Subject: I-D ACTION:draft-jabley-ipv6-rh0-is-evil-00.txt

From: Jeroen Massar <[email-masked]>
Date: Tue, 08 May 2007 00:04:28 +0100

See below.

Very short though.

I personally would rather see a "MUST drop packets containing RH0".

Greets,
 Jeroen

--

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

	Title		: Deprecation of Type 0 Routing Headers in IPv6
	Author(s)	: J. Abley
	Filename	: draft-jabley-ipv6-rh0-is-evil-00.txt
	Pages		: 13
	Date		: 2007-5-7
	
   The functionality provided by IPv6's Type 0 Routing Header can be
   exploited in order to perform remote network discovery, to bypass
   firewalls and to achieve packet amplification for the purposes of
   generating denial-of-service traffic.  This document updates the IPv6
   specification to deprecate the use of IPv6 Type 0 Routing Headers, in
   the light of these security concerns.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-jabley-ipv6-rh0-is-evil-00.txt

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Joe Abley <[email-masked]>
Date: Mon, 7 May 2007 19:48:57 -0400

> I personally would rather see a "MUST drop packets containing RH0".

Indeed, I was mainly interested in building the framework; I was  
assuming that the working group would modulate the normative  
language, and I had already observed volunteers on this list offering  
text (but suggesting that a framework to slot it into would be useful).

Bob tells me that Pekka also has a draft in the pipeline, so perhaps  
we have a collision. But better two colliding drafts than no drafts  
at all :-)

Joe

---

From: Pekka Savola <[email-masked]>
Date: Thu, 10 May 2007 10:00:00 +0300 (EEST)

> 	Filename	: draft-jabley-ipv6-rh0-is-evil-00.txt
...
> http://www.ietf.org/internet-drafts/draft-jabley-ipv6-rh0-is-evil-00.txt

In order to kickstart some discussion, here are two comments:

3.  Implementation

    Compliant IPv6 hosts and routers MUST NOT transmit IPv6 datagrams
    containing RH0.

==> does 'transmit' include both 'originate' and 'forward' or just the 
former?

I'd be interested in seeing comments from router vendors on the 
feasibility of the blocking forwarding for type 0 routing headers (but 
not other types).

Would that include packets where the routing header wouldn't be the 
immediate next-header (e.g., you'd put a hop-by-hop header or 
something like that first, only then routing headers)?  That's even 
more difficult as the implementation would need to skip through all of 
them, possibly with a 'lookup depth' of the maximum packet size.

AFAIK, usually the amount of bytes of the header available to ACLs is 
limited, unless you punt the whole packet to the control processor 
which is probably a treatment worse than the disease.

4.  Operations

    Compliant IPv6 hosts and routers which receive IPv6 datagrams
    containing RH0 MUST silently discard those datagrams without further
    processing.

==> is this really 'Operations' or is it really implementation?  I.e., 
are you requiring the network or host operators to do something or the 
implementations?

The same comment as above wrt router vendors.  AFAIK, no core router 
software currently deployed support routing-header type matching (I 
believe some recent Cisco IOS versions, on some platforms, support 
type matching but those are typically deployed at the edges if even 
there yet).  I don't know whether such a change in the ACL lookup 
"depth" would be feasible or not.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings