[Full-disclosure] Fwd: IPv6 RA-Guard: Advice on the implementation (feedback requested)
- From: Fernando Gont <fgont@xxxxxxxxxxxxxxx>
- Date: Wed, 01 Feb 2012 23:17:46 -0300
We have talked about this one quite a few times (including
-- still, most implementations remain broken.
If you care to get this fixed, please provide feedback about this I-D on
the IETF *v6ops* mailing-list <v6ops@xxxxxxxx>, and CC me if possible.
-------- Original Message --------
Subject: RA-Guard: Advice on the implementation (feedback requested)
Date: Wed, 01 Feb 2012 21:44:29 -0300
From: Fernando Gont <fgont@xxxxxxxxxxxxxxx>
Organization: SI6 Networks
To: IPv6 Operations <v6ops@xxxxxxxx>
We have just published a revision of our I-D "Implementation Advice for
IPv6 Router Advertisement Guard (RA-Guard)"
In essence, this is the problem statement, and what this I-D is about:
* RA-Guard is essential to have feature parity with IPv4.
* Most (all?) existing RA-Guard implementations can be trivially evaded:
if the attacker includes extension headers in his packets, the RA-Guard
devices fail to identify the Router Advertisement messages. -- For
instance, THC's "IPv6 attack suite" (<http://www.thc.org/thc-ipv6/>)
contains tools that can evade RA-Guard as indicated.
* The I-D discusses this problem, and provides advice on how to
implement RA-Guard, such that the aforementioned vulnerabilities are
eliminated, we have an effective RA-Guard device, and hence
feature-parity with IPv4.
We'd like feedback on this I-D, including high-level comments on whether
you support the proposal in this I-D.
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] Fwd: RA-Guard: Advice on the implementation (feedback requested)
- Next by Date: [Full-disclosure] [CAL-2012-0004] opera array integer overflow
- Previous by thread: [Full-disclosure] Fwd: RA-Guard: Advice on the implementation (feedback requested)
- Next by thread: [Full-disclosure] [CAL-2012-0004] opera array integer overflow