Subject: Different view on RH0: it is good to take out unmaintained networks

From: Jeroen Massar <[email-masked]>
Date: Mon, 14 May 2007 11:26:35 +0100

Hi,

A little mail for a nice Monday morning discussion/flamebait:

I became to realize that RH0 filtering is at all not really necessary.

Networks who have uRPF enabled, they check the source of the packet and
as such the packet pingpong doesn't work, yes the packet arrives, but
when the packet has to be sent out onto the network again, it gets
caught by the uRPF filter.

Networks who do not have uRPF enabled and thus are not properly checking
where a packet is actually being sourced from are open to the RH0 attack.

As such, any network which does not have uRPF enabled is vulnerable to
some nice RH0 packet ping ponging.

Now, what we should hope is that people actually do NOT filter out RH0
and then send out a lot of packets with RH0 headers ping ponging
throughout the Internet. This will take care that the networks who are
not properly applying uRPF will in effect nicely melt down.

Maybe that brings to their attention that doing uRPF is actually a good
thing as is being specified in BCP38 (BCP stands for Best Common
Practices, but clearly a lot of networks don't take it in common).

Greets,
 Jeroen

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: "James Jun" <[email-masked]>
Date: Mon, 14 May 2007 06:36:23 -0400

> Practices, but clearly a lot of networks don't take it in common).

Another factor though is, many major router vendors still don't support
BCP38 or especially uRPF for that matter on all of their platforms in proper
fashion.

It's not a good thing when people ask you to do uRPF, and best your router
can do for IPv6 is only strict-mode uRPF which doesn't work too well with
multihomed customers or on peering and transit interfaces.  :)

james

---

From: Gert Doering <[email-masked]>
Date: Mon, 14 May 2007 14:44:48 +0200

Hi,

> where a packet is actually being sourced from are open to the RH0 attack.

Usually, in "normal" ISP networks, you cannot do strict uRPF on backbone 
links (because there is unavoidable asymmetry), and loose uRPF won't
help you (because there *are* routes for this host).

So the attack "send in a 2Mbit stream of packets that will bounce 50
times between two core routers" is still possible, eating backbone
bandwidth and router CPU.

The attack "send in a 2Mbit stream that will bounce between a customer
device and <somewhere else>" will be caught by strict uRPF at the customer
edge (which is a good thing to do).

So what we need, at minimum, is

  - a way to turn off RH0 processing in routers (*all* OS variants)

  - working uRPF on the edge

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  113403

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279