Re: [IPv6] [OPSEC] [v6ops] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)

["[e-mail]" <[e-mail]>]

Ole,
> What would you even do with EHs through a load balancer? 
I think a load balancer should pass EHs from the origin or destination through unchanged or undropped.   I, being a developer myself, can think of some quite unfortunate actions which could occur if this is not done.   It should not be the job of a load balancer to act as a firewall -- unless that is explicit.   Load balancers should not be  dropping packets which contain EH.
It is interesting though, some people appear to call a device a "load balancer" when it is really acting as a proxy.
Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
[phone]




 
 
 On Monday, May 22, 2023 at 10:09:38 AM PDT, Ole Troan <[e-mail]> wrote: 





Nalini,

> 
> Once bugs are fixed, then we need to consider carefully what BCP around EHs should be done, taking into account various common topologies as well as devices such as proxies and load balancers.  I mention those in particular as what we have found points to those devices in particular as posing problems rather than transit networks.  

I look at load balancers as an extension of the application (or network function).
Unless the application had a particular use for a extension header I would not implement it.
And that’s with an implementors hat on. Writing custom load-balancers for network services.
What would you even do with EHs through a load balancer? Provide ALGs for EHs containing addresses inside of them? It would have to be on a case by case basis.



> Of course, our testing to date is absolute lack of transmission rather than lack of transmission based on EH length or type.  We felt that was the logical first step.

O.