May 2015 - ipv6-wg - mailman.ripe.net

Extension Headers / Impact on Security Devices
by Enno Rey 26 Jun '15

26 Jun '15

Hi, hope everybody had a great #RIPE70 meeting. We did! Many thanks to the organizers and chairs! With regard to the strong position on ext hdrs that I expressed in the session yesterday pls allow to add some material/sources: - this is a paper laying out how we could circumvent some major (both commercial and FOSS) IDPS solutions in their at the time of testing latest versions, by various combinations of extension headers and fragmentation: https://www.ernw.de/download/eu-14-Atlasis-Rey-Schaefer-briefings-Evasion-o…. - here's some thoughts and preliminary results of tests performed to circumvent stateless ACLs: http://www.insinuator.net/2015/01/evasion-of-cisco-acls-by-abusing-ipv6-dis…. http://www.insinuator.net/2015/01/the-persistent-problem-of-state-in-ipv6-s…. We have a (somewhat) ongoing research project looking more closely on the interaction of ACLs and extension headers. For the moment I can only state that it's not just Cisco who are "affected". More results will be available in some months. If the chairs consider this appropriate we will happily give a presentation on this stuff in Bucharest or at another occasion. We could even bring some devices to Bucharest to do some practical testing and demos "in some side room" during #RIPE71, for those interested. We can even do the latter without any official part in a session, if there's interest. As for the topic itself I'd like to summarize our position as follows: - it has not happened in the past 17 yrs (since publication of RFC2460) that compelling, Internet-scale use cases of extension headers have been brought up. - we're hence quite sceptical as for the "we might see cool use cases in 15-20 yrs" position someone expressed at the mic. - from a security perspective they turn out to be a nightmare for (a number of) current security architectures and controls. it is hence understandable (and we actually advise to do so) that they are blocked at the _border_ of networks that have not yet managed to identify a compelling use case. - looking at the "liberty" RFC2460 provides as for ext_hdrs (wrt to their number, order, options, fragmentable vs. unfragmentable part etc.) we do not expect that type of security issues to disappear soon (the main reason why we did not continue the IDPS research was that the involved student eventually delivered this thesis. one can probably find much more issues provided time & resources). Adding more parsing cycles & intelligence (read: silicon) is not an option, at least not for sth that doesn't have a use case. - the results of this (blocking) approach have been observed and documented by Jen & Fernando and others (Tim Chown). - now that "this vicious circle" has gained sufficient ground it will be even less incentivized to develop a compelling use case. which is why we do not expect to see one in the future. === Everybody have a great weekend and for those still in AMS: have a safe trip home! Best Enno -- Enno Rey ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de Tel. +49 6221 480390 - Fax 6221 419008 - Cell +49 173 6745902 Handelsregister Mannheim: HRB 337135 Geschaeftsfuehrer: Enno Rey ======================================================= Blog: www.insinuator.net || Conference: www.troopers.de Twitter: @Enno_Insinuator =======================================================

16 43

IPv6 only as default for next meeting
by Jérôme Fleury 24 May '15

24 May '15

During WG this afternoon, the idea was submitted that the IPv6 only experimentation be made the default SSID for the next meeting. While this has been working tremendously well for routine internet usage, I've been unable to use this network mainly because of incompatibility with my VPN network. We have a dual-stack VPN. some of the resources are v4 only though. The DNS64 converts my v4 VPN resources into v6 resources that are then routed to the non-VPN interface. While there could be workarounds (DNS64 on the VPN side, full v6 routing on the VPN, or all VPN resources available on v6) I don't think the technology is mature enough to make it the default for advanced usage. My 0.02$

11 18

How to Unsubscribe!?
by Adem Karatepe 15 May '15

15 May '15

Hi folks, I used to work in IPV6 work group before in my company and my colleague add me to this list but I'm not working on this group anymore and my colleague resigned from company so we don't have login details and we can not unsubscribe from the mail list. Is there any other way to unsubscribe? Adem Karatepe BT Proje Asistanı Project Support Staff Yazılım Geliştirme Direktörlüğü Software Development www.turksat.com.tr<http://www.turksat.com.tr> akaratepe(a)turksat.com.tr<mailto:akaratepe@turksat.com.tr> Gazi Üniversitesi Gölbaşı Yerleşkesi Teknoparkplaza kat 2 06830 Gölbaşı/ANKARA T : +90 312 497 47 00 F : +90 "Bu mesaj ve ekleri mesajda gönderildiği belirtilen kişi ya da kişilere özel olup gizli bilgiler içeriyor olabilir. Mesajın muhatabı ilgilisi ya da gönderileni değilseniz lütfen mesajı herhangi bir şekilde kullanmayınız çoğaltmayınız ve başkalarına ifşa etmeyiniz. Eğer mesaj yanlışlıkla size ulaşmışsa anılan mesaj ve ekinde yer alan bilgileri gizli tutunuz ve mesajı gönderen kişiyi bilgilendirerek söz konusu mesaj ile eklerini derhal imha ediniz. Bu mesaj ve ekindeki belgelerin bilinen virüslere karşı kontrolü yapılmıştır. Ancak e-posta sistemlerinin taşıdığı risklerden dolayı şirketimiz bu mesajın ve içerdiği bilgilerin size değişikliğe uğrayarak veya geç ulaşmasından bütünlüğünün ve gizliliğinin korunamamasından virüs içermesinden ve herhangi bir sebeple bilgisayarınıza ve sisteminize verebileceği zararlardan sorumlu tutulamaz.”<<<<< “This message together with its attachments is intended solely for the address(es) and may contain confidential or privileged information. If you are not the intended recipient please do not use copy or disclose the message for any purpose. Should you receive this message by mistake please keep all information contained in the message or its attachments strictly confidential and advise the sender and delete it immediately without retaining a copy. This message and its attachments have been swept by anti-virus systems for the presence of known viruses. However due to the risks of e-mail systems our company cannot accept liability for any changes or delay in receiving loss of integrity and confidentiality containing viruses and any damages caused in any way to your computer and system recipient, you are notified that disclosing, distributing, or copying this e-mail is strictly prohibited. “

1 0

Chair replacement procedure for ipv6-wg
by Dave Wilson 15 May '15

15 May '15

Hi all, You might remember from the last RIPE meeting that each working group had to finalise chair selection procedures. Because we were changing chairs anyway, ipv6-wg got to wait for one more meeting. Since the other working groups have gone through that process, however, we can use that to our advantage. Instead of starting from scratch, we propose to use a procedure which has already been discussed by a working group. The one we've chosen, because it seems very close to what we discussed at RIPE 69, is the procedure used by anti-abuse-wg. I hope this draft is already "good enough" for us to adopt as a result; if so, it'll save us repeating work that's already been done several times over in other WGs. We have this on the agenda for RIPE 70, and I hope we'll be able to adopt it then. Best regards, Dave ===(cut here)=== Note on Language: Throughout this document the word Chair shall be used for both Chairs and Co-Chairs. ** Introduction: This document outlines procedures dealing with the tenure of RIPE Working Group Chairs. It applies to all RIPE Working Groups. ** WG Chair Term: The term of a WG Chair is three years. A current chair may stand for re-selection at the end of their term. A WG Chair may resign voluntarily at any time. ** Selection of a WG Chair: WG Chair vacancies, along with a call for candidates, must be announced on the WG mailing list at least one month in advance of the date upon which the selection will be held. The announcement should set a closing date for candidates. A WG may request that a WG Chair vacancy be opened so long as the addition of a new Chair would not cause the number of Chairs of that WG to exceed three. WG Chairs are elected at WG sessions at RIPE meetings. Anyone physically present at the WG session is eligible to participate in the selection process. The candidate does not need to be physically present at the WG session. If possible the Chair should be elected by acclamation by the WG or by consensus after discussion. If the result is unclear, then a secret ballot should be held. In the case of a ballot, votes will be counted by RIPE NCC Staff and/or Chairs of other WGs. The result will be determined by simple majority. ** Removal of a WG Chair: A WG Chair may be unable to fulfil their duties as described in this document or otherwise fail to serve the WG and the community. With the endorsement of a significant share of the WG, a vote of no confidence may be initiated. Before a vote of no confidence is taken, due effort should be made to address the issue(s) leading to the vote. The right of reply must be given to all parties involved in the procedure. If this effort fails to resolve the issue, the vote may proceed. The vote must be requested on the WG mailing list at least one week in advance of the WG Session at a RIPE meeting and should take place during the WG session. Anyone physically present at the WG session may take part in the vote. The vote should be conducted by secret ballot and votes counted by RIPE NCC Staff and/or WG Chairs of other WGs. The result will be determined by simple majority. If the vote of no confidence in a WG Chair is passed, the seat is vacated and the WG Chair is not eligible for stand for re-selection. ** No Chair: If a working group is left with no Chair, e.g. due to the resignation or removal of the sole WG Chair, then the WG may elect an interim WG Chair according to the selection procedures specified above, but with candidates nominated at the WG session. An interim WG Chair must resign at the next WG session, but may stand for re-selection. ** Staggered Introduction: For the purposes of staggering the introduction of this policy, in the case where all co-Chairs of a WG have served for more than the standard WG Chair term limit, an optional waiver is given to these WGs to allow them to schedule the automatic resignations of their Chairs over the two RIPE meetings immediately following the adoption of this policy. If the WG decides to avail of this waiver, it is the responsibility of the WG to decide in what order its co-Chairs should stand down. ===(cut here)=== -- Dave Wilson, Service Desk Manager web: www.heanet.ie HEAnet Ltd, 5 George's Dock, IFSC, Dublin 1 tel: +353-1-660-9040 Registered in Ireland, no 275301 fax: +353-1-660-3666

5 6

Link to publicly available DNS64/NAT64 implementations
by Jan Zorz 15 May '15

15 May '15

Dear IPv6 WG, As promised during the IPv6 WG meeting at RIPE70, I'm sending the link with information how to test remotely different implementations of NAT64 that we are running in Go6lab: http://go6lab.si/current-ipv6-tests/nat64dns64-public-test/ Ecdysis is the weakest one and somehow a bit buggy, so please use the PAN and C1000 ones, that are dedicated boxes for this test and *will* handle the traffic and translation process ;) Cheers, Jan Zorz

4 3

Fwd: Re: IPv6-only network at RIPE70
by Wilfried Woeber 14 May '15

14 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Forgot to also include the wg mail list. sorry. Here you go, Wilfried. - -------- Forwarded Message -------- Subject: Re: [ipv6-wg] IPv6-only network at RIPE70 Date: Thu, 14 May 2015 11:50:07 +0200 From: Wilfried Woeber <woeber(a)cc.univie.ac.at> To: Jen Linkova <furry13(a)gmail.com> Hi Jen, v6-folks, > General feedback (do you guys see any value in such an experiment, > what was your experience etc) is appreciated. I was on this network while doing stuff after yesterday's key signing party, and it simply works, to fetch keys from servers and to upload. Just a minor thing and not too important for the "masses", but still thumbs-up :-) Wilfried -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVVQcKAAoJEPMGt0I/M2zSbX4P+waEJREbW9GoozrhpZov584V lKG5PKQGDRmLLvroF95Xr/KCKSMVwkOeE1Sizelh6uJXYkbnNpCCMifSg495SQY1 Oug/v0f6trhv03FpmQIKtpy2Jj9A3Vz6SislNbGFuvCB0T6LwV8vH1SKmGUdBeKX UoA8VfymQ6PGTOe2JsbIc6r3mdIhw9vjUeXYvoshEcItYmDYjrkXEELEO+YLpv88 8InaUVtlS1x5GR5M7DTaFhCjBaUPlEt9HXBk0BBg/6E+xXwaOU8JbtKq4yiifRH8 EjIEjsl77NGuhtlVPuUDmdq+pZ+Lgx9Sf1s0w7qOhQPxQI18EvnbqR0gVMZT0XGg PZjMt3W4AhktjXcwnS0bctCC+fdWYDK4YoxxhT9m9use94mj76Qk7BNMqyGKNJgF R9MFwps5pvVzykpoL0kHiIrfeN09EWMzjNTu+N5xUzu5KF4N3W431aYqsg4bFB64 mEbfzXbI7UBx7PYfCoGIvWwX+9Z4SM7MoO+FtZv/Bo/nXBP1X9nml2H3w0xYf7+R 2rOTciNesi9u1Mp0HCh6q0IUrijviw0QgdR7+fHYw7MDSbHmYaCO2ZGGDI8AVKjR aTf6Y6JZTr/WcH+nC18/Ix8gX88p8HfJT2bAsHVvmsAc5kzXxjlbklDFxMjYjV6i TaC7zIrY992Wt5ZXXFJc =FBOo -----END PGP SIGNATURE-----

1 0

IPv6-only network at RIPE70
by Jen Linkova 13 May '15

13 May '15

I'm glad to announce that there is a IPv6-only (with NAT64) network at RIPE70. Please note that this experimental network is not supported by the RIPE NCC or RIPE 67 Technical Team and is offered on a best-effort basis. How to connect: - Make sure IPv6 is enabled on your device - Connect to SSID: IPV6ONLYEXP - Enter the password: iknowbesteffort Please note that NAT64&DNS64 is used to provide connectivity to IPv4-only resources, so use DNS servers information provided by the network. If you see any connectivity issues: - connect to the 'normal' dual-stack one; - if connecting to dual-stack network solves the issue, please email me (furry13(a)gmail.com) with details, I'd love to know about any problems. General feedback (do you guys see any value in such an experiment, what was your experience etc) is appreciated. -- SY, Jen Linkova aka Furry

3 6

[training] RIPE NCC Training Courses July-September 2015
by Training Services 11 May '15

11 May '15

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Frankfurt, London, Skopje, Stockholm, Minsk, Sarajevo, Vladivostok, Tel Aviv, Tallinn, Zurich, Paris, Amsterdam. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - Database Training Course - Basic IPv6 Training Course - 2 day Advanced Training Course - Routing Security Training Course For more information visit: https://www.ripe.net/support/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0