Subject: Re: AD review of draft-ietf-6man-flow-3697bis

From: RJ Atkinson <[email-masked]>
Date: Tue, 21 Jun 2011 09:22:41 -0400

Earlier, Jari Arkko wrote:
> In addition, I'm not sure I understand how a router knows that it is a first hop router.

My understanding is that the IPv6 WG's compromise regarding 
the "Flow Label covert channel issue" that has been worked out 
expressly permits any IPv6 security gateway to rewrite 
IPv6 Flow Labels from value A to value B, if required by the 
security policy deployed in that IPv6 security gateway, 
provided that value B  provides the documented required 
mathematical properties that support load-balancing purposes.

Since IPv6 Flow Label rewriting is allowed under that situation, 
I don't see any value in restricting the rewriting of IPv6 packets 
containing a zero IPv6 Flow Label to a non-zero IPv6 Flow Label value 
-- again, provided the new non-zero value meets the documented 
required mathematical properties.

So I don't think it matters whether the router performing 
rewriting is a first-hop router or not.   Requiring a check
of whether the router is a first-hop router is just wasted
computational overhead for the router.  

From the perspective of an IPv6 router implementer, the relevant 
data are (A) was the IPv6 Flow Label value zero upon receipt
by that router, (B) are the 5 input values easily read 
by that router, and (C) is calculating a non-zero Flow Label 
value reasonable given other computational demands on that 
router at that moment in time.  

For an ASIC-based or FPGA-based IPv6 forwarding engine, 
- (A) is trivial to check at wire speed
- (B) is true IFF packet is not fragmented
- (C) is irrelevant since one would throw a few lines
      of Verilog at the problem

For an NP-based IPv6 forwarding engine,
- (A) is trivial to check at wire speed
- (B) is generally true IFF packet is not fragmented
- (C) depends primarily on how much other processing
      (e.g. encapsulation/decapsulation) that particular frame 
      might require, and secondarily on the number of
      NP cycles available while performing at wire-speed

BOTTOM LINE:

If any IPv6 router sees any zero-value Flow Label, the router ought 
to be permitted (but NOT required) to rewrite the Flow Label value 
to a non-zero value that meets the published mathematical requirements.

Yours,

Ran