RFC 7112

Implications of Oversized IPv6 Header Chains

📅 published January 2014, from ietf

RFC 7112: Implications of Oversized IPv6 Header Chains 🎀

Okay bestie, this is RFC 7112, a Standards Track document from January 2014 (ISSN 2070-1721). It was written by F. Gont of Huawei Technologies, V. Manral of Ionos Networks, and R. Bonica of Juniper Networks. It updates RFC 2460, and there's no Obsoletes line up top, so it isn't replacing anything. 💅

Abstract 🌸

IPv6 lets header chains be any size, and options can make each header bigger too 👀. When the chain or the options are super long and packets get fragmented (or the fragments are tiny), the First Fragment of a packet might not contain the whole IPv6 Header Chain 😭. This doc looks at the interoperability and security problems that causes. It also updates RFC 2460 so that the First Fragment of a packet is required to contain the entire IPv6 Header Chain ✨.

Status of This Memo 💜

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741.

For the current status of this document, any errata, and how to send feedback, check out http://www.rfc-editor.org/info/rfc7112 🦋.

Copyright Notice 🌈

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, since they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they are provided without warranty as described in the Simplified BSD License 🫶.

Table of Contents 🧚

1. Introduction ....................................................2
2. Requirements Language ...........................................3
3. Terminology .....................................................3
4. Motivation ......................................................4
5. Updates to RFC 2460 .............................................5
6. IANA Considerations .............................................5
7. Security Considerations .........................................6
8. Acknowledgements ................................................6
9. References ......................................................7
   9.1. Normative References .......................................7
   9.2. Informative References .....................................7

1. Introduction ✨

With IPv6, optional internet-layer info rides along in one or more IPv6 Extension Headers [RFC2460]. Extension Headers sit between the IPv6 header and the Upper-Layer Header in a packet. The term "Header Chain" is the group name for the IPv6 header, the Extension Headers, and the Upper-Layer Header, all together in one packet. When the IPv6 Header Chain is unusually long and packets get fragmented (or the fragment size is very small), the Header Chain can spread across multiple fragments 🍓.

IPv4 had a fixed max length for all the IPv4 options in one packet, but IPv6 doesn't have an equivalent limit right now 😤. This document updates the set of IPv6 specs to create an overall limit on the combined size of IPv6 options and Extension Headers allowed in a single IPv6 packet. Basically, it updates RFC 2460 so that the First Fragment of a fragmented datagram is required to contain the entire IPv6 Header Chain 💖.

Quick clarifier: this doesn't stop you from using big payloads. It just means every header, from the IPv6 base header down to the Upper-Layer Header (like TCP or similar), has to be in the First Fragment 🎀.

2. Requirements Language 💅

Here's how the key words work in this doc. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖.

3. Terminology 🦋

For this doc, the terms Extension Header, IPv6 Header Chain, First Fragment, and Upper-Layer Header mean the following:

Extension Header 🧩

Extension Headers are defined in Section 4 of [RFC2460]. Because of [RFC7045], [IANA-PROTO] gives a list of assigned Internet Protocol Numbers and marks which of those protocol numbers also represent Extension Headers.

First Fragment 🌸

An IPv6 fragment with Fragment Offset equal to 0.

IPv6 Header Chain 🔗

The IPv6 Header Chain has an initial IPv6 header, zero or more IPv6 Extension Headers, and optionally a single Upper-Layer Header. If there's an Upper-Layer Header, it ends the header chain. If not, the "No Next Header" value (Next Header = 59) ends it 🛑.

The first member of the IPv6 Header Chain is always an IPv6 header. For a later header to count as a member of the chain, the "Next Header" field of the previous member has to reference it. But if a second IPv6 header shows up in the chain (like when IPv6 is tunneled over IPv6), that second IPv6 header counts as an Upper-Layer Header and ends the chain. Same deal with an Encapsulating Security Payload (ESP) header: if one appears in the chain, it counts as an Upper-Layer Header and ends the chain 🙈.

Upper-Layer Header 🎯

Usually, the Upper-Layer Header is the first member of the header chain that's neither an IPv6 header nor an IPv6 Extension Header. But if an ESP header or a second IPv6 header shows up, those count as Upper-Layer Headers and end the chain 🔚.

The upper-layer payload, and any protocol data after the upper-layer payload, are not part of the IPv6 Header Chain. For example, if the Upper-Layer Header is a TCP header, the TCP payload isn't part of the IPv6 Header Chain. In a fancier example, if the Upper-Layer Header is an ESP header, then neither the payload data nor any of the fields that come after the payload in the ESP header are part of the IPv6 Header Chain 🌈.

4. Motivation 🔥

Lots of forwarding devices run stateless firewalls. A stateless firewall enforces a forwarding policy one packet at a time 👀. To enforce that policy, a stateless firewall might need to pull info from both the IPv6 headers and the upper-layer headers.

Here's an example. Say a stateless firewall drops all traffic coming in from an interface unless it's headed for a certain TCP port on a certain IPv6 address. Now the firewall gets a fragmented packet aimed at a different TCP port, and the whole header chain sits inside the First Fragment. The firewall drops the First Fragment and lets the later fragments through. Since the First Fragment got dropped, the packet can't be reassembled at the destination. And because the packet can't be reassembled, the forwarding policy is enforced 🙌.

But when the firewall gets a fragmented packet where the header chain spans multiple fragments, the First Fragment doesn't have enough info for the firewall to enforce its policy 😵. Without enough info, the stateless firewall either forwards that fragment or drops it. Either way, it can fail to enforce its forwarding policy 💀.

7. Security Considerations 🔐

okay bestie, this section is the tea ☕ and it's giving "we found a hole and we're patching it" energy 🕳️➡️🧱. no new security exposures or issues are raised by this document, fr fr ✨. what it does point out is that undesirably fragmented packets can be used to sneak past stateless packet filtering 🥷, so this document updates [RFC2460] so that undesirably fragmented packets are forbidden 🚫. that means a security vulnerability is removed 💖, literally the best kind of glow-up 🦋.

if a node drops those packets, it can tell the sender about it using an ICMPv6 "Parameter Problem, IPv6 First Fragment has incomplete IPv6 header chain" (Type 4, Code 3) error message 📩. it's like leaving a polite little note 🌸.

As with all ICMPv6 error/diagnostic messages, deploying Source Address Forgery Prevention filters helps reduce the chances of an attacker successfully performing a reflection attack 🪞. the attacker would be sending forged illegal packets with the victim's or target's IPv6 address as the IPv6 source address of the illegal packet, so the filters are a must-have shield 🛡️ [RFC2827] [RFC3704] 💅.

⚠️ bestie, the last one is important: a firewall that does stateless deep packet inspection (aka it looks at the application payload content) might still be unable to process fragmented packets correctly, even if the IPv6 Header Chain isn't fragmented 💀🙈.

8. Acknowledgements 🫶

the authors want to thank Ran Atkinson for contributing text and ideas that went into this document 🧚.

they also want to thank (in alphabetical order) Ran Atkinson, Fred Baker, Stewart Bryant, Brian Carpenter, Benoit Claise, Dominik Elsbroek, Wes George, Mike Heard, Bill Jouris, Suresh Krishnan, Dave Thaler, Ole Troan, Eric Vyncke, and Peter Yee 👑, for giving super valuable comments on earlier versions of this doc 💜✨.

9. References 📚

9.1. Normative References

[RFC1981]  McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery
           for IP version 6", RFC 1981, August 1996.

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2460]  Deering, S. and R. Hinden, "Internet Protocol, Version 6
           (IPv6) Specification", RFC 2460, December 1998.

[RFC4443]  Conta, A., Deering, S., and M. Gupta, "Internet Control
           Message Protocol (ICMPv6) for the Internet Protocol
           Version 6 (IPv6) Specification", RFC 4443, March 2006.

[RFC4821]  Mathis, M. and J. Heffner, "Packetization Layer Path MTU
           Discovery", RFC 4821, March 2007.

[RFC7045]  Carpenter, B. and S. Jiang, "Transmission and Processing
           of IPv6 Extension Headers", RFC 7045, December 2013.

9.2. Informative References

[RFC2827]  Ferguson, P. and D. Senie, "Network Ingress Filtering:
           Defeating Denial of Service Attacks which employ IP Source
           Address Spoofing", BCP 38, RFC 2827, May 2000.

[RFC3704]  Baker, F. and P. Savola, "Ingress Filtering for Multihomed
           Networks", BCP 84, RFC 3704, March 2004.

[IANA-PROTO]
           Internet Assigned Numbers Authority, "Protocol Numbers",
           <http://www.iana.org/assignments/protocol-numbers>.

Authors' Addresses 📮

Fernando Gont
Huawei Technologies
Evaristo Carriego 2644
Haedo, Provincia de Buenos Aires  1706
Argentina

Phone: +54 11 4650 8472
EMail: fgont@si6networks.com


Vishwas Manral
Ionos Networks
Sunnyvale, CA  94089
US

Phone: 408-447-1497
EMail: vishwas@ionosnetworks.com


Ronald P. Bonica
Juniper Networks
2251 Corporate Park Drive
Herndon, VA  20171
US

Phone: 571 250 5819
EMail: rbonica@juniper.net

📦 where this page comes from

ietf: rfc7112 2014-01
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms