Re: Feedback on the use of Hop-by-Hop options extension header (draft-francois-dots-ipv6-signal-option-01)

[神明達哉 <[e-mail]>]

On Wed, Feb 8, 2017 at 1:17 AM, Jérôme François <[e-mail]> wrote

> We are working on a DOTS draft about using the Hop-by-Hop option header
> to encapsulated DDoS signaling  within network to enabel a kind of
> epidemic propagation
> (https://tools.ietf.org/html/draft-francois-dots-ipv6-signal-option-01)
[...]
> We have also followed the mailing list discussion about header insertion,
> which obviously concerns our approach since we are extracting and inserting
> some info in headers on the paths. Even if this is is limited to specific
> routers in a single domain, we understand that it can create problems and
> should maybe use packet encapsulation.

I've just (quickly) read the 01 version.  Regarding the header
insertion, I think the conclusion has now been made in the context of
rfc2460bis, but that aside, it was not really clear to me from the
draft text that it intends to allow an intermediate node (= DOTS
opportunistic-capable router?) to insert a new Hop-by-hop option.  If
you're going to avoid insertion as a result of the decision on
rfc2460bis, that will be moot anyway.  But if you plan to keep it
(possibly as post-rfc2460bis fodder), I think the draft text should be
much clearer on the intent.

Some other comments:

- I suspect this use of Hop-by-hop options header could be considered
  a layer violation; my general understanding is that HbH options are
  intended to be used at around layer 3, but the proposed use seems to
  belong to a much higher layer.  I'm not a layer-boundary-police
  officer, so I personally wouldn't be opposed to the idea just
  because of that, but I can easily imagine some of those officers
  will complain about it.

- (a minor point) in section 1.2 the draft states:

   an application layer (DNS) attack [rootops-ddos]. Each one of the 13
   root server letters (A--M) was hit by attacks peaking at 5 million
   queries per second.

  This could be misleading.  Root DNS servers are highly distributed
  using anycast today, and there are actual several hundreds server
  instances.  And in that sense "each one of the 13 letters" is
  ambiguous: whether it's each *one set of servers* of each of the 13
  letters, or it's each instance of hundreds of actual servers.
  Actually the referenced document ([rootops-ddos]) is also ambiguous,
  so it's not really a fault of this draft, but it's still better to
  be clarified or to find another clearer example.

- Section 5:

   [...] At DOTS capable
   nodes (client, gateway and server), it requires a service interface
   used by upper-layer protocols and application programs to ask the IP
   layer to insert and listen to the Hop-by-Hop header option in IPv6
   packets with the content and strategies described in Section 3. A
   DOTS client invokes the service interface to insert the option, A
   DOTS gateway invokes the service interface for listening and
   inserting the option, and finally a DOTS server only invokes the
   service interface to listen to the DOTS signalling option.

  At least for the actual source and destination nodes of the packets,
  I believe the advanced socket API (RFC3542) could be used for this
  purpose (unfortunately, though, it's not as widely implemented as
  the basic API).  You may want to refer to RFC3542 here.

--
JINMEI, Tatuya