[IPv6]Re: Fwd: New Version Notification for draft-iurman-6man-eh-occurrences-00.txt

[Nick Hilliard <[e-mail]>]

Hi Justin,

Justin Iurman wrote on 23/12/2025 21:10:
> The change proposed in the draft not only enforces the rule for senders, 
> but is also allows receivers to discard packets with extension headers 
> exceeding their number of occurrences. Right now, RFC 8200 assumes that 
> a receiving node should process EHs regardless of the number of 
> occurrences.

yes, but this misses the point.

Your draft allows a receiving node to drop multiple occurrences of the 
same type (nb: at the cost of maintaining a count or index for each 
type, which is a significant state overhead when handling packet 
forwarding), but the point is that in order to do this, the receiving - 
or intermediate node - needs to parse the entire header chain to find 
out which EHs to drop. The requirement to parse excessively long EH 
chains is the root cause of the problems identified in rfc9098.

You can't address the problems in rfc9098 by setting rules of engagement 
at the sending side. You can only deal with them on receiving / 
intermediate nodes by putting an upper bound on the "overall quantity" 
of EHs in the packet.

I'm using the vague term "overall quantity" because some hardware craps 
out on parsing due to fixed buffer lengths and other hardware craps out 
after a specific number of headers.  So any draft aimed at addressing 
this problem needs to acknowledge both situations when specifying what 
limits a receiving or intermediate node should implement in order to 
protect itself against ddos threat incidents.

Nick