The IPv6 Type 0 Routing Header Issue

Hello !! There are two possible reasons explaining you ended on that page:

You are looking for Scapy6. Clone the repository using mercurial:

    hg clone http://hg.natisbad.org/scapy6

Mon Sep 24 19:22:00 CEST 2007: Please, note the change in the repository definition. Before today, cloning was done using hg clone http://hg.natisbad.org/ scapy6 (the space matters). If you already had cloned the repository at the old location using that command, you just have to edit the .hg/hgrc in your local copy and replace http://hg.natisbad.org/ by http://hg.natisbad.org/scapy6/. This message will disappear in few monthes. -- arno

You are interested by the "IPv6 Type 0 Routing Header issue"

[last updates: Thu Jun 21 00:39:59 CEST 2007]

Slides:

IPv6 Type 0 Routing Header Security : flat slides of CanSecWest/core07 presentation

Tools

Scapy6: IPv6 extension for Scapy (Guillaume Valadon and Arnaud Ebalard)
Scapy: The network tool !!
IPv6 world: 3D IPv6 backbone explorer
RTGraph3D: make 3D graphs in realtime

Some "side effects" of the presentation (public ones)

APPLE-SA-2007-06-20 Mac OS X v10.4.10 : X.4.X ;-)
FreeBSD-SA-07:03.ipv6: FreeBSD Security Advisory, "IPv6 Routing Header 0 is dangerous"
OpenBSD Type 0 Routing Header Security Advisory: ... "This is a design flaw in IPv6 and not a bug in OpenBSD."
Heads up: IPv6 routing header 0 issues : NetBSD developers reaction is described here
KAME project's action on Type 0 Routing Header issue: KAME newsletter on the issue (2007/05/02)
Linux 2.6.20.9 Changelog: RH0 is disallowed by default (!!!! see next link !!!!)
Linux 2.6.21 Changelog: Interesting commit a23cf14b161b8deeb0f701d577a0e8be6365e247 with comment "Oops, thinko. The test for accempting a RH0 was exatly the wrong way around."
Linux 2.6.21.1 Changelog: another correction (commit 3dff7c2995f65611d7def4a7b5dbbd8686b1d0ea) correcting again previous patches (when MIPv6 is activated)
[PATCH] Disable IPv6 routing header type 0 processing by default: RH0 processing disabled by default on DragonFlyBSD.
RH0 treated as an unknown routing header on DragonFlyBSD: Fix from Hasso Tepper (Mon, 7 May 2007)
Urgent security update necessary for all DragonFly versions: message from Simon Schubert to all DragonFly users (May 9, 2007)
Cisco to deny RH0 processing by default?: Mail from Patrick on ipv6-ops
SixXS FAQ : Is my connectivity filtered? / Mandatory IPv6 Filtering on IPv6: Sixxs now DROPs RH0 traffic from/to their users by default. Also provide a list of filtering rules for many systems.
All IPv6 instances of the F Root DNS server now filter RH0 traffic (Node Information Queries traffic is also dropped)
Cisco Intelligence Bulletin: IPv6 Routing Header Extension Spoofing and Denial of Service Attacks
Securityfocus Security Advisory (Bugtraq ID: 23615): IPv6 Protocol Type 0 Route Header Denial of Service Vulnerability (funny list of vulnerable systems, including RFC 2460)
Security Advisory on Secunia (SA24978 / CVE-2007-2242): OpenBSD IPv6 Type 0 Route Headers Denial of Service
Cisco Security Advisory: IPv6 Routing Header Vulnerability: Cisco advisory on Type 0 Routing Header processing flaw in the IOS (Reported by Arnaud and published 2007 January 24, i.e. before CanSecWest 2007 presentation)
Cisco Applied Intelligence Response: Identifying and Mitigating Exploitation of the IPv6 Routing Header Vulnerability (for previous flaw). Also provide some information regarding filtering of Routing Header on IOS-based Cisco devices.
Heise: Gefährliche Routing-Option in IPv6: On April 30 2007, the news made its way to Germany. Information and comment, in german ;-) (english version)
RH0 issue on Digg: digg it!!!
IPv6 routing flaws -- Are our standards screwed?: digg it !!!

Press coverage (articles, selected blogs, podcasts, ...)

bsdtalk115 Interview with Itojun, on bsdtalk
Old IPv4 flaws resurface with IPv6: article on Ars Technica, by Iljitsch van Beijnum (May 15, 2007)
IETF moves against IPv6 threat: article on Techworld, by Matthew Broersma (May 14, 2007)
IPv6 Flaw Could Greatly Amplify DDoS Attacks: post on /. with followed by useless comments (May 11, 2007)
Experts scramble to quash IPv6 flaw: article on SecurityFocus, by Robert Lemos (May 9, 2007)
Five Security Flaws in IPv6: article on Dark Reading, by Kelly Jackson Higgins (May 8, 2007)
RH0 Threats: Lesson Not Learned: article on eWeek, by Lisa Vaas (May 4, 2007)
Risky Business #11 IPv6 bugs: The issue discussed in Risky Business podcast. "IPv6 is insecure ... could it be the standards fault?"
IPv6 kämpft mit Sicherheitslücken: article in german on silicon.de, by Simone Schnell (May 09, 2007)
The ISP column: IPv6 Ping Pong: article by Geoff Huston (May 2007). Also available in pdf and txt.
Press coverage on FreeBSD SA: in japanese.

Discussions on IPv6 related mailing lists (drafts review)

[ipv6@ietf.org] I-D ACTION:draft-jabley-ipv6-rh0-is-evil-00.txt: New draft by Joe, asking for "Deprecation of Type 0 Routing Headers in IPv6" (May 07, 2007)
[ipv6@ietf.org] RH0: disable by default draft: New draft by Pekka and George, asking (at the moment) for a "disable by default" behavior (May 08, 2007)

Discussions on IPv6 related mailing lists (pre-drafts review)

[dns-operations] IPv6 Type 0 Routing Header issues: Nico's post on dns-ops ...
[ipv6@ietf.org] IPv6 Type 0 Routing Header issues: ... forwarded on ipv6@ietf.org and v6ops@ops.ietf.org (long thread)
[ipv6@ietf.org] Question for IPv6 w.g. on [Re: IPv6 Type 0 Routing Header issues]: Bob Hinden's question to the WG on possible actions
[ipv6@ietf.org] itojun2.0: the beginning: itojun's reaction to the issue (see below)
[ipv6@ietf.org] post by kjc@iijlab ...: ... about the real message itojun2.0 needs to deliver
KAME T-shirt is available: for those who read the ipv6@ietf discussions and KAME IPv6 Samurai Itojun (now Itojun 2.0) ...
[ipv6-ops] IPv6 Type 0 Routing Header issues: The issue discussed on ipv6-ops. With interesting discussions on how to filter RH0.
[c-nsp] no ipv6 source-route: thread on cisco-nsp ML regarding the lack of support for the command on some Cisco devices.
[j-nsp] IPv6 Routing Headers: thread on juniper-nsp ML regarding the possible filtering of RH0 on Juniper devices.
[ipv6-ops] Checkpoint's products status: it seems they drop all packets including RH0 by default (note: no access, so unchecked info)

Some comments on our "experimental talk" (We obviously lost the content because of the form (3D + non natural born speaker). Sorry Dragos !!!)

Comment c'etait CanSecWest 2007 by Cedric, in French (at least, take a look at the pictures, [1][2][3]!!!!)
CanSecWest 2007 Day One Highlights, by Chris Eng
Enable IPv6 and kill the internet, by jedi
Fun with IPv6 routing headers, by Phillip Beynon