Re: [v6ops] WG Doc? draft-gont-v6ops-ipv6-ehs-packet-drops

[Lorenzo Colitti <[e-mail]>]

On Thu, Mar 17, 2016 at 8:23 PM, Fernando Gont <[e-mail]>
wrote:

> Every time we talked about EHs, you asked the same question: "why do you
> need to obtain the layer-4 information, if you're supposed to just fwd
> packets?"
>

I disagree with the characterization of the problem. Intermediate routers
don't typically need to find the layer-4 header. If operators configure
them to do so, then such operators are also free to configure the boxes to
drop the packets if they can't find the layer-4 header.

As regards ACLs: the extension headers are a part of the packet just like
any other, and security policies can do whatever they wish with them. You
can certainly define a security policy that allows no extension headers at
all if you wish.

As regards hashing: traversing the whole length of the extension header
chain only to provide flow-based hashing is a bad use of processing power.
(If it's implemented in hardware, it's might also be a bad use of die
space, enercy, customer money, etc.) Using the flow label is much better.
So perhaps we should recommend that if hosts emit packets with extension
headers, they should also randomize the flowlabel.