Re: I-D Action: draft-gont-6man-ipv6-universal-extension-header-01.txt

[Fernando Gont <[e-mail]>]

Hi, Brian,

On 05/01/2014 10:57 PM, Brian E Carpenter wrote:
> 
> I've finally understood what's been bothering me about this draft.
> Actually, two things:
> 
> 1. If a node (regardless of whether it's the destination host,
> or an intermediate node such as a firewall) has a policy
> of discarding packets with an unknown extension header
> or an unknown transport protocol, it *doesn't matter* that
> it can't distinguish them. The packet is discarded anyway.
> 
> Comment on that: In either case, this discard by a host is
> consistent with RFC2460 (even as updated by RFC7045). 

While I agree that it is consistent with RFC2460, that also implicitly
means that new EHs are not incrementally deployable. Not only because of
firewalls, but also because of the hosts themselves. (i.e., if I send
you my packets with my sihny new EH then, if you don't understand it,
you'd drop the packet).

(another way to see it would be to assume that the reason for which
RFC2460 says so is because it didn't define a uniform format for EHs in
the first place?)


> In either
> case, it's what we would expect a firewall to do if it has the
> usual sort of paranoid policy, and that again is consistent
> with RFC7045.

I'm not sure I'd agree. in v4, some firewalls do not just filter packets
for the options they contain, but they do filter based on the {src ip,
dst ip, protocol, src port, dst port}



> 2. Given that argument, I think this draft should consider a
> 4th possible solution: Do Nothing. I think it's a valid option.

At the very least 6564 should probably be updated, or at least a
clarification issued. -- quite a few of us had assumed that as a result
of RFC6564, one could parse past unknown EH -- which is certainly not
possible.



> Nits: I don't see why this draft is tagged as Standards Track
> and Updates 2460. It's an informational discussion.

It's std track. And the "update" tag is because the UEH would be part of
the v6 specification (not to mention that otherwise it would be
virtually impossible for an IPv6 implementer to spot this document in
the first place).



> Please change the title of the draft. At the moment it has
> the same title as draft-gont-6man-rfc6564bis.

Will do.

Thanks!
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492