Subject: I-D Action: draft-ietf-6man-oversized-header-chain-01.txt

From: [email-masked]
Date: Mon, 16 Jul 2012 14:38:30 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the IPv6 Maintenance Working Group of the IETF.

	Title           : Security and Interoperability Implications of Oversized IPv6 Header Chains
	Author(s)       : Fernando Gont
                          Vishwas Manral
	Filename        : draft-ietf-6man-oversized-header-chain-01.txt
	Pages           : 13
	Date            : 2012-07-16

Abstract:
   The IPv6 specification allows IPv6 header chains of an arbitrary
   size.  The specification also allows options which can in turn extend
   each of the headers.  In those scenarios in which the IPv6 header
   chain or options are unusually long and packets are fragmented, or
   scenarios in which the fragment size is very small, the first
   fragment of a packet may fail to include the entire IPv6 header
   chain.  This document discusses the interoperability and security
   problems of such traffic, and updates RFC 2460 such that the first
   fragment of a packet is required to contain the entire IPv6 header
   chain.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-6man-oversized-header-chain

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-6man-oversized-header-chain-01

A diff from previous version is available at:
http://tools.ietf.org/rfcdiff?url2=draft-ietf-6man-oversized-header-chain-01

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Fernando Gont <[email-masked]>
Date: Mon, 16 Jul 2012 22:45:40 +0100

Folks,

I've posted a rev of draft-ietf-6man-oversized-header-chain. It
incorporates a clarification of what we mean by "entire IPv6 header
chain", as suggested by Suresh.

Since this I-D is very simple and short, and has been pretty stable for
a while, I personally think that it should be ready for WGLC.

Thoughts?

Best regards,
Fernando

On 07/16/2012 10:38 PM, [email-masked] wrote:
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
> 

-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Tue, 17 Jul 2012 06:35:54 +0000

Fernando,

As I said in Paris, very useful I-D which is really important for stateless firewalls (read switch ACL).

Two minor comments:
- section 2.0 I would also explicitly add ICMP in addition to UDP & TCP (as ICMP is not really an upper-layer protocol as it is the control engine of the network layer)
- not sure whether an upper-layer header could strictly be part on the IPv6 extension header chain (at least not per RFC 2460)

Even as the I-D is, it is ready for WGLC IMHO

-éric

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> [email-masked]
> Sent: lundi 16 juillet 2012 23:39
> To: [email-masked]
> Cc: [email-masked]
> Subject: I-D Action: draft-ietf-6man-oversized-header-chain-01.txt
> 
>

---

From: Fernando Gont <[email-masked]>
Date: Tue, 17 Jul 2012 14:15:26 +0100

Hi, Eric,

Thanks so much for your feedback! -- Please find my comments inline...
On 07/17/2012 07:35 AM, Eric Vyncke (evyncke) wrote:
> - section 2.0 I would also explicitly add ICMP in addition to UDP & TCP 

How about e.g. s/UDP/ICMPv6/, since, after all, "UDP" was just there as
an example? (I'd prefer to do this rather to add yet another protocol,
since it might lead people to think that the list is exhaustive.. when
it's not).

> (as ICMP is not really an upper-layer protocol as it is the control engine of the network layer)

>From the point of view of encapsulation, I view ICMP as an upper layer
protocol -- although it clearly provides a function at lower layers.

A similar example would be BGP, which is an "app" protocol, but provides
functions for the network layer.

> - not sure whether an upper-layer header could strictly be part on the IPv6 extension header chain (at least not per RFC 2460)

Well, I'd consider the upper-layer header being part of the "ipv6 header
chain" (*) since they are identified with the same namespace used for
extension headers.

(*) I've just skimmed through RFC 2460, and it doesn't mention/define
the term "header chain".

Two possible options:
1) Leave the doc "as is"

2) s/IPv6 header chain/header chain/
This one might address the issue you've raised, but then some might
argue that "the entire header chain could also mean that e.g. an
app-layer header should be included".

I'd rather stick with 1, but I'm certainly open to suggestions. Thoughts?

> Even as the I-D is, it is ready for WGLC IMHO

Thanks!

Best regards,

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Tue, 17 Jul 2012 14:39:42 +0000

Fernando,

Fully agree with your first change. Just for the pleasure chatting: BGP is indeed an app while ICMP is the control part of the network layer, let's reserve a beer to discuss about this. 

Regarding the 'IPv6 header chain', indeed RFC 2460 does not define 'chain' but specifically write about 'IPv6 extension headers' as w/o upper-layer protocol, hence, 'IPv6 header chain' could be confusing. I.e. I am using this wording to address the extension header chain (ellipsis of mine). Your I-D clearly defines it so no big deal, just slightly confusing. I would prefer the word 'IPv6 header chain + next-layer header' but this is quite long of course.

-éric

> From: Fernando Gont [mailto:[email-masked]]
> Sent: mardi 17 juillet 2012 15:15
> To: Eric Vyncke (evyncke)
> Cc: [email-masked]
> Subject: Re: I-D Action: draft-ietf-6man-oversized-header-chain-01.txt
> 
> Hi, Eric,
> 
> How about e.g. s/UDP/ICMPv6/, since, after all, "UDP" was just there as an
> example? (I'd prefer to do this rather to add yet another protocol, since it
> might lead people to think that the list is exhaustive.. when it's not).
> 
> 
> > - not sure whether an upper-layer header could strictly be part on the
> > IPv6 extension header chain (at least not per RFC 2460)
> 
> (*) I've just skimmed through RFC 2460, and it doesn't mention/define the
> term "header chain".
> 
> 
> Two possible options:
> 1) Leave the doc "as is"
> 
> This one might address the issue you've raised, but then some might argue
> that "the entire header chain could also mean that e.g. an app-layer header
> should be included".
> 
>