Re:CVE-2023-4809: FreeBSD pf bypass when using IPv6
by simoncion on Friday September 08, 2023 @06:44PM
(#37440242)
> It's almost certain you'd have deployed a dual stack ipv4 and ipv6 internal network...
For the ones that needed Internet access, sure. But, a huge chunk of these machines were machines that never, ever, ever talked outside of the corporate intranet, so they never needed an Internet gateway, and NAT was never an issue. Assigning these boxes an address from a ULA would have worked just fine.
> ...you'd have to re-number the ipv4 part anyway,
As mentioned above, for the machines that did need to talk to the Internet (which required them to have v4 addresses) yeah, sure.
> ...and still probably end up with a mess with ipv6.
I don't see how this follows from what you said.
The way you generate ULA prefixes means that you're highly unlikely to ever have to renumber ULA-using networks that you want to merge. Do you have specific addressing perils or pitfalls in mind?
(Bear in mind that you're talking to someone who has been happily using IPv6 at home for twenty years, and someone who's quite aware that companies like Comcast, T-Mobile, and a bunch of other telecoms run IPv6 on their infrastructure (and often their customer-facing) networks, trouble-free, and have been for many, many years.)
For the ones that needed Internet access, sure. But, a huge chunk of these machines were machines that never, ever, ever talked outside of the corporate intranet, so they never needed an Internet gateway, and NAT was never an issue. Assigning these boxes an address from a ULA would have worked just fine.
> ...you'd have to re-number the ipv4 part anyway,
As mentioned above, for the machines that did need to talk to the Internet (which required them to have v4 addresses) yeah, sure.
> ...and still probably end up with a mess with ipv6.
I don't see how this follows from what you said.
The way you generate ULA prefixes means that you're highly unlikely to ever have to renumber ULA-using networks that you want to merge. Do you have specific addressing perils or pitfalls in mind?
(Bear in mind that you're talking to someone who has been happily using IPv6 at home for twenty years, and someone who's quite aware that companies like Comcast, T-Mobile, and a bunch of other telecoms run IPv6 on their infrastructure (and often their customer-facing) networks, trouble-free, and have been for many, many years.)