Re: [Errata Rejected] RFC6564 (4423)

[Fernando Gont <[e-mail]>]

Hi, Brian,

On 09/15/2015 11:17 PM, Brian E Carpenter wrote:
>>> I also believe that the problem raised is insoluble in IPv6;
>>> we would need to version the protocol to fix it.
>>>
>>> That's why RFC 7045 created the "IPv6 Extension Header Types" registry:
>>> https://tools.ietf.org/html/rfc7045#section-4
>>
>> I disagree here. The problem is solvable as per
>> draft-gont-6man-ipv6-universal-extension-header.
>>
>> (Well, you can argue that we "circumvent the problem": we defined the
>> last EH ever, which creates a subspace for EH types).
> 
> Yes, nobody escapes having to write code for all the existing EH's.
> But I haven't understood why your proposal is really different from
> using the option headers as universal.

Let me illustrate with an example:

Let's say I have a middle-box that wants to filter everything other than
TCP port 80. My middle-box will try to process the entire IPv6 header
chain, inspect the TCP port number, and allow the packets if they are
identified to be TCP port 80.

Let's say a new EH is introduced. Existing middle-boxes have no way to
tell whether the new "Next Header" value is an EH or a transport
protocols -- because the middle-box implementation predates the
specification of the new EH.

Therefore, it's impossible for the middlebox to skip past the
newly-defined EH.


Our I-D does this:
It defines a final EH syntax, which includes a "sub-type", and length.
Then, if you want to specify a new EH, you use our IANA-assigned "Next
Header" value, and request IANA a new "sub-type" for your EH.

As a result, once our new EH is implemented, middleboxes can parse past
newly-defined EHs, since all of them will share the same "Next Header"
value and the same syntax.



>> Since it is not unlikely that during IPv6's lifetime we want to specify
>> new EHs, we better fix this sooner than later...
> 
> You would think so, but the history of IPv4 options says the opposite.
> I think the problem is that whatever solution is used, firewalls will
> block what they don't understand.

I don't necessarily disagree with you. But if we are going to keep them,
we better do whatever we can to improve the current state of affairs.

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492