Re: [v6ops] I-D Action: draft-gont-v6ops-ipv6-ehs-packet-drops-01.txt

[Brian E Carpenter <[e-mail]>]

Hi,

> 2.  Previous Work on IPv6 Extension Headers
...
>    ... [RFC7045] clarifies how intermediate
>    nodes should deal with IPv6 extension headers.

More than that, it means that they can find the end of the
header chain, which is the critical issue for this draft.
Middleboxes that implement 7045 can find the end of any header
chain conforming to headers standardised up to the date of
implementation.

> 4.1.1.  Enforcing infrastructure ACLs

I think you should list ICMP PTB and fragment headers as
likely permitted traffic here. (Yes, I know you discuss
PTB as an attack vector later, but in general it needs to
be permitted everywhere.)

> 4.1.3.  ECMP and Hash-based Load-Sharing

You could note that the flow label is a specific mitigation for
this aspect (RFC 6437, 6438).

> 4.2.  Route-Processor Protection
...
>    The Hop-by-Hop Options header is particularly challenging since, in
>    most (if not all) implementations, it causes the corresponding packet
>    to be punted to a software path.  As a result, operators usually drop
>    IPv6 packets containing this extension header.

You definitely need a reference to draft-baker-6man-hbh-header-handling here.

Regards
   Brian