Re: [v6ops] Security Considerations for draft-gont-v6ops-ipv6-ehs-in-real-world

[Fernando Gont <[e-mail]>]

On 09/03/2014 09:59 PM, Mark Andrews wrote:
>>
>> I think the problem is that isn't painful at all to the people who
>> configure the blocking device. It's only painful to actual users.
> 
> Which in 99% of case work for the same people that orded the firewall
> to be installed.  If fragments aren't getting to your device take
> the issue up with your management.  It's almost always a problem
> at the receiving end.

Brian already commented on this issue. That said, for the case we are
describing, your assessment does not really apply: the filtering is
happening in transit rather than at the edge.

e.g., I was able to attack my own connection against www.kernel.org, and
there wasn't any firewall on my access.

Whether firewalls at the edge are predominant when it comes to filtering
of IPv6 packets with Ehs between peers (i.e., peer to peer) is something
worth exploring... but for the time being is rather orthogonal to our
discussion (although it might help to exacerbate the problem when
there's no filtering on the network, but the border firewall does filter
IPv6 packets with EHs).

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492