Subject: Routing Extension Headers: Security Question

From: Ron Bonica <[email-masked]>
Date: Mon, 3 Dec 2018 19:30:12 +0000

Folks,

Assume that a node receives the following packet:

- The IPv6 Destination Address is a link-local address that identifies the interface upon which it arrived
- The packet contains an unrecognized routing extension header with Segments Left equal to 0

Does the recipient have reason to be suspicious? The packet may have originated off link?

                                                                   Ron

---

From: 神明達哉 <[email-masked]>
Date: Mon, 3 Dec 2018 13:55:12 -0800

At Mon, 3 Dec 2018 19:30:12 +0000,
Ron Bonica <[email-masked]> wrote:

> Does the recipient have reason to be suspicious?

"Suspicious" is a subjective term, and it would depend on the details
of the "unrecognized routing header".  Since it's "unrecognized", it
could be an experiment of a new protocol where this particular usage
makes sense and the recipient doesn't necessarily have to understand
it (other than accepting the packet).  But I tend to agree that in
general it's more likely to be some "suspicious" activity (some kind
of bug or even an attack attempt).

> The packet may have originated off link?

Again, it would depend on the details of the "unrecognized routing
header".  But if it were the now-deprecated Type-0 routing header,
RFC4007 ensures it cannot originate off link (see Section 7 of
RFC4007).

--
JINMEI, Tatuya