idnits 2.17.00 (12 Aug 2021) /tmp/idnits59403/draft-ietf-v6ops-ipv6-ehs-packet-drops-00.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (July 31, 2020) is 659 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- ** Obsolete normative reference: RFC 2460 (Obsoleted by RFC 8200) == Outdated reference: draft-ietf-intarea-frag-fragile has been published as RFC 8900 == Outdated reference: A later version (-10) exists of draft-ietf-opsec-ipv6-eh-filtering-06 -- Obsolete informational reference (is this intentional?): RFC 5575 (Obsoleted by RFC 8955) Summary: 1 error (**), 0 flaws (~~), 3 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 IPv6 Operations Working Group (v6ops) F. Gont 3 Internet-Draft SI6 Networks 4 Intended status: Informational N. Hilliard 5 Expires: February 1, 2021 INEX 6 G. Doering 7 SpaceNet AG 8 W. Kumari 9 Google 10 G. Huston 11 APNIC 12 W. Liu 13 Huawei Technologies 14 July 31, 2020 16 Operational Implications of IPv6 Packets with Extension Headers 17 draft-ietf-v6ops-ipv6-ehs-packet-drops-00 19 Abstract 21 This document summarizes the operational implications of IPv6 22 extension headers, and attempts to analyze reasons why packets with 23 IPv6 extension headers may be dropped in the public Internet. 25 Status of This Memo 27 This Internet-Draft is submitted in full conformance with the 28 provisions of BCP 78 and BCP 79. 30 Internet-Drafts are working documents of the Internet Engineering 31 Task Force (IETF). Note that other groups may also distribute 32 working documents as Internet-Drafts. The list of current Internet- 33 Drafts is at https://datatracker.ietf.org/drafts/current/. 35 Internet-Drafts are draft documents valid for a maximum of six months 36 and may be updated, replaced, or obsoleted by other documents at any 37 time. It is inappropriate to use Internet-Drafts as reference 38 material or to cite them other than as "work in progress." 40 This Internet-Draft will expire on February 1, 2021. 42 Copyright Notice 44 Copyright (c) 2020 IETF Trust and the persons identified as the 45 document authors. All rights reserved. 47 This document is subject to BCP 78 and the IETF Trust's Legal 48 Provisions Relating to IETF Documents 49 (https://trustee.ietf.org/license-info) in effect on the date of 50 publication of this document. Please review these documents 51 carefully, as they describe your rights and restrictions with respect 52 to this document. Code Components extracted from this document must 53 include Simplified BSD License text as described in Section 4.e of 54 the Trust Legal Provisions and are provided without warranty as 55 described in the Simplified BSD License. 57 Table of Contents 59 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 60 2. Disclaimer . . . . . . . . . . . . . . . . . . . . . . . . . 3 61 3. Previous Work on IPv6 Extension Headers . . . . . . . . . . . 3 62 4. Packet Forwarding Engine Constraints . . . . . . . . . . . . 5 63 5. Requirement to Process Layer-3/layer-4 information in 64 Intermediate Systems . . . . . . . . . . . . . . . . . . . . 6 65 5.1. ECMP and Hash-based Load-Sharing . . . . . . . . . . . . 6 66 5.2. Enforcing infrastructure ACLs . . . . . . . . . . . . . . 7 67 5.3. DDoS Management and Customer Requests for Filtering . . . 7 68 6. Operational Implications . . . . . . . . . . . . . . . . . . 8 69 6.1. Inability to Find Layer-4 Information . . . . . . . . . . 8 70 6.2. Route-Processor Protection . . . . . . . . . . . . . . . 8 71 6.3. Inability to Perform Fine-grained Filtering . . . . . . . 8 72 6.4. Security Concerns Associated with IPv6 Extension Headers 8 73 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 74 8. Security Considerations . . . . . . . . . . . . . . . . . . . 10 75 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10 76 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 10 77 10.1. Normative References . . . . . . . . . . . . . . . . . . 10 78 10.2. Informative References . . . . . . . . . . . . . . . . . 11 79 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 15 81 1. Introduction 83 IPv6 Extension Headers (EHs) allow for the extension of the IPv6 84 protocol, and provide support for core functionality such as IPv6 85 fragmentation. However, common implementation limitations suggest 86 that EHs present a challenge for IPv6 packet routing equipment and 87 middle-boxes, and evidence exists that IPv6 packets with EHs may be 88 intentionally dropped in the public Internet in some network 89 deployments. 91 The authors of this document have been involved in numerous 92 discussions about IPv6 extension headers (both within the IETF and in 93 other fora), and have noticed that the security and operational 94 implications associated with IPv6 EHs were unknown to the larger 95 audience participating in these discussions. 97 This document has the following goals: 99 o Raise awareness about the operational and security implications of 100 IPv6 Extension Headers, and presents reasons why some networks may 101 intentionally drop packets containing IPv6 Extension Headers. 103 o Highlight areas where current IPv6 support by networking devices 104 maybe sub-optimal, such that the aforementioned support is 105 improved. 107 o Highlight operational issues associated with IPv6 extension 108 headers, such that those issues are considered in IETF 109 standardization efforts. 111 Section 3 of this document summarizes the previous work that has been 112 carried out in the area of IPv6 extension headers. Section 4 113 discuses packet forwarding engine constraints in modern routers. 114 Section 5 discusses why modern routers and middle-boxes may need to 115 access Layer-4 information to make a forwarding decision. Finally, 116 Section 6 discusses the operational implications of IPv6 EHs. 118 2. Disclaimer 120 This document analyzes the operational challenges represented by 121 packets that employ IPv6 Extension Headers, and documents some of the 122 operational reasons for which these packets may be dropped in the 123 public Internet. This document IS NOT a recommendation to drop such 124 packets, but rather an analysis of why they are dropped. 126 3. Previous Work on IPv6 Extension Headers 128 Some of the operational implications of IPv6 Extension Headers have 129 been discussed in IETF circles: 131 o [I-D.taylor-v6ops-fragdrop] discusses a rationale for which 132 operators drop IPv6 fragments. 134 o [I-D.wkumari-long-headers] discusses possible issues arising from 135 "long" IPv6 header chains. 137 o [I-D.kampanakis-6man-ipv6-eh-parsing] describes how 138 inconsistencies in the way IPv6 packets with extension headers are 139 parsed by different implementations may result in evasion of 140 security controls, and presents guidelines for parsing IPv6 141 extension headers with the goal of providing a common and 142 consistent parsing methodology for IPv6 implementations. 144 o [I-D.ietf-opsec-ipv6-eh-filtering] analyzes the security 145 implications of IPv6 EHs, and the operational implications of 146 dropping packets that employ IPv6 EHs and associated options. 148 o [RFC7113] discusses how some popular RA-Guard implementations are 149 subject to evasion by means of IPv6 extension headers. 151 o [I-D.ietf-intarea-frag-fragile] analyzes the fragility introduced 152 by IP fragmentation. 154 A number of recent RFCs have discussed issues related to IPv6 155 extension headers, specifying updates to a previous revision of the 156 IPv6 standard ([RFC2460]), many of which have now been incorporated 157 into the current IPv6 core standard ([RFC8200]) or the IPv6 Node 158 Requirements ([RFC8504]). Namely, 160 o [RFC5095] discusses the security implications of Routing Header 161 Type 0 (RTH0), and deprecates it. 163 o [RFC5722] analyzes the security implications of overlapping 164 fragments, and provides recommendations in this area. 166 o [RFC7045] clarifies how intermediate nodes should deal with IPv6 167 extension headers. 169 o [RFC7112] discusses the issues arising in a specific fragmentation 170 case where the IPv6 header chain is fragmented into two or more 171 fragments (and formally forbids such fragmentation case). 173 o [RFC6946] discusses a flawed (but common) processing of the so- 174 called IPv6 "atomic fragments", and specified improved processing 175 of such packets. 177 o [RFC8021] deprecates the generation of IPv6 atomic fragments. 179 o [RFC8504] clarifies processing rules for packets with extension 180 headers, and also allows hosts to enforce limits on the number of 181 options included in IPv6 EHs. 183 o [RFC7739] discusses the security implications of predictable 184 fragment Identification values, and provides recommendations for 185 the generation of these values. 187 o [RFC6980] analyzes the security implications of employing IPv6 188 fragmentation with Neighbor Discovery for IPv6, and formally 189 recommends against such usage. 191 Additionally, [RFC8200] has relaxed the requirement that "all nodes 192 examine and process the Hop-by-Hop Options header" from [RFC2460], by 193 specifying that only to nodes that have been explicitly configured to 194 process the Hop-by-Hop Options header are required to do so. 196 A number of studies have measured the extent to which packets 197 employing IPv6 extension headers are dropped in the public Internet: 199 o [PMTUD-Blackholes], [Gont-IEPG88], [Gont-Chown-IEPG89], and 200 [Linkova-Gont-IEPG90] presented some preliminary measurements 201 regarding the extent to which packet containing IPv6 EHs are 202 dropped in the public Internet. 204 o [RFC7872] presents more comprehensive results and documents the 205 methodology for obtaining the presented results. 207 o [Huston-2017] and [Huston-2020] measured packet drops resulting 208 from IPv6 fragmentation when communicating with DNS servers. 210 4. Packet Forwarding Engine Constraints 212 Most modern routers use dedicated hardware (e.g. ASICs or NPUs) to 213 determine how to forward packets across their internal fabrics (see 214 [IEPG94-Scudder] and [APNIC-Scudder] for details). One of the common 215 methods of handling next-hop lookup is to send a small portion of the 216 ingress packet to a lookup engine with specialised hardware (e.g. 217 ternary CAM or RLDRAM) to determine the packet's next-hop. Technical 218 constraints mean that there is a trade-off between the amount of data 219 sent to the lookup engine and the overall performance of the lookup 220 engine. If more data is sent, the lookup engine can inspect further 221 into the packet, but the overall performance of the system will be 222 reduced. If less data is sent, the overall performance of the router 223 will be increased but the packet lookup engine may not be able to 224 inspect far enough into a packet to determine how it should be 225 handled. 227 NOTE: 228 For example, current high-end routers can use up to 192 bytes of 229 header (Cisco ASR9000 Typhoon) or 384 bytes of header (Juniper MX 230 Trio). 232 If a hardware forwarding engine on a modern router cannot make a 233 forwarding decision about a packet because critical information is 234 not sent to the look-up engine, then the router will normally drop 235 the packet. 237 NOTE: 239 Section 5 discusses some of the reasons for which a modern router 240 might need to access layer-4 information to make a forwarding 241 decision. 243 Historically, some packet forwarding engines punted packets of this 244 form to the control plane for more in-depth analysis, but this is 245 unfeasible on most current router architectures as a result of the 246 vast difference between the hardware forwarding capacity of the 247 router and processing capacity of the control plane and the size of 248 the management link which connects the control plane to the 249 forwarding plane. 251 If an IPv6 header chain is sufficiently long that its header exceeds 252 the packet look-up capacity of the router, then it may be dropped due 253 to hardware inability to determine how it should be handled. 255 5. Requirement to Process Layer-3/layer-4 information in Intermediate 256 Systems 258 The following subsections discuss some of reasons for which modern 259 routers and middle-boxes may need to process Layer-3/layer-4 260 information to make a forwarding decision. 262 5.1. ECMP and Hash-based Load-Sharing 264 In the case of ECMP (equal cost multi path) load sharing, the router 265 on the sending side of the link needs to make a decision regarding 266 which of the links to use for a given packet. Since round-robin 267 usage of the links is usually avoided in order to prevent packet 268 reordering, forwarding engines need to use a mechanism which will 269 consistently forward the same data streams down the same forwarding 270 paths. Most forwarding engines achieve this by calculating a simple 271 hash using an n-tuple gleaned from a combination of layer-2 through 272 to layer-4 packet header information. This n-tuple will typically 273 use the src/dst MAC address, src/dst IP address, and if possible 274 further layer-4 src/dst port information. As layer-4 port 275 information increases the entropy of the hash, it is normally highly 276 desirable to use it where possible. 278 We note that in the IPv6 world, flows are expected to be identified 279 by means of the IPv6 Flow Label [RFC6437]. Thus, ECMP and Hash-based 280 Load-Sharing would be possible without the need to process the entire 281 IPv6 header chain to obtain upper-layer information to identify 282 flows. However, we note that for a long time many IPv6 283 implementations failed to set the Flow Label, and ECMP and Hash-based 284 Load-Sharing devices also did not employ the Flow Label for 285 performing their task. 287 Clearly, widespread support of [RFC6437] would relieve middle-boxes 288 from having to process the entire IPv6 header chain, making Flow 289 Label-based ECMP and Hash-based Load-Sharing [RFC6438] feasible. 291 While support of [RFC6437] is currently widespread for current 292 versions of all popular host implementations, there is still only 293 marginal usage of the IPv6 Flow Label for ECMP and load balancing 294 [Cunha-2020] -- possibly as a result of issues that have been found 295 in host implementations and middle-boxes [Jaeggli-2018]. 297 5.2. Enforcing infrastructure ACLs 299 Generally speaking, infrastructure ACLs (iACLs) drop unwanted packets 300 destined to parts of a provider's infrastructure, because they are 301 not operationally needed and can be used for attacks of different 302 sorts against the router's control plane. Some traffic needs to be 303 differentiated depending on layer-3 or layer-4 criteria to achieve a 304 useful balance of protection and functionality, for example: 306 o Permit some amount of ICMP echo (ping) traffic towards the 307 router's addresses for troubleshooting. 309 o Permit BGP sessions on the shared network of an exchange point 310 (potentially differentiating between the amount of packets/seconds 311 permitted for established sessions and connection establishment), 312 but do not permit other traffic from the same peer IP addresses. 314 5.3. DDoS Management and Customer Requests for Filtering 316 The case of customer DDoS protection and edge-to-core customer 317 protection filters is similar in nature to the infrastructure ACL 318 protection. Similar to infrastructure ACL protection, layer-4 ACLs 319 generally need to be applied as close to the edge of the network as 320 possible, even though the intent is usually to protect the customer 321 edge rather than the provider core. Application of layer-4 DDoS 322 protection to a network edge is often automated using Flowspec 323 [RFC5575]. 325 For example, a web site which normally only handled traffic on TCP 326 ports 80 and 443 could be subject to a volumetric DDoS attack using 327 NTP and DNS packets with randomised source IP address, thereby 328 rendering traditional [RFC5635] source-based real-time black hole 329 mechanisms useless. In this situation, DDoS protection ACLs could be 330 configured to block all UDP traffic at the network edge without 331 impairing the web server functionality in any way. Thus, being able 332 to block arbitrary protocols at the network edge can avoid DDoS- 333 related problems both in the provider network and on the customer 334 edge link. 336 6. Operational Implications 338 6.1. Inability to Find Layer-4 Information 340 As discussed in Section 5, modern routers and middle-boxes that need 341 to find the layer-4 header must process the entire IPv6 extension 342 header chain. When such devices are unable to obtain the required 343 information, they may simply resort to dropping the corresponding 344 packets. 346 6.2. Route-Processor Protection 348 Most modern routers have a fast hardware-assisted forwarding plane 349 and a loosely coupled control plane, connected together with a link 350 that has much less capacity than the forwarding plane could handle. 351 Traffic differentiation cannot be done by the control plane side, 352 because this would overload the internal link connecting the 353 forwarding plane to the control plane. 355 The Hop-by-Hop Options header has been particularly challenging 356 since, in most (if not all) implementations, it has typically caused 357 the corresponding packet to be punted to a software path. As a 358 result, operators usually drop IPv6 packets containing this extension 359 header. Please see [RFC6192] for advice regarding protection of the 360 router control plane. 362 6.3. Inability to Perform Fine-grained Filtering 364 Some router implementations lack fine-grained filtering of IPv6 365 extension headers. For example, an operator may want to drop packets 366 containing Routing Header Type 0 (RHT0) but may only be able to 367 filter on the extension header type (Routing Header). As a result, 368 the operator may end up enforcing a more coarse filtering policy 369 (e.g. "drop all packets containing a Routing Header" vs. "only drop 370 packets that contain a Routing Header Type 0"). 372 6.4. Security Concerns Associated with IPv6 Extension Headers 374 The security implications of IPv6 Extension Headers generally fall 375 into one or more of these categories: 377 o Evasion of security controls 379 o DoS due to processing requirements 381 o DoS due to implementation errors 383 o Extension Header-specific issues 384 Unlike IPv4 packets where the upper-layer protocol can be trivially 385 found by means of the "IHL" ("Internet Header Length") IPv4 header 386 field, the structure of IPv6 packets is more flexible and complex, 387 and may represent a challenge for devices that need to find this 388 information, since locating upper-layer protocol information requires 389 that all IPv6 extension headers be examined. This has presented 390 implementation difficulties, and packet filtering mechanisms that 391 require upper-layer information (even if just the upper layer 392 protocol type) have been found to be trivially evasible by inserting 393 IPv6 Extension Headers between the main IPv6 header and the upper 394 layer protocol. [RFC7113] describes this issue for the RA-Guard 395 case, but the same techniques can be employed to circumvent other 396 IPv6 firewall and packet filtering mechanisms. Additionally, 397 implementation inconsistencies in packet forwarding engines may 398 result in evasion of security controls 399 [I-D.kampanakis-6man-ipv6-eh-parsing] [Atlasis2014] [BH-EU-2014]. 401 Packets that use IPv6 Extension Headers may have a negative 402 performance impact on the handling devices. Unless appropriate 403 mitigations are put in place (e.g., packet dropping and/or rate- 404 limiting), an attacker could simply send a large amount of IPv6 405 traffic employing IPv6 Extension Headers with the purpose of 406 performing a Denial of Service (DoS) attack (see Section 6 for 407 further details). 409 NOTE: 410 In the most trivial case, a packet that includes a Hop-by-Hop 411 Options header might go through the slow forwarding path, and be 412 processed by the router's CPU. Another possible case might be 413 that in which a router that has been configured to enforce an ACL 414 based on upper-layer information (e.g., upper layer protocol or 415 TCP Destination Port), needs to process the entire IPv6 header 416 chain (in order to find the required information), causing the 417 packet to be processed in the slow path [Cisco-EH-Cons]. We note 418 that, for obvious reasons, the aforementioned performance issues 419 may affect other devices such as firewalls, Network Intrusion 420 Detection Systems (NIDS), etc. [Zack-FW-Benchmark]. The extent 421 to which these devices are affected is typically implementation- 422 dependent. 424 IPv6 implementations, like all other software, tend to mature with 425 time and wide-scale deployment. While the IPv6 protocol itself has 426 existed for over 20 years, serious bugs related to IPv6 Extension 427 Header processing continue to be discovered. Because there is 428 currently little operational reliance on IPv6 Extension headers, the 429 corresponding code paths are rarely exercised, and there is the 430 potential for bugs that still remain to be discovered in some 431 implementations. 433 IPv6 Fragment Headers are employed to allow fragmentation of IPv6 434 packets. While many of the security implications of the 435 fragmentation / reassembly mechanism are known from the IPv4 world, 436 several related issues have crept into IPv6 implementations. These 437 range from denial of service attacks to information leakage, as 438 discussed in [RFC7739], [Bonica-NANOG58] and [Atlasis2012]). 440 7. IANA Considerations 442 There are no IANA registries within this document. The RFC-Editor 443 can remove this section before publication of this document as an 444 RFC. 446 8. Security Considerations 448 The security implications of IPv6 extension headers are discussed in 449 Section 6.4. This document does not introduce any new security 450 issues. 452 9. Acknowledgements 454 The authors would like to thank (in alphabetical order) Mikael 455 Abrahamsson, Fred Baker, Brian Carpenter, Tim Chown, Owen DeLong, Tom 456 Herbert, Lee Howard, Sander Steffann, Eduard Vasilenko, Eric Vyncke, 457 Jingrong Xie, and Andrew Yourtchenko, for providing valuable comments 458 on earlier versions of this document. 460 Fernando Gont would like to thank Jan Zorz / Go6 Lab 461 , Jared Mauch, and Sander Steffann 462 , for providing access to systems and networks 463 that were employed to perform experiments and measurements involving 464 packets with IPv6 Extension Headers. 466 10. References 468 10.1. Normative References 470 [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 471 (IPv6) Specification", RFC 2460, DOI 10.17487/RFC2460, 472 December 1998, . 474 [RFC5095] Abley, J., Savola, P., and G. Neville-Neil, "Deprecation 475 of Type 0 Routing Headers in IPv6", RFC 5095, 476 DOI 10.17487/RFC5095, December 2007, 477 . 479 [RFC5722] Krishnan, S., "Handling of Overlapping IPv6 Fragments", 480 RFC 5722, DOI 10.17487/RFC5722, December 2009, 481 . 483 [RFC6946] Gont, F., "Processing of IPv6 "Atomic" Fragments", 484 RFC 6946, DOI 10.17487/RFC6946, May 2013, 485 . 487 [RFC6980] Gont, F., "Security Implications of IPv6 Fragmentation 488 with IPv6 Neighbor Discovery", RFC 6980, 489 DOI 10.17487/RFC6980, August 2013, 490 . 492 [RFC7112] Gont, F., Manral, V., and R. Bonica, "Implications of 493 Oversized IPv6 Header Chains", RFC 7112, 494 DOI 10.17487/RFC7112, January 2014, 495 . 497 [RFC8021] Gont, F., Liu, W., and T. Anderson, "Generation of IPv6 498 Atomic Fragments Considered Harmful", RFC 8021, 499 DOI 10.17487/RFC8021, January 2017, 500 . 502 [RFC8200] Deering, S. and R. Hinden, "Internet Protocol, Version 6 503 (IPv6) Specification", STD 86, RFC 8200, 504 DOI 10.17487/RFC8200, July 2017, 505 . 507 [RFC8504] Chown, T., Loughney, J., and T. Winters, "IPv6 Node 508 Requirements", BCP 220, RFC 8504, DOI 10.17487/RFC8504, 509 January 2019, . 511 10.2. Informative References 513 [APNIC-Scudder] 514 Scudder, J., "Modern router architecture and IPv6", APNIC 515 Blog, June 4, 2020, . 518 [Atlasis2012] 519 Atlasis, A., "Attacking IPv6 Implementation Using 520 Fragmentation", BlackHat Europe 2012. Amsterdam, 521 Netherlands. March 14-16, 2012, 522 . 525 [Atlasis2014] 526 Atlasis, A., "A Novel Way of Abusing IPv6 Extension 527 Headers to Evade IPv6 Security Devices", May 2014, 528 . 531 [BH-EU-2014] 532 Atlasis, A., Rey, E., and R. Schaefer, "Evasion of High- 533 End IDPS Devices at the IPv6 Era", BlackHat Europe 2014, 534 2014, . 537 [Bonica-NANOG58] 538 Bonica, R., "IPv6 Extension Headers in the Real World 539 v2.0", NANOG 58. New Orleans, Louisiana, USA. June 3-5, 540 2013, . 543 [Cisco-EH-Cons] 544 Cisco, "IPv6 Extension Headers Review and Considerations", 545 October 2006, 546 . 549 [Cunha-2020] 550 Cunha, I., "IPv4 vs IPv6 load balancing in Internet 551 routes", NPS/CAIDA 2020 Virtual IPv6 Workshop, 2020, 552 . 555 [Gont-Chown-IEPG89] 556 Gont, F. and T. Chown, "A Small Update on the Use of IPv6 557 Extension Headers", IEPG 89. London, UK. March 2, 2014, 558 . 561 [Gont-IEPG88] 562 Gont, F., "Fragmentation and Extension header Support in 563 the IPv6 Internet", IEPG 88. Vancouver, BC, Canada. 564 November 13, 2013, . 567 [Huston-2017] 568 Huston, G., "Dealing with IPv6 fragmentation in the 569 DNS", APNIC Blog, 2017, 570 . 573 [Huston-2020] 574 Huston, G., "Measurement of IPv6 Extension Header 575 Support", NPS/CAIDA 2020 Virtual IPv6 Workshop, 2020, 576 . 579 [I-D.ietf-intarea-frag-fragile] 580 Bonica, R., Baker, F., Huston, G., Hinden, R., Troan, O., 581 and F. Gont, "IP Fragmentation Considered Fragile", draft- 582 ietf-intarea-frag-fragile-17 (work in progress), September 583 2019. 585 [I-D.ietf-opsec-ipv6-eh-filtering] 586 Gont, F. and W. LIU, "Recommendations on the Filtering of 587 IPv6 Packets Containing IPv6 Extension Headers", draft- 588 ietf-opsec-ipv6-eh-filtering-06 (work in progress), July 589 2018. 591 [I-D.kampanakis-6man-ipv6-eh-parsing] 592 Kampanakis, P., "Implementation Guidelines for parsing 593 IPv6 Extension Headers", draft-kampanakis-6man-ipv6-eh- 594 parsing-01 (work in progress), August 2014. 596 [I-D.taylor-v6ops-fragdrop] 597 Jaeggli, J., Colitti, L., Kumari, W., Vyncke, E., Kaeo, 598 M., and T. Taylor, "Why Operators Filter Fragments and 599 What It Implies", draft-taylor-v6ops-fragdrop-02 (work in 600 progress), December 2013. 602 [I-D.wkumari-long-headers] 603 Kumari, W., Jaeggli, J., Bonica, R., and J. Linkova, 604 "Operational Issues Associated With Long IPv6 Header 605 Chains", draft-wkumari-long-headers-03 (work in progress), 606 June 2015. 608 [IEPG94-Scudder] 609 Petersen, B. and J. Scudder, "Modern Router Architecture 610 for Protocol Designers", IEPG 94. Yokohama, Japan. 611 November 1, 2015, . 614 [Jaeggli-2018] 615 Jaeggli, G., "Dealing with IPv6 fragmentation in the 616 DNS", APNIC Blog, 2018, 617 . 620 [Linkova-Gont-IEPG90] 621 Linkova, J. and F. Gont, "IPv6 Extension Headers in the 622 Real World v2.0", IEPG 90. Toronto, ON, Canada. July 20, 623 2014, . 626 [PMTUD-Blackholes] 627 De Boer, M. and J. Bosma, "Discovering Path MTU black 628 holes on the Internet using RIPE Atlas", July 2012, 629 . 632 [RFC5575] Marques, P., Sheth, N., Raszuk, R., Greene, B., Mauch, J., 633 and D. McPherson, "Dissemination of Flow Specification 634 Rules", RFC 5575, DOI 10.17487/RFC5575, August 2009, 635 . 637 [RFC5635] Kumari, W. and D. McPherson, "Remote Triggered Black Hole 638 Filtering with Unicast Reverse Path Forwarding (uRPF)", 639 RFC 5635, DOI 10.17487/RFC5635, August 2009, 640 . 642 [RFC6192] Dugal, D., Pignataro, C., and R. Dunn, "Protecting the 643 Router Control Plane", RFC 6192, DOI 10.17487/RFC6192, 644 March 2011, . 646 [RFC6437] Amante, S., Carpenter, B., Jiang, S., and J. Rajahalme, 647 "IPv6 Flow Label Specification", RFC 6437, 648 DOI 10.17487/RFC6437, November 2011, 649 . 651 [RFC6438] Carpenter, B. and S. Amante, "Using the IPv6 Flow Label 652 for Equal Cost Multipath Routing and Link Aggregation in 653 Tunnels", RFC 6438, DOI 10.17487/RFC6438, November 2011, 654 . 656 [RFC7045] Carpenter, B. and S. Jiang, "Transmission and Processing 657 of IPv6 Extension Headers", RFC 7045, 658 DOI 10.17487/RFC7045, December 2013, 659 . 661 [RFC7113] Gont, F., "Implementation Advice for IPv6 Router 662 Advertisement Guard (RA-Guard)", RFC 7113, 663 DOI 10.17487/RFC7113, February 2014, 664 . 666 [RFC7739] Gont, F., "Security Implications of Predictable Fragment 667 Identification Values", RFC 7739, DOI 10.17487/RFC7739, 668 February 2016, . 670 [RFC7872] Gont, F., Linkova, J., Chown, T., and W. Liu, 671 "Observations on the Dropping of Packets with IPv6 672 Extension Headers in the Real World", RFC 7872, 673 DOI 10.17487/RFC7872, June 2016, 674 . 676 [Zack-FW-Benchmark] 677 Zack, E., "Firewall Security Assessment and Benchmarking 678 IPv6 Firewall Load Tests", IPv6 Hackers Meeting #1, 679 Berlin, Germany. June 30, 2013, 680 . 684 Authors' Addresses 686 Fernando Gont 687 SI6 Networks 688 Segurola y Habana 4310, 7mo Piso 689 Villa Devoto, Ciudad Autonoma de Buenos Aires 690 Argentina 692 Email: fgont@si6networks.com 693 URI: https://www.si6networks.com 695 Nick Hilliard 696 INEX 697 4027 Kingswood Road 698 Dublin 24 699 IE 701 Email: nick@inex.ie 703 Gert Doering 704 SpaceNet AG 705 Joseph-Dollinger-Bogen 14 706 Muenchen D-80807 707 Germany 709 Email: gert@space.net 710 Warren Kumari 711 Google 712 1600 Amphitheatre Parkway 713 Mountain View, CA 94043 714 US 716 Email: warren@kumari.net 718 Geoff Huston 720 Email: gih@apnic.net 721 URI: http://www.apnic.net 723 Will (Shucheng) Liu 724 Huawei Technologies 725 Bantian, Longgang District 726 Shenzhen 518129 727 P.R. China 729 Email: liushucheng@huawei.com