Subject: [Mip6] Deprecating Routing Header Type 0

From: Vijay Devarapalli <[email-masked]>
Date: Sun, 17 Jun 2007 10:53:35 -0700

Hello folks,

There is a discussion going on in the IPv6 WG about deprecating
the use of Routing Header Type 0. See the following URL for the
discussion on this topic.

http://www1.ietf.org/mail-archive/web/ipv6/current/msg07634.html

For more information on security threats due to Routing Header
Type 0, see http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf.
It is an interesting read.

Some folks are suggesting "knee-jerk" reactions of blocking all
messages with a routing header in them. This would of course
break MIPv6. MIPv6 uses Router Header Type 2. It would be
especially bad if the firewalls start blocking them instead of
the hosts or the routers that receive such messages.

Comments?

Vijay

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Jean-Michel Combes" <[email-masked]>
Date: Tue, 26 Jun 2007 19:50:42 +0200

Hi,

it seems that the issue is solved (from the new pre-version of the draft):
"Firewall policy intended to protect against packets containing RH0
MUST NOT simply filter all traffic with a routing header; it must be
possible to disable forwarding of type 0 traffic without blocking
other types of routing headers. In addition, the default configuration
MUST permit forwarding of traffic using a RH other than 0."
Source: http://www1.ietf.org/mail-archive/web/ipv6/current/msg07849.html

Best regards.

JMC.