- ipv6-wg - mailman.ripe.net

[training] RIPE NCC Webinars - new dates
by Training Services 18 Jun '15

18 Jun '15

Dear colleagues, We are pleased to announce the dates for the RIPE NCC Webinars for the coming quarter. These interactive on-line learning sessions take about one hour, and give you the opportunity to learn and interact with our trainers without leaving your desk. In the next 3 months you can participate in the following Webinars: - Advanced RIPE Atlas Usage (NEW!) - Introduction to the RIPE Database - RIPE Database - Advanced Topics - IPv6 in the RIPE Database - IPv6 Addressing Plan - Webinar for New LIRs - Resource Certification (RPKI) Register now at https://www.ripe.net/support/training/learn-online/webinars Participation is limited to 20 people, so don't hesitate if you want to take part! If you have any questions, please email <training(a)ripe.net>. We look forward to seeing you online. Kind regards, RIPE NCC Training Services

1 0

[news] Finnish IPv6 Launch Event on 8 June in Helsinki, Finland
by Marco Hogewoning 16 Jun '15

16 Jun '15

Dear colleagues, Finnish IPv6 Launch Event on 8 June in Helsinki, Finland On Tuesday 8 June, Viestintävirasto, the Finnish telecoms regulator, hosted a seminar on the launch of IPv6 in Finland across a broad spectrum of sectors. Emile Aben and I participated in this meeting on behalf of the RIPE NCC. This half-day meeting was the pinnacle of a project that started about two years ago with a renewal of the work programme of the national IPv6 task force. This renewal led to efforts to coordinate the deployment of IPv6, with the seminar date set as a milestone by which to achieve nationwide support for IPv6. The project found support from all major access providers as well as hosting companies and content providers including the national broadcaster, YLE, and MTV. We are pleased to see this strategy has paid off: the regulator estimates that approximately five million Finnish Internet connections are IPv6 enabled to date. Real-time measurements by APNIC also showed a rapid increase of IPv6 users over the preceding week: the percentage of end users observed using IPv6 quickly rose from almost nothing to 4.7%. DNA achieved the most spectacular deployment: the percentage of their customers using IPv6 skyrocketed to 16% and is still increasing. During the seminar, various operators reported on their experiences during the deployment. They also looked forward to resolving any remaining issues and using the knowledge gained to further advance IPv6 adoption throughout the country. More information about the initiative can be found at http://ipv6nyt.fi. For detailed statistics on the IPv6 deployment, see: http://stats.labs.apnic.net/ipv6/FI?c=FI&x=1&p=0&r=1&w= Regards, Marco Hogewoning -- External Relations - RIPE NCC

1 0

Re: [ipv6-wg] [v6ops] Extension Headers / Impact on Security Devices
by Mark ZZZ Smith 16 Jun '15

16 Jun '15

From: Ca By <cb.list6(a)gmail.com> To: Eric Vyncke (evyncke) <evyncke(a)cisco.com> Cc: "v6ops(a)ietf.org" <v6ops(a)ietf.org>; "ipv6-wg(a)ripe.net" <ipv6-wg(a)ripe.net> Sent: Tuesday, 16 June 2015, 8:32 Subject: Re: [v6ops] Extension Headers / Impact on Security Devices On Monday, June 15, 2015, Eric Vyncke (evyncke) <evyncke(a)cisco.com> wrote: Enno, As you probably know, Cisco handles PSIRT issues with care, so, I have no clue on this specific advisory. My own (educated) guess is that the packet causing a LC reload is fully RFC 2460 compliant but unusual, so, probably (a guess again) a combination of extension headers triggering a bug. In this specific case, I would not blame IPv6 or RFC 2460 but rather my own company (even if the affected versions were quite old as new IOS-XR versions appear to be immune to this bug). And I appreciate the humor in your rhetorical question about which FW could protect a CRS... Air gap probably :-) More generally, regarding the 'parsing of the header' and performance, my understanding (and I am NOT a HW engineer) is that there are multiple ways to parse the header chain: - purely software in low-end devices, should have a marginal performance impact - specific ASIC in middle-end devices (read high end enterprise), probably some limitations and heavy performance impact (but again within one organization, so, easier to fix the root cause) - a lot of specialized network processors in high-end devices (SP gears), which is a similar case as the 'low-end device', performance impact but marginal as parsing the chain of headers is not that hard after all _when_ coded correctly As the extension headers are specific to IPv6, this is an area when we will all learn (and have learned already) a lot of things... I respectfully disagree with your last sentence. Of course, destination AS/host SHOULD only accept useful, known and legit ext headers; but, why would an ISP filter on ext headers if they do not harm their own infra or a customer infra? Do you envision an Internet where only TCP/443 and UDP/43 would be accepted? Last point, the Internet will have to use IPv6 for 10 or 20 years at least. If the IETF/ISP block all new _options_ in _existing_ extension headers, then we will be stuck in 1997 for network innovation. While I do not like taking security risks, I even fear more the lack of innovation. I keep hearing this and it is very bizarre to hear With regards to 1997, believing that there will be innovation in the narrow waist of hour glass (network layer), that is very 1997. The network layer is stable and boring.... Hence it being narrow. Innovation is welcome everywhere except network in the e2e model / Absence of evidence is not evidence of absence. / Consider what the network and host situation was in 1997 (wired network access, desktops outselling laptops, dialup Internet for residential, corporates in total probably being the largest spenders on Internet access) to today and the near future (wireless networks, smartphones/tablets being the dominant Internet access device in some markets - and they're multi-homed, M2M/IoT considered to be place where the greatest expansion of Internet connected devices is going to occur in the near future.) / IPv6 has had relatively little adoption, and it is only starting to increase quite rapidly in the last few years and that is mainly because of mobile networks. There hasn't and still doesn't seem to be much thinking about how IPv6's differences from IPv4's can be taken advantage of yet - an "IPv4 first" or an "IPv4 == IPv6" mindset seems to be still very common (I think the network virtualisation space is where this is might be most prominent - I think most of the technologies they're inventing require fork lift network upgrades, so the costs of deploying IPv6 at the same time become a lot less significant. So if there is a "cheap" opportunity to deploy IPv6, and IPv6 is going to be the long term network layer 3, why not optimise for it now? That was the thinking behind my "Enhancing Virtual Network Encapsulation with IPv6" draft) / We don't want to disable innovation opportunities that IPv6 may provide before people have arrived at an "IPv6 first" or "IPv4 != IPv6" mindset. Let's talk on Thursday at Silvia's IPv6 Conference in Zurich ;-) -éric On 11/06/15 11:58, "Enno Rey" <erey(a)ernw.de> wrote: > >the problem here is the definition of "normal IP packet" as of RFC2460. >To illustrate this I just quote from today's Cisco advisory (Cisco IOS XR >Software Crafted IPv6 Packet Denial of Service Vulnerability) on packets >potentially crashing CRS-3 line cards: > >"The vulnerability is due to incorrect processing of an IPv6 packet >carrying IPv6 extension headers that are valid but unlikely to be seen >during normal operation. An attacker could exploit this vulnerability by >sending such an IPv6 packet to an affected device that is configured to >process IPv6 traffic. An exploit could allow the attacker to cause a >reload of the line card, resulting in a DoS condition." > >two question come to mind here: > >- is a "valid but unlikely" extension header chain "normal"? >- what ("combination of FW & IPS or whatever") would you put in front of >a CRS? > >my (sad) expectation is that we'll see much more of these (types of) >issues in the future. given the current level of freedom that the RFC2460 >leaves (see also discussion/picture in >http://www.insinuator.net/2015/06/is-ipv6-more-secure-than-ipv4-or-less/) >"properly parsing an IPv6 packet, let alone in wire speed" seems a pretty >much unsolvable task to me. > >That said I still fail to see any useful extension header besides AH&ESP >(not even FH) to be transported in the Internet. > >best > >Enno > > > > > > > > If your firewall cannot implement this policy, then >> it is time to change or to use a combination of FW & IPS or whatever. >> >> - network person: as I will live with IPv6 for the rest of my life, >>then I >> want a way to extend it and I need any packet to travel to my source to >>my >> destination. Any IPv6 packet should be able to traverse the >> Internet/private network as long as its layer-3 header is valid >> (filtering/dropping can be done exceptionally for good operational >> reason). Did we remember the IPv4 teardrop attack? It is blocked by >> default by most routers for years ;-) >> >> Bugs will plague us for ever... And make our life more complex than the >> above description of course ;-) >> >> -??ric >> >> On 17/05/15 20:43, "Silvia Hagen" <silvia.hagen(a)sunny.ch> wrote: >> >> >Hi >> > >> >I keep stumbling about that "recommendational wording" in RFC 2460 >> >everytime I teach it. >> > >> >Couldn't we update RFC2460 and make this list a strict order? >> > >> >I would want my firewall to notify me if the EHs in a packet do not >> >follow the list. >> >And limiting the number of possible EHs per packet might be a good >>idea. >> > >> >Silvia >> > >> >-----Urspr??ngliche Nachricht----- >> >Von: ipv6-wg [mailto:ipv6-wg-bounces@ripe.net] Im Auftrag von Benedikt >> >Stockebrand >> >Gesendet: Sonntag, 17. Mai 2015 18:39 >> >An: ipv6-wg(a)ripe.net >> >Betreff: Re: [ipv6-wg] Extension Headers / Impact on Security Devices >> > >> >Hi Enno and list, >> > >> >Enno Rey <erey(a)ernw.de> writes: >> > >> >> hope everybody had a great #RIPE70 meeting. We did! >> >> Many thanks to the organizers and chairs! >> > >> >and thanks to the actual speakers as well the speakers we had to turn >> >down due to time constraints, too:-) >> > >> >> If the chairs consider this appropriate we will happily give a >> >> presentation on this stuff in Bucharest or at another occasion. >> > >> >Sounds good to me! >> > >> >> - looking at the "liberty" RFC2460 provides as for ext_hdrs (wrt to >> >> their number, order[...] >> > >> >Actually, as far as I'm concerned that's the real core of the problem. >> >Or more specifically, the first two lines of RFC 2460, section 4.1: >> > >> > When more than one extension header is used in the same packet, it >>is >> > recommended that those headers appear in the following order: >> > >> >followed on the next page by >> > >> > Each extension header should occur at most once, except for the >> > Destination Options header which should occur at most twice (once >> > before a Routing header and once before the upper-layer header). >> > >> >Note in particular that these are not even RFC 2119 "SHOULD" or >> >"RECOMMENDED" and such. >> > >> >The impact here is actually at least twofold: >> > >> >- It is impossible to implement this as a simple pipeline architecture >> > in hardware; at least for cases deviating from the "recommendations" >> > above this effectively becomes either excessively complex to >>implement >> > in hardware or an invitation to DoS when implemented in software on >>an >> > otherwise hardware router. >> > >> >- As I understand it, at least some of the issues you have found are >> > effectively based on violating the second paragraph quoted, making it >> > impossible to come up with a lower bound on how long the header chain >> > can actually get and therefore leading to the fragmentation related >> > attacks and similar you have discovered. >> > >> >The original idea was that the extension headers are processed strictly >> >in the order they occur, so one question to ask is if there is any >>valid >> >reason to violate these "recommendations" for other than malicious >> >purposes. >> > >> > >> >Cheers, >> > >> > Benedikt >> > >> >-- >> >Benedikt Stockebrand, Stepladder IT >>Training+Consulting >> >Dipl.-Inform. http://www.stepladder-it.com/ >> > >> > Business Grade IPv6 --- Consulting, Training, Projects >> > >> >BIVBlog---Benedikt's IT Video Blog: >>http://www.stepladder-it.com/bivblog/ >> > >> > >> > >-- >Enno Rey > >ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de >Tel. +49 6221 480390 - Fax 6221 419008 - Cell +49 173 6745902 > >Handelsregister Mannheim: HRB 337135 >Geschaeftsfuehrer: Enno Rey > >======================================================= >Blog: www.insinuator.net || Conference: www.troopers.de >Twitter: @Enno_Insinuator >======================================================= > >_______________________________________________ >v6ops mailing list >v6ops(a)ietf.org >https://www.ietf.org/mailman/listinfo/v6ops _______________________________________________ v6ops mailing list v6ops(a)ietf.org https://www.ietf.org/mailman/listinfo/v6ops _______________________________________________ v6ops mailing list v6ops(a)ietf.org https://www.ietf.org/mailman/listinfo/v6ops

1 0

Looking for info on IGP choices in production dual-stack networks
by Victor Kuarsingh 09 Jun '15

09 Jun '15

RIPE IPv6 Folks: Philip Matthews and I are co-authors on an active draft within the IETF related to IPv6 routing design choices. To ensure we are gathering sufficient data we are looking for an expanded set of input from operator forums as well (vs. just the v6ops IETF list). The draft is found here -(https://tools.ietf.org/html/draft-ietf-v6ops-design-choices). We are looking for information on the IGP combinations people are running in their dual-stack networks. We are gathering this information so we can document in our draft which IGP choices are known to work well (i.e., people actually run this combination in production networks without issues). The draft will not name names, but just discuss things in aggregate: for example, "there are 3 large and 2 small production networks that run OSPF for IPv4 and IS-IS for IPv6, thus that combination is judged to work well". If you have a production dual-stack network, then we would like to know which IGP you use to route IPv4 and which you use to route IPv6. We would also like to know roughly how many routers are running this combination. Feel free to share any successes or concerns with the combination as well. We are looking particularly at combinations of the following IGPs: IS-IS, OSPFv2, OSPFv3, EIGRP. If you run something else (RIP?) then we would also like to hear about this, though we will likely document these differently. [We suspect you run RIP/RIPng only at the edge for special situations, but feel free to correct us]. And if you have one of those modern networks that carries dual-stack customer traffic in a L3VPN or similar and thus don’t need a dual-stacked core, then please email us and brag ... If you are on multiple lists at RIPE, NANOG or the IETF, we apologize for any redundant emails you may get (we are just attempting to reach the widest audience possible). Philip Matthews Victor Kuarsingh

1 0

New on RIPE Labs: IPv6 Deployment in Estonia
by Mirjam Kuehne 04 Jun '15

04 Jun '15

Dear colleagues, In case you missed Tarko Tikan's description of the IPv6 deployment in Estonia on other lists, we put the story on RIPE Labs: https://labs.ripe.net/Members/tarko_tikan/ipv6-deployment-in-estonia Kind regards, Mirjam Kuehne RIPE NCC

1 0

IPv6 only as default for next meeting
by Jérôme Fleury 24 May '15

24 May '15

During WG this afternoon, the idea was submitted that the IPv6 only experimentation be made the default SSID for the next meeting. While this has been working tremendously well for routine internet usage, I've been unable to use this network mainly because of incompatibility with my VPN network. We have a dual-stack VPN. some of the resources are v4 only though. The DNS64 converts my v4 VPN resources into v6 resources that are then routed to the non-VPN interface. While there could be workarounds (DNS64 on the VPN side, full v6 routing on the VPN, or all VPN resources available on v6) I don't think the technology is mature enough to make it the default for advanced usage. My 0.02$

11 18

How to Unsubscribe!?
by Adem Karatepe 15 May '15

15 May '15

Hi folks, I used to work in IPV6 work group before in my company and my colleague add me to this list but I'm not working on this group anymore and my colleague resigned from company so we don't have login details and we can not unsubscribe from the mail list. Is there any other way to unsubscribe? Adem Karatepe BT Proje Asistanı Project Support Staff Yazılım Geliştirme Direktörlüğü Software Development www.turksat.com.tr<http://www.turksat.com.tr> akaratepe(a)turksat.com.tr<mailto:akaratepe@turksat.com.tr> Gazi Üniversitesi Gölbaşı Yerleşkesi Teknoparkplaza kat 2 06830 Gölbaşı/ANKARA T : +90 312 497 47 00 F : +90 "Bu mesaj ve ekleri mesajda gönderildiği belirtilen kişi ya da kişilere özel olup gizli bilgiler içeriyor olabilir. Mesajın muhatabı ilgilisi ya da gönderileni değilseniz lütfen mesajı herhangi bir şekilde kullanmayınız çoğaltmayınız ve başkalarına ifşa etmeyiniz. Eğer mesaj yanlışlıkla size ulaşmışsa anılan mesaj ve ekinde yer alan bilgileri gizli tutunuz ve mesajı gönderen kişiyi bilgilendirerek söz konusu mesaj ile eklerini derhal imha ediniz. Bu mesaj ve ekindeki belgelerin bilinen virüslere karşı kontrolü yapılmıştır. Ancak e-posta sistemlerinin taşıdığı risklerden dolayı şirketimiz bu mesajın ve içerdiği bilgilerin size değişikliğe uğrayarak veya geç ulaşmasından bütünlüğünün ve gizliliğinin korunamamasından virüs içermesinden ve herhangi bir sebeple bilgisayarınıza ve sisteminize verebileceği zararlardan sorumlu tutulamaz.”<<<<< “This message together with its attachments is intended solely for the address(es) and may contain confidential or privileged information. If you are not the intended recipient please do not use copy or disclose the message for any purpose. Should you receive this message by mistake please keep all information contained in the message or its attachments strictly confidential and advise the sender and delete it immediately without retaining a copy. This message and its attachments have been swept by anti-virus systems for the presence of known viruses. However due to the risks of e-mail systems our company cannot accept liability for any changes or delay in receiving loss of integrity and confidentiality containing viruses and any damages caused in any way to your computer and system recipient, you are notified that disclosing, distributing, or copying this e-mail is strictly prohibited. “

1 0

Chair replacement procedure for ipv6-wg
by Dave Wilson 15 May '15

15 May '15

Hi all, You might remember from the last RIPE meeting that each working group had to finalise chair selection procedures. Because we were changing chairs anyway, ipv6-wg got to wait for one more meeting. Since the other working groups have gone through that process, however, we can use that to our advantage. Instead of starting from scratch, we propose to use a procedure which has already been discussed by a working group. The one we've chosen, because it seems very close to what we discussed at RIPE 69, is the procedure used by anti-abuse-wg. I hope this draft is already "good enough" for us to adopt as a result; if so, it'll save us repeating work that's already been done several times over in other WGs. We have this on the agenda for RIPE 70, and I hope we'll be able to adopt it then. Best regards, Dave ===(cut here)=== Note on Language: Throughout this document the word Chair shall be used for both Chairs and Co-Chairs. ** Introduction: This document outlines procedures dealing with the tenure of RIPE Working Group Chairs. It applies to all RIPE Working Groups. ** WG Chair Term: The term of a WG Chair is three years. A current chair may stand for re-selection at the end of their term. A WG Chair may resign voluntarily at any time. ** Selection of a WG Chair: WG Chair vacancies, along with a call for candidates, must be announced on the WG mailing list at least one month in advance of the date upon which the selection will be held. The announcement should set a closing date for candidates. A WG may request that a WG Chair vacancy be opened so long as the addition of a new Chair would not cause the number of Chairs of that WG to exceed three. WG Chairs are elected at WG sessions at RIPE meetings. Anyone physically present at the WG session is eligible to participate in the selection process. The candidate does not need to be physically present at the WG session. If possible the Chair should be elected by acclamation by the WG or by consensus after discussion. If the result is unclear, then a secret ballot should be held. In the case of a ballot, votes will be counted by RIPE NCC Staff and/or Chairs of other WGs. The result will be determined by simple majority. ** Removal of a WG Chair: A WG Chair may be unable to fulfil their duties as described in this document or otherwise fail to serve the WG and the community. With the endorsement of a significant share of the WG, a vote of no confidence may be initiated. Before a vote of no confidence is taken, due effort should be made to address the issue(s) leading to the vote. The right of reply must be given to all parties involved in the procedure. If this effort fails to resolve the issue, the vote may proceed. The vote must be requested on the WG mailing list at least one week in advance of the WG Session at a RIPE meeting and should take place during the WG session. Anyone physically present at the WG session may take part in the vote. The vote should be conducted by secret ballot and votes counted by RIPE NCC Staff and/or WG Chairs of other WGs. The result will be determined by simple majority. If the vote of no confidence in a WG Chair is passed, the seat is vacated and the WG Chair is not eligible for stand for re-selection. ** No Chair: If a working group is left with no Chair, e.g. due to the resignation or removal of the sole WG Chair, then the WG may elect an interim WG Chair according to the selection procedures specified above, but with candidates nominated at the WG session. An interim WG Chair must resign at the next WG session, but may stand for re-selection. ** Staggered Introduction: For the purposes of staggering the introduction of this policy, in the case where all co-Chairs of a WG have served for more than the standard WG Chair term limit, an optional waiver is given to these WGs to allow them to schedule the automatic resignations of their Chairs over the two RIPE meetings immediately following the adoption of this policy. If the WG decides to avail of this waiver, it is the responsibility of the WG to decide in what order its co-Chairs should stand down. ===(cut here)=== -- Dave Wilson, Service Desk Manager web: www.heanet.ie HEAnet Ltd, 5 George's Dock, IFSC, Dublin 1 tel: +353-1-660-9040 Registered in Ireland, no 275301 fax: +353-1-660-3666

5 6

Link to publicly available DNS64/NAT64 implementations
by Jan Zorz 15 May '15

15 May '15

Dear IPv6 WG, As promised during the IPv6 WG meeting at RIPE70, I'm sending the link with information how to test remotely different implementations of NAT64 that we are running in Go6lab: http://go6lab.si/current-ipv6-tests/nat64dns64-public-test/ Ecdysis is the weakest one and somehow a bit buggy, so please use the PAN and C1000 ones, that are dedicated boxes for this test and *will* handle the traffic and translation process ;) Cheers, Jan Zorz

4 3

Fwd: Re: IPv6-only network at RIPE70
by Wilfried Woeber 14 May '15

14 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Forgot to also include the wg mail list. sorry. Here you go, Wilfried. - -------- Forwarded Message -------- Subject: Re: [ipv6-wg] IPv6-only network at RIPE70 Date: Thu, 14 May 2015 11:50:07 +0200 From: Wilfried Woeber <woeber(a)cc.univie.ac.at> To: Jen Linkova <furry13(a)gmail.com> Hi Jen, v6-folks, > General feedback (do you guys see any value in such an experiment, > what was your experience etc) is appreciated. I was on this network while doing stuff after yesterday's key signing party, and it simply works, to fetch keys from servers and to upload. Just a minor thing and not too important for the "masses", but still thumbs-up :-) Wilfried -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVVQcKAAoJEPMGt0I/M2zSbX4P+waEJREbW9GoozrhpZov584V lKG5PKQGDRmLLvroF95Xr/KCKSMVwkOeE1Sizelh6uJXYkbnNpCCMifSg495SQY1 Oug/v0f6trhv03FpmQIKtpy2Jj9A3Vz6SislNbGFuvCB0T6LwV8vH1SKmGUdBeKX UoA8VfymQ6PGTOe2JsbIc6r3mdIhw9vjUeXYvoshEcItYmDYjrkXEELEO+YLpv88 8InaUVtlS1x5GR5M7DTaFhCjBaUPlEt9HXBk0BBg/6E+xXwaOU8JbtKq4yiifRH8 EjIEjsl77NGuhtlVPuUDmdq+pZ+Lgx9Sf1s0w7qOhQPxQI18EvnbqR0gVMZT0XGg PZjMt3W4AhktjXcwnS0bctCC+fdWYDK4YoxxhT9m9use94mj76Qk7BNMqyGKNJgF R9MFwps5pvVzykpoL0kHiIrfeN09EWMzjNTu+N5xUzu5KF4N3W431aYqsg4bFB64 mEbfzXbI7UBx7PYfCoGIvWwX+9Z4SM7MoO+FtZv/Bo/nXBP1X9nml2H3w0xYf7+R 2rOTciNesi9u1Mp0HCh6q0IUrijviw0QgdR7+fHYw7MDSbHmYaCO2ZGGDI8AVKjR aTf6Y6JZTr/WcH+nC18/Ix8gX88p8HfJT2bAsHVvmsAc5kzXxjlbklDFxMjYjV6i TaC7zIrY992Wt5ZXXFJc =FBOo -----END PGP SIGNATURE-----

1 0