draft-ietf-v6ops-cpe-simple-security-00

[Iljitsch van Beijnum <iljitsch@muada.com>]

Looking at draft-ietf-v6ops-cpe-simple-security-00:

"The operational goals of security capabilities in Internet gateways  
are described with more detail in "Local Network Protection for  
IPv6" [IPv6-NAP], but they can be summarized as follows.

o Check all traffic to and from the public Internet for basic sanity,  
e.g. anti-spoofing and "martian" filters.
o Allow tracking of application usage by source and destination  
transport addresses.
o Provide a barrier against untrusted external influences on the  
interior network by requiring filter state to be activated by traffic  
originating at interior network nodes.
o Allow manually configured exceptions to the stateful filtering rules  
according to network administration policy."

The first bullet is fairly obvious (although personally I've never  
felt the need to filter packets that are going to fail just fine on  
their own) but I'm not quite sure what the other bullets get at...

Some things that may deserve attention in the draft:

What about packets with unknown next headers?

On the one end you don't want bad guys to work around filters by  
inserting a header or two between the IPv4 and TCP or UDP headers, but  
on the other hand you don't want to make innovation impossible by  
filtering out anything that didn't exist when the CPE was shipped.

An extra complication is that although there is a fairly standard  
extension header format, not all headers conform to this format, so it  
may or may not be possible to look beyond an unknown header in a packet.

PMTUD is mentioned but no language about allowing the required packet  
too big messages through. This is extremely important, PMTUD black  
holes are a big problem, and some of the IPv4 worarounds aren't  
available in IPv6. It may even be useful to allow the CPE to advertise  
a reduced MTU on the LAN side to work around upstream PMTUD breakage,  
although it wouldn't be a good idea to enable this by default, IMO.

Some other stuff that routinely cause trouble with at least some  
firewalls: diffserv bits in the IP header, ECN, TCP options in general  
and window scale in particular. Do we need to say anything about  
these? (Some firewalls ignore the window scale option but then block  
"out of window" segments.)