Re: [Tsv-art] game over, EH [Tsvart last call review of draft-ietf-opsec-ipv6-eh-filtering-06]

Stewart Bryant <stewart.bryant@gmail.com> Thu, 06 December 2018 12:40 UTC

Return-Path: <stewart.bryant@gmail.com>
X-Original-To: tsv-art@ietfa.amsl.com
Delivered-To: tsv-art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4D25130DDB; Thu, 6 Dec 2018 04:40:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wwQBl9Zrek7s; Thu, 6 Dec 2018 04:40:07 -0800 (PST)
Received: from mail-wm1-x332.google.com (mail-wm1-x332.google.com [IPv6:2a00:1450:4864:20::332]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A30801286E7; Thu, 6 Dec 2018 04:40:06 -0800 (PST)
Received: by mail-wm1-x332.google.com with SMTP id c126so888818wmh.0; Thu, 06 Dec 2018 04:40:06 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding:content-language; bh=cAhuA6j0wn4+04Ohh5+SStFLIHkg+7HRmXWwpphSMmE=; b=T+HCdirBI6p8x2eioMBwOc0oYsAFcQGRFAoK6nnEA1HA4eXO5eOFGdvydcltCqVQNL Gnm4ahSlMmmUHGzEa43Ki+TDlea45daacKDBR96TiYfL40m00HbfWavw+IkAcRuVqvHu bYWQSUoV0xy+CVEAlre7BjYAJLwwstXaA7uAvDX9uqggkh8u43iMXuu5AmKdWp+xXUX7 lWJVrnMQPPpYBCx979pkym8ZixfWZ2HY/z4QOvFxspm4gh0jZSb80lyuDOPtQXIOg+FF Vq5frgcHLuCLIR1KuDqKSRf8+s7D4rERZBqmh5mxaO4VrT/qnBw8hvedjOvuDQmaObXv 3ifA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding :content-language; bh=cAhuA6j0wn4+04Ohh5+SStFLIHkg+7HRmXWwpphSMmE=; b=h+f4bgRiY0F/xHoJsbid/RghX6AFi1CsLyukz/Zgl0Ue4AFHx3lx8ePE1TaqACATlR hLSSMfFenv5UvUiHdEN/rrxsF37kZIU/6yi/eOzhVSy69dTrqaOtr7Un3tjyt1nE/8fR DOpJ5Cm5lm4yYoPnQP/xAH1GByIwzxiz+IH6xFSxnc6WJNy03hXnKaOCsR2Avx6kOTRN wqgWFpRzvdcdzqvYm85XGX93TtRE18DdiJWOq2u/YTmPxpJc3qEhj894je4It4iC5ds+ 0iRStfYVqKkQCdmBcWeHTpiK5D6uSPyZ2TqzCdxX0a2I+da219+4NKzz/Bnk7EznHLOf kh5Q==
X-Gm-Message-State: AA+aEWZhA+hViqNSW+/xhXqp4sym9JuyLp3lFVaCkDdoQqM3rOg0K913 PehEjB2pQOvu1t34jrLAoix9yJNniRc=
X-Google-Smtp-Source: AFSGD/XR+xv40+goEyGtE6GYQYYXE5ctRYOqXGr/DOKuICT2gn7N7Iqw3ETUzYvL4YhCMGCWGatQzQ==
X-Received: by 2002:a1c:cf0d:: with SMTP id f13mr18800404wmg.70.1544100004917; Thu, 06 Dec 2018 04:40:04 -0800 (PST)
Received: from [192.168.2.198] (host213-123-124-182.in-addr.btopenworld.com. [213.123.124.182]) by smtp.gmail.com with ESMTPSA id l202sm1217431wma.33.2018.12.06.04.40.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 06 Dec 2018 04:40:04 -0800 (PST)
To: Fernando Gont <fgont@si6networks.com>, Brian E Carpenter <brian.e.carpenter@gmail.com>, Gert Doering <gert@space.net>, Christopher Morrow <morrowc.lists@gmail.com>
Cc: heard@pobox.com, tsv-art@ietf.org, opsec wg mailing list <opsec@ietf.org>, ietf <ietf@ietf.org>, draft-ietf-opsec-ipv6-eh-filtering.all@ietf.org
References: <CACL_3VGeJPzDhS0RVAvpQs9W8b4EODft-qJRwBD6Xxm+X6BZ6A@mail.gmail.com> <CAL9jLabK0bZz2nki=oFNHT0OrpVAB8pw7emAj2BtkHRCzkfmqQ@mail.gmail.com> <cf64abbf-e447-71e3-b983-4e525cc139aa@gmail.com> <CAL9jLaYMRDGFa7Qzj4ukRV1FPbJM40qbuZ34SYxoA30Z+h3EWw@mail.gmail.com> <20181205085227.GG1543@Space.Net> <9ba948f9-f286-1016-2dbd-f7056a15e744@gmail.com> <d569a804-053a-fdf1-a2c5-3bae5f418389@si6networks.com>
From: Stewart Bryant <stewart.bryant@gmail.com>
Message-ID: <dad4f8f6-8ea9-8532-4253-bf99e6f2910c@gmail.com>
Date: Thu, 06 Dec 2018 12:40:02 +0000
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <d569a804-053a-fdf1-a2c5-3bae5f418389@si6networks.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Content-Language: en-GB
Archived-At: <https://mailarchive.ietf.org/arch/msg/tsv-art/GB_hRIah64ZBWY_vgo_ZmkYAvsk>
Subject: Re: [Tsv-art] game over, EH [Tsvart last call review of draft-ietf-opsec-ipv6-eh-filtering-06]
X-BeenThere: tsv-art@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Transport Area Review Team <tsv-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tsv-art>, <mailto:tsv-art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tsv-art/>
List-Post: <mailto:tsv-art@ietf.org>
List-Help: <mailto:tsv-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tsv-art>, <mailto:tsv-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Dec 2018 12:40:09 -0000


On 06/12/2018 02:37, Fernando Gont wrote:
> On 5/12/18 21:14, Brian E Carpenter wrote:
>> On 2018-12-05 21:52, Gert Doering wrote:
>>> Hi,
>>>
>>> On Tue, Dec 04, 2018 at 10:57:43PM -0500, Christopher Morrow wrote:
>>>> HA! ok. As gert/nick noted ... we have Nx100G links today (at the edge) and
>>>> coming nx400G ... there's just not a reasonable story for "dpi" there. (I
>>>> suppose: "yet" and "without paying the approximate value Coca-Cola
>>>> Companies yearly advertising budget")
>>> Indeed.
>>>
>>> Unfortunately, there *is* a story for being able to rate-limit incoming
>>> crap by protocol type - "give me no more than 200 Mbit/s of UDP packets
>>> coming from source port 53".
>>>
>>> Which implies that as soon as the evil guys out there find a way to
>>> generate DDoS streams carrying EHs that our border routers will (have to)
>>> apply very strict rate limiting to everything they do not understand.
>>>
>>>   - pass TCP
>>>   - rate-limit UDP on well-known reflective attacks port
>>>   - pass rest of UDP
>>>   - rate-limit ICMP
>>>   - rate-limit fragments
>>>   - rate-limit all the rest to something which can never exceed a customer's
>>>     access-link
>>>
>>> game over, EH
>> Just to point out that this is equivalent to saying "game over, any new layer 4 protocol" too. For example, you just killed SCTP. And the same goes for new protocols over IPv4.
> Not exactly the same. If you are using a new transport protocols (*)
> without any EHs, you have already found the upper-layer protocol. May
> allow or drop, but that's it. With EHs, if you need to do packet
> filtering or ECMP, you need to follow the EH chain.The later
> (particularly if the EH) is normally going to cause issues, where the
> former would not.
I think the problem is that it is very difficult to teach the core about 
any new
transport protocol.

- Stewart