IETF Logo Mail Archive

Re: [v6ops] [IPv6] [EXTERNAL] Re: [OPSEC] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)

Tom Herbert <tom@herbertland.com> Fri, 26 May 2023 15:51 UTC

Return-Path: <tom@herbertland.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 867BEC1519B1 for <v6ops@ietfa.amsl.com>; Fri, 26 May 2023 08:51:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=herbertland.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id remboO9DSmm8 for <v6ops@ietfa.amsl.com>; Fri, 26 May 2023 08:51:10 -0700 (PDT)
Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACB75C1519A6 for <v6ops@ietf.org>; Fri, 26 May 2023 08:51:10 -0700 (PDT)
Received: by mail-pl1-x62f.google.com with SMTP id d9443c01a7336-1ae875bf125so6137115ad.1 for <v6ops@ietf.org>; Fri, 26 May 2023 08:51:10 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=herbertland.com; s=google; t=1685116270; x=1687708270; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=TTTRW/lXTp+05BNDygiyS/GrpofLmQJFgRc2h1GvGiM=; b=DDNlIQxmXvjtg/hSjrb/+NPrQ0ofbw5URdsGOxpi7XYcrSx6W19sd+gRls0mXKahNi WlpRfHUBm3olSwLkJa6k6bJ+ODeUSL2EB/V/rdN9sDWORIruGx3FkWBEffPjJfJ4Q82/ nGdAYkqDdKcDf58ue8gii4TF/HudNgMkEYd7hPqopoyndVhok5Kpniy+4+uzcqpQ3yK1 IYqS4/I13Xk6L9wyQSWZaO/Tku8thBOtR3Tlr0CWZV/LfYmGqxGM1oYMCqQ3EeoEvPJk 1WZvW+Jv5G7bw+ynC42AAILI7e+NpCoHL0YLNxx++jnOkyl+R0MGDjgD2cv6otVtucJO RlUw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685116270; x=1687708270; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TTTRW/lXTp+05BNDygiyS/GrpofLmQJFgRc2h1GvGiM=; b=aYrMwXjlKtXyJpiXxKplxmxB/9zKYvfgyBR1MQYTIvfzg+PQWZ/o2GBcE3OIIy9DUi C8+QmAs71vGVupTUdxisYnQTHFaEztrCv7uk0Dh13W3C3Ry738HH4cMJskEoltlnoeNW RbT6CW29WaVX/RhszCS9vZA1BCQDWRjTab6W5u6hjqzTfus4W0NhMoShtLqq+NbRMH2Q LXR5C6TFDLS4eKaVCEXt1i8HUIosY1WDkwDgK/ygPw3WqTRIUfNWC1OSdK33x+ROTSDM nSSqtMsF8HO5v4r/Hn7BNeAhA9OTBCwH6fx0yB1ghZjsUNaBAxUJbH6boZ5Gka4YjIjG ny8w==
X-Gm-Message-State: AC+VfDzWfhejIyoSquRhjhaK7HxB2o9Dp/guBXshmBUevG2p4o9rW+zQ Rvy8COR0DQ6pXf7GjZKrAwDMIRYi2WlC9XPiikanQw==
X-Google-Smtp-Source: ACHHUZ6pgFLHV0ku/LvVg/tYCgHOicNWy5qu7dijY1E+xfE3gtV5Dwn7/AS5OlE55PgRkJlGl0+vdBnPon1JtnhAtT0=
X-Received: by 2002:a17:902:f551:b0:1af:b47e:7887 with SMTP id h17-20020a170902f55100b001afb47e7887mr3505399plf.65.1685116269628; Fri, 26 May 2023 08:51:09 -0700 (PDT)
MIME-Version: 1.0
References: <11087a11-476c-5fb8-2ede-e1b3b6e95e48@si6networks.com> <CALx6S343f_FPXVxuZuXB4j=nY-SuTEYrnxb3O5OQ3fv5uPwT8g@mail.gmail.com> <CAN-Dau1pTVr6ak9rc9x7irg+aLhq0N8_WOyySqx5Syt74HMX=g@mail.gmail.com> <a087b963-1e12-66bf-b93e-5190ce09914b@si6networks.com> <CALx6S349nNA8L5+_1hrbWayqp8GfTYypWy_SP57c_Xxams=csg@mail.gmail.com> <51a066b3-4b4c-d573-ffbe-d6b44a4f193f@gont.com.ar> <a411a1b0-c521-c456-3d44-d99a1cc0975b@gmail.com> <CWXP265MB5153E4687BE45480DBC5A531C2439@CWXP265MB5153.GBRP265.PROD.OUTLOOK.COM> <27d28224-0cb0-eec2-8d54-f0d175596c85@gmail.com> <f5758380-9967-b67b-744d-dc36b7b599ab@si6networks.com> <72784f8e65f34bcc9f5652c0a553c70c@boeing.com> <CALx6S373P2X-JRbCNpOCGuq_Cum0+OzJFRBkuQ64h5R52B7Dhw@mail.gmail.com> <222731ea012b4b0ebd7a51f72b5bcd40@boeing.com> <dd61024e-1bd8-ff3d-216f-22cc7600ad10@gmail.com> <CAHw9_iJyXiT=O5cMyy08bVq+U7VTtKTkR_60OfvrcCng8Joe5w@mail.gmail.com> <d9b86705-463c-c754-6e47-5b21917f9aa5@gont.com.ar>
In-Reply-To: <d9b86705-463c-c754-6e47-5b21917f9aa5@gont.com.ar>
From: Tom Herbert <tom@herbertland.com>
Date: Fri, 26 May 2023 08:50:57 -0700
Message-ID: <CALx6S37RQObFts+1o2fj56FK7BzDATCVcDpThRb7w=q9uyRYug@mail.gmail.com>
To: Fernando Gont <fernando@gont.com.ar>
Cc: Warren Kumari <warren@kumari.net>, Brian E Carpenter <brian.e.carpenter@gmail.com>, IPv6 Operations <v6ops@ietf.org>, 6man <ipv6@ietf.org>, opsec@ietf.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/PQSoK_2qvQV9aT5WVn2LrWIK5FQ>
Subject: Re: [v6ops] [IPv6] [EXTERNAL] Re: [OPSEC] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 26 May 2023 15:51:14 -0000

On Fri, May 26, 2023 at 8:38 AM Fernando Gont <fernando@gont.com.ar> wrote:
>
> Hi, Warren,
>
> On 26/5/23 11:03, Warren Kumari wrote:
>
> >
> >
> > On Thu, May 25, 2023 at 11:13 PM, Brian E Carpenter
> > <brian.e.carpenter@gmail.com <mailto:brian.e.carpenter@gmail.com>> wrote:
> >
> [....]
> >
> >     A well-implemented host will not be troubled by unkown extension
> >     headers or options.
> >
> >
> > Indeed. However, not all hosts are well-implemented.
>
> Indeed. Datapoint:
> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=IPv6+extension+header
>
> Smarter searching/keywords will at least double the results.

Uh, several of those are bugs in Cisco routers not host
implementations. In any case, this is hardly a quantitative
measurement of quality in hosts. I suggest you look at netdev list of
Linux, the world's most deployed OS, when security issues are found,
they are addressed quickly. Consumer devices are updated regularly, at
least faster than routers are typically updated, and at least an order
of magnitude faster than it takes to IETF to publish an RFC.

Tom

>
>
> --
> Fernando Gont
> e-mail: fernando@gont.com.ar
> PGP Fingerprint: 7F7F 686D 8AC9 3319 EEAD C1C8 D1D5 4B94 E301 6F01
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

v2.23.0 | Report a Bug | By Email