CVE-2023-4809: FreeBSD pf bypass when using IPv6

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by tsimionescu on Friday September 08, 2023 @05:09PM (#37439469)

Isn't NAT the only real difference? In IPv6 you get NDP instead of ARP, but you generally still need DHCPv6 for many kinds of networks. So you have IPv4 + ARP + DHCP + NAT, vs IPv6 + NDP + DHCPv6. Not that much of a difference. Especially since, for a household user, there is actually pretty little difference between NAT and just a stateful firewall.

[ Parent | on HN ]

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by enrico204 on Friday September 08, 2023 @05:13PM (#37439500)

Actually, if the router supports RDNSS (DNS info in RA), SLAAC is sufficient for household users -- no need for DHCPv6.

[ Parent | on HN ]

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by whatwhaaaaat on Friday September 08, 2023 @05:19PM (#37439577)

Sure for an intranet. Know of any ISPs handing out addresses in slacc? I sure hope not as the rfc (too lazy to find who CV) stipulates resi users should get bigger than a /64.

So now we have two types of network addressing depending on which type of network! So simple.

All of this is ignoring the absolute madman icmpv6 vulns discovered over the last few years that are generally allowed through do to ndp using icmp.

V6 sucks and this is coming from someone who lived and breathed it for years. I do not run it on my sensitive installations.

[ Parent | on HN ]

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by simoncion on Friday September 08, 2023 @05:39PM (#37439748)

> > > Not that much of a difference. Especially since, for a household user, there is actually pretty little difference between NAT and just a stateful firewall.

> > Actually, if the router supports RDNSS (DNS info in RA), SLAAC is sufficient for household users -- no need for DHCPv6.

> Sure for an intranet. Know of any ISPs handing out addresses in slacc?

It's a bit odd to reply to two folks talking about residential LANs with "Yeah, well, what about what ISPs do, eh?!".

Reading through the relevant RFCs leaves me pretty sure that SLAAC works for prefixes larger than /64... you just won't get split that into subnets that your router delegates to the LAN side of things.

[ Parent | on HN ]

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by whatwhaaaaat on Friday September 08, 2023 @06:11PM (#37439990)

It’s a bit odd to leave out the most exposed component of your residential lan when discussing its simplicity. Are you expecting never to touch the external interface of your residential lan?

Then you are reading the “rfcs” wrong.

What you really want to put in to your search engine is “does slacc do prefix delegation”.

[ Parent | on HN ]

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by simoncion on Friday September 08, 2023 @06:33PM (#37440154)

> What you really want to put in to your search engine is “does slacc do prefix delegation”.

As I said:

> ... you just won't get [to] split that into subnets that your router delegates to the LAN side of things.

[ Parent | on HN ]

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by whatwhaaaaat on Friday September 08, 2023 @09:43PM (#37441363)

prefix delegation is more than just splitting a larger prefix into smaller prefixes Have a nice night!

[ Parent | on HN ]

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by simoncion on Saturday September 09, 2023 @05:31AM (#37443610)

kek

[ Parent | on HN ]

Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6 by whatwhaaaaat on Saturday September 09, 2023 @09:26AM (#37445124)

I would be embarrassed too if I was trying to act like slacc can hand out a 64 so I understand why you are defensive

[ Parent | on HN ]