Fwd: RFC 7112 on Implications of Oversized IPv6 Header Chains

Fwd: RFC 7112 on Implications of Oversized IPv6 Header Chains

[Fernando Gont]

Folks,

FYI. This one has important implications -- it allows stateless
filtering in IPv6 (otherwise not really possible)



-------- Original Message --------
Subject: RFC 7112 on Implications of Oversized IPv6 Header Chains
Date: Wed, 29 Jan 2014 09:30:44 -0800 (PST)
From: rfc-editor@rfc-editor.org
To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org
CC: drafts-update-ref@iana.org, ipv6@ietf.org, rfc-editor@rfc-editor.org

A new Request for Comments is now available in online RFC libraries.


        RFC 7112

        Title:      Implications of Oversized IPv6 Header
                    Chains
        Author:     F. Gont, V. Manral,
                    R. Bonica
        Status:     Standards Track
        Stream:     IETF
        Date:       January 2014
        Mailbox:    fgont@si6networks.com,
                    vishwas@ionosnetworks.com,
                    rbonica@juniper.net
        Pages:      8
        Characters: 15897
        Updates:    RFC 2460

        I-D Tag:    draft-ietf-6man-oversized-header-chain-09.txt

        URL:        http://www.rfc-editor.org/rfc/rfc7112.txt

The IPv6 specification allows IPv6 Header Chains of an arbitrary
size.  The specification also allows options that can, in turn,
extend each of the headers.  In those scenarios in which the IPv6
Header Chain or options are unusually long and packets are
fragmented, or scenarios in which the fragment size is very small,
the First Fragment of a packet may fail to include the entire IPv6
Header Chain.  This document discusses the interoperability and
security problems of such traffic, and updates RFC 2460 such that the
First Fragment of a packet is required to contain the entire IPv6
Header Chain.

This document is a product of the IPv6 Maintenance Working Group of the
IETF.

This is now a Proposed Standard.

STANDARDS TRACK: This document specifies an Internet standards track
protocol for the Internet community,and requests discussion and suggestions
for improvements.  Please refer to the current edition of the Internet
Official Protocol Standards (STD 1) for the standardization state and
status of this protocol.  Distribution of this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
  http://www.ietf.org/mailman/listinfo/ietf-announce
  http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

For searching the RFC series, see
http://www.rfc-editor.org/search/rfc_search.php
For downloading RFCs, see http://www.rfc-editor.org/rfc.html

Requests for special distribution should be addressed to either the
author of the RFC in question, or to rfc-editor@rfc-editor.org.  Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.


The RFC Editor Team
Association Management Solutions, LLC


--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6@ietf.org
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------




-- 
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@si6networks.com
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

Re: Fwd: RFC 7112 on Implications of Oversized IPv6 Header Chains

[Ben Hutchings]

[-- Attachment #1: Type: text/plain, Size: 427 bytes --]

On Wed, 2014-01-29 at 16:25 -0300, Fernando Gont wrote:
> Folks,
> 
> FYI. This one has important implications -- it allows stateless
> filtering in IPv6 (otherwise not really possible)
[...]

Still not possible unless you can trust that all hosts behind the
firewall will correctly drop overlapping fragments.

Ben.

-- 
Ben Hutchings
It is a miracle that curiosity survives formal education. - Albert Einstein

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]

Re: Fwd: RFC 7112 on Implications of Oversized IPv6 Header Chains

[Fernando Gont]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/30/2014 10:56 AM, Ben Hutchings wrote:
> On Wed, 2014-01-29 at 16:25 -0300, Fernando Gont wrote:
>> Folks,
>> 
>> FYI. This one has important implications -- it allows stateless 
>> filtering in IPv6 (otherwise not really possible)
> [...]
> 
> Still not possible unless you can trust that all hosts behind the 
> firewall will correctly drop overlapping fragments.

All recent versions of popular OSes already do that.

Yes, there will be older ones around for a while -- but so many things
have and are being improved in the IPv6 area that, if you ran an old
OS, processing overlapping fragments should probably be the last thing
you should worry about.

Thanks,
- -- 
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@si6networks.com
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBAgAGBQJS6mjuAAoJEJbuqe/Qdv/x3e0H/iwSar/7m9XJr6/6QOt6Nst5
gbvAOzd2PgtjwGuRYHT0rSwZi2+/Ju7CRoiBjsTpMuAVtpYYt9+1+RX20W1Q0VpA
QVKlQUKoOeL00jNLjWGVCG8rJtDhE5Q+oi5hynjrWtphEQ3mNeHCn+bfW/Jbu0R6
oFv6uOkMiRNvdcVGkXxf6cNeZ9uE4w2pTOIXHbZekl6ejfUjkn5z8u5VlckDS7QR
ct3NPSKSOMv0C/3q+ncuZeUp2ids5BiyxBUzhJvxH2YG8/CYL5gjjOi/YbTDdz+3
TKM/ZB13U1ZqoTpWgYjr8o4UPR14Ek/GTCwrHYY6O9X5Y8FgXoQZePrItqexR0Y=
=CQDC
-----END PGP SIGNATURE-----