Deprecation of Type 0 Routing Headers in IPv6

Abstract

Status of This Memo This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.

Transmission and Processing of IPv6 Extension Headers

“…o 0, IPv6 Hop-by-Hop Option, [RFC2460] o 43, Routing Header for IPv6, [RFC2460], [RFC5095] o 44, Fragment Header for IPv6, [RFC2460] o 50, Encapsulating Security Payload, [RFC4303] o 51, Authentication Header, [RFC4302] o 60, Destination Options for IPv6, [RFC2460] o 135, Mobility Header, [RFC6275] o 139, Experimental use, Host Identity Protocol [RFC5201] o 140, Shim6 Protocol, [RFC5533] o 253, Use for experimentation and testing, [RFC3692], [RFC4727] o 254, Use for experimentation and testing, [RFC3692], [RFC4727] This list excludes type 59, No Next Header, [RFC2460], which is not an extension header as such.…”

An IPv6 Routing Header for Source Routes with the Routing Protocol for Low-Power and Lossy Networks (RPL)

“…The SRH also differs from RH0 in the processing rules to alleviate security concerns that led to the deprecation of RH0 [RFC5095]. First, RPL routers implement a strict source route policy where each and every IPv6 hop between the source and destination of the source route is specified within the SRH.…”

“…If such addresses appear more than once and are separated by at least one address not assigned to that router, the router MUST drop the packet and SHOULD send an ICMP Parameter Problem, Code 0, to the Source Address. While this loop check does add significant perpacket processing overhead, it is required to mitigate bandwidth exhaustion attacks that led to the deprecation of RH0 [RFC5095].…”

The Impact of IPv6 on Penetration Testing

“…With RH0 enabled, an attacker could craft a packet that follows a certain path into a network, bypassing a firewall. Or, the destination according to the destination address could be allowed by the firewall, while the real final destination specified inside the RH0 header is not [1,5]. The first destination host would then forward the packet over the internal network.…”

“…Because of the vulnerabilities identified in the RH0 functionality, the IPv6 standard was updated in 2007 [1] to deprecate RH0 extension headers. However, many IPv6 implementations already contained the RH0 functionality, and there is no guarantee that all of them have been updated to reflect the change.…”