Subject: Re: Question for IPv6 w.g. on [Re: IPv6 Type 0 Routing Headerissues]

From: "Ebalard, Arnaud" <[email-masked]>
Date: Mon, 14 May 2007 08:27:09 +0200

Oy,

Le 13 mai 07 à 18:10, Iljitsch van Beijnum a écrit :

> On 8-mei-2007, at 21:00, Tim Enos wrote:
>
>> I would also prefer that RH0 be silently dropped but could live
>> with an ICMPv6 error message being sent back to the sending host
>
> Why is everyone so in love with silently dropping?
> This only makes troubleshooting harder.
So you use RH0 in your networks ? Just by curiosity : How much ? How  
do you filter it ? Where ? What brands of routers are you using ?

> - source routing can be used for amplification
;-)

> - IPv6 source routing is enabled by default on most implementations
> - IPv6 source routing can't be disabled on some implementations
> - BSD will _forward_ IPv6 source routed packets even when IPv6
> forwarding is disabled
That's no more the case : Look at http://www.natisbad.org/

> - apparently, there is no check whether the same addresses appear
> multiple time in many implementations
Actually, AFAIK, there is no implementation that provides that  
"feature". Anyway, with a O(n^2) complexity in the number of  
addresses (for a basic implementation), this probably explain why it  
is not widely implemented.

Cheers,

a+

-- Arnaud Ebalard
EADS Innovation Works - IT Sec Research Engineer
PGP KeyID:047A5026 FingerPrint:47EB85FEB99AAB85FD0946F30255957C047A5026

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 14 May 2007 16:47:29 +0200

> So you use RH0 in your networks ?

What does that have to do with the question of whether dropping  
should be silent or not?

But, apparently not:

#sh ipv6 traffic
IPv6 statistics:
   Rcvd:  4113572 total, 49481 local destination
          0 source-routed

> Just by curiosity : How much ? How

Hopefully, the vendors of my OSes will make sure hosts will stop  
forwarding RH0 packets and I guess I'll tell my Cisco "no ipv6 source- 
route".

> That's no more the case : Look at http://www.natisbad.org/

That page only has links, it tells me nothing.

> is not widely implemented.

There is no complexity. It's a simple check: when taking the next  
address from the list, see if either that address or the local  
address appear anywhere else in the list.

But at this point, I don't see how it makes sense to fix this feature  
rather than turning it off, as apparently nobody uses it, and the  
chances of it still being in the next version of the IPv6 spec aren't  
good.

Iljitsch