Re: [v6ops] draft-gont-v6ops-ipv6-ehs-in-real-world: clarification text

Joe Touch <touch@isi.edu> Wed, 22 April 2015 18:04 UTC

Return-Path: <touch@isi.edu>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C56581ACF02 for <v6ops@ietfa.amsl.com>; Wed, 22 Apr 2015 11:04:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level:
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c4C1IZE9cx7I for <v6ops@ietfa.amsl.com>; Wed, 22 Apr 2015 11:04:34 -0700 (PDT)
Received: from webspace.isi.edu (webspace.isi.edu [128.9.64.65]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A27C61ACEFD for <v6ops@ietf.org>; Wed, 22 Apr 2015 11:04:27 -0700 (PDT)
Received: from [128.9.160.252] (pen.isi.edu [128.9.160.252]) (authenticated bits=0) by vapor.isi.edu (8.13.8/8.13.8) with ESMTP id t3MI1mwu007001 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Wed, 22 Apr 2015 11:01:50 -0700 (PDT)
Message-ID: <5537E20C.5030804@isi.edu>
Date: Wed, 22 Apr 2015 11:01:48 -0700
From: Joe Touch <touch@isi.edu>
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: Gert Doering <gert@space.net>
References: <553696EC.4060207@isi.edu> <55369855.1040101@joelhalpern.com> <55369B2D.80906@isi.edu> <20150422.084056.74672865.sthaug@nethelp.no> <5537D7A6.4020106@isi.edu> <20150422175452.GK54385@Space.Net>
In-Reply-To: <20150422175452.GK54385@Space.Net>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
X-ISI-4-43-8-MailScanner: Found to be clean
X-MailScanner-From: touch@isi.edu
Archived-At: <http://mailarchive.ietf.org/arch/msg/v6ops/PbkVXmUuIOF8_1tz0qgWbmStwtY>
Cc: draft-gont-v6ops-ipv6-ehs-in-real-world@tools.ietf.org, v6ops@ietf.org, merike@doubleshotsecurity.com, fgont@si6networks.com
Subject: Re: [v6ops] draft-gont-v6ops-ipv6-ehs-in-real-world: clarification text
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Apr 2015 18:04:35 -0000


On 4/22/2015 10:54 AM, Gert Doering wrote:
> Hi,
> 
> On Wed, Apr 22, 2015 at 10:17:26AM -0700, Joe Touch wrote:
>> I.e., not using EHs is your prerogative, and not forwarding EHs to
>> others is *their* prerogative, but castrating IPv6 for the entire
>> Internet is not necessary.
> 
> I'm not sure what the benfefit is in insisting that IPv6 as currently 
> standardized is The Only And Proper Way To Do Networking?  It was designed
> 20 years ago, and some of the assumptions from back then are turning out
> to cause enormous amount of friction today.

And might not tomorrow.

There are a lot of reasons why EHs are critical - source fragmentation
is one very important one.

> "Forwarding packets with EH" is one aspect of this, "RA guard" is 
> another one, and "correctly operating firewalls" (be it host-based or
> traditional perimeter based) is a third one.
> 
> So what's wrong with just fixing the damn protocol, and doing something
> productive with our time, like, "play with our kids"?

Nothing is wrong with fixing something that's broken.

That includes routers that don't support EH, and maybe the long shopping
list of "what if" extensions that we might not need. It also might
include a "jump to the transport header" EH.

But, FWIW, none of these problems are going away even without EHs. Today
it's EHs, tomorrow it'll be tunnel headers (which have the same
problem), and the next it'll be encryption.

It's always useful to explore the entire constellation of what needs to
be done. If it's critical to update IPv6, that ought to be done in
INTAREA, not as a convenience for operators, though.

Joe