IETF Logo Mail Archive

Re: [Tsv-art] [OPSEC] Tsvart last call review of draft-ietf-opsec-ipv6-eh-filtering-06

Brian E Carpenter <brian.e.carpenter@gmail.com> Wed, 05 December 2018 04:46 UTC

Return-Path: <brian.e.carpenter@gmail.com>
X-Original-To: tsv-art@ietfa.amsl.com
Delivered-To: tsv-art@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 255DE130DC9; Tue, 4 Dec 2018 20:46:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1
X-Spam-Level:
X-Spam-Status: No, score=-1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hkbtqecqCErD; Tue, 4 Dec 2018 20:46:21 -0800 (PST)
Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19762126F72; Tue, 4 Dec 2018 20:46:20 -0800 (PST)
Received: by mail-pl1-x62f.google.com with SMTP id p8so9449503plo.2; Tue, 04 Dec 2018 20:46:20 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=kxRx9+sUKk7A/HVVrCF4oQvD6HfHQdZK1zsWXdIlZ7w=; b=TVQ5KHjG91MZuR5h+qSEGZmxMSGDubm+IaUtHptr7uOqB+J/IXgZNVbEErcvA2Kuxk G1lAgs3OIiFp5fHa+dCjnELKZoQ70xMBYeo+h85spHnMFD2umXEXGXABMa5wIW4aZiGk e+n1Xag91ttmCdWf4NtXNgpxeXnkYYpU8uLVqI7jcA08tYcONn5Ab/Vy5xafnlrXEFu1 Hh+JbLp7N/mO+GQrdcNCMT1/CyXAHeU3KtsL85KZ6fsOTr+wBBxXuc65r5ZpcMeaM89+ bvXuZ9RNbAo1ztMgL5HscAnjfj6OK7Kzufg0tWb4OOB2SW+OHIlyJXxxSH4NSEI2RVyZ gc7Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=kxRx9+sUKk7A/HVVrCF4oQvD6HfHQdZK1zsWXdIlZ7w=; b=PJf0omEcg8Buoqiw1wGQrlMwEo5DYFIZWCHkgbwPjKA1z0ndw2eDJe55GXeJssr1ls qL4JKf6dZthxGy6XLRFuthcDgvt3BnkkJijMHtpjb9jQdVy+pinWMX2ByTbk+dircL5N 0RcrlozWAwKvBeA2ukD4spZ3H7wB0ajcON6nRrwl9Cnjnbo/UHrsihL4Pv6UsmoDOnrm QiTuf3gOKaYD3PGnnQm/LPa8uRPQkgaMiLZlNM40FKLnmK+R2e+lnhGQE2KPI4y8d0ES A+3cAr3aEnL08krnJ0VW4dPEX/xOCjXfQmELgx3+lO+fGXI/neZ0rA0MZ7ZNHv0NNa78 9XJg==
X-Gm-Message-State: AA+aEWbpJ4SrE5M8WLp6B2bGHc8WvvDgbAyyjPl0Xu1FcNdCK3Wuo+42 1LzLRFhnvNNeV0CzPAIGF9MMFCAgm4A=
X-Google-Smtp-Source: AFSGD/XEh3+iueutiz2q5lh8US0BXJ2u2FHT9cPXMKM6En9rLIi/C9QBDa/wkyVpS0ILLFOSoMu2SA==
X-Received: by 2002:a17:902:9a9:: with SMTP id 38mr22387570pln.204.1543985180320; Tue, 04 Dec 2018 20:46:20 -0800 (PST)
Received: from [192.168.178.30] ([118.148.76.40]) by smtp.gmail.com with ESMTPSA id f20sm11098820pfn.177.2018.12.04.20.46.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 04 Dec 2018 20:46:19 -0800 (PST)
To: Joe Touch <touch@strayalpha.com>, Christopher Morrow <morrowc.lists@gmail.com>
Cc: ietf <ietf@ietf.org>, draft-ietf-opsec-ipv6-eh-filtering.all@ietf.org, opsec wg mailing list <opsec@ietf.org>, tsv-art@ietf.org
References: <977CA53D-7F72-4443-9DE2-F75F7A7C1569@strayalpha.com> <0f56c25d-7ac7-e534-4e2c-cc09f5154e77@foobar.org> <28EDE667-457E-4AED-8480-F27ECAA8E985@strayalpha.com> <6bd1ec94-f420-1f4c-9254-941814704dbb@gmail.com> <6be84ccf-9a72-2694-e19d-fa19043a0cb1@huitema.net> <4C249487-BD58-41BB-B8B6-081323E29F6C@strayalpha.com> <20181126075746.GO72840@Space.Net> <6C50775C-EB67-4236-93B8-DF0259E04167@strayalpha.com> <20181126175336.GW72840@Space.Net> <c959d8cb6f6a04a8da8318cfa89da341@strayalpha.com> <2425355d-e7cc-69dd-5b5d-78966056fea7@foobar.org> <C4D47788-0F3D-4512-A4E3-11F3E6EC230B@strayalpha.com> <8d3d3b05-ecc3-ad54-cb86-ffe6dc4b4f16@gmail.com> <C929A8B9-D65C-4EF7-9707-2238AE389BE3@strayalpha.com> <CAL9jLaY4h75KK4Bh-kZC6-5fJupaNdUfm1gK2Dg99jBntMCEyQ@mail.gmail.com> <C47149DC-CAF2-449F-8E18-A0572BBF4746@strayalpha.com> <CAL9jLaYfysKm7qrG=+jq7zV=5ODnSX-tAhBAiTU7SzYF-YmcGw@mail.gma il.com> <728C6048-896E-4B12-B80B-2091D7373D16@strayalpha.com>
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Message-ID: <8a676a4a-c76d-9fa5-ce79-534a14cf0511@gmail.com>
Date: Wed, 05 Dec 2018 17:46:14 +1300
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.2
MIME-Version: 1.0
In-Reply-To: <728C6048-896E-4B12-B80B-2091D7373D16@strayalpha.com>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/tsv-art/eMDYKUe6EE4Ph6KNQmSoXuPtCRY>
Subject: Re: [Tsv-art] [OPSEC] Tsvart last call review of draft-ietf-opsec-ipv6-eh-filtering-06
X-BeenThere: tsv-art@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Transport Area Review Team <tsv-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tsv-art>, <mailto:tsv-art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tsv-art/>
List-Post: <mailto:tsv-art@ietf.org>
List-Help: <mailto:tsv-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tsv-art>, <mailto:tsv-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 05 Dec 2018 04:46:22 -0000

On 2018-12-05 17:32, Joe Touch wrote:
> 
> 
> On Dec 4, 2018, at 8:11 PM, Christopher Morrow <morrowc.lists@gmail.com <mailto:morrowc.lists@gmail.com>> wrote:
> 
>>     That works only for HBH options of type 00. Others require particular actions when not supported.
>>
>>
>> can you expand on this some?
> 
> Nobody deprecated the flags that require HBH options to be processed or dropped if not supported. 

Intentionally. If a forwarding node is transparent to HbH options,
it is not looking at those flags. If it is looking at HbH options,
it will obey those flags. Why is that a problem?

    Brian

> 
> And if there is a security risk to the control plane, it is using that place for slow path processing without properly limiting its use of shared resources. 
> 
> This idea that packets processed as intended are a security risk is like saying big packets are a security risk to small packets. It may be a bad design but it doesn’t mean such packets are inherently a security risk. 
> 
> Joe

v2.23.0 | Report a Bug | By Email