Re: IPv6 Type 0 Routing Header issues

[Mohacsi Janos <[e-mail]>]

Hi All,

I think this is not a solution. The problems of routing header type 0 well 
know by the community since long time. This has been documented for more 
than 2-3 years know (raised 4 years ago). Are there any consensus, that 
type 0 routing header should be deprecated? Until that it is documented to
  be filtered if there is no need for it. The current patch provided by 
OpenBSD/FreeBSD makes *BSD IPv6 implemenation non-conformant to standard. 
I would rather focus on pf changes - allow filtering based on the routing 
header type. Currently you can filter based existence/non-existence of 
routing header type. This is currently clearly not enough....

Regards,

Janos Mohacsi
Network Engineer, Research Associate, Head of Network Planning and Projects
NIIF/HUNGARNET, HUNGARY
Key 70EF9882: DEC2 C685 1ED4 C95A 145F  4300 6F64 7B00 70EF 9882

On Wed, 25 Apr 2007, George V. Neville-Neil wrote:

> At Wed, 25 Apr 2007 00:46:28 +0300,
> Jari Arkko wrote:
>>
>>
>>> Just in case folks are missing out on this, find below a rather nasty
>>> security issue.
>>>
>>
>> I cannot say that this is a big surprise, even if the specific attack
>> is news to me and it has a major impact. Some issues with Type 0
>> have been known for years; I think draft-savola-ipv6-rh-ha was the
>> first to report these. RFC 4294 warns of the issues and RFC 3775
>> design was based on the idea of avoiding Type 0 because it
>> was felt that at some point Type 0 would likely be filtered due
>> to its problems. Also, draft-ietf-v6ops-security-overview was recently
>> approved. It notes, among other things that "it may be desirable
>> to forbid or limit the processing of Type 0 Routing Headers
>> in hosts and some routers."
>>
>> So I think we should take that advice and modify the stacks that
>> do not do the right thing today. A good first approximation is
>> to add a configuration knob for processing Type 0 headers
>> in both hosts and routers, with default set to off. Better
>> firewall support for doing this would also be needed (without
>> disabling use of Type 2, of course).
>>
>
> FreeBSD has already committed patches disabling the processing of
> route header option 0 by default in all 3 of the currently shipping
> branches (HEAD, 6-STABLE and 5-STABLE).
>
>> But we at the IETF also need to draw a conclusion about the
>> state of Type 0. This feature needs to be retired.
>
> The sooner that decision is made the better.  Those of us working on
> the stacks would like to remove this processing if the feature is
> retired.
>
> Best,
> George Neville-Neil
> (FreeBSD Security Team and Core Member)
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[e-mail]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------