Subject: Re: Question for IPv6 w.g. on [Re: IPv6 Type 0 Routing Header issues]

From: Jeroen Massar <[email-masked]>
Date: Tue, 01 May 2007 12:17:21 +0100

Eric Klein wrote:
> I have just noticed that this topic seems to be going on simutaniously
> on both the IPv6 and v6OPS mailing lists.
>  
> The two threads are not coordinated, but both seem very concerned with
> IPv6 Type 0 Routing Header issues.
[..]
> It concerns me that the two teams are working seperatly to solve the
> same issue.

You misunderstand. These are two separate groups, although some members
of them fall under both groups and participate in both. Which is a good
thing as without one the other doesn't exist and vice versa, thus feed
back from both into both is very important. Unfortunately not everybody
can participate in both as some people have networks to run etc ;)

To make it a bit clearer:

The [email-masked] list is for IPv6 Operational matters. This
list contains folks who have actual have "enable" or "root" on the
network routers around the globe and who can take immediate effect on
their workings. As such these people have fortunately, where possible,
already taken action to resolve this issue by filtering out Routing
Header Type 0 from propagating through their networks. Most of them are
awaiting a fix from Juniper though, to resolve it for those routers
which actually comprise the largest amount of the IPv6 backbones. These
people operating them do this for the benefit of their own organization
and thus take their decisions based on the simple metric: does it impact
revenue or my operating of the network. As it does pose a danger it is a
simple equation to resolve it. The general consensus in this community
seems to be to filter out IPv6 Routing Headers of Type 0 completely. The
only argument raised by some is that it is useful for 'reverse
traceroute', but as that doesn't work when a network properly does uRPF
(which it should be doing!) this is far from useless in most cases
anyway. uRPF in general makes RH0 completely useless anyway.

Having uRPF enabled in most cases mitigates this attack already
perfectly fine. Unless of course folks have defaults pointing both ways
or the RH0 path is following the correct interface direction. Hard but
possibly doable.

The [email-masked] list is for the standardization of the IPv6 protocol.
Here is specified how those routers should behave, what the packet data
should/must look like etc. There are a lot of different people from a
lot of different backgrounds all with different interests in this group,
as such, as they don't all have the same goal, not all can be satisfied
in one go, unlike the operators who run their network for profit, and
consensus have to be reached first amongst all the parties for this to
be resolved. Although this group defines the initial RFC, the Operators,
next to the Vendors, actually implement them. The standard in the end
thus is actually what both groups together come up with. As IPv6 is not
a standard yet, we'll just have to write a draft to amend the current
IPv6 RFC to resolve this issue.

All that said though, as the Operative community is already mostly
filtering out RH0, there seems to be little options left where RH0 still
is useful...

Greets,
 Jeroen

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: "Eric Klein" <[email-masked]>
Date: Tue, 1 May 2007 20:30:15 +0300

> can participate in both as some people have networks to run etc ;)

 Jeroen,

I am sorry if I was unclear. I am on both lists and understand their
diffrences.

My concern is that both lists are reviewing this problem and looking for a
solution independently of each other.

So I am wondering which group is more appropriate for a soltuion, thus the
topic would fall under:
1. IPv6 WG
2. v6OPS WG
3. Some sort of joint discussions
4. Inter-Area WG

I do not see how the multiple lists will coordinate their solutions if there
is confusion over the ownership of the issue.

Eric

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 03 May 2007 18:46:50 +0100

Eric Klein wrote:
[..]
> I am sorry if I was unclear. I am on both lists and understand their

No, you are confusing [email-masked] with [email-masked].
They are not the same. The first has nothing to do with the IETF and
can't care much about what the IETF will decide, they will most likely
look at it and take it into consideration, but that is it.

Please actually READ what I write.

> My concern is that both lists are reviewing this problem and looking for
> a solution independently of each other.
>  
> So I am wondering which group is more appropriate for a soltuion, thus
> the topic would fall under:
> 1. IPv6 WG
> 2. v6OPS WG

As this definitely concerns the IPv6 Protocol, as the RT0 is part of the
protocol and that is broken it belongs in [email-masked] (IPv6 WG) and
not in v6ops which is also not where this discussion is taking place.

Greets,
 Jeroen

---

From: "Eric Klein" <[email-masked]>
Date: Thu, 3 May 2007 22:47:23 +0300

> look at it and take it into consideration, but that is it.

Actually I am refering to IETF V6OPS WG
<[email-masked]><http://mail.softhome.net/email/login/EricLKlein%40SoftHome.net.authcustom/0BC8674E7137F0F2DDE11B156B482B25/1178221322?folder=NAP&form=quickadd&pos=17&newname=IETF+V6OPS+WG&newaddr=v6ops%40ops.ietf.org>
not
the one on cluenet, as this is where the discussion is occuring.

> I agree in where this should be taking place, but disagree that it is only
> taking place here.

Please see the thread starting with message:
http://ops.ietf.org/lists/v6ops/v6ops.2007/msg00302.html

Fore the discussion in the OPS WG

Eric

---

From: Kenjiro Cho <[email-masked]>
Date: Sat, 05 May 2007 21:49:10 +0900 (JST)

I'm sending this on behalf of itojun.
I talked with itojun today over the phone.
He now seems to have understood that his strong language does not help
us move forward.
He has asked me to translate his intension into plain English and post
it to the list on his behalf.
So, I'm trying my best.

>   1) Deprecate all usage of RH0

itojun has been spending his life for IPv6, and took the rthdr0 issue
very seriously.
The language he used was completely inappropriate.  It was partly due
to his mental condition and the effect of the pills, but he was in a
panic mode and thought such language would help to push people.

Anyway, technical points itojun was trying to make are:
 - Please do not underestimate the security risk.  It is very easy to
   exploit this security hole, just to find 2 vulnerable machines.
   A damage could be fatal for the IPv6 deployment if simultaneous
   attacks are well orchestrated.

 - For KAME derived implementations, please apply the 2 patches from
   the KAME tree described at
   http://www.kame.net/newsletter/20070502/index.html
   One is for not processing rthdr0, and the other is for immediately
   dropping packets with more than one routing headers in ip6_input().

 - Please do not leave a sysctl knob for accepting rthdr0.  Its risks
   are too high for very limited benefits.

Hope this helps.

-Kenjiro