Re: [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03

Tim Chown <Tim.Chown@jisc.ac.uk> Thu, 05 October 2017 08:04 UTC

Return-Path: <tim.chown@jisc.ac.uk>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0AAA1321CB for <v6ops@ietfa.amsl.com>; Thu, 5 Oct 2017 01:04:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.32
X-Spam-Level:
X-Spam-Status: No, score=-4.32 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=jisc.ac.uk
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xgDhJLzEHRPM for <v6ops@ietfa.amsl.com>; Thu, 5 Oct 2017 01:04:05 -0700 (PDT)
Received: from eu-smtp-delivery-189.mimecast.com (eu-smtp-delivery-189.mimecast.com [207.82.80.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B28E913247A for <v6ops@ietf.org>; Thu, 5 Oct 2017 01:04:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jisc.ac.uk; s=mimecast20170213; t=1507190641; h=from:subject:date:message-id:to:cc:mime-version:content-type:content-transfer-encoding:in-reply-to:references; bh=Bhuy4zoLOU32SViCmQM84J+w47R3bUdLfM+3Z37WIIk=; b=dmDbfWhYB8HnJ6XuBQ0neiySSQpHHFcDgy43tJAxUBXLQ2TvB9/wTh7jqjto+POa2qX+gTzEIIsIIgmpLsXYyEsbjJ+ygwLXTb8eiUyINomGTQODkQx/fbOVt8OYyzK1ehXvPD4HZvAGF+PYSe3Xdv2icnV4/+HTkK++2VwW/Nw=
Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-db5eur01lp0176.outbound.protection.outlook.com [213.199.154.176]) (Using TLS) by eu-smtp-1.mimecast.com with ESMTP id uk-mta-129-eKZOwXvvPCWGHoDCzlfT4g-1; Thu, 05 Oct 2017 09:02:35 +0100
Received: from AM3PR07MB1140.eurprd07.prod.outlook.com (10.163.188.14) by AM3PR07MB1139.eurprd07.prod.outlook.com (10.163.188.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.5; Thu, 5 Oct 2017 08:02:34 +0000
Received: from AM3PR07MB1140.eurprd07.prod.outlook.com ([fe80::6d:9ebf:900:b590]) by AM3PR07MB1140.eurprd07.prod.outlook.com ([fe80::6d:9ebf:900:b590%14]) with mapi id 15.20.0077.018; Thu, 5 Oct 2017 08:02:34 +0000
From: Tim Chown <Tim.Chown@jisc.ac.uk>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
CC: Joe Touch <touch@strayalpha.com>, "Van De Velde, Gunter (Nokia - BE/Antwerp)" <gunter.van_de_velde@nokia.com>, "opsec@ietf.org" <opsec@ietf.org>, "v6ops@ietf.org" <v6ops@ietf.org>, "draft-ietf-opsec-ipv6-eh-filtering@ietf.org" <draft-ietf-opsec-ipv6-eh-filtering@ietf.org>
Thread-Topic: [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03
Thread-Index: AQHTOPqnaanFnY3C/0OsRx2AxtJLKaLTsseAgACWVQCAAKWagA==
Date: Thu, 5 Oct 2017 08:02:34 +0000
Message-ID: <24A7E567-1CE3-4EF2-AC44-F3C2C9890A4A@jisc.ac.uk>
References: <8C3BB7BE-4E84-4D44-8DA9-BBE80EA51752@nokia.com> <e8ede91e-8d46-5364-9789-76d7e833fb7d@strayalpha.com> <2c8c0d70-4b63-12ba-d83a-192b829159b8@gmail.com>
In-Reply-To: <2c8c0d70-4b63-12ba-d83a-192b829159b8@gmail.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-mailer: Apple Mail (2.3273)
x-originating-ip: [194.82.140.195]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; AM3PR07MB1139; 20:wRHz+aePrfsD+nvltUjGG4A7BFRNzn+tyFOuSuVyhC1dXRs+U1W2R3qbPVwiVS5EfvZJhR+pMyMoYwT/KszqSq3EF74XmYeS92Nx1JLuq9V66jeXnnTzlyPnVf8zBGZ8pXc/KPt5Vf+Q/tearccoWsm0gv3qCJkduV1mZ7F4p3g=
x-ms-exchange-antispam-srfa-diagnostics: SSOS;
x-ms-office365-filtering-correlation-id: 07bd036d-d1cd-4b53-8ae0-08d50bc76fb8
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254152)(2017052603199)(201703131423075)(201703031133081)(201702281549075); SRVR:AM3PR07MB1139;
x-ms-traffictypediagnostic: AM3PR07MB1139:
x-exchange-antispam-report-test: UriScan:;
x-microsoft-antispam-prvs: <AM3PR07MB1139FF60EA5B7581E02879F4D6700@AM3PR07MB1139.eurprd07.prod.outlook.com>
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(3002001)(100000703101)(100105400095)(10201501046)(93006095)(93001095)(6041248)(20161123564025)(20161123560025)(201703131423075)(201702281529075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123562025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:AM3PR07MB1139; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:AM3PR07MB1139;
x-forefront-prvs: 04519BA941
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(346002)(376002)(199003)(377454003)(24454002)(189002)(76176999)(8676002)(50226002)(4326008)(82746002)(99286003)(6506006)(57306001)(66066001)(6246003)(478600001)(3660700001)(3280700002)(2906002)(101416001)(86362001)(53936002)(8936002)(97736004)(81166006)(25786009)(6306002)(53546010)(81156014)(105586002)(6512007)(5250100002)(39060400002)(6436002)(54906003)(6486002)(42882006)(83716003)(7736002)(106356001)(189998001)(2950100002)(786003)(14454004)(5660300001)(50986999)(230783001)(316002)(36756003)(33656002)(6916009)(72206003)(6116002)(305945005)(2900100001)(68736007)(102836003)(3846002)(74482002)(966005)(229853002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM3PR07MB1139; H:AM3PR07MB1140.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-ID: <4EAD47E54B20D14EB2EE1FC82FE39286@eurprd07.prod.outlook.com>
MIME-Version: 1.0
X-OriginatorOrg: jisc.ac.uk
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Oct 2017 08:02:34.2930 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 48f9394d-8a14-4d27-82a6-f35f12361205
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM3PR07MB1139
X-MC-Unique: eKZOwXvvPCWGHoDCzlfT4g-1
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: base64
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/xfaYFLFRufDdj3QMNHJPZlXJDRQ>
Subject: Re: [v6ops] WGLC for draft-ietf-opsec-ipv6-eh-filtering-03
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Oct 2017 08:04:06 -0000

Hi,

> On 4 Oct 2017, at 23:10, Brian E Carpenter <brian.e.carpenter@gmail.com> wrote:
> 
> On 05/10/2017 02:12, Joe Touch wrote:
>> 
>> 
>> On 9/29/2017 1:12 AM, Van De Velde, Gunter (Nokia - BE/Antwerp) wrote:
>>> 
>>> This is to open a two week WGLC
>>> for https://tools.ietf.org/html/draft-ietf-opsec-ipv6-eh-filtering-03.
>>> 
>> 
>> I do not agree with the claims of this document. It "informationally"
>> advises against support for key IPv6 capabilities and undermines the
>> extensibility of IPv6 by making recommendations about discarding
>> currently unassigned codepoints.
> 
> Here's the problem, Joe. It's a fact of life that many firewalls
> discard a lot of stuff that they shouldn't - that's why we wrote
> RFC 7045 - but in the real world, operators blunder around based
> on folklore and vendors' defaults. We can't change any of that, but
> we can try to issue sensible advice that, overall, will limit the
> resulting breakage. IMHO this document, positioned correctly as
> Informational, will do that: on balance, it makes the world a better
> place.
> 
> I agree with Bob Hinden that a careful review against RFC 8200 is
> essential. I already pointed out one problem (RH0) at
> https://mailarchive.ietf.org/arch/msg/opsec/StjbjvCP9PLC3ssnTKYO6jqFgk0
> and Bob found a problem with Hop-by-Hop.

I think pragmatic Informational (not BCP) advice is useful.

The advice seems to boil down to four categories. I guess it would be interesting to discuss which categories the WG feels are acceptable for publication as an Informational document, and which are problematic. Can we nail down where the issues are?

a) Advice on different EH types

Here, the document advises dropping RH0; all other EH types except HBH are permitted.
For HBH options, the recommended policy depends on the system capability; with h/w support, allow, with only slow path support and no rate limiting capability, consider dropping.
This section seems pragmatic.

b) Advice on unknown EH types

3.5.5 "Intermediate systems should discard packets containing unknown IPv6 EHs.”
This conflicts with Section 2.1 of RFC7045.

c) Advice on different IPv6 options

The advice here is a mixture of recommended drops, and conditional drops.
Recommended drops: SMF_DPD, Endpoint Identification, Line-Identification Option, Deprecated
Conditional: Jumbo Payload, RPL, Router Alert, CALIPSO, IP_DFF, RFC3692-style Experiment 
i.e. if your network doesn’t require those options to function, drop them.
Pragmatic again.

d) Advice on unknown IPv6 options

4.4.5 "Enterprise intermediate systems that process the contents of IPv6 EHs
   should discard packets that contain unknown options.  Other
   intermediate systems that process the contents of IPv6 EHs should
   permit packets that contain unknown options.”

It’s not clear here why the advice is different for enterprise vs intermediate.
And why the recommended unknown IPv6 option policy is different to unknown EH policy.

A summary table for IPv6 options would be useful, as per the EH types.

Saying that, the summary for Routing Header types in the table is not consistent with the advice in the text.

As per Bob and Brian’s comments, alignment with RFC 8200 is a must.

So in general I support pragmatic advice, but there are some open questions and conflicts in the text as it is.

Tim