IPv6 Type 0 Routing Header issues

[George V. Neville-Neil]

At Wed, 25 Apr 2007 00:46:28 +0300,
Jari Arkko wrote:
> 
> 
> > Just in case folks are missing out on this, find below a rather nasty
> > security issue.
> >   
> 
> I cannot say that this is a big surprise, even if the specific attack
> is news to me and it has a major impact. Some issues with Type 0
> have been known for years; I think draft-savola-ipv6-rh-ha was the
> first to report these. RFC 4294 warns of the issues and RFC 3775
> design was based on the idea of avoiding Type 0 because it
> was felt that at some point Type 0 would likely be filtered due
> to its problems. Also, draft-ietf-v6ops-security-overview was recently
> approved. It notes, among other things that "it may be desirable
> to forbid or limit the processing of Type 0 Routing Headers
> in hosts and some routers."
> 
> So I think we should take that advice and modify the stacks that
> do not do the right thing today. A good first approximation is
> to add a configuration knob for processing Type 0 headers
> in both hosts and routers, with default set to off. Better
> firewall support for doing this would also be needed (without
> disabling use of Type 2, of course).
> 

FreeBSD has already committed patches disabling the processing of
route header option 0 by default in all 3 of the currently shipping
branches (HEAD, 6-STABLE and 5-STABLE).

> But we at the IETF also need to draw a conclusion about the
> state of Type 0. This feature needs to be retired.

The sooner that decision is made the better.  Those of us working on
the stacks would like to remove this processing if the feature is
retired.

Best,
George Neville-Neil
(FreeBSD Security Team and Core Member)