- ipv6-wg - mailman.ripe.net

Windows 11 now implements RFC 7217 (stable privacy addresses)!
by Fernando Gont 13 Dec '22

13 Dec '22

Folks, After over 10 (yes, *ten*) years, we have finally addressed security/privacy issues in the generation of IPv6 stable addresses in most popular operating systems. The traditional scheme/algorithm to generate stable IPv6 addresses with SLAAC required that the underlying MAC address be employed to generate the Interface Identifier. That is, the underlying MAC address would be embedded in the lower bits of an IPv6 address. This scheme allowed for host-tracking (since MAC addresses are usually globally-unique), address scanning (since addresses will follow specific patterns) and a number of other issues. In 2011, I submitted an IETF Internet-Draft proposing a scheme for generating stable addresses with SLAAC, meant to replace the traditional scheme. The scheme could be summarized and simplified as: Interface_ID = Hash(Prefix, Secret). Thus, interface identifiers would be stable within the same subnet, but vary across subnets. [Replacing the traditional scheme with this new scheme was anything but easy -- if you're curious, please check the "IPv6 Addressing" section in <https://www.si6networks.com/2020/08/06/a-brief-history-of-recent-advances-i…> ] Over time, popular operating systems and packages adopted the proposed algorithm: the Linux kernel, NetworkManager, OpenBSD's slaacd, MacOS, etc. Eventually, virtually every popular OS had adopted the scheme.... except Windows. Based on a recent note by Brian Carpenter, I ended up testing Windows 11, and I can confirm that it does implement RFC 7217 / RFC 8064! Therefore, e.g. if multiple prefixes are employed on a subnet, the stable addresses for each of such prefixes will employ a different Interface Identifier, thus avoiding the security/privacy issues discussed above -- this is really good news! Unfortunately, Windows still generates temporary addresses with the algorithm specified in RFC 4941, thus resulting in all temporary addresses for a given interface employing the same Interface Identifier (!). This problem has been addressed in RFC 8981... but it's implementation is not yet widespread, yet (it has been incorporated in e.g. the Linux kernel, though). I just hope it doesn't take Windows and others yet another 10+ years to implement RFC 8981, to finally address the remaining security/privacy issues in IPv6 address generation! [Original article with screenshots: https://www.linkedin.com/posts/fernandogont_after-over-10-yes-ten-years-we-… ] Thanks! Regards, -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494

2 1

Minutes from RIPE 85 IPv6 WG
by Raymond Jetten 17 Nov '22

17 Nov '22

Dear list members, here are the draft minutes from RIPE 85 IPv6 wg. Please share your comments or remarks to the list so they can be adjusted. The minutes will otherwise be published in two weeks IPv6 Working Group Minutes - RIPE 85 Wednesday, 26 Oct 2022, 12:00-13:00 (UTC+2) WG co-Chairs: Benedikt Stockebrand, Raymond Jetten Scribe: Oleg Muravskiy Status: Draft Welcome, Etiquette, Approving Minutes, Co-Chair Selection IPv6 Working Group Co-Chairs Raymond reminded participants about the Code of Conduct. The RIPE 84 minutes were approved. Benedict announced that Raymond's term as co-chair had ended, but that he was happy to continue in that role. There were no further nominations or objections, so Raymond was re-appointed as co-chair. Path Tracing Pablo Camarillo, Cisco Systems This presentation is available at: https://ripe85.ripe.net/wp-content/uploads/presentations/76-20221026-RIPE85… Pablo described the recent implementation of an addition to the IPv6 packet header extension that records the path of packets in ECMP networks and presented the use cases that were enabled by this feature. Leandro Bertholdo, University of Twente, asked how this addition was different from the IPv4 registration option. Pablo replied that the main difference in this approach was that they recorded the information at the line speed of the basic packet forwarding pipeline, and used only 3 bytes for each node. Leandro asked the presenter if they recorded an ID of the router that the packet passed. Pablo replied that they recorded a sequence of interface ID. Leandro asked if it was for the input interface or the output. Pablo replied that they recorded an ID of the output interface at each one of the routers Alexander Azimov, Yandex, asked if this would work in the MPLS core. Pablo said that this was possible, but that for the moment it was only implemented for IPv6. Open Source NAT64 Implementations Nico Schottelius, ungleich This presentation is available at: https://ripe85.ripe.net/wp-content/uploads/presentations/74-ripe85-open-sou… Nico showed a comparison of different open source implementations of NAT64, and asked the audience to provide more feedback and point out implementations they missed. Jan Žorž, 6connect, asked Nico if they had tried a VPP implementation as it was very fast. Nico said that he hadn't but that it was nice to know about it. Urban Suhadolnik, University of Ljubljana, asked if the presenter knew of any CLAT implementation, possibly for Windows, as the user-space implementation of CLAT was missing. Nico said that he couldn't answer the question as he was not familiar with this the topic. Deploying IPv6-Mostly Access Networks Ondřej Caletka, RIPE NCC This presentation is available at: https://ripe85.ripe.net/wp-content/uploads/presentations/9-RIPE85-Deploying… Ondřej presented an "IPv6-mostly" network that was implemented at this RIPE Meeting, which combined IPv6 functionality only for devices that supported it, and traditional dual-stack for other devices, all in the same network. Leonard Wagner, IN-Berlin e.V, asked since which Android PREF64, DHCP option 108 and CLAT were supported. Ondřej replied that version 11 and above were supported by the vendor, but that he was not sure about older versions. Michael Richardson, one of the authors of the IPv4-only option, noted that when he developed this feature he never imagined that people would deploy it on DHCP servers and not change anything. He added that it was interesting to see how it worked because they assumed that DHCP servers would not allocate addresses and therefore would not run out of addresses in the pool. So it was cool to see that it just worked without doing that. He further said that for any connect, if the client was v4-only, and was just creating a v4-only UDP encapsulated thing that the local end of course had no idea what to do with, it had to be encapsulated in a v6 packet to send it. He added that he thought CLAT would be of no help but that it might work on Mac OS but not on other systems. He mentioned that IOS would never work until it went to v6 and that the Cisco people should be embarrassed about this. Veronika McKillop, UK IPv6 Council, asked which DHCP servers supported RFC8925. Ondřej replied that this was option 108 and that Kea, at least, did not support it. He added that there were two options. If you have enough addresses for the IPv4 pool, any server that allowed setting a custom option could be used. If there was any special support for this feature, the server would simply respond with option 108 and not allocate an address from the pool. He stated that he was not aware of such an implementation, as even Kea cannot be used in this way. He added that if the pool was empty, it would not even respond and that this was an interesting feature to implement for DHCP server producers. Jordi Palet Martínez, The IPv6 Company, said that it was worth mentioning that most of the CLAT implementations just used a default NAT64 prefix (the WKP). He added that there was only a single translation when using the CLAT and that two translations were only needed if there were no DNS64 (https://datatracker.ietf.org/doc/rfc8683). He said that even if your network was using NAT, NAT64 would also work well. Radek Zajic via Meetecho shared that the CLAT on iOS 16 also worked in apps requiring unix/raw sockets too (e.g. Hurricane Electric Network Tools can ping IPv4-only targets via the CLAT). Ondřej thanked Radek for his comment. Round Up and Thanks IPv6 Working Group Co-Chairs Raymond thanked all participants and the RIPE NCC and closed the session. For Internal Use Only

1 0

SLAAC and Broadcast RA
by Xuo Guoto 02 Nov '22

02 Nov '22

Dear WG, Apologies if this mail is off topic here. I have a question about BCOP-690 wrt SLAAC BCOP-690 says: Using a /64 prefix from a dedicated pool of IPv6 prefixes is the most common scenario and currently the best practice. A separate block of IPv6 space is allocated for the WAN links to the end customer CPEs, so that when CPE connects to the network and performs router discovery, a /64 prefix is used to number both ends of the connection. My understanding of this recommendation is that in an ISP scenario, each RG will be assigned a seperate /64 prefix for CPE WAN. The ISP BRAS or BNG is also expected to send periodic multicast RA. My question is how a multicast RA can be sent to a VLAN, in which each RG is expected to have a different /64 prefix? R-43 of TR-177 says: The BNG MUST be configurable to send multicast RA messages that do not contain a Prefix Information Option (PIO), in order to advertise the default router address. R-44 says: The BNG SHOULD support sending periodic and solicited multicast RA messages having the unicast MAC address of the RG or of the hosts behind a bridged RG (see RFC 6085 [26]). Reading these two together, is it correct to say that BNG should be sending out periodic multicast RA without PIO, but RA with PIO should be sent only as a reply to an RS message from RG, with multicast IPv6 destination address but with unicast link-layer address of RG. Thanks and Regards, X.

1 0

IPv6 for Dutch email servers
by Michael Richardson 28 Oct '22

28 Oct '22

A few years ago there was a presentation about getting IPv6 MX setup for various Dutch entities: Municipalities, Hospitals, etc. I couldn't find this in the agendas for the past ten RIPE meetings for IPv6. Maybe it was in a plenary. I think it was pre-pandemic. I wondered (I am suggesting) that maybe an update on this effort would be timely? -- Michael Richardson <mcr+IETF(a)sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =-

5 6

APNIC IPv6 alias?
by Vasilenko Eduard 18 Oct '22

18 Oct '22

Hi all, Does APNIC has similar alias? (related to IPv6). Thanks. Ed/

1 0

web services to ipv6
by Gery Escalier 14 Oct '22

14 Oct '22

Hello everyone on the list! this is my first post, sorry if this is not the right place for my question. I currently reside in Spain, which most ISPs do not assign ipv6 to end users and with a penetration of 3% *1 I think that percentage has not changed much since 2021, it only remains to say, incredible! Previously I have used Hurricane Electric *2 when I lived in Bolivia, South America only to browse ipv6 sites. I have seen the website august.tw *3 "This is a non-profit project for learning, education and research.Our goal is to support the ever-growing internet community that wants to experiment and gain hands-on experience with the real world BGP. We provide the following services. " I am interested for personal use. -Free IPv4/IPv6 BGP tunnel-Public NAT64 server available at 2602:fc23:18::7-Public Teredo server available at teredo.august.tw Is this website known by the community?Or have any of the community users used these services?These services can be recommended for personal use? Data, I was struck by the logo shown at the bottom with a link to RIPE NCC and ARIN. I appreciate any help in this regard, thank you very much, best regards! *1 https://labs.ripe.net/documents/176/Mediterranean_country_report_Spanish_fi… *2 https://tunnelbroker.net/*3 https://august.tw/ Gery

2 1

WG co-chair selection RIPE 85
by Raymond Jetten 19 Sep '22

19 Sep '22

Dear members of the IPv6 WG list. According to our WG webpages https://www.ripe.net/participate/ripe/wg/active-wg/ipv6 it is my turn to step down as a co-chair. In a little over a month at the RIPE 85 meeting the selection will take place during the IPv6 WG session. Here is the official process: https://www.ripe.net/participate/ripe/wg/active-wg/ipv6/ipv6-wg-chair-selec… As part of the process this is a call for candidates, however I am more than happy to continue, and step up for the next term. I will open the call as from now, and the call will be closed on 30.9.2022 at 12:00 CET (Amsterdam time). If you have any questions, we , the co-chairs, will be very happy to answer them, either on the list ipv6-wg(a)ripe.net<mailto:ipv6-wg@ripe.net> or directly to us ipv6-wg-chair(a)ripe.net<mailto:ipv6-wg-chair@ripe.net>. Rgds, Raymond Jetten Raymond Jetten Senior Technology Specialist Production Cloud Services, Networks and connectivity Interconnectivity & Content Elisa Oyj Vuolteenkatu 2 33100 Tampere +358 45 6700 139 raymond.jetten(a)elisa.fi<mailto:raymond.jetten@elisa.fi> www.elisa.fi<http://www.elisa.fi/> Lisätietoa henkilötietojen käsittelystä ja tietosuojasta Elisalla https://elisa.fi/tietosuoja Mer information om Elisas hantering av personuppgifter och dataskydd https://elisa.fi/tietosuoja More information on personal data management and data protection at Elisa https://elisa.com/dataprotection ********************************************************************************************* For Internal Use Only

1 0

Mitigating the effects of SLAAC renumbering events (draft-ietf-6man-slaac-renum)
by Fernando Gont 31 Aug '22

31 Aug '22

Folks, We have been discussing the potential problems associated with SLAAC renumbering events for a while now -- one of the most common cases being ISPs rotating home prefixes, and your devices ending up with stale/invalid addresses. We have done quite a bit of work already: * Problem statement: https://datatracker.ietf.org/doc/html/rfc8978 * CPE recommendations: https://datatracker.ietf.org/doc/html/rfc9096 But there's still some work to do to address this issue: The last remaining it is to improve SLAAC such that hosts can more gracefully deal with this renumbering events. In that light, IETF's 6man has been working on this document: https://www.ietf.org/archive/id/draft-ietf-6man-slaac-renum-04.txt And we have proposed a simple algorithm for SLAAC (an extension, if you wish) that can easily help, as follows: If you (host) receive an RA that contains options, but not all of the previously-received options/information, simply send a unicast RS to the local-router, to verify/refresh that such missing information is still valid. If the information is stale, get rid of it. I presented this algorithm at the last IETF meeting (https://youtu.be/eKEizC8xhhM?t=1308). (You may find the slides here: https://datatracker.ietf.org/meeting/114/materials/slides-114-6man-improvin…) Finally, I've sent draft text for the specification of the algorithm here: https://mailarchive.ietf.org/arch/msg/ipv6/KD_Vpqg0NmkVXOQntVTOMlWHWwA/ We would be super thankful if you could take a look at the draft text (i.e., https://mailarchive.ietf.org/arch/msg/ipv6/KD_Vpqg0NmkVXOQntVTOMlWHWwA/) and provide feedback/comments. If you can post/comment on the 6man wg mailing list (https://www.ietf.org/mailman/listinfo/ipv6), that´d be fabulous. But we'll appreciate your feedback off-line, on this list, etc. (that'd still be great ;-) ) Thanks in advance! Regards, -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494

2 1

Fwd: RFC 9288 on Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers
by Fernando Gont 19 Aug '22

19 Aug '22

Hi, FYI. RFC 9288, "Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers" (available at: https://www.rfc-editor.org/rfc/rfc9288) FWIW, IMO most of the value is in the analysis of what protocols/features use what EHs, and what would break (if anything) if packets with EHs are dropped. These other two are useful for context: * RFC 9098, "Operational Implications of IPv6 Packets with Extension Headers" (https://www.rfc-editor.org/rfc/rfc9098.html) * RFC 7872, "Observations on the Dropping of Packets with IPv6 Extension Headers in the Real World (https://www.rfc-editor.org/rfc/rfc7872.html). Thanks! Cheers, Fernando -------- Forwarded Message -------- Subject: RFC 9288 on Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers Date: Thu, 18 Aug 2022 16:21:47 -0700 (PDT) From: rfc-editor(a)rfc-editor.org To: ietf-announce(a)ietf.org, rfc-dist(a)rfc-editor.org CC: rfc-editor(a)rfc-editor.org, drafts-update-ref(a)iana.org, opsec(a)ietf.org A new Request for Comments is now available in online RFC libraries. RFC 9288 Title: Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers Author: F. Gont, W. Liu Status: Informational Stream: IETF Date: August 2022 Mailbox: fgont(a)si6networks.com, liushucheng(a)huawei.com Pages: 33 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-opsec-ipv6-eh-filtering-10.txt URL: https://www.rfc-editor.org/info/rfc9288 DOI: 10.17487/RFC9288 This document analyzes the security implications of IPv6 Extension Headers and associated IPv6 options. Additionally, it discusses the operational and interoperability implications of discarding packets based on the IPv6 Extension Headers and IPv6 options they contain. Finally, it provides advice on the filtering of such IPv6 packets at transit routers for traffic not directed to them, for those cases where such filtering is deemed as necessary. This document is a product of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor(a)rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC _______________________________________________ IETF-Announce mailing list IETF-Announce(a)ietf.org https://www.ietf.org/mailman/listinfo/ietf-announce

2 1

New on RIPE Labs: Deploying IPv6-Mostly Access Networks
by Anastasiya Pak 02 Aug '22

02 Aug '22

Dear colleagues, Dual stack is the most common way of deploying IPv6 in access networks. A recent standard defines IPv6-mostly access networks, providing IPv4 connectivity only for legacy devices while allowing modern devices to run IPv6-only. My colleague Ondřej Caletka explored the deployment of IPv6-Mostly Access Networks. Read his article on RIPE Labs: https://labs.ripe.net/author/ondrej_caletka_1/deploying-ipv6-mostly-access-… Best regards, Anastasiya Pak Marketing & Communications Officer RIPE NCC

1 0