Internet Engineering Task Force (IETF) N. Hilliard
Request for Comments: 6666 INEX
Category: Informational D. Freedman
ISSN: 2070-1721 Claranet
August 2012
Internet Engineering Task Force (IETF) N. Hilliard
Request for Comments: 6666 INEX
Category: Informational D. Freedman
ISSN: 2070-1721 Claranet
August 2012
A Discard Prefix for IPv6
IPv6的丢弃前缀
Abstract
摘要
Remote triggered black hole filtering describes a method of mitigating the effects of denial-of-service attacks by selectively discarding traffic based on source or destination address. Remote triggered black hole routing describes a method of selectively re-routing traffic into a sinkhole router (for further analysis) based on destination address. This document updates the "IPv6 Special Purpose Address Registry" by explaining why a unique IPv6 prefix should be formally assigned by IANA for the purpose of facilitating IPv6 remote triggered black hole filtering and routing.
远程触发黑洞过滤描述了一种通过基于源地址或目标地址有选择地丢弃流量来减轻拒绝服务攻击影响的方法。远程触发黑洞路由描述了一种基于目标地址选择性地将流量重新路由到天坑路由器（用于进一步分析）的方法。本文档更新了“IPv6专用地址注册表”，解释了IANA为方便IPv6远程触发黑洞过滤和路由而应正式分配唯一IPv6前缀的原因。
Status of This Memo
关于下段备忘
This document is not an Internet Standards Track specification; it is published for informational purposes.
本文件不是互联网标准跟踪规范；它是为了提供信息而发布的。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741.
本文件是互联网工程任务组（IETF）的产品。它代表了IETF社区的共识。它已经接受了公众审查，并已被互联网工程指导小组（IESG）批准出版。并非IESG批准的所有文件都适用于任何级别的互联网标准；见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6666.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问http://www.rfc-editor.org/info/rfc6666.
Copyright Notice
版权公告
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2012 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本，并提供简化BSD许可证中所述的无担保。
Table of Contents
目录
1. Introduction ....................................................2
1.1. Notational Conventions .....................................3
2. A Discard Prefix for IPv6 .......................................3
3. Operational Implications ........................................4
4. IANA Considerations .............................................4
5. Security Considerations .........................................4
6. References ......................................................5
6.1. Normative References .......................................5
6.2. Informative References .....................................5
1. Introduction ....................................................2
1.1. Notational Conventions .....................................3
2. A Discard Prefix for IPv6 .......................................3
3. Operational Implications ........................................4
4. IANA Considerations .............................................4
5. Security Considerations .........................................4
6. References ......................................................5
6.1. Normative References .......................................5
6.2. Informative References .....................................5
Remote Triggered Black Hole (RTBH) filtering describes a class of methods of blocking IP traffic either from a specific source ([RFC5635]) or to a specific destination ([RFC3882]) on a network. RTBH routing describes a class of methods of re-routing IP traffic destined to the attacked/targeted host to a special path (tunnel) where a sniffer could capture the traffic for analysis. Both of these methods operate by setting the next-hop address of an IP packet with a specified source or destination address to be a unicast prefix that is connected locally or remotely to a router's discard, null, or tunnel interface. Typically, reachability information for this prefix is propagated throughout an autonomous system using a dynamic routing protocol such as BGP ([RFC3882]). By deploying RTBH systems across a network, traffic to or from specific destinations may be selectively black-holed or re-routed to a sinkhole device in a manner that is efficient, scalable, and straightforward to implement.
远程触发黑洞（RTBH）过滤描述了阻止来自网络上特定源（[RFC5635]）或特定目的地（[RFC3882]）的IP流量的一类方法。RTBH路由描述了一类将目的地为受攻击/目标主机的IP流量重新路由到特殊路径（隧道）的方法，嗅探器可以在其中捕获流量进行分析。这两种方法都是通过将具有指定源或目标地址的IP数据包的下一跳地址设置为单播前缀来操作的，该前缀在本地或远程连接到路由器的丢弃、空或隧道接口。通常，该前缀的可达性信息使用动态路由协议（如BGP）（[RFC3882]）在自治系统中传播。通过在网络上部署RTBH系统，到特定目的地或从特定目的地来的流量可以以高效、可扩展且易于实现的方式选择性地被黑洞覆盖或重新路由到陷穴设备。
On some networks, operators configure RTBH installations using [RFC1918] address space or the address blocks reserved for documentation in [RFC5737]. This approach is inadequate because RTBH configurations are not documentation, but rather operationally important features of many public-facing production networks. Furthermore, [RFC3849] specifies that the IPv6 documentation prefix should be filtered in both local and public contexts. On this basis, it is suggested that both private network address blocks and the documentation prefixes described in [RFC5737] are inappropriate for RTBH configurations and that a dedicated IPv6 prefix should be assigned instead.
在某些网络上，运营商使用[RFC1918]地址空间或[RFC5737]中为文档保留的地址块配置RTBH安装。这种方法是不够的，因为RTBH配置不是文档，而是许多面向公众的生产网络的重要操作功能。此外，[RFC3849]指定应在本地和公共上下文中过滤IPv6文档前缀。在此基础上，建议[RFC5737]中描述的专用网络地址块和文档前缀不适用于RTBH配置，而应指定专用IPv6前缀。
This document updates the "IPv6 Special Purpose Address Registry" [IANA-IPV6REG].
本文档更新了“IPv6专用地址注册表”[IANA-IPV6REG]。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照[RFC2119]中所述进行解释。
For the purposes of implementing an IPv6 RTBH configuration, a unicast address block is required. There are currently no IPv6 unicast address blocks that are specifically nominated for the purposes of implementing such RTBH systems.
为了实现IPv6 RTBH配置，需要单播地址块。目前没有专门指定用于实现此类RTBH系统的IPv6单播地址块。
While it could be argued that there are other addresses and address prefixes that could be used for this purpose (e.g., documentation prefixes, private address space), or that an operator could assign an address block from their own address space for this purpose, there is currently no operational clarity on what address block would be appropriate or inappropriate to use for this purpose. By assigning a globally unique discard prefix for IPv6, the IETF will introduce good practice for the implementation of IPv6 RTBH configurations and will facilitate operational clarity by allowing operators to implement consistent and deterministic inter-domain prefix and traffic filtering policies for black-holed traffic.
虽然有人可能会争辩说，还有其他地址和地址前缀可用于此目的（例如，文档前缀、专用地址空间），或者运营商可为此目的从自己的地址空间分配地址块，目前还不清楚哪些地址块适合或不适合用于此目的。通过为IPv6分配一个全球唯一的丢弃前缀，IETF将引入实施IPv6 RTBH配置的良好实践，并通过允许运营商为黑洞流量实施一致和确定的域间前缀和流量过滤策略，促进运营清晰度。
As [RFC3882] and [RFC5635] describe situations where more than one discard address may be used for implementing multiple RTBH scenarios, a single address is not sufficient to cover all likely RTBH situations. Consequently, an address block is required.
由于[RFC3882]和[RFC5635]描述了多个丢弃地址可用于实现多个RTBH场景的情况，单个地址不足以覆盖所有可能的RTBH场景。因此，需要一个地址块。
This assignment MAY be carried in a dynamic routing protocol within an autonomous system. The assignment SHOULD NOT be announced to or accepted from third-party autonomous systems, and IPv6 traffic with a destination address within this prefix SHOULD NOT be forwarded to or accepted from third-party autonomous systems. If the prefix or a subnet of the prefix is inadvertently announced to or accepted from a third-party autonomous system, this may cause excessive volumes of traffic to pass unintentionally between the two networks, which would aggravate the effect of a denial-of-service attack.
该分配可以在自治系统内的动态路由协议中进行。不应向第三方自治系统宣布或接受该分配，且目标地址在此前缀内的IPv6流量不应转发给第三方自治系统或从第三方自治系统接受。如果前缀或前缀的子网无意中被宣布给第三方自治系统或被第三方自治系统接受，这可能会导致两个网络之间无意中通过过多的通信量，这将加剧拒绝服务攻击的影响。
On networks that implement IPv6 remote triggered black holes, some or all of this network block MAY be configured with a next-hop destination of a discard or null interface on any or all IPv6 routers within the autonomous system.
在实现IPv6远程触发黑洞的网络上，此网络块的部分或全部可配置为自治系统内任何或所有IPv6路由器上的丢弃或空接口的下一跳目的地。
Per this document, IANA has recorded the allocation of the IPv6 address prefix 0100::/64 as a Discard-Only Prefix in the "Internet Protocol Version 6 Address Space" and added the prefix to the "IANA IPv6 Special Purpose Address Registry" [IANA-IPV6REG]. No end party has been assigned to this prefix. The prefix has been allocated from ::/3.
根据本文件，IANA已将IPv6地址前缀0100:：/64的分配记录为“Internet协议版本6地址空间”中的仅丢弃前缀，并将前缀添加到“IANA IPv6专用地址注册表”[IANA-IPV6REG]。尚未将任何结束方分配给此前缀。前缀已从以下位置分配：/3。
As the prefix specified in this document ought not normally be transmitted or accepted over inter-domain BGP sessions for the reasons described in Section 3, it is usually appropriate to include this prefix in inter-domain BGP prefix filters [RFC3704] or otherwise ensure the prefix is neither transmitted to nor accepted from a third-party autonomous system.
由于第3节所述原因，本文件中规定的前缀通常不应通过域间BGP会话传输或接受，因此通常应将该前缀包括在域间BGP前缀过滤器中[RFC3704]或者以其他方式确保前缀既不会传输到第三方自治系统，也不会从第三方自治系统接收。
[IANA-IPV6REG] Internet Assigned Numbers Authority, "IPv6 Special Purpose Address Registry", 2012, <http://www.iana.org/assignments/ iana-ipv6-special-registry>.
[IANA-IPV6REG]互联网分配号码管理局，“IPv6专用地址注册”，2012年<http://www.iana.org/assignments/ iana-ipv6-special-registry>。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[RFC3882] Turk, D., "Configuring BGP to Block Denial-of-Service Attacks", RFC 3882, September 2004.
[RFC3882]Turk，D.，“配置BGP以阻止拒绝服务攻击”，RFC 3882，2004年9月。
[RFC5635] Kumari, W. and D. McPherson, "Remote Triggered Black Hole Filtering with Unicast Reverse Path Forwarding (uRPF)", RFC 5635, August 2009.
[RFC5635]Kumari，W.和D.McPherson，“具有单播反向路径转发（uRPF）的远程触发黑洞滤波”，RFC 56352009年8月。
[RFC1918] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G., and E. Lear, "Address Allocation for Private Internets", BCP 5, RFC 1918, February 1996.
[RFC1918]Rekhter，Y.，Moskowitz，B.，Karrenberg，D.，de Groot，G.，和E.Lear，“私人互联网地址分配”，BCP 5，RFC 1918，1996年2月。
[RFC3704] Baker, F. and P. Savola, "Ingress Filtering for Multihomed Networks", BCP 84, RFC 3704, March 2004.
[RFC3704]Baker，F.和P.Savola，“多宿网络的入口过滤”，BCP 84，RFC 37042004年3月。
[RFC3849] Huston, G., Lord, A., and P. Smith, "IPv6 Address Prefix Reserved for Documentation", RFC 3849, July 2004.
[RFC3849]Huston，G.，Lord，A.，和P.Smith，“为文档保留IPv6地址前缀”，RFC 3849，2004年7月。
[RFC5737] Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks Reserved for Documentation", RFC 5737, January 2010.
[RFC5737]Arkko，J.，Cotton，M.和L.Vegoda，“为文档保留的IPv4地址块”，RFC 5737，2010年1月。
Authors' Addresses
作者地址
Nick Hilliard INEX 4027 Kingswood Road Dublin 24 IE
Nick Hilliard INEX都柏林金斯伍德路4027号24 IE
EMail: nick@inex.ie
EMail: nick@inex.ie
David Freedman Claranet 21 Southampton Row, Holborn London WC1B 5HA UK
David Freedman Claranet英国伦敦霍尔伯恩南安普敦街21号WC1B 5HA
EMail: david.freedman@uk.clara.net
EMail: david.freedman@uk.clara.net