Re: [v6ops] Fwd: New Version Notification for draft-wkumari-long-headers-01.txt

[Nick Hilliard <[e-mail]>]

On 05/07/2013 14:35, Joe Touch wrote:
> ... then limiting the forwarding chain won't help because these aren't
> forwarded by that router.

then your understanding of modern routers is incorrect.

Let's say you have an IPv6 address on a router interface - it doesn't
matter if it's used for management or not.  If it's pingable, then the ping
packets will be directed to the router management or route processor engine
for slow path processing.  We use control plan policing or equivalent
technologies to ensure that packets of this form do not overload the RE / RP.

In order to implement CoPP/RE firewalling, we need hardware ACL support to
be able to distinguish between the sorts of packets that we want to see and
the ones we don't.  In practice, this means implementing sophisticated ACL
+ QoS support in hardware. Consequently, this means that we need the
ability to inspect reasonably deeply into ipv6 packet headers.

On several well known router engines, this functionality is not there
because the lookup engines cannot inspect far enough into the packet header
to handle ipv6 headers properly.  Consequently, large chunks of the
internet run on equipment which cannot be protected against trivial pps
based ipv6 attacks.  On some of them, it turns out that it doesn't matter
whether it's pingable or not, because you can craft IPv6 packets which can
bypass the hardware classification mechanisms.  All you need to know is the
ipv6 address of any interface on the box, and you can trivially trash it
remotely.

On this basis, I would suggest that this is not just a technical problem,
but a really serious technical problem with potentially devastating
operational consequences.

Nick