RE: I-D Action:draft-ietf-6man-exthdr-01.txt

[Suresh Krishnan <[e-mail]>]

Hi Fernando,
 Please see response inline.

> -----Original Message-----
> From: Fernando Gont 
> [mailto:[e-mail]] On Behalf Of 
> Fernando Gont
> Sent: Monday, January 03, 2011 4:43 PM
> To: Brian E Carpenter
> Cc: Thomas Narten; [e-mail]; Suresh Krishnan
> Subject: Re: I-D Action:draft-ietf-6man-exthdr-01.txt
> 
> On 03/01/2011 06:25 p.m., Brian E Carpenter wrote:
> 
> > The basic motivation for the present draft is clear:
> > 
> >>    However,
> >>    some intermediate nodes such as firewalls, may need to 
> look at the
> >>    transport layer header fields in order to make a 
> decision to allow or
> >>    deny the packet.  
> > 
> > That is, help middleboxes to violate e2e transparency and, 
> > furthermore, allow unknown headers to cross those middleboxes.
> 
> I don't think this I-D will make a difference.
> 
> From the POV of a firewall, unless it really wants a packet 
> to pass-through, it will block it.
> 
> So, whether the Extension Header is unknown, or whether 
> draft-ietf-6man-exthdr-01.txt is implemented and the Specific 
> type is unknown will lead to the same result: the packet will 
> be discarded.
> 
> This proposal would only be useful to firewalls that 
> implement a "default allow", and that simply want to somehow 
> ignore an unknown extension header and base their decision on 
> the upper-layer protocol (only). -- But we all know that 
> firewalls operate (or should operate) in "default deny" 
> rather than "default allow".
> 
> So IMHO this proposal won't be useful for such firewalls.

Yes. You are correct. This proposal will not be useful for such
firewalls. On the other hand 

http://tools.ietf.org/html/draft-ietf-v6ops-cpe-simple-security-16

allows a class of firewalls that can put application transparency
over strict filtering (see REC-11). In such case differentiating 
an unknown transport layer protocol from an unknown extension 
header would be useful. Whether or not such firewall would exist
in the wild is an interesting question, but I do not see how to 
answer that conclusively.

Thanks
Suresh