--- 1/draft-ietf-grow-embed-addr-01.txt 2006-02-04 23:24:01.000000000 +0100 +++ 2/draft-ietf-grow-embed-addr-02.txt 2006-02-04 23:24:01.000000000 +0100 @@ -1,17 +1,17 @@ Global Routing Operations D. Plonka Internet-Draft University of Wisconsin -Expires: December 6, 2004 June 7, 2004 +Expires: December 7, 2004 June 8, 2004 Embedding Globally Routable Internet Addresses Considered Harmful - draft-ietf-grow-embed-addr-01 + draft-ietf-grow-embed-addr-02 Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. @@ -20,40 +20,45 @@ and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. - This Internet-Draft will expire on December 6, 2004. + This Internet-Draft will expire on December 7, 2004. Copyright Notice Copyright (C) The Internet Society (2004). All Rights Reserved. Abstract This document means to clarify best current practices in the Internet community. Internet hosts should not contain globally routable Internet Protocol addresses embedded within firmware or elsewhere as part of their default configuration such that it influences run-time behavior. Revision History RFC-EDITOR: PLEASE REMOVE REVISION HISTORY BEFORE PUBLICATION. The following is the revision history of this document $Log: draft-ietf-grow-embed-addr.xml,v $ + Revision 1.15 2004/06/08 14:16:45 plonka + revised conclusion based on input from Geoff Huston + + added netgear-sntp technical report to list of informative references + Revision 1.14 2004/06/07 18:16:27 plonka split references into normative and informative sections Revision 1.13 2004/06/07 16:32:10 plonka Set category to BCP. Rewrote/resized abstract and introduction as suggested by Pekka Savola. Improved section about using DNS names, re; hard-coding caveats, as suggested by Pekka Savola. @@ -264,35 +268,39 @@ security or privacy policy. Furthermore, the significant possibility of malicious parties exploiting such a remote control mechanism may completely negate any potential benefit of the remote control scheme. 5. IANA Considerations This document creates no new requirements on IANA namespaces. 6. Conclusion - As larger numbers of homogenous Internet hosts continue to be - deployed, it is particularly important that both their designers and - other members of the Internet community diligently assess host - implementation quality and reconfigurability. Unique, globally - routable IP addresses should not be embedded within a host's fixed - configuration because doing so excludes the ability to remotely - influence hosts when the unsolicited IP traffic they generate causes - problems for those operating the IP addresses to which the traffic is - destined. + When large numbers of homogenous Internet hosts are deployed, it is + particularly important that both their designers and other members of + the Internet community diligently assess host implementation quality + and reconfigurability. + + Implementors of host services should avoid any kind of use of unique + globally routable IP addresses within a fixed configuration part of + the service implementation. If there is a requirement for + pre-configured state then care should be taken to use an appropriate + service identifier and use standard resolution mechanisms to + dynamically resolve the identifier into an IP address. Also, any + such identifiers should be alterable in the field through a + conventional command and control interface for the service. 7. Acknowledgements The author thanks the following reviewers for their contributions to - this document: Paul Barford, Mike O'Connor, Michael Patton, Tom - Petch, Pekka Savola, and David Meyer. + this document: Paul Barford, Geoff Huston, David Meyer, Mike + O'Connor, Michael Patton, Tom Petch, and Pekka Savola. 8. References 8.1 Normative References [1] Hubbard, K., "INTERNET REGISTRY IP ALLOCATION GUIDELINES", RFC 2050, BCP 12, November 1996. [2] Eastlake, D., "Reserved Top Level DNS Names", RFC 2606, BCP 32, June 1999. @@ -310,23 +318,27 @@ [6] Hamilton, M., "Use of DNS Aliases for Network Services", RFC 2219, BCP 17, October 1997. [7] Mills, D., "Simple Network Time Protocol (SNTP) Version 4 for IPv4, IPv6 and OSI", RFC 2030, October 1996. [8] Alexander, S., "DHCP Options and BOOTP Vendor Extensions", RFC 2132, March 1997. + [9] Plonka, D., "Flawed Routers Flood University of Wisconsin + Internet Time Server", August 2003, + . + Author's Address - David J. Plonka + David Plonka University of Wisconsin - Madison EMail: plonka AT doit DOT wisc DOT edu URI: http://net.doit.wisc.edu/~plonka/ Appendix A. Background In June 2003, the University of Wisconsin discovered that a network product vendor named NetGear had manufactured and shipped over 700,000 routers with firmware containing a hard-coded reference to @@ -342,22 +354,22 @@ source addresses, destined for the University's network, resulting in significant operational problems. These flawed routers are widely deployed throughout the global Internet and are likely to remain in use for years to come. As such, the University of Wisconsin with the cooperation of NetGear will build a new anycast time service which aims to mitigate the damage caused by the misbehavior of these flawed routers. A technical report regarding the details of this situation is - available on the world wide web: - + available on the world wide web: Flawed Routers Flood University of + Wisconsin Internet Time Server [9]. Intellectual Property Statement The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and