[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: IPv6-PMP?

On Apr 11, 2007, at 00:52, Rémi Denis-Courmont wrote:
- many people seem to think that a disaster will happen if the NATs side effect security vanishes, and they won't switch to IPv6 if there is no "stateful firewall" (regardless of the fact that most malware is now transmitted through upper layers that won't care about stateful firewalls).
I'm trying to find somebody with some technical expertise, and who can speak authoritatively on the subject, who *DOESN'T* believe this.
+ Microsoft's recommendations for Internet gateway device implementers call for this. + The NAP draft in this working group calls for this, and I'm told this the result of an IETF consensus. + Apple received nothing but negative criticism for shipping AirPort Extreme without this side effect on the IPv6 side. (The U.S. Department of Homeland Security called it a "design error".)
Is there anyone on the IESG or the IAB who will speak up about this? Anyone? You'll forgive me if I don't hold my breath. 


(Yes, I know.  People will yell at you if you don't have "IPv6
firewall!!" on the product's data sheet.  But some half-informed
people will yell at you anyway... :( )
Hmm, some product managers in NetworkBoxCorp will read that IPv6 CPEs need a "stateful firewall" because IETF said so. So they'll put it to the requirements list, and voilà, it has to be there in every IPv6 CPEs. 

This has already happened.  I was in the room.
Worse, the security team at $CORPORATION has issued a security advisory to the effect that not having the "stateful firewall" enabled exposes local network nodes to remote attack and instructs customers to take steps to enable it, and changed the factory configuration to match the advised behavior. This means that every box from $CORPORATION for the foreseeable future will ship with the "stateful firewall" enabled in the default configuration, and users will never be comfortable turning it off. Indeed, the manufacturer is advising them *not* to turn it off. 

This isn't hypothetical.  It's the reality today.
And then, IPv6 is completely useless, since it has the exact same connectivity problems as IPv4+NAT: outbound TCP works; UDP works through hole punching if you know the peer address/port. Inbound TCP does not work (so COMEDIA SIP does not), unsolicited UDP does not work. So IPv6 becomes pretty useless, while it remains very costly an upgrade.
Unless we do something. I'm proposing that we consider extending ICMP to support automatically opening pinholes in the default gateway's stateful packet filter. Does anybody have any alternative to consider? 


--
j h woodyatt <jhw@apple.com>