[LACNIC/Seguridad] [LAC-TF] Fwd: RFC 7217 on A Method for Generating Semantically Opaque Interface Identifiers with IPv6 Stateless Address Autoconfiguration (SLAAC)

[Fernando Gont]

On 05/13/2014 05:41 PM, Arturo Servin wrote:
> 
> Esto suena mejor. "Deshabilita IPv6 si no lo necesitas, pero no te
> olvides de él y monitorea si hay mal uso o abuso".
> 
> Lo que esta en el draft es más en la línea de "deshabilita IPv6 y te
> ahorras problemas"

Asumiendo que el draft al que te referis es el hoy RFC7123, debo decir
que eso no es lo que el documento dice (*).

La sección 1 dice, explicitamente:

"  In general, most of the aforementioned security implications can be
   mitigated by enforcing security controls on native IPv6 traffic and
   on IPv4-tunneled IPv6 traffic.  Among such controls, is the
   enforcement of filtering policies to block undesirable traffic.
   While IPv6 widespread/global IPv6 deployment has been slower than
   expected, it is nevertheless happening; and thus, filtering IPv6
   traffic (whether native or transition/coexistence) to mitigate IPv6
   security implications on IPv4 networks should (generally) only be
   considered as a temporary measure until IPv6 is deployed."



El bottom-line del documento es "No te olvides que IPv6 afecta a tu red,
por mas que creas que tu red es solo IPv4", y menciona posibles opciones
para mitigar las implicancias.


La realidad es que, para muchas cuestiones, si uno realmente está
preocupado por las implicancias descriptas, en ocasiones no hay muchas
mas opciones que bloquear IPv6 -- sea deshabilitandolo completamente, o
por ejemplo filtrando Ether proto 0x86dd.


En palabras de Bertrand Russell:

"When you are studying any matter or considering any philosophy, ask
yourself only what are the facts and what is the truth that the facts
bear out. Never let yourself be diverted either by what you wish to
believe or by what you think would have beneficent social effects if it
were believed, but look only and solely at what are the facts."


Abrazo,
-- 
Fernando Gont
SI6 Networks
e-mail: fgont en si6networks.com
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492