[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
On Mar 29, 2007, at 10:25, james woodyatt wrote:
I'd like to assure the working group that I'll make the appropriate
recommendations to decision makers at Apple about how to proceed in
compliance with the recommendations of the IETF.
I have an update about this. Today, Apple released the following
article "About the security content of Firmware Update 7.1 for
AirPort Extreme Base Station with 802.11n"
Here's the relevant section:
I'm still a little unclear about the rational arguments in favor of
this behavior, but I've learned to stop asking dumb and annoying
questions and to just do my job.
Available for: AirPort Extreme Base Station with 802.11n*
Impact: AirPort Extreme Base Station with 802.11n* allows incoming
Description: The default configuration of an AirPort Extreme Base
Station with 802.11n* allows incoming IPv6 connections. This may
expose network services on hosts connected through an AirPort
Extreme Base Station with 802.11n* to remote attackers. This
update addresses the issue by changing the default setting to
limit inbound IPv6 traffic to the local network. This issue only
affects AirPort Extreme Base Station with 802.11n*, and not other
versions of the Base Station.
One concern I've been asked to think about is that the product
doesn't offer any mechanism for nodes on the leaf network to request
the opening of a pinhole in the stateful packet filter. This
function is performed in the IPv4 case by NAT-PMP (which Apple has
tried to advance within IETF without much success), but there is no
equivalent function for IPv6. This was a deliberate decision on our
part, but now we're left reconsidering it.
I know the world's experts on IPv6 operations are regular
participants here, so I'm hoping the group will provide me with the
clue that I'm trying desperately to catch.
As far as I know, there is no current or pending IETF standard for
nodes to use in requesting open pinholes through the stateful packet
filter in a residential IPv6 gateway. In light of the IETF consensus
noted earlier in this thread, doesn't that seems like a serious
oversight? Isn't this function something that rightfully belongs in
ICMP6? If not, do we really think extending NAT-PMP and UPnP IGD to
support IPv6 network boundary filters is a good idea? (A month ago,
I would have found that hard to believe, but I've made some
embarrassing mistakes lately, so I'm gun-shy about what I don't
Incidentally, for those interested in the IPv6 behavior of this
product, be advised that most IPv6 applications won't work in the
default mode, i.e. with the stateful packet filter turned on. For
example, active mode FTP from the leaf network won't work, because
the inbound TCP connection for the data will be blocked by the
filter. We haven't written any application layer gateways for the
IPv6 filter in the AirPort Extreme base station, so things like SIP,
RTSP, IPsec/IKE, etc. simply will not work at all. I can't say when
enhancements to support any of those application protocols will be
available. They'll have to be written one by one, and until
recently, we mistakenly thought that the whole point of IPv6 was to
make that unnecessary. (Yeah, that'll teach me not to stay abreast
of developments in the IETF.)
j h woodyatt <firstname.lastname@example.org>
- Re: IPv6-PMP?
- From: Rémi Denis-Courmont <email@example.com>