Practical IPv 6 Filtering Ben Eater eaterjuniper net

IPv 4/IPv 6 Feature Parity • Features and tools will lag • Vendors need to figure out what will be useful before committing engineering resources • Not everything published in an RFC will get implemented • Early adopters like DREN are instrumental in guiding this process • Once basic IPv 6 forwarding is implemented, most other features can be easily added • Filtering (and features that rely on it) presents additional challenges Copyright © 2003 Juniper Networks, Inc. www. juniper. net 2

Filtering IPv 6 • Filtering is required to implement many security mechanisms • Simple accept/discard actions • Selecting traffic to monitor/log/count/mirror • Rate limiting • Policy route, Qo. S handling, others… • Filtering IPv 6 traffic presents some challenges. Copyright © 2003 Juniper Networks, Inc. www. juniper. net 3

Filtering IPv 6 in Software • Pros • Very easy to do • Cons • Lack of predictable performance • Impossible to use in high-bandwidth applications • Lack of headroom can allow attacks to exhaust limited CPU resources even in lower bandwidth applications Copyright © 2003 Juniper Networks, Inc. www. juniper. net 4

Filtering IPv 6 in Hardware • Pros • Predictable performance • Performance under load (or during an attack) • Cons • Most (but not all) existing equipment will need totally new hardware to support IPv 6 • State of the art in hardware-based filtering evolved with IPv 4 in mind. Copyright © 2003 Juniper Networks, Inc. www. juniper. net 5

IPv 4 Filtering Assumptions • To filter on any field in the L 3/L 4 header: • Look at a fixed offset into the packet • Match based on the bits you find at that offset • This model breaks in the presence of IP options • Most (all? ) network operators drop all IPoption packets anyway Copyright © 2003 Juniper Networks, Inc. www. juniper. net 6

IPv 6 Filtering • IPv 6 uses extension headers • An arbitrary number of extension headers can be chained together • Header fields are no longer always in the same place • Hardware filtering technology designed for IPv 4 can’t cope Copyright © 2003 Juniper Networks, Inc. www. juniper. net 7

So what can current HW do? • The IP header is always in the same place • Source address • Destination address • Class of service • Flow label • Packet length • Next header Copyright © 2003 Juniper Networks, Inc. www. juniper. net 8

So what can current HW do? • If there are no other extension headers • TCP, UDP, ICMP, ESP, AH, etc. header will be next • These headers are now in a predictable location • If there are other extension headers • There is no way to find the TCP, UDP, or ICMP header. • What do we do? – Permit the packet – Drop the packet Copyright © 2003 Juniper Networks, Inc. www. juniper. net 9

Extension Headers • Hop-by-Hop Options Header • Used for router alert. • Specified as an IP option in IPv 4 • Not widely used in IPv 4 • Routing Header • Used for source routing • Not widely used in IPv 4 Copyright © 2003 Juniper Networks, Inc. www. juniper. net 10

Extension Headers • Fragment Header • IPv 6 fragmentation is only done by the sending node • Sender really should use PMTU discovery • Effective PMTU discovery obviates fragmentation • Destination Options Header • Only defined option is padding the packet to a 64 bit boundary Copyright © 2003 Juniper Networks, Inc. www. juniper. net 11

Drop packets with Extension Headers? • IPv 4 IP-Options packets • Require extra processing by routers • Can’t be filtered in hardware • None of the defined options are widely used • Most network operators simply drop them • IPv 6 Extension headers • Doomed to a similar fate? Copyright © 2003 Juniper Networks, Inc. www. juniper. net 12

Practical filtering of IPv 6 • Near Term • Network operators will drop all packets with extension headers • Normal filtering is possible • Longer Term • A “killer app” would be required to rejuvenate interest in using extension headers • Barring this, I don’t see how extensive effort would be expended to support extension headers Copyright © 2003 Juniper Networks, Inc. www. juniper. net 13