Subject: [OPSEC] Start of WGLC for draft-ietf-opsec-vpn-leakages

From: Warren Kumari <[email-masked]>
Date: Wed, 3 Jul 2013 16:58:25 -0400

Dear OpSec WG,

This starts a Working Group Last Call for draft-ietf-opsec-vpn-leakages.

The draft is available here: https://datatracker.ietf.org/doc/draft-ietf-opsec-vpn-leakages/

The authors of draft-ietf-opsec-vpn-leakages have indicated that they have incorporated feedback and believe that the document is ready for WGLC. 
It is the authors responsibility to drum up additional feedback and review.

Please review this draft to see if you think it is ready for publication
and comments to the list, clearly stating your view.

This WGLC ends Wed 17-Jul-2013.

Helpful Notes: 
draft-ietf-opsec-vpn-leakages was originally draft-gont-opsec-vpn-leakages.

There was some discussion in the thread: IPv6 implications on IPv4 nets: IPv6 RAs, IPv4's VPN "leakage"
and "New IETF I-D about VPN traffic leakages (Fwd: New Version Notification for draft-gont-opsec-vpn-leakages-00.txt)"

Thanks,
Warren Kumari
(as OpSec WG co-chair)

-- 
Outside of a dog, a book is your best friend, and inside of a dog, it's too dark to read

---

From: "cb.list6" <[email-masked]>
Date: Sun, 7 Jul 2013 13:35:59 -0700

I support publication of this draft.

I recently ran into this leaking issue on Android with OpenVPN.  An
open OpenVPN server used for security and anonymity only inserted
routes for IPv4 on the client, with the result being all IPv6 does not
go through the VPN.

Many naive users will assume all traffic goes via the VPN, but in fact
only a subset of IPv4-only traffic will go via the VPN while all ipv6
traffic travels outside the VPN

CB

On Wed, Jul 3, 2013 at 1:58 PM, Warren Kumari <[email-masked]> wrote:
> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec

---

From: Warren Kumari <[email-masked]>
Date: Tue, 9 Jul 2013 17:50:41 -0400

Hi all,

Just a reminder to please read and review this document…

W

--
"When it comes to glittering objects, wizards have all the taste and self-control of a deranged magpie."
-- Terry Pratchett

---

From: Gert Doering <[email-masked]>
Date: Fri, 12 Jul 2013 20:38:54 +0200

Hi,

> routes for IPv4 on the client, with the result being all IPv6 does not

It pains me to see such issues with OpenVPN, as OpenVPN service providers
should be able to redirect IPv6 as well now, or at least set up IPv6
in a way that directs traffic into the tunnel and "ICMP unreachable!"'s
it on the server side...

So yes, I also support publication of that draft.

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Fri, 12 Jul 2013 19:02:24 +0000

+1

For completeness, I would like to request the authors to add a sentence in Section 5, to say that the recommendations in case of IPv6-only VPN (IPv4-only is discussed) are equivalent. In other words, if only IPv6 traffic goes through the VPN (split tunnel or not) then IPv4 should be dropped.

Panos

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Gert Doering
Sent: Friday, July 12, 2013 2:39 PM
To: cb.list6
Cc: [email-masked]; Warren Kumari; [email-masked]
Subject: Re: [OPSEC] Start of WGLC for draft-ietf-opsec-vpn-leakages

Hi,

> routes for IPv4 on the client, with the result being all IPv6 does not 

It pains me to see such issues with OpenVPN, as OpenVPN service providers should be able to redirect IPv6 as well now, or at least set up IPv6 in a way that directs traffic into the tunnel and "ICMP unreachable!"'s it on the server side...

Gert Doering
        -- NetMaster

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 13 Jul 2013 18:03:41 -0700

I have read this draft and think it is fine. Merike's list of proposed
changes are also all very good.

--Paul Hoffman

On Fri, Jul 12, 2013 at 12:02 PM, Panos Kampanakis (pkampana) <
[email-masked]> wrote:

> +1
>
> For completeness, I would like to request the authors to add a sentence in
> Section 5, to say that the recommendations in case of IPv6-only VPN
> (IPv4-only is discussed) are equivalent. In other words, if only IPv6
> traffic goes through the VPN (split tunnel or not) then IPv4 should be
> dropped.
>
> Panos
>
>
>
> Cc: [email-masked]; Warren Kumari;
> [email-masked]
> should be able to redirect IPv6 as well now, or at least set up IPv6 in a
> way that directs traffic into the tunnel and "ICMP unreachable!"'s it on
> the server side...
>