- ipv6-wg - mailman.ripe.net

Fwd: RFC 9288 on Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers
by Fernando Gont 19 Aug '22

19 Aug '22

Hi, FYI. RFC 9288, "Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers" (available at: https://www.rfc-editor.org/rfc/rfc9288) FWIW, IMO most of the value is in the analysis of what protocols/features use what EHs, and what would break (if anything) if packets with EHs are dropped. These other two are useful for context: * RFC 9098, "Operational Implications of IPv6 Packets with Extension Headers" (https://www.rfc-editor.org/rfc/rfc9098.html) * RFC 7872, "Observations on the Dropping of Packets with IPv6 Extension Headers in the Real World (https://www.rfc-editor.org/rfc/rfc7872.html). Thanks! Cheers, Fernando -------- Forwarded Message -------- Subject: RFC 9288 on Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers Date: Thu, 18 Aug 2022 16:21:47 -0700 (PDT) From: rfc-editor(a)rfc-editor.org To: ietf-announce(a)ietf.org, rfc-dist(a)rfc-editor.org CC: rfc-editor(a)rfc-editor.org, drafts-update-ref(a)iana.org, opsec(a)ietf.org A new Request for Comments is now available in online RFC libraries. RFC 9288 Title: Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers Author: F. Gont, W. Liu Status: Informational Stream: IETF Date: August 2022 Mailbox: fgont(a)si6networks.com, liushucheng(a)huawei.com Pages: 33 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-opsec-ipv6-eh-filtering-10.txt URL: https://www.rfc-editor.org/info/rfc9288 DOI: 10.17487/RFC9288 This document analyzes the security implications of IPv6 Extension Headers and associated IPv6 options. Additionally, it discusses the operational and interoperability implications of discarding packets based on the IPv6 Extension Headers and IPv6 options they contain. Finally, it provides advice on the filtering of such IPv6 packets at transit routers for traffic not directed to them, for those cases where such filtering is deemed as necessary. This document is a product of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor(a)rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC _______________________________________________ IETF-Announce mailing list IETF-Announce(a)ietf.org https://www.ietf.org/mailman/listinfo/ietf-announce

2 1

New on RIPE Labs: Deploying IPv6-Mostly Access Networks
by Anastasiya Pak 02 Aug '22

02 Aug '22

Dear colleagues, Dual stack is the most common way of deploying IPv6 in access networks. A recent standard defines IPv6-mostly access networks, providing IPv4 connectivity only for legacy devices while allowing modern devices to run IPv6-only. My colleague Ondřej Caletka explored the deployment of IPv6-Mostly Access Networks. Read his article on RIPE Labs: https://labs.ripe.net/author/ondrej_caletka_1/deploying-ipv6-mostly-access-… Best regards, Anastasiya Pak Marketing & Communications Officer RIPE NCC

1 0

Call for presentations IPv6 WG @RIPE85
by Jetten Raymond 25 Jul '22

25 Jul '22

Hello All, RIPE 85 will take place from 24-28 Oktober 2022 in a hybrid format in which online and onsite participants can interact with each other using a common platform. The onsite event will take place in Belgrade Serbia. For both cases you can register here: https://ripe85.ripe.net/attend/register/ The IPv6 Working Group session is scheduled for Wednesday 26 Oktober from 12:00 . 13:00 (UTC+1) We still have some time in our session. We are looking for presentations - please email : ipv6-wg-chair (at) ripe.net if you'd like to present. Please also state if you intend to be online or onsite, and the duration of your presentation, and a short description of it. Once we have decided on the agenda, we'll contact the presenters. Hope to see many of you, On behalf of the IPv6-WG Benedikt, Jen, Ray For Internal Use Only

1 0

Minutes from RIPE84 IPv6 WG
by Jetten Raymond 25 Jul '22

25 Jul '22

Dear IPv6 WG list members, Here are the minutes from the IPv6 WG session from RIPE 84 in Berlin and online. A very big thank you to Gerardo and Ulka from the RIPE NCC. If you have any comments or remarks please let us know as soon as possible. We plan to publish the minutes at latest 2 weeks from now. Thanks, The IPv6 co-chairs IPv6 Working Group Minutes Date: Thursday, 19 May 11:00 - 12:30 (UTC+2) Chaired By: Benedikt Stockebrand, Jen Linkova, Raymond Jetten Scribe: Gerardo Viviers Welcome, Etiquette, Approving Minutes Working Group Co-Chairs Raymond Jetten, Working Group Co-Chair, welcomed everyone to the session and went over some rules of engagement. There were no questions or comments. IPv6 and the Windows 10 Firewall Wilhelm Boeddinghaus, system.de This presentation is available here: https://ripe84.ripe.net/wp-content/uploads/presentations/100-Boeddinghaus-R… Wilhelm did an in-depth analysis of how IPv6 is handled by the Windows 10 Defender Firewall software. The presentation conclusions provided some advice on how to best configure the firewall to provide good security for IPv6. Alvaro Vives, RIPE NCC, asked if there were improvements to the default firewall rules in Windows 11. Wilhelm said that he didn't think so, but he had not yet looked into Windows 11, and that he didn't expect the rules to be any better and maybe they should be proposed by the community. Christian Bretterhofer, Andritz AG, asked if there is a tool which allows users to see the firewall rules. Wilhelm replied that the Microsoft administration interface displays the rules. Most of the outgoing rules are not needed, because everything outgoing is allowed. He suggested that there might be some other firewall tools which were better. Kurt Kayser, Kurt Kayser Konsultation, commented that on the slides, the link local prefix was /64 and not /10. Wilhelm explained that this prefix size was mentioned in the Microsoft environments and simply took it over. Jan Zorz, 6connect, asked if Wilhelm thinks it's still a good idea to have a central firewall and not rely on the Windows 10 firewall. Wilhelm explained that you cannot rely on the Windows 10 firewall, but you must use it anyways. The central firewall does not protect your LAN. To ensure a secure environment, we need to use all the firewalls and packet filters available. Kostas Zorbadelos, CANAL+ Telecom, said that a default rule set is a problem, and asked Wilhelm if he had a suggestion for what the default ruleset should be. Wilhelm answered that it was difficult to come up with a real new default ruleset, because it is application centred. It depends on where the PC is used - in a loose environment or in a strict environment. Maybe the community can come up with a better firewall rule set. Maria Matejka, CZ.NIC, mentioned that one problem is a too-open firewall, and another is a too-closed firewall. The area of too closed and too open overlaps. We can't find a solution to having the firewall not too open and not too closed. Rule confirmations pop up frequently and home users click without thinking about it. Wilhelm replied that home users usually don't know much about packets and ports, so they don't understand what is right or wrong. Maybe the enterprise admins can make better rules for their environment, as they have the knowledge. Jen Linkova, Google, mentioned she is not a Windows user, but wondered if the firewall rules related to Neighbor Discovery might be useful for VMs on the same device. Wilhelm replied that he didn't think so. The VM packets don't need to be sent outside. Virtualisation is an enterprise feature and should be dealt with by the enterprise administrators. IPv6 Deployment Status: Update and Remaining Challenges Paolo Volpato, SID and Huawei Technologies This presentation is available here: https://ripe84.ripe.net/wp-content/uploads/presentations/114-IPv6_Status_Pa… Paolo presented on the status of IPv6 deployment around the world, pointing out how the statistics need a more refined interpretation to approach a true status. Christian Bretterhofer, Andritz AG, asked when companies in China would get access to IPv6 and open connectivity. His experience in China was difficult and the ISPs offered only a /64 IPv6 prefix. Paolo said that the plan was to have a good percentage of IPv6-only networks in China by 2030. He added that the issue of open connectivity could not be addressed in the current session. Maximilian Wilhelm, Cloudflare, commented that he felt IPv6 is a second-class citizen on Paolo's platform and asked when will IPv6 be on par with IPv4. Paolo answered that he is confident IPv6 is not a second-class citizen and if there is something to be fixed, he will pass on any messages to the headquarters for support. Jad el Cham, RIPE NCC, asked about IPv6 policies that have a good impact on IPv6 deployment. Paolo replied that certain policies in the USA have triggered some questions about IPv6 deployment. He added that his personal view was that the expectations are high and he doesn't believe that the proposed dates are realistic. Paolo suggested looking at countries like India, China, and Brazil, along with the EU. He expects that 2030 might be the flag year in which we might actually transition networks to IPv6. Maximilian Emig, aiticon GmbH, mentioned that Paolo's employer, Huawei, has been pushing the "New IP" proposal, which has received extensive press coverage. He asked Paolo to elaborate on how it fits with IPv6. Paolo mentioned he did not have an official answer. His personal opinion is it was a mistake, and it is not related to IPv6. Just Another Measurement of Extension Header Survivability (JAMES) Justin Lurman, ULiege, and Eric Vyncke, Cisco This presentation is available here: https://ripe84.ripe.net/wp-content/uploads/presentations/32-JAMES-RIPE84.pdf Justin Lurman provided an overview of how IPv6 packets using Extension Headers are processed or dropped on the public Internet. There were no questions or comments. IPv6 Addressing Inside a VPN Tunnel Between Endpoints With Rotating Prefixes Matthias Scheer, AVM This presentation is available here: https://ripe84.ripe.net/wp-content/uploads/presentations/59-ripe84_ipv6wg_v… Matthias Scheer presented on the challenges encountered by networks attempting to route IPv6 within VPNs, when the IPv6 prefixes assigned to the endpoints are rotated. Christian Betterhofer, Andritz AG, asked if there was any chance to update the Fritz 7582, specially the Wireguard support. Matthias replied that Wireguard support is available. He suggested to go to website and try out the beta, which is quite safe. Anže Jenšterle, AS211776, commented that Wireguard prefers IPv6 in DNS resolution only and this depends on how the resolver code is written. Jen Linkova, Google, mentioned that strictly speaking RFC 4193 does not recommend, it says certain addresses "CAN" be used. The language is not "SHOULD". Jen added that the default address selection is called "default" for a reason. Jan Zorz, 6connect, pointed out that Matthias mentioned the problem of rotating prefixes. Jan asked Matthias that if he came across ISPs that do this, he should point them to RIPE 690. Jan also mentioned that RFC 9096 talks about ways to improve the reaction of CPEs to IPv6 renumbering events. Gert Doering, congratulated AVM on working on IPv6 by default on their CPEs and on the work with IPv6 and VPNs. He mentioned that he liked the idea of using OSPFv3 to cope with renumbering events. Matthias remarked that he removed some slides that dealt with this topic due to time constraints. David Lamparter, OpenSourceRouting and NetDEF, replied to Jan Zorz's comment on RIPE 690 saying that he has customers that request prefix rotations. The RIPE document is not important for him. He applauded AVM's work on solving the prefix rotation problem. Matthias agreed that it was a good idea to continue the dialogue and find a solution together. Round Up and Thanks Working Group Co-Chairs The Working Group Co Chairs thanked the attendees for joining the session. For Internal Use Only

1 0

Join our Upcoming Open House on the IPv6 Skills Gap
by Alastair Strachan 14 Jun '22

14 Jun '22

Dear colleagues, We are organising an Open House on the IPv6 skills gap. The event will take place on Wednesday, 29 June from 10:00-11:30 UTC. Lack of adequate know-how remains a roadblock for IPv6 transition. Join us for a discussion on the challenges of building IPv6 skills. We'd love to hear your thoughts and suggestions! Register for free at: https://www.ripe.net/participate/forms/apply/openhouse-ipv6skills-29-june-2… <https://www.ripe.net/participate/forms/apply/openhouse-ipv6skills-29-june-2…> I hope to see many of you at there! Best regards, Alastair Strachan RIPE NCC Communtiy Development Officer

1 0

IPv6 Addressing Considerations (IETF Internet-Draft)
by Fernando Gont 02 Jun '22

02 Jun '22

Hi, We have published a revision of our IETF Internet-Draft "IPv6 Addressing Considerations". It is available at: https://datatracker.ietf.org/doc/html/draft-gont-v6ops-ipv6-addressing-cons… It discusses a lot of practical considerations regarding IPv6 addressing, so we'd love to hear from you if there's any that we missed or that you think we got wrong. Abstract IPv6 addresses can differ in a number of properties, such as scope, stability, and intended usage type. This document analyzes the impact of these properties on aspects such as security, privacy, interoperability, and network operations, with the goal of providing guidance about IPv6 address usage. Additionally, it identifies challenges and gaps that currently prevent systems and applications from leveraging the increased flexibility and availability of IPv6 addresses. Thanks! Regards, -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

1 0

IPv6 Guide
by Jens Link 20 May '22

20 May '22

Hi, about a month ago I was asked on Twitter if I new any good and current books ob IPv6. Apparently there is nothing current[1]. I came up with the idea of starting an OpenSource Guide on IPv6. I created a git repo: https://gitlab.com/jenslink/ipv6guide and also have (sponsored) hardware to run website, mailing list, ... There is not much yet, but I'll reserved a couple of hours per week for it starting in June. The project is hosted in gitlab (because they have IPv6) and will be written in markdown. For now I'd prefer to start with an English version and maybe add translations later. All we need is people to create, review and edit content. That means we need your help if you have some time to spare. If you have any question, just ask. I'm also around the RIPE meeting for the rest of the week. Jens [1] Which might not be a problem, Gert Doering just recycled an 11year old presentation with very little changes. -- ---------------------------------------------------------------------------- | Delbrueckstr. 41 | 12051 Berlin, Germany | +49-151-18721264 | | http://blog.quux.de | jabber: jenslink(a)quux.de | --------------- | ----------------------------------------------------------------------------

6 11

Ipv6 adress policy Musings
by Jetten Raymond 18 May '22

18 May '22

Dear IPv6 list members. The Address policy working group has asked for our input on the current address policies. Please have a look at the large list of questions, and please do participate in the discussion on the Address Policy working group list https://www.ripe.net/ripe/mail/archives/address-policy-wg/2022-May/013541.h… Rgds The ipv6 wg co chairs For Internal Use Only

1 0

RIPE 84 IPv6 WG Agenda
by Jetten Raymond 11 May '22

11 May '22

Hello All, Here is the current agenda for the RIPE 84 meeting in Berlin next week (also online). The IPv6 WG session will be on Thursday 19 May 2022 from 11:00 - 12:30 CET Co Chairs, * welcome, etiquette etc, acceptation of the minutes 5 min. Wilhelm Boeddinghaus * "IPv6 and the Windows 10 Firewall" (25 min incl Q&A) Paolo Volpato * "IPv6 Deployment Status: Update and Remaining Challenges". (20 min incl Q&A) Justin Lurman & Eric Vyncke * "Just Another Measurement of Extension header Survivability (JAMES)" (10 min incl Q&A) Eric van Uden Or collegue * IPv6 in the field Feld, KPI-results / and Or naming challenges IPv6 inside VPN (25 min incl Q&A) Co Chairs * round up, thanks 5 min Welcome onsite, or online ! Raymond Jetten Senior Technology Specialist Production Cloud Services, Networks and connectivity Interconnectivity & Content Elisa Oyj Vuolteenkatu 2 33100 Tampere +358 45 6700 139 raymond.jetten(a)elisa.fi<mailto:raymond.jetten@elisa.fi> www.elisa.fi<http://www.elisa.fi/> Lisätietoa henkilötietojen käsittelystä ja tietosuojasta Elisalla https://elisa.fi/tietosuoja Mer information om Elisas hantering av personuppgifter och dataskydd https://elisa.fi/tietosuoja More information on personal data management and data protection at Elisa https://elisa.com/dataprotection ********************************************************************************************* For Internal Use Only

1 0

Second call for presentations IPv6 WG @RIPE84
by Jetten Raymond 12 Apr '22

12 Apr '22

Hello All, RIPE 84 will take place from 16-20 May 2022 in a hybrid format in which online and onsite participants can interact with each other using a common platform. The onsite event will take place in Berlin. For both cases you can register here: https://ripe84.ripe.net/attend/register/ The IPv6 Working Group session is scheduled for , Thursday 19 May from 11:00 . 12:30 (UTC+1) We still have some time in our session. We are looking for presentations - please email : ipv6-wg-chair (at) ripe.net if you'd like to present. Please also state if you intend to be online or onsite, and the duration of your presentation, and a short description of it. Once we have decided on the agenda, we'll contact the presenters. Hope to see many of you, On behalf of the IPv6-WG Benedikt, Jen, Ray

1 0