Subject: [saag] preventing denial of service in IPv6

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Thu, 22 Oct 2015 10:12:59 +0200

I've been looking on ways to prevent denial of service on a server
application, and I stumbled on IPv6. By denial of service, I mean
exhaustion of resources, being memory or CPU.

Unlike IPv4, in IPv6 a user may typically have 2^64, and more able adversaries
may have 2^80 or even more addresses(*). That means that single IP
blacklisting to prevent DoS is not going to work; not even against a
single adversary who has 2^64 IPs. So one would expect software to
blacklist whole ranges of networks, e.g., a /64 or /48 once few IPs
violate some of its "detection properties".  Given recommendations
like RFC6164 which recommend /127 for PtP links (which can be a user
VPN link), any heuristic that will ban whole networks looks more like
a vessel to perform another denial of service (e.g., denying some user
access to a server), rather than a solution to the original denial of
service.

Are there any recommendations for protecting servers from the IPv6
address proliferation? If not, are there any conventions for IPv6
address assignment to end-users?

regards,
Nikos

[0]. rfc6177 is supposed to describe the best current practice, but it
mostly focuses on what isn't the current best practice (i.e., /48 is
not recommended any more).

---

From: Sean Turner <[email-masked]>
Date: Thu, 22 Oct 2015 11:29:19 -0400

Might be worth asking the v6ops WG too:
http://datatracker.ietf.org/wg/v6ops/documents/

spt

> On Oct 22, 2015, at 04:12, Nikos Mavrogiannopoulos <[email-masked]> wrote:
> 
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag

---

From: Yoav Nir <[email-masked]>
Date: Thu, 22 Oct 2015 18:52:06 +0300

We've been looking at this issue for the anti-ddos draft at IPsecME. We haven't come up with anything better than blacklisting or limiting entire /64 networks.

It should be noted that those /64 networks often replace non-routable IPv4 networks natted behind a single IP. So you had to blacklist them before as well.

Regards,

Yoav

Sent from my Windows Phone 

-----Original Message-----
From: "Nikos Mavrogiannopoulos" <[email-masked]>
Sent: ‎10/‎22/‎2015 11:13
To: "IETF SAAG" <[email-masked]>
Subject: [saag] preventing denial of service in IPv6

regards,
Nikos

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 23 Oct 2015 11:13:16 +0200

On Thu, Oct 22, 2015 at 5:52 PM, Yoav Nir <[email-masked]> wrote:
> We've been looking at this issue for the anti-ddos draft at IPsecME. We
> haven't come up with anything better than blacklisting or limiting entire
> /64 networks.
> It should be noted that those /64 networks often replace non-routable IPv4
> networks natted behind a single IP. So you had to blacklist them before as
> well.

That's a reasonable thing to do in the blurry IPv6 waters, but I don't
think it's viable. A /64 network is sufficient for an ISP to use (and
in fact I'm aware of ISPs who hand out smaller than /64 subnets to
their users), so a blanket ban of /64 or /48 would not be without
repercussion. Given the vast amount of addresses in such networks the
collateral damage could range from enormous (banning a whole country)
to none.

---

From: Christian Huitema <[email-masked]>
Date: Fri, 23 Oct 2015 17:28:46 +0000

On Friday, October 23, 2015 2:13 AM, Nikos Mavrogiannopoulos wrote:
> > We've been looking at this issue for the anti-ddos draft at IPsecME.
> > We haven't come up with anything better than blacklisting or limiting
> > entire
> > /64 networks.
> > It should be noted that those /64 networks often replace non-routable
> > IPv4 networks natted behind a single IP. So you had to blacklist them
> > before as well.
> 
> That's a reasonable thing to do in the blurry IPv6 waters, but I don't think it's
> viable. A /64 network is sufficient for an ISP to use (and in fact I'm aware of
> ISPs who hand out smaller than /64 subnets to their users), so a blanket ban
> of /64 or /48 would not be without repercussion. Given the vast amount of
> addresses in such networks the collateral damage could range from
> enormous (banning a whole country) to none.

The ISP who handle less than /64 to their customers are not following IETF recommendations. They should not complain about the repercussions if a single misbehaving user leads to a blocked /64 and impacts many of their customers. In fact, such breakage should push them to ask for a larger address block, and follow the recommended practice.  

-- Christian Huitema