Subject: RE: Question for IPv6 w.g. on [Re: IPv6 Type 0 Routing Headerissues]

From: [email-masked]
Date: Thu, 03 May 2007 23:46:28 -0700

Solaris 9/10 ships with IPv6 processing of the routing header disabled 
by default:

# ndd /dev/ip6 ip6_forward_src_routed
0

...and Solaris only implements processing for RHT0.

Solaris 8 appears to be the only one with it enabled by default.

Darren

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Jeroen Massar <[email-masked]>
Date: Sun, 06 May 2007 13:21:58 +0100

> Solaris 8 appears to be the only one with it enabled by default.

Although that is a partial step in the right direction, when the machine
is used for forwarding packets, it still allows these packets to be
forwarded.

As such, when forwarding, the host still forward these malicious packets
and even though this host on your network is correctly configured, other
networks and hosts, which are not active enough in updating their
configurations will make your host still be a part of a nice DoS attack
as it will forward the malicious packets.

Of course, when Transits filter them out these packets will be limited
to the networks on the edges, which then usually is their own problem.

The current Linux and FreeBSD patches also only _DISABLE_ processing,
they still forward these packets on.

I am recording all the implementations and how they handle RT0 on:
http://www.sixxs.net/faq/connectivity/?faq=filters
for updates/changes/comments etc, of course don't hesitate to yell.

Greets,
 Jeroen

---

From: Jeroen Massar <[email-masked]>
Date: Tue, 08 May 2007 10:37:48 +0100

[..]
> I think my initial email gave the wrong impression of Solaris' behavior.
> 
> Solaris 9 & 10 will drop these packets by default, whether they
> are being received as the final destination or as a stepping stone.

Cool, that sounds much better (IMHO :) Does the "DROP" imply a silent
discard of the packet or does it send an ICMP parameter problem?

Reason I am asking is more for the follow up question, which is useful
for the deprecation drafts: what do you (and others) think is a
reasonable default:

 a) Silently discard the packet (maybe a log entry somewhere)
 b) Discard packet, but send back an ICMPv6 Parameter Problem.
 c) Don't process packet, but forward it anyway

Option c) seems to be clearing off the table by most implementation from
what I have seen upto now. Most don't even have a knob to turn it on
again either.

I am in favor of, and have implemented, option a), though b) doesn't
seem to be a very bad option either as backscatter is minimal and only
to the sending host who should most likely know about it. Next to that,
as itojun mentioned, ICMPv6 errors are rate-limited anyway when
implemented according to the spec.

Greets,
 Jeroen
  (I got no Solaris boxes around to test)
  (http://www.sixxs.net/faq/connectivity/?faq=filters updated)