Deprecation of Type 0 Routing Headers in IPv6
updates
Extracted elements (14)
Blocking all Routing Headers in firewalls (rather than only Type 0) is explicitly discouraged because even a small percentage of firewalls doing so would make it impossible in practice to extend IPv6 Routing Headers, and would render Mobile IPv6 (which uses Type 2 Routing Header) undeployable.
RH0 is deprecated entirely rather than restricted because the severity of the traffic amplification threat is considered sufficient to warrant full deprecation; benign use-cases are sacrificed, but future Routing Header specifications may provide equivalent functionality.
Mobile IPv6 (RFC 3775) relies on the Type 2 Routing Header, not RH0; the Mobile IPv6 specification was previously modified to use Type 2 specifically to avoid the security issues associated with RH0.
RH0 processing nodes may continue to exist in deployed networks for some time; ingress filtering per RFC 2827 and RFC 3704 can mitigate some RH0-based attacks during the transition period.
A site security policy intended to protect against RH0 attacks SHOULD include implementation of ingress filtering at the site border, as recommended in RFC 2827 and RFC 3704.
An IPv6 node that receives a packet with a destination address assigned to it and that contains an RH0 extension header MUST NOT execute the RH0 routing algorithm specified in RFC 2460 Section 4.4.
Firewall policy intended to protect against RH0 packets MUST NOT simply filter all traffic with a Routing Header; it must be possible to disable forwarding of Type 0 traffic without blocking other Routing Header types.
If a received RH0 packet has Segments Left of zero, the node must ignore the Routing Header and proceed to process the next header; if Segments Left is non-zero, the node must discard the packet and send an ICMP Parameter Problem, Code 0, message to the source address.
IPv6 implementations are no longer required to implement RH0 in any way; support for RH0 is fully deprecated.
The default firewall configuration MUST permit forwarding of traffic using a Routing Header other than Type 0, to avoid breaking protocols such as Mobile IPv6 that rely on other Routing Header types.
The IPv6 Type 0 Routing Header (RH0) is extension header type 43, subtype 0, as defined in RFC 2460. It can contain multiple intermediate node addresses, and the same address may appear more than once, enabling the amplification attack.
The IANA registry 'Internet Protocol Version 6 (IPv6) Parameters' should be updated to reflect that variant 0 of IPv6 header-type 43 ('Routing Header') is deprecated.
RH0 provides a mechanism for traffic amplification by allowing a packet to oscillate between two RH0-processing nodes many times; an 88-fold amplification has been demonstrated, enabling denial-of-service attacks along arbitrary remote paths.
The RH0 attack affects the entire path between two exploited nodes, not only the nodes themselves or their local networks, making it more severe than analogous IPv4 source route option abuse.