IETF Logo Mail Archive

Re: [IPv6] [v6ops] [EXTERNAL] Re: [OPSEC] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)

Tom Herbert <tom@herbertland.com> Fri, 26 May 2023 15:51 UTC

Return-Path: <tom@herbertland.com>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB227C151996 for <ipv6@ietfa.amsl.com>; Fri, 26 May 2023 08:51:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=herbertland.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LJtk7LSEE0Dt for <ipv6@ietfa.amsl.com>; Fri, 26 May 2023 08:51:10 -0700 (PDT)
Received: from mail-pg1-x536.google.com (mail-pg1-x536.google.com [IPv6:2607:f8b0:4864:20::536]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6227C15198A for <ipv6@ietf.org>; Fri, 26 May 2023 08:51:10 -0700 (PDT)
Received: by mail-pg1-x536.google.com with SMTP id 41be03b00d2f7-53487355877so589638a12.1 for <ipv6@ietf.org>; Fri, 26 May 2023 08:51:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=herbertland.com; s=google; t=1685116270; x=1687708270; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=TTTRW/lXTp+05BNDygiyS/GrpofLmQJFgRc2h1GvGiM=; b=DDNlIQxmXvjtg/hSjrb/+NPrQ0ofbw5URdsGOxpi7XYcrSx6W19sd+gRls0mXKahNi WlpRfHUBm3olSwLkJa6k6bJ+ODeUSL2EB/V/rdN9sDWORIruGx3FkWBEffPjJfJ4Q82/ nGdAYkqDdKcDf58ue8gii4TF/HudNgMkEYd7hPqopoyndVhok5Kpniy+4+uzcqpQ3yK1 IYqS4/I13Xk6L9wyQSWZaO/Tku8thBOtR3Tlr0CWZV/LfYmGqxGM1oYMCqQ3EeoEvPJk 1WZvW+Jv5G7bw+ynC42AAILI7e+NpCoHL0YLNxx++jnOkyl+R0MGDjgD2cv6otVtucJO RlUw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685116270; x=1687708270; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TTTRW/lXTp+05BNDygiyS/GrpofLmQJFgRc2h1GvGiM=; b=H6fK8cohqSuYR6WjGsxMIAN3cVaOYHHDWxXWz1OHZnIX5uLq1uwalbXwf1lbw/UTMn 5sibfm529jGsLmITAjKLGfzq/TDm3b2ttpdDP8zDsehXrOJVaaFrHfJvCru6HNdYTcXv cFZ77B3ROLpHe0BdSsiWocxWGDQ87s6hEbCKkcdcvZUSwUSRszg76ZZHa8d46Nka8WWc hMH+1BPejozNEZhlnF5vi8n/pI2Wb4BoDqdRWdJiqoN/ytlM5FasCcPBVLGd1aZjSv4z jiaH2KQpPAm9wC/8u4iwT4DN2MpQeGkhSsR9+d+9W033HgnMnZ0Ne0fDWaD5UwAmnbvv yU8A==
X-Gm-Message-State: AC+VfDwE6oRsSdPammhKRrP9ODWc2+DDU+w4Kvc2/8wklizWoYqujqbh 6PEYg06PYzRYmxuEZKi9lpvV618ldhI+0Gk9xsmHSQ==
X-Google-Smtp-Source: ACHHUZ6pgFLHV0ku/LvVg/tYCgHOicNWy5qu7dijY1E+xfE3gtV5Dwn7/AS5OlE55PgRkJlGl0+vdBnPon1JtnhAtT0=
X-Received: by 2002:a17:902:f551:b0:1af:b47e:7887 with SMTP id h17-20020a170902f55100b001afb47e7887mr3505399plf.65.1685116269628; Fri, 26 May 2023 08:51:09 -0700 (PDT)
MIME-Version: 1.0
References: <11087a11-476c-5fb8-2ede-e1b3b6e95e48@si6networks.com> <CALx6S343f_FPXVxuZuXB4j=nY-SuTEYrnxb3O5OQ3fv5uPwT8g@mail.gmail.com> <CAN-Dau1pTVr6ak9rc9x7irg+aLhq0N8_WOyySqx5Syt74HMX=g@mail.gmail.com> <a087b963-1e12-66bf-b93e-5190ce09914b@si6networks.com> <CALx6S349nNA8L5+_1hrbWayqp8GfTYypWy_SP57c_Xxams=csg@mail.gmail.com> <51a066b3-4b4c-d573-ffbe-d6b44a4f193f@gont.com.ar> <a411a1b0-c521-c456-3d44-d99a1cc0975b@gmail.com> <CWXP265MB5153E4687BE45480DBC5A531C2439@CWXP265MB5153.GBRP265.PROD.OUTLOOK.COM> <27d28224-0cb0-eec2-8d54-f0d175596c85@gmail.com> <f5758380-9967-b67b-744d-dc36b7b599ab@si6networks.com> <72784f8e65f34bcc9f5652c0a553c70c@boeing.com> <CALx6S373P2X-JRbCNpOCGuq_Cum0+OzJFRBkuQ64h5R52B7Dhw@mail.gmail.com> <222731ea012b4b0ebd7a51f72b5bcd40@boeing.com> <dd61024e-1bd8-ff3d-216f-22cc7600ad10@gmail.com> <CAHw9_iJyXiT=O5cMyy08bVq+U7VTtKTkR_60OfvrcCng8Joe5w@mail.gmail.com> <d9b86705-463c-c754-6e47-5b21917f9aa5@gont.com.ar>
In-Reply-To: <d9b86705-463c-c754-6e47-5b21917f9aa5@gont.com.ar>
From: Tom Herbert <tom@herbertland.com>
Date: Fri, 26 May 2023 08:50:57 -0700
Message-ID: <CALx6S37RQObFts+1o2fj56FK7BzDATCVcDpThRb7w=q9uyRYug@mail.gmail.com>
To: Fernando Gont <fernando@gont.com.ar>
Cc: Warren Kumari <warren@kumari.net>, Brian E Carpenter <brian.e.carpenter@gmail.com>, IPv6 Operations <v6ops@ietf.org>, 6man <ipv6@ietf.org>, opsec@ietf.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipv6/YYI0ORwyiWBmGC-P3xMeER2ON24>
Subject: Re: [IPv6] [v6ops] [EXTERNAL] Re: [OPSEC] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipv6/>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 26 May 2023 15:51:14 -0000

On Fri, May 26, 2023 at 8:38 AM Fernando Gont <fernando@gont.com.ar> wrote:
>
> Hi, Warren,
>
> On 26/5/23 11:03, Warren Kumari wrote:
>
> >
> >
> > On Thu, May 25, 2023 at 11:13 PM, Brian E Carpenter
> > <brian.e.carpenter@gmail.com <mailto:brian.e.carpenter@gmail.com>> wrote:
> >
> [....]
> >
> >     A well-implemented host will not be troubled by unkown extension
> >     headers or options.
> >
> >
> > Indeed. However, not all hosts are well-implemented.
>
> Indeed. Datapoint:
> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=IPv6+extension+header
>
> Smarter searching/keywords will at least double the results.

Uh, several of those are bugs in Cisco routers not host
implementations. In any case, this is hardly a quantitative
measurement of quality in hosts. I suggest you look at netdev list of
Linux, the world's most deployed OS, when security issues are found,
they are addressed quickly. Consumer devices are updated regularly, at
least faster than routers are typically updated, and at least an order
of magnitude faster than it takes to IETF to publish an RFC.

Tom

>
>
> --
> Fernando Gont
> e-mail: fernando@gont.com.ar
> PGP Fingerprint: 7F7F 686D 8AC9 3319 EEAD C1C8 D1D5 4B94 E301 6F01
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

v2.23.0 | Report a Bug | By Email