops Security Overview - IETF 66 - Montreal8 Use of Link Local Addresses  Extensive discussion of link local addresses for applications that are not specifically designed to use them mostly management applications  Problem of overlapping addresses and zone specification  Recommendation in will be toned down and explained further

12 July 2006 v6ops Security Overview - IETF 66 - Montreal9 Minor Issues Needing Clarification  s : Middleboxes looking at destination opts, etc: needs to reflect that actual practice breaks the IPv6 spec (and it doesn't matter AFAICS)  Clarify s4.9 with regard to privacy addresses and ingress filtering  Using MAC addresses to identify equipment characteristics (App B)

12 July 2006 v6ops Security Overview - IETF 66 - Montreal10 Items Discussed - No Change Required or Proposed  Excessive use of Router Alert  Document reorganisation secdir reviewer didn't like organisation  A few things that were not necessarily IPv6 specific

12 July 2006 v6ops Security Overview - IETF 66 - Montreal11 Next Steps  Revised draft soon  Further WG review needed?  Back to IESG