Re: [v6ops] [OPSEC] [IPv6] Why folks are blocking IPv 6 extension headers? (Episode 1000 and counting) (Linux DoS)

[Fernando Gont <[e-mail]>]

Hi, Haisheng Yu,

On 26/5/23 06:14, Haisheng Yu (Johnson) wrote:
[....]
> 
> The essence of the extension header issue is determined by the 
> competition between operators and equipment vendors.For most internet 
> users, they rely on the default configurations provided by the operators 
> or equipment vendors. Operators always want devices from vendors that 
> offer powerful features (e.g., in SRv6, equipment vendors aim to support 
> as many layers of Segment Routing lists as possible). However, during 
> actual deployment, only a portion of these features is used due to 
> security concerns. Equipment vendors are motivated to innovate as they 
> seek to outperform their competitors and gain profits in the market.
> 
> The extension headers in IPv6 provide a significant advantage beyond the 
> address space of IPv4, enabling flexible and programmable network 
> transmissions. Looking at the current applications of IPv6 extension 
> headers, notable achievements have been made (such as SRv6). Perhaps 
> it's time to consider reducing restrictions on extension headers and 
> allow for more innovation and application.

I'm super fine with folks that have a use for EHs, to use them. -- And I 
agree that for vendors it's an interesting source fo revenue.

That said, I'm not that fine if invited to a party where, if anything, I 
will only pay the bills. So, I block everything that I don't use. e.g., 
I have no use for EHs in any of my servers, except the pentesting boxes 
that I use to send weird packets to others.

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494