Re: [Tsv-art] [OPSEC] Tsvart last call review of draft-ietf-opsec-ipv6-eh-filtering-06

[Jared Mauch <[e-mail]>]

> On Dec 6, 2018, at 5:05 PM, Brian E Carpenter <[e-mail]> wrote:
> 
> Gert,
> 
> On 2018-12-06 22:13, Gert Doering wrote:
>> Hi,
>> 
>> On Thu, Dec 06, 2018 at 01:48:29PM +1300, Brian E Carpenter wrote:
>>> And I don't think that is an oversight. The *definition* of "router"
>>> for IPv6 is "a node that forwards IPv6 packets not explicitly addressed
>>> to itself." No mention of filtering, classification, admission control,...
>> 
>> This definition of a router is nice, but such a device will not be 
>> useful in today's Internet.
> 
> Are you saying that *every* router in a carrier network needs to
> perform filtering? I would have thought that this would be done
> where necessary, but intentionally avoided elsewhere, to reduce
> energy consumption and improve throughput. Anyway…

Depends on how you build your network, but yes, every router needs to
perform filtering and you want it done in hardware as well.

>> What do you want this draft to be?  Theoretically beautiful, or useful
>> for people operating outside a closed and well-controlled network?
> 
> I wasn't actually thinking about this draft; I was just trying to make
> the (obvious) point that IPv6 was designed a certain way and that is
> what the IPv6 standards track documents deal with. This draft is directed
> at the operational community and I fully agree with you that it needs
> to match operational reality as much as possible. (My issues with the
> draft were fixed before it moved to IETF Last Call.)

We learned in the late 90s and early 2000’s about the problems of
processing things like IP options and their complexity.  Most providers
turn off or filter these as they are a risk to the control plane of the
device and there could be loss of control of the device due to the CPU
being consumed with these packets.  You can’t have a few hundred gigs
Of traffic going to the CPU, no matter what scale you think the router
is.

	- Jared