Re: [v6ops] [EXT] Re: [OPSEC] [IPv6] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)

[Bob Natale <[e-mail]>]

Thanks for the feedback, Nalini. I believe that Ole’s subsequent comment captured my concern and position in more precise technical terms:

Ole:
> Now for EHs in general. Their functionality of providing a separate signalling channel independent of the application… it might be time that we accept that this was a bad idea. Which deployment status has confirmed.

Learning,
BobN

From: [e-mail] <[e-mail]>
Sent: Monday, May 22, 2023 10:38 AM
To: Tom Herbert <tom=[e-mail]>; Nick Buraglio <[e-mail]>; Bob Natale <[e-mail]>
Cc: Fernando Gont <[e-mail]>; [e-mail]; V6 Ops List <[e-mail]>; opsec WG <[e-mail]>
Subject: [EXT] Re: [OPSEC] [v6ops] [IPv6] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)

Bob,

I am not sure of what you are saying.

> New uses should require protocol updates via the standard process or new protocols

Of course, protocol updates will go through the IETF process.  All I am saying is that sitting here in 2023, we cannot tell what "new uses" will be found in 2033.   I would expect that someone who has a new option will submit it to the IETF as an internet draft, etc.

Hope that is more clear.

Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com<http://www.insidethestack.com>
[phone]


On Monday, May 22, 2023 at 07:17:49 AM PDT, Bob Natale <[e-mail]<mailto:[e-mail]>> wrote:



From way up in the nose-bleed section for lurkers:

> Although, IMHO one of the points of extension headers is that they can be used to extend the protocol for purposes which we cannot think of today!



Something tells me that’s a bad idea for Internet-grade (and similar) standard protocols … just sounds “looser” (i.e., congenitally riskier and ultimately “messier”) than defined options or profiles. New uses should require protocol updates via the standard process or new protocols. Is that an utterly naïve position and the Internet cannot live without protocols that do not include undefined “extensions” for purposes we cannot think of at the time the protocols are standardized?



Lurking with a bit of vertigo now 😊,

BobN



From: OPSEC <[e-mail]<mailto:[e-mail]>> On Behalf Of [e-mail]<mailto:[e-mail]>
Sent: Thursday, May 18, 2023 10:53 AM
To: Tom Herbert <tom=[e-mail]<mailto:tom=[e-mail]>>; Nick Buraglio <[e-mail]<mailto:[e-mail]>>
Cc: Fernando Gont <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; V6 Ops List <[e-mail]<mailto:[e-mail]>>; opsec WG <[e-mail]<mailto:[e-mail]>>
Subject: [EXT] Re: [OPSEC] [v6ops] [IPv6] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)



Nick,



> neither really have use cases



I think a use cases document is a great idea!  Although, IMHO one of the points of extension headers is that they can be used to extend the protocol for purposes which we cannot think of today!



Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com<http://www.insidethestack.com>
[phone]





On Thursday, May 18, 2023 at 07:49:50 AM PDT, Nick Buraglio <[e-mail]<mailto:[e-mail]>> wrote:





Is there any document that details the current operational best practices or explains the EH options and use cases in a succinct document? I didn't find one (although I did not look terribly hard). If not, that sounds like an opportunity to work through them and create one, perhaps?

Nalani has a deep dive study here https://www.ietf.org/archive/id/draft-elkins-v6ops-eh-deepdive-fw-01.html and https://datatracker.ietf.org/doc/draft-elkins-v6ops-eh-deepdive-cdn/ but I wasn't able to find a list with some use cases akin to the ND considerations draft here https://datatracker.ietf.org/doc/draft-ietf-v6ops-nd-considerations/

RFC7045 has a decent, and RFC2460 explains what they are but neither really have use cases.



nb



On Thu, May 18, 2023 at 9:33 AM Tom Herbert <tom=[e-mail]<mailto:[e-mail]>> wrote:

On Thu, May 18, 2023 at 7:24 AM Andrew Campling
<[e-mail]<mailto:[e-mail]>> wrote:
>
> I wonder if part of the issue here is that insufficient attention is being given to operational security matters and too much weight is given to privacy in protocol development, irrespective of the security implications (which is of course ultimately detrimental to security anyway)?

Andrew,

There is work being done to address the protocol "bugs" of extension
headers. See 6man-hbh-processing and 6man-eh-limits for instance.

Tom

>
> Andrew
>
>
> From: OPSEC <[e-mail]<mailto:[e-mail]>> on behalf of Fernando Gont <[e-mail]<mailto:[e-mail]>>
> Sent: Thursday, May 18, 2023 2:19 pm
> To: David Farmer <[e-mail]<mailto:[e-mail]>>; Tom Herbert <tom=[e-mail]<mailto:[e-mail]>>
> Cc: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; V6 Ops List <[e-mail]<mailto:[e-mail]>>; opsec WG <[e-mail]<mailto:[e-mail]>>
> Subject: Re: [OPSEC] [IPv6] Why folks are blocking IPv6 extension headers? (Episode 1000 and counting) (Linux DoS)
>
> Hi, David,
>
> On 18/5/23 02:14, David Farmer wrote:
> >
> >
> > On Wed, May 17, 2023 at 13:57 Tom Herbert
> > <tom=[e-mail]<mailto:[e-mail]>
> > <mailto:[e-mail]<mailto:[e-mail]>>> wrote:
> [...]
> >
> > Maximum security is rarely the objective, I by no means have maximum
> > security at my home. However, I don’t live in the country where some
> > people still don’t even lock there doors. I live in a a city, I have
> > decent deadbolt locks and I use them.
> >
> [....]
> >
> > So, I’m not really happy with the all or nothing approach the two of you
> > seem to be offering for IPv6 extension headers, is there something in
> > between? If not, then maybe that is what we need to be working towards.
>
> FWIW, I[m not arguing for a blank "block all", but rather "just allow
> the ones you really need" -- which is a no brainer. The list you need
> is, maybe Frag and, say, IPsec at the global level? (from the pov of
> most orgs).
>
> (yeah... HbH and the like are mostly fine for the local link (e.g. MLD).
>
> Thanks,
> --
> Fernando Gont
> SI6 Networks
> e-mail: [e-mail]<mailto:[e-mail]>
> PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494
>
> _______________________________________________
> OPSEC mailing list
> [e-mail]<mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/opsec

_______________________________________________
v6ops mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/v6ops

_______________________________________________
v6ops mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/v6ops