Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6
by whatwhaaaaat on Friday September 08, 2023 @06:11PM
(#37439990)
It’s a bit odd to leave out the most exposed component of your residential lan when discussing its simplicity. Are you expecting never to touch the external interface of your residential lan?
Then you are reading the “rfcs” wrong.
What you really want to put in to your search engine is “does slacc do prefix delegation”.
Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6
by simoncion on Friday September 08, 2023 @06:33PM
(#37440154)
> What you really want to put in to your search engine is “does slacc do prefix delegation”.
As I said:
> ... you just won't get [to] split that into subnets that your router delegates to the LAN side of things.
Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6
by whatwhaaaaat on Friday September 08, 2023 @09:43PM
(#37441363)
prefix delegation is more than just splitting a larger prefix into smaller prefixes Have a nice night!
Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6
by simoncion on Saturday September 09, 2023 @05:31AM
(#37443610)
kek
Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6
by whatwhaaaaat on Saturday September 09, 2023 @09:26AM
(#37445124)
I would be embarrassed too if I was trying to act like slacc can hand out a 64 so I understand why you are defensive
> > Actually, if the router supports RDNSS (DNS info in RA), SLAAC is sufficient for household users -- no need for DHCPv6.
> Sure for an intranet. Know of any ISPs handing out addresses in slacc?
It's a bit odd to reply to two folks talking about residential LANs with "Yeah, well, what about what ISPs do, eh?!".
Reading through the relevant RFCs leaves me pretty sure that SLAAC works for prefixes larger than /64... you just won't get split that into subnets that your router delegates to the LAN side of things.