8 ms·

IPv6 Extension headers are a nightmare. There are likely lots of bugs lurking in lots of places due to extension headers stacked in unusual ways. A lot of har

IPv6 Extension headers are a nightmare. There are likely lots of bugs lurking in lots of places due to extension headers stacked in unusual ways. A lot of hardware and drivers simply give up on packets with more than a single extension header for this reason.

xorcist 3y ago
Fragmentation is a nightmare. There's been lots of unexpected interactions and security bypasses with that over the years.
- enrico204 3y ago
  Fragmentation is a nightmare in a nightmare: we also discovered that IPv6 fragments reassembly (as implemented by major operating systems) is still plagued by the problem of overlapping fragments. Potentially, you can still bypass IDS/IPS using the same techniques from IPv4... Shameless plug: we will present these results at ESORICS 2023 :-)
- warbeforepeace 3y ago
  IPv4 fragmentation was even worse since any device in the middle could fragment packets. IPv6 atleast limits it to the client/host. I still think they should have designed IPv6 to include L4 info in each fragment to avoid having to reassemble to get that data.
formerly_proven 3y ago
v6 on the whole just doesn't seem like a well-designed protocol, especially not for the 21st century. It's kind of a shame that the negligible uptake in the 2000s wasn't used to do a go-around and create a more apt successor to v4.
- ianlevesque 3y ago
  Curious why you think that? IPv4 + ARP + DHCP + NAT has a lot more baggage. IPv6 and a stateful firewall gets the job done quite well, without the address exhaustion.
  - axytol 3y ago
    Not OP and certainly not in the anti-IPv6 camp. I'm wondering though: could you build a case that under IPv4, a misconfigured NAT would only result in lost connectivity for nodes behind the router, while for IPv6 a misconfigured firewall and worse triggered through a vulnerability, would then result in protected nodes being exposed? I know NAT-PMP (port mapping) vulnerabilities exist, allowing external actors to set port mappings to hosts behind NAT, but this seems a bit harder to exploit than a bypassed firewall.
    - ianlevesque 3y ago
      I don't think that's true in general because each of these end-user routers have their own sharp edges. IPv4 consumer routers have a DMZ option which would, for at least 1 device, be the same as taking down your stateful firewall. Also, thankfully, in all of the examples I've seen in the wild, the stateful firewall was just on by default, much as NAT is on by default. In both cases you are taking steps to compromise your own security, that most people won't bother to do. Finally, the risk to an individual machine 'loose on the internet' is lower than its ever been because Windows has for years enabled a firewall by default on its own, and macOS doesn't expose any open ports by default either. That does leave printers, IoT devices, and the like, but now we're really pretty far into the weeds of lots of non-default customization combined with individual CVEs in non-computing hardware.
      - iso1631 3y ago
        If my firewall failed then the packet won't reach my 192.168.0.1 DMZ server as it will likely never be translated from my real 12.34.56.78 IP address (as the translation would be part of that stateful firewall) Sure there are exceptions, but you are massively reducing your risk by not having your toaster having a public address by default and having something actively have to translate it to a public address
  - Quekid5 3y ago
    I think it's probably just the fact that the IPv4 stack has just received a lot more hardening because it's deployed everywhere (by necessity)... and IPv4 has had a 15+ years lead over IPv6 on that whole hardening thing because it came later and a time where IPv4 was already pretty well established.

xorcist 3y ago

Fragmentation is a nightmare. There's been lots of unexpected interactions and security bypasses with that over the years.

enrico204 3y ago
Fragmentation is a nightmare in a nightmare: we also discovered that IPv6 fragments reassembly (as implemented by major operating systems) is still plagued by the problem of overlapping fragments. Potentially, you can still bypass IDS/IPS using the same techniques from IPv4... Shameless plug: we will present these results at ESORICS 2023 :-)
warbeforepeace 3y ago
IPv4 fragmentation was even worse since any device in the middle could fragment packets. IPv6 atleast limits it to the client/host. I still think they should have designed IPv6 to include L4 info in each fragment to avoid having to reassemble to get that data.

formerly_proven 3y ago

v6 on the whole just doesn't seem like a well-designed protocol, especially not for the 21st century. It's kind of a shame that the negligible uptake in the 2000s wasn't used to do a go-around and create a more apt successor to v4.

ianlevesque 3y ago
Curious why you think that? IPv4 + ARP + DHCP + NAT has a lot more baggage. IPv6 and a stateful firewall gets the job done quite well, without the address exhaustion.
- axytol 3y ago
  Not OP and certainly not in the anti-IPv6 camp. I'm wondering though: could you build a case that under IPv4, a misconfigured NAT would only result in lost connectivity for nodes behind the router, while for IPv6 a misconfigured firewall and worse triggered through a vulnerability, would then result in protected nodes being exposed? I know NAT-PMP (port mapping) vulnerabilities exist, allowing external actors to set port mappings to hosts behind NAT, but this seems a bit harder to exploit than a bypassed firewall.
  - ianlevesque 3y ago
    I don't think that's true in general because each of these end-user routers have their own sharp edges. IPv4 consumer routers have a DMZ option which would, for at least 1 device, be the same as taking down your stateful firewall. Also, thankfully, in all of the examples I've seen in the wild, the stateful firewall was just on by default, much as NAT is on by default. In both cases you are taking steps to compromise your own security, that most people won't bother to do. Finally, the risk to an individual machine 'loose on the internet' is lower than its ever been because Windows has for years enabled a firewall by default on its own, and macOS doesn't expose any open ports by default either. That does leave printers, IoT devices, and the like, but now we're really pretty far into the weeds of lots of non-default customization combined with individual CVEs in non-computing hardware.
    - iso1631 3y ago
      If my firewall failed then the packet won't reach my 192.168.0.1 DMZ server as it will likely never be translated from my real 12.34.56.78 IP address (as the translation would be part of that stateful firewall) Sure there are exceptions, but you are massively reducing your risk by not having your toaster having a public address by default and having something actively have to translate it to a public address
- Quekid5 3y ago
  I think it's probably just the fact that the IPv4 stack has just received a lot more hardening because it's deployed everywhere (by necessity)... and IPv4 has had a 15+ years lead over IPv6 on that whole hardening thing because it came later and a time where IPv4 was already pretty well established.