[IPv6]Re: Fwd: New Version Notification for draft-iurman-6man-eh-occurrences-00.txt

[Tom Herbert <[e-mail]>]

On Tue, Dec 23, 2025, 2:54 PM Justin Iurman <[e-mail]> wrote:

> Hi Nick,
>
> On 12/23/25 23:29, Nick Hilliard wrote:
> > Hi Justin,
> >
> > Justin Iurman wrote on 23/12/2025 21:10:
> >> The change proposed in the draft not only enforces the rule for
> >> senders, but is also allows receivers to discard packets with
> >> extension headers exceeding their number of occurrences. Right now,
> >> RFC 8200 assumes that a receiving node should process EHs regardless
> >> of the number of occurrences.
> >
> > yes, but this misses the point.
> >
> > Your draft allows a receiving node to drop multiple occurrences of the
> > same type (nb: at the cost of maintaining a count or index for each
> > type, which is a significant state overhead when handling packet
> > forwarding), but the point is that in order to do this, the receiving -
> > or intermediate node - needs to parse the entire header chain to find
> > out which EHs to drop. The requirement to parse excessively long EH
> > chains is the root cause of the problems identified in rfc9098.
> >
> > You can't address the problems in rfc9098 by setting rules of engagement
> > at the sending side. You can only deal with them on receiving /
> > intermediate nodes by putting an upper bound on the "overall quantity"
> > of EHs in the packet.
> >
> > I'm using the vague term "overall quantity" because some hardware craps
> > out on parsing due to fixed buffer lengths and other hardware craps out
> > after a specific number of headers.  So any draft aimed at addressing
> > this problem needs to acknowledge both situations when specifying what
> > limits a receiving or intermediate node should implement in order to
> > protect itself against ddos threat incidents.
>
> Oh, got it, thanks! Would something like this address what you described
> above?
>
> OLD:
>    IPv6 nodes MAY discard a packet exceeding the number of occurrences of
>    extension headers.
>
> NEW:
>    IPv6 nodes MAY discard a packet exceeding the number of occurrences
> of
>    extension headers, provided that they can safely parse the header
>    chain without exceeding their processing or hardware limitations.
>

If they can't safely parse the header chain, what action is taken?

>
> Justin
>
> > Nick
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> List Info: https://mailman3.ietf.org/mailman3/lists/[e-mail]/
> --------------------------------------------------------------------
>