Subject: 6MAN WG Call for adoption draft-gont-6man-oversized-header-chain-02

From: Ole Trøan <[email-masked]>
Date: Wed, 13 Jun 2012 14:29:45 +0200

All,
     This starts a 2-week consensus call on adopting

     Title     : Security and Interoperability Implications of Oversized IPv6 Header
                 Chains
     Author(s) : F. Gont, V. Manral
     Filename  : draft-gont-6man-oversized-header-chain-02
     Pages     : 12
     Date      : 2012-06-13

as a 6MAN WG document.  Please state your opinion (either for or
against) on making this draft a WG draft either on the mailing list or
to the chairs.  This call will end June 27, 2012.

Regards,
Ole & Bob

---

From: Dave Hart <[email-masked]>
Date: Wed, 13 Jun 2012 18:46:18 +0000

I am in favor of adopting draft-gont-6man-oversized-header-chain-02 as
a 6MAN WG document.

Dave Hart

---

From: Rémi Després <[email-masked]>
Date: Thu, 14 Jun 2012 10:08:45 +0200

> I am in favor of adopting draft-gont-6man-oversized-header-chain-02 as

+1
RD

> 
> Dave Hart
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: Dominik Elsbroek <[email-masked]>
Date: Wed, 27 Jun 2012 18:01:45 +0200

+1

Kind regards,
Dominik Elsbroek

---

From: Vishwas Manral <[email-masked]>
Date: Wed, 27 Jun 2012 11:11:18 -0700

+1 too.

-Vishwas

---

From: Suresh Krishnan <[email-masked]>
Date: Wed, 27 Jun 2012 16:34:58 -0400

Hi Chairs,

> to the chairs.  This call will end June 27, 2012.

I read through the draft and I am generally supportive of the sentiment
behind the draft. But the draft itself is not at all clear on what
constitutes a "entire IPv6 header chain". Without this, I think the
draft in its current form is not actionable. I would like a crisper
definition of what exactly is the expected behavior on sending,
receiving and intermediate nodes

Thanks
Suresh

---

From: Fernando Gont <[email-masked]>
Date: Thu, 28 Jun 2012 04:46:33 +0200

On 06/27/2012 10:34 PM, Suresh Krishnan wrote:
> draft in its current form is not actionable. 

I simply disagree. While I have no objection with including "a crisper
definition of what 'entire IPv6 header chain'", I think claiming that
"the draft in current for is not actionable" is taking it way too far.
For instance, a bunch of people clearly understood what the document is
talking about -- with the entire IPv6 header chain being all headers
from the fixed IPv6 header chain, till the upper layer protocol (TCP,
UDP, etc. -- assuming there's one of those), including any extension
headers.

> I would like a crisper

Essentially, what is important is the sending behaviour: You must
include the entire IPv6 header chain in the first fragment. Intermediate
nodes may simply forward non-compliant packets, but may also decide to
drop them -- ditto for end nodes.

(We might want to require *end-nodes* to drop them.. However, it
wouldn't make sense to require intermediate nodes to drop such packets,
since it would implicitly require them to process the entire IPv6 header
chain).

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Bob Hinden <[email-masked]>
Date: Thu, 28 Jun 2012 12:49:19 -0700

All,

Based on the feedback received, the 6man chairs believe there is consensus to adopt draft-gont-6man-oversized-header-chain-02 as a 6MAN working group document.

The authors should submit the next revision as an 6MAN document.  

Regards,
Bob Hinden and Ole Troan

---

From: Suresh Krishnan <[email-masked]>
Date: Fri, 29 Jun 2012 20:48:16 -0400

Hi Fernando,

> UDP, etc. -- assuming there's one of those), including any extension

This description works for me. Just put it in the draft and we are all set.

> drop them -- ditto for end nodes.

I asked because there is a legitimate problem that you raise in Section 4

"However, if the first
   fragment fails to include the entire IPv6 header chain, they may have
   no option other than "blindly" allowing or blocking the corresponding
   fragment.  If they blindly allow the packet, then the firewall can be
   easily circumvented by intentionally sending fragmented packets that
   fail to include the entire IPv6 header chain in the first fragment."

but the draft does nothing to mitigate this issue.

Thanks
Suresh

---

From: Fernando Gont <[email-masked]>
Date: Sat, 30 Jun 2012 15:08:29 +0200

Hi, Suresh,

Thanks so much for yur feedback! -- Please find my comments in-line...

> This description works for me. Just put it in the draft and we are all set.

Ok, great!

> but the draft does nothing to mitigate this issue.

Well, the problem *was* that at least in theory such packets could exist
in practice. Now that we'll ban those packets, then a middle-box is free
to drop first-fragments that fail to include the entire IPv6 header
chain, since those packets are illegitimate in the first place (i.e.,
problem solved!).

(Note: such packets have not been found in real networks, and
middle-boxes area already dropping them -- hence we're aligning the
specs with the real-world).

Thanks!

Best regards,