Re: [v6ops] [Last-Call] Tsvart last call review of draft-ietf-v6ops-ipv6-ehs-packet-drops-05

[Fernando Gont <[e-mail]>]

Tom,

On 24/2/21 14:01, Tom Herbert wrote:
>>
> Fernando,
> 
> The analogy doesn't hold here because unlike knives, extension headers
> are not inherently dangerous. The problems have been caused by some
> routers implementations that have assumed unwritten requirements (like
> routers must access transport layer), unquantified requirements
> (header chains can't be too long), and apparently buggy
> implementations (mentioned in the draft). This draft describes, cites,
> recommends, references, or suggests (whichever you prefer) two
> specific mitigations which are to drop packets or rate limit packets.
> These mitigations are described without context or parameterization,
> so the reader might infer that blindly dropping all packets with
> extension headers is an acceptable mitigation. Furthermore, if the
> draft is suggesting mitigations to problems created by routers, then
> an obvious one would be to ask router vendors to fix their bugs (which
> I am trying to say without cynicism).

It seems that your mis-interpreting our document.

Abstract

    This document summarizes the operational implications of IPv6
    extension headers specified in the IPv6 protocol specification
    (RFC8200), and attempts to analyze reasons why packets with IPv6
    extension headers are often dropped in the public Internet.

It is an operational document produced by v6ops, and not a protocol spec 
produced by 6man. It is aimed at operators. And, if anything, the IETF 
can make use of it for further work.

It discusses challenges that are faced in the real world, from an 
operational perspective, discussing the things an operator may have at hand.

We don't provide recommendations. We don't even mean to.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492