Re: [v6ops] draft-gont-v6ops-ipv6-ehs-in-real-world: clarification text

[Mark ZZZ Smith <[e-mail]>]

      From: Gert Doering <[e-mail]>
 To: Joe Touch <[e-mail]> 
Cc: "[e-mail]" <[e-mail]>; Merike Kaeo <[e-mail]>; "[e-mail]" <[e-mail]>; Fernando Gont <[e-mail]> 
 Sent: Tuesday, 21 April 2015, 16:48
 Subject: Re: [v6ops] draft-gont-v6ops-ipv6-ehs-in-real-world: clarification text
   
Hi,

On Mon, Apr 20, 2015 at 02:28:08PM -0700, Joe Touch wrote:
> On 4/20/2015 2:21 PM, Gert Doering wrote:
> > On Mon, Apr 20, 2015 at 08:43:28AM -0700, Joe Touch wrote:
> >>> If for some reasons, a router in the middle needs access to layer-4
> >>                                              ^^^^^
> >>> information (IPFIX? DDoS mitigation? ... ?), then the EH chain must be
> >>> parsed which can cause a performance impact.
> > [..]
> >>     1) this is the router vendor's decision, not a requirement
> >>     of Internet routers
> > 
> > So, please tell me how you build an Internet router that is able to
> > defend itself against control plane abuse and does not need to look into
> > L4 to do so?
> 
> A router can protect its own control plane by looking at the packet
> contents, but then it is acting as a host at that point and should be
> looking there only for packets addressed to interfaces of that router.
> That's not a forwarding function and thus doesn't limit the forwarding
> plane.

Of course, but real world requires that this filter function needs to be
implemented in the forwarding plane, because otherwise packets would just
saturate the link between forwarding and control plane if you would only 
filter on "the other side".
/ So it should be easily possible to identify trusted IPv6 source and/or destination addresses for control plane processes/protocols, and drop packets that don't match them those on ingress to that control plane link, filtering them at egress of the forwarding plane. Host firewalling at the ingress of the control plane would then be able to perform further level of filtering if necessary. With the processing power of control plane CPUs these days, they shouldn't have trouble doing that.
/Furthermore, network cards these days perform large receive offload (concatenation of multiple UDP or TCP packets to be able to form a single large one to hand up to the operating system.) Because of their level of UDP or TCP understanding, It may be possible to push TCP or UDP port level filtering down into one of those if the control plane link is actually an ethernet link (or you could put one at the forwarding plane egress of the link to the control plane, and perform TCP/UDP port level filtering there.)
/ Regards,
Mark.



>From a purely academic point of view, I totally agree with you.  

Unfortunately, the Internet is not.



Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                  HRB: 136055 (AG Muenchen)
Tel: [phone]          USt-IdNr.: DE813185279
_______________________________________________
v6ops mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/v6ops