Re: [v6ops] [IPv6] [OPSEC] Why folks are blocking IPv 6 extension headers? (Episode 1000 and counting) (Linux DoS)

[Tom Herbert <[e-mail]>]

On Fri, May 26, 2023 at 8:12 AM Fernando Gont <[e-mail]> wrote:
>
> Hi, Haisheng Yu,
>
> On 26/5/23 06:14, Haisheng Yu (Johnson) wrote:
> [....]
> >
> > The essence of the extension header issue is determined by the
> > competition between operators and equipment vendors.For most internet
> > users, they rely on the default configurations provided by the operators
> > or equipment vendors. Operators always want devices from vendors that
> > offer powerful features (e.g., in SRv6, equipment vendors aim to support
> > as many layers of Segment Routing lists as possible). However, during
> > actual deployment, only a portion of these features is used due to
> > security concerns. Equipment vendors are motivated to innovate as they
> > seek to outperform their competitors and gain profits in the market.
> >
> > The extension headers in IPv6 provide a significant advantage beyond the
> > address space of IPv4, enabling flexible and programmable network
> > transmissions. Looking at the current applications of IPv6 extension
> > headers, notable achievements have been made (such as SRv6). Perhaps
> > it's time to consider reducing restrictions on extension headers and
> > allow for more innovation and application.
>
> I'm super fine with folks that have a use for EHs, to use them. -- And I
> agree that for vendors it's an interesting source fo revenue.
>
> That said, I'm not that fine if invited to a party where, if anything, I
> will only pay the bills. So, I block everything that I don't use. e.g.,
> I have no use for EHs in any of my servers, except the pentesting boxes
> that I use to send weird packets to others.

Fernando,

If you're making that decision as the operator of a public network
then you are not making that decision for yourself, but you're making
a "big brother" decision for others and preventing permissionless
innovation as Brian stated nicely. I don't believe it could be claimed
that this is for "the good of the Internet".

Tom

>
> Cheers,
> --
> Fernando Gont
> SI6 Networks
> e-mail: [e-mail]
> PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------