Re: [v6ops] Operational Implications of IPv6 Packets with Extension Headers - Security as Functionality

[Tom Herbert <[e-mail]>]

On Mon, Jul 27, 2020 at 1:57 AM Vasilenko Eduard
<[e-mail]> wrote:
>
> Hi Fernando,
> Security is sometimes functionality, not vulnerability or attack vector. The good example is Firewall. Firewall needs to parse all headers to be useful.
> Hence, I believe it is in the logic of this draft to have section 5.1.5: one additional "use case" when parsing of ALL headers are mandatory. FW, IDPS

Eduard,

I would love to see the firewall device that is capable of processing
ALL protocol headers in the IETF protocol suite! Reality is that
firewalls can only process what they are programmed to process which
is typically a very small subset of the possible protocols a host
might want to use. The effect of this model is protocol ossification
since firewalls drop anything that they don't understand even if the
protocols are otherwise useful to the host endpoints. EH is one victim
of protocol ossification in this regard, but it's not the only the
one. For instance QUIC and any future transport protocols will encrypt
as much as the packet as possible expressly for the purpose of
avoiding ossification of these protocols by middleboxes.

Tom

> Eduard
> -----Original Message-----
> From: v6ops [mailto:[e-mail]] On Behalf Of Fernando Gont
> Sent: 26 июля 2020 г. 8:46
> To: IPv6 Operations <[e-mail]>
> Cc: [e-mail]
> Subject: [v6ops] Operational Implications of IPv6 Packets with Extension Headers (Fwd: New Version Notification for draft-gont-v6ops-ipv6-ehs-packet-drops-04.txt)
>
> Folks,
>
> We have posted a rev of our IETF I-D "Operational Implications of IPv6 Packets with Extension Headers".
>
> The I-D is available at:
> https://www.ietf.org/internet-drafts/draft-gont-v6ops-ipv6-ehs-packet-drops-04.txt
>
> Your feedback will be appreciated.
>
> Thanks!
>
> Cheers,
> Fernando
>
>
>
>
> -------- Forwarded Message --------
> Subject: New Version Notification for
> draft-gont-v6ops-ipv6-ehs-packet-drops-04.txt
> Date: Sat, 25 Jul 2020 22:28:50 -0700
> From: [e-mail]
> To: Fernando Gont <[e-mail]>, Gert Doering <[e-mail]>, Geoff Huston <[e-mail]>, Warren Kumari <[e-mail]>, Nick Hilliard <[e-mail]>
>
>
> A new version of I-D, draft-gont-v6ops-ipv6-ehs-packet-drops-04.txt
> has been successfully submitted by Fernando Gont and posted to the IETF repository.
>
> Name:           draft-gont-v6ops-ipv6-ehs-packet-drops
> Revision:       04
> Title:          Operational Implications of IPv6 Packets with Extension Headers
> Document date:  2020-07-25
> Group:          Individual Submission
> Pages:          15
> URL:
> https://www.ietf.org/internet-drafts/draft-gont-v6ops-ipv6-ehs-packet-drops-04.txt
> Status:
> https://datatracker.ietf.org/doc/draft-gont-v6ops-ipv6-ehs-packet-drops/
> Htmlized:
> https://tools.ietf.org/html/draft-gont-v6ops-ipv6-ehs-packet-drops-04
> Htmlized:
> https://datatracker.ietf.org/doc/html/draft-gont-v6ops-ipv6-ehs-packet-drops
> Diff:
> https://www.ietf.org/rfcdiff?url2=draft-gont-v6ops-ipv6-ehs-packet-drops-04
>
> Abstract:
>     This document summarizes the security and operational implications of
>     IPv6 extension headers, and attempts to analyze reasons why packets
>     with IPv6 extension headers may be dropped in the public Internet.
>
>
>
>
> Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
>
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops
>
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops