Re: [v6ops] I-D Action: draft-ietf-v6ops-ipv6-ehs-packet-drops-01.txt

[Fernando Gont <[e-mail]>]

Hello, Dale,

Thanks a lot for your timely feedback! In-line....

On 14/10/20 13:19, Dale W. Carder wrote:
> Thus spake Fernando Gont ([e-mail]) on Wed, Oct 14, 2020 at 09:37:38AM -0300:
>> The rev is available at:
>> https://tools.ietf.org/html/draft-ietf-v6ops-ipv6-ehs-packet-drops-01
> 
> In section 7.4, is it worth referencing covert channel risk from rfc6437's
> section 6.1?

Section 7.4 is about the security implications of *EHs*... so that would 
be off-topic, so to speak...



> In section 7.1, I thought there was a class of devices (routers) where if
> configured with a packet filter / acl that when unable to find the upper
> protocol information buried past the size of the lookup engine would actually
> forward traffic even if the policy was to deny.  I could have sworn I saw
> this topic fly by on the v6ops list, but I can't find it (thus I don't want
> to mistakenly name and shame).

I do recall reports of that. I guess we can simply note it without a 
reference?  (I don't mind the reference myself, but some of my 
co-authors might differ :-) )


> I am not sure if I agree with the last paragraph of 6.1 which opines on
> the low adoption of rfc6437-style flow label hash entropy. 

We don't argue low-entropy, but issues with the Flow  Label 
implementation. See e.g.: 
https://blog.apnic.net/2018/01/11/ipv6-flow-label-misuse-hashing/



> I would
> expect that the current low adoption in ecmp implementations is a
> chicken/egg problem.  If you have a product that needs to hash and you are
> not confident there is enough adoption in host stacks, you are still forced
> to hunt for entropy from the upper-protocol protocols.  Otherwise all the
> legacy host traffic with the flow label set to 0 risks getting hashed
> entirely to one side or face reordering.

We're just stating that there's marginal usage of the Flow Label, which 
is what the work by Cunha et al seems to indicate. As to the possible 
consequences, part might be LBs lagging behind host implementations. But 
issues in the Flow Label implementation might have also discouraged its use.

That said, the important info that Section 6.1 is meant to convey is 
that there still seems to be marginal use of the FL. And also note that 
issues have been found in FL implementations. -- i.e., we're not trying 
to infer why there's marginal use of the FL.

If you think this warrants some tweaks in the text, please do let us know.

Thanks!

Regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492