Re: [Int-area] New Version Notification for draft-herbert-ipv4-eh-03.txt

[Tom Herbert <[e-mail]>]

On Thu, Mar 21, 2024 at 12:36 AM Bob Hinden <[e-mail]> wrote:
>
> Tom,
>
> > On Mar 21, 2024, at 2:20 PM, Tom Herbert <tom=[e-mail]> wrote:
> >
> > On Wed, Mar 20, 2024 at 8:36 PM Toerless Eckert <[e-mail]> wrote:
> >>
> >> Btw: When i asked on of the 6MAN chairs, about the meaning of an Internet Protocol
> >> Number being an "IPv6 Extension Header" or not, the answer was that in his
> >> interpretation it is simply whether the header itself has it's own "Next Header"
> >> field using the IANA Assigned Internet Protocol Numbers registry - or not.
> >
> > Thanks for asking. So by this definition IPv4 already supports
> > extension headers :-).
>
> As I remember it, Authentication Header (AH) and Encapsulating Security Payload (ESP) were first developed for IPv6 and then adapted to IPv4.

Bob,

Yes, that is one of the motivations to support other extension headers
in IPv4. Basically, we're just backporting useful forward looking
features from IPv6 to IPv4.

Tom

>
> Bob
>
>
> >
> >>
> >> In other words, Destination Option Headers do not have fundamentally distinct
> >> processing requirements on the destination host examining it than any other
> >> possible protocol header (e.g.: UDP, TCP), or at least we could not find such a description
> >> for any such guiding rules or treatment differences in RFC8200.
> >
> > Yes, that's mostly how all the IP protocols are implemented.
> > Processing of an encapsulated  protocol isn't completely independent,
> > for instance the pseudo header for the TCP and UDP checksum is
> > different for IPv4 and IPv6.
> >
> >>
> >> To me this means that it's simply a matter of consistency of simply calling ESP and AH
> >> "Extension Headers" when we do introduce this concept into IPv4.
> >
> > Agreed.
> >
> >>
> >> Of course, this interpretation is not fully consistent with the way the
> >> "IPv6 Extension Header" flag is used in the registry: IPv6 itself does not have this
> >> flag, so likely IPv4 should neither, even though both have this "next header" field,
> >> but maybe this can be explained by both ofg these being recursion instead of extension
> >> when happening in a header chain.
> >
> > Yes, although it's not clear to me how relevant the flag in the
> > registry is. In any case, for IPv4 extension headers it makes sense to
> > be consistent with IPv6.
> >
> > Tom
> >
> >>
> >> Cheers
> >>    Toerless
> >>
> >> On Tue, Mar 05, 2024 at 05:56:54PM +0100, Toerless Eckert wrote:
> >>> On Mon, Mar 04, 2024 at 06:11:38PM -0800, Tom Herbert wrote:
> >>>> We can treat them as EH for purposes of extension header ordering in
> >>>> section 2.2. Also, IPv4 AH needs to be updated to take EH into account
> >>>> as mentioned below. Other than that I don't believe there are any
> >>>> substantive differences.
> >>>
> >>> Yes, i am trying to use ESP/AH as examples to understand the benefits
> >>> of destination headers as opposed to just non-extension headers ..
> >>>
> >>>> No changes to APIs, we can use the same APis in IPv6 with IPv4. Kernel
> >>>> changes to Linux will be straightforward.
> >>>
> >>> My question was not about differences in API between IPv4/IPv6, but between when
> >>> ESP/AH are (as currently) NOT extension headers in IPv4 vs. after they become
> >>> extension because the kernel changes have been applied.
> >>>
> >>> Ul;timately, i am trying to understand whether, and if so WHY we should
> >>> reclassify ESP and AH in IPv4 to be extension headers. Right now the only
> >>> argument i would know would be "consistency with IPv6", but that by itself
> >>> does not seem to be sufficient to change something for what's being deployed
> >>> worldwide in so many places. So there should be a technical benefit.
> >>>
> >>> And if the answer is "it does not make any difference whatsoever", then i also
> >>> wonder why we would want to do it...
> >>>
> >>>>> Any other functional differences ? Aka: i couldn't find a simple:
> >>>>>
> >>>>> "If i want to define a new protocol header, should i call it an
> >>>>> extension header or an ipv6 extension header - for Dummies" ?
> >>>>
> >>>> I think there are IPv6 extension headers and IPv4 extension headers.
> >>>> IPv4 extension headers are probably just a subset of IPv6 extension
> >>>> headers.
> >>>
> >>> That's certainly safer, e.g.: asking for a separate column in the IANA registry.
> >>>
> >>>>> be renamed to "IP/IPv6 Extension Header". But when this was done
> >>>>> to AH/ESP, and there actually is a functional difference expressed by
> >>>>> this extension header (as opposed to non-extension header) status, then
> >>>>> what be the imapct of this ? Aka: I upgrade my linux kernel to extension
> >>>>> header and all my AH/ESP breaks ?  Or i do get the benefit of above
> >>>>> (userland access) ?
> >>>>>
> >>>>> Would there be any (backward compatibility) reason to have new codepoints in IPv4 for ESP/AH
> >>>>> with this extension header status and leave the existing (non extension
> >>>>> header) codepoints alone ?
> >>>>
> >>>> No, I don't think we need that. ESP/AH should be backwards compatible.
> >>>> For instance, if someone sends AH with HBH in IPv4 then they know that
> >>>> their using EH and AH would take into account mutable HBH options. If
> >>>> the packet is sent to a host that supports IPv4 EH then they would
> >>>> know how to process the AH with HBH correctly. If the packet is sent
> >>>> to a legacy node that doesn't support EH, then the packet will bv
> >>>> dropped since the host doesn't recognize protocol 0 (HBH).
> >>>
> >>> Not clear. What you are writing implies that the encoding on the wire would
> >>> change for AH from what it is now. What's exactly the change ? It's not
> >>> in the next header field...
> >>>
> >>>> There is no
> >>>> behavioral change at either the receiver or the sender if someone
> >>>> sends an AH with no other EH. The draft will need to update RFC4302 to
> >>>> describe AH processing with IPv4 EH present.
> >>>>
> >>>> RFC4303 needs an update as well, but that's just to say that EH after
> >>>> the ESP is covered by the encryption, but I don't believe that
> >>>> materially changes the requirements.
> >>>
> >>> I guess unless i can get excited for AH/ESP to get some improved behavior
> >>> when turning into extension headers (see Q above), i'd probably stick to not touching
> >>> them, aka: do not declare them to be extension headers for IPv4.
> >>>
> >>> Cheers
> >>>    Toerless
> >>>
> >>>> Tom
> >>>>
> >>>>>
> >>>>> Cheers
> >>>>>    Toerless
> >>>>>
> >>>>> On Thu, Feb 22, 2024 at 05:40:31PM -0800, Tom Herbert wrote:
> >>>>>> Hi,
> >>>>>>
> >>>>>> I updated the IPv4 extension headers draft. I structured it to be
> >>>>>> self-contained without any normative references for IPv6 RFCs. It's a
> >>>>>> little bigger, but about 80% of the text is cut-and-paste from other
> >>>>>> RFCs and drafts.
> >>>>>>
> >>>>>> Comments are appreciated!
> >>>>>>
> >>>>>> Tom
> >>>>>>
> >>>>>> ---------- Forwarded message ---------
> >>>>>> From: <[e-mail]>
> >>>>>> Date: Thu, Feb 22, 2024 at 5:29 PM
> >>>>>> Subject: New Version Notification for draft-herbert-ipv4-eh-03.txt
> >>>>>> To: Tom Herbert <[e-mail]>
> >>>>>>
> >>>>>>
> >>>>>> A new version of Internet-Draft draft-herbert-ipv4-eh-03.txt has been
> >>>>>> successfully submitted by Tom Herbert and posted to the
> >>>>>> IETF repository.
> >>>>>>
> >>>>>> Name:     draft-herbert-ipv4-eh
> >>>>>> Revision: 03
> >>>>>> Title:    IPv4 Extension Headers and Flow Label
> >>>>>> Date:     2024-02-23
> >>>>>> Group:    Individual Submission
> >>>>>> Pages:    47
> >>>>>> URL:      https://www.ietf.org/archive/id/draft-herbert-ipv4-eh-03.txt
> >>>>>> Status:   https://datatracker.ietf.org/doc/draft-herbert-ipv4-eh/
> >>>>>> HTMLized: https://datatracker.ietf.org/doc/html/draft-herbert-ipv4-eh
> >>>>>> Diff:     https://author-tools.ietf.org/iddiff?url2=draft-herbert-ipv4-eh-03
> >>>>>>
> >>>>>> Abstract:
> >>>>>>
> >>>>>>   This specification defines extension headers for IPv4 and an IPv4
> >>>>>>   flow label.  The goal is to provide a uniform and feasible method of
> >>>>>>   extensibility that is common between IPv4 and IPv6.
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>> The IETF Secretariat
> >>>>>>
> >>>>>
> >>>>> --
> >>>>> ---
> >>>>> [e-mail]
> >>>>
> >>>
> >>> --
> >>> ---
> >>> [e-mail]
> >>
> >> --
> >> ---
> >> [e-mail]
> >
> > _______________________________________________
> > Int-area mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/int-area
>