Subject: [v4tov6transition] Ways to break IPv6

From: Ed Jankiewicz <[email-masked]>
Date: Tue, 12 Oct 2010 22:40:29 -0400

this is not a surprise, it is something that has been predicted by 
many as one of the "growing pains" of IPv6 transition.  Firewalls and 
other security software will "support" IPv6 initially by just blocking 
it - too much work (and too little demand) for a real implementation.

Just loaded an updated version of the commercial anti-virus package that 
I've been using, let it remain nameless, it is certainly not the only 
offender in this area.  Unlike the previous version this includes an 
enhancement - it blocks all IPv6 and IPv6 over IPv4 traffic by default.  
The firewall rule can be disabled.

If you are a network operator, there is a lot of mischief that can be 
done by software that the end-user downloads onto their machines that 
can make IPv6 appear broken.  This is another area that should get some 
attention - how will customer service and help desk people be trained to 
deal with "connectivity" problems the user can cause themselves?

It took me a while to figure this out, and I'm one of the people who 
frequently predicted this would happen.  Imagine your average end-user 
who knows nothing about IPv6 and expects that "it just works".  Also, 
many books, websites and other security advice says "when in doubt, turn 
off IPv6".  At least in the foreseeable future, this will continue to be 
impedance against the uptake of IPv6.

-- 
Ed Jankiewicz - SRI International
Fort Monmouth Branch Office - IPv6 Research
Supporting DISA Standards Engineering Branch
732-389-1003 or  [email-masked]

---

From: "Yiu L. Lee" <[email-masked]>
Date: Tue, 12 Oct 2010 22:45:54 -0400

This is expected behavior. Since IPv6 provides e2e connectivity, this is
required to enable FW by default. I think the FW is doing the right thing.
Despite the correct behavior, this will create a lot of confusion in the
beginning of launching IPv6. Education is needed to train the users to
realize the changes and this isn't going to be easy.

---

From: Joel Jaeggli <[email-masked]>
Date: Tue, 12 Oct 2010 23:49:46 -0700

I love how we talk about what they will do in the future tense. They do this today. my corporate laptops have had v6 broken in various sundry ways by bad policy and retarded security products across three employers since 2007. As long as v6 has been enabled in systems  people have been disabling it deliberately, or worse, breaking it in ways that make you wonder how these companies keep v4 working, in point of fact sometimes they don't. 

Joel's widget number 2

On Oct 12, 2010, at 19:40, Ed Jankiewicz <[email-masked]> wrote:

> this is not a surprise, it is something that has been predicted by many as one of the "growing pains" of IPv6 transition.  Firewalls and other security software will "support" IPv6 initially by just blocking it - too much work (and too little demand) for a real implementation.
> 
> Just loaded an updated version of the commercial anti-virus package that I've been using, let it remain nameless, it is certainly not the only offender in this area.  Unlike the previous version this includes an enhancement - it blocks all IPv6 and IPv6 over IPv4 traffic by default.  The firewall rule can be disabled.
> 
> If you are a network operator, there is a lot of mischief that can be done by software that the end-user downloads onto their machines that can make IPv6 appear broken.  This is another area that should get some attention - how will customer service and help desk people be trained to deal with "connectivity" problems the user can cause themselves?
> 
> It took me a while to figure this out, and I'm one of the people who frequently predicted this would happen.  Imagine your average end-user who knows nothing about IPv6 and expects that "it just works".  Also, many books, websites and other security advice says "when in doubt, turn off IPv6".  At least in the foreseeable future, this will continue to be impedance against the uptake of IPv6.
> 
> 
> -- 
> _______________________________________________
> v4tov6transition mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v4tov6transition
>

---

From: Tim Chown <[email-masked]>
Date: Wed, 13 Oct 2010 10:45:39 +0100

> I love how we talk about what they will do in the future tense. They do this today. my corporate laptops have had v6 broken in various sundry ways by bad policy and retarded security products acros…

Disabling IPv6 administratively is probably quite wise, until you're ready to do a managed deployment.     Even in supposed IPv4-only networks issues like rogue RAs can cause problems for hosts with IPv6 enabled.    We surveyed a local reasonable size wireless network for example and 50% of the time a host somewhere on it was issuing rogue RAs; that was over 6 months of data.

Tim

---

From: Rémi Després <[email-masked]>
Date: Wed, 13 Oct 2010 14:55:53 +0200

Le 13 oct. 2010 à 11:45, Tim Chown a écrit :

> Disabling IPv6 administratively is probably quite wise, until you're ready to do a managed deployment.

This definitely depends on the context.
As a free.fr customer, I have been using IPv6 since december 2007, and find no need to disable it.
In particular, we never had any rogue RA problem that might have justified it.

>     Even in supposed IPv4-only networks issues like rogue RAs can cause problems for hosts with IPv6 enabled.    We surveyed a local reasonable size wireless network for example and 50% of the time a host somewhere on it was issuing rogue RAs; that was over 6 months of data.

Finding which proportion of IPv6 users have problems is useful per se.
But wouldn't it be useful also to know which configurations have no problem?

Regards,
RD

---

From: Ed Jankiewicz <[email-masked]>
Date: Wed, 13 Oct 2010 10:13:52 -0400

Good point, Joel, the future is now.  Some  recognize that IPv6 is 
already here, others see it sometime in the distant future.  Operational 
and security gaps arise from incompatible assumptions.

I haven't investigated what happened between versions of the network 
security package I use, but it looks like it went from "don't care" 
about IPv6, to block all (by default).  It does permit turning off that 
firewall rule, so I can set it back to ignorance like the previous 
version.  Sort of still leaves me without an IPv6 firewall at the 
moment, but no worse than it was before, and I'm just an experimental user.

It does seem that security products, especially those for end-user 
systems, are particularly behind the curve with IPv6 support.

On 10/13/2010 2:49 AM, Joel Jaeggli wrote:
> On Oct 12, 2010, at 19:40, Ed Jankiewicz<[email-masked]>  wrote:
>