Subject: question about IPv6 Flow label

From: marcelo bagnulo braun <[email-masked]>
Date: Mon, 18 May 2009 03:22:46 +0200

Hi,

In the MEXT WG we are discussing about using the Flow Label as a flow 
descriptor and we were wondering how widely implemented is RFC3697. In 
particular, how many of the current OSes actually do:

   To enable Flow Label based classification, source nodes SHOULD assign
   each unrelated transport connection and application data stream to a
   new flow.

Thanks, marcelo

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Mon, 18 May 2009 08:28:04 +0200

On Mon, 18 May 2009 03:22:46 +0200, marcelo bagnulo braun

>    new flow.

Linux has had an API for a while. Dunno about other systems.

-- 

Rémi Denis-Courmont

---

From: David Malone <[email-masked]>
Date: Mon, 18 May 2009 11:19:17 +0100

> particular, how many of the current OSes actually do:

I had a look at this a few years ago with Orla McGann, because we
wanted to know if the flow label could be used by a stateful firewall:

	http://www.maths.tcd.ie/~dwmalone/p/ec2nd05.pdf

It seemed that there were some problems where the flow label was
not set consistently. We fixed this up in FreeBSD, so I can tell
you what happens there. For TCP the flow label is usually set
randomly, either using a hash of the connection details (+ a secret)
or is set randomly using a PRNG. At the moment there isn't check
to make sure the flow label is not shared between two flows.

For UDP, I think the flow label will default to zero.

	David.

---

From: Hesham Soliman <[email-masked]>
Date: Mon, 18 May 2009 20:50:51 +1000

> For UDP, I think the flow label will default to zero.

=> Do you know why the same was not done for UDP?

Hesham

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Mon, 18 May 2009 14:46:06 +0200

On Mon, 18 May 2009 20:50:51 +1000, Hesham Soliman

> => Do you know why the same was not done for UDP?

Flow is an application-layer-dependent notion. The UDP layer does not know

about it, and should hence not try to guess either.

-- 

Rémi Denis-Courmont

---

From: marcelo bagnulo braun <[email-masked]>
Date: Mon, 18 May 2009 15:19:43 +0200

> about it, and should hence not try to guess either.

mmm, what about setting a non zero flow label per UDP connected socket?
For non connected sockets, i agree with you, it should be up to the 
application to define it through the API and the default should be zero
regards, marcelo

---

From: Joel Jaeggli <[email-masked]>
Date: Mon, 18 May 2009 10:10:59 -0700

Even, or perhaps especially, the authors of 3697 would disagree with you
as to the security value you can associate with flow labels.

joel

ZhangDong wrote:
> Hi,
> 
> I think that the flow label is able to be a good use for firewall. The firewall does not need to know the ports to identify a flow. It makes sense for flows encrypted, such as IPsec.
> 
> Thanks.
> 
> Dong Zhang
> Huaweisymantec Technologies Co., Ltd
> 
> 
> ----- 原始邮件 -----
> 发件人: David Malone <[email-masked]>
> 日期: 2009年 5月 18日, 星期一,  下午6:54
> 主题: Re: question about IPv6 Flow label
> 收件人: marcelo bagnulo braun <[email-masked]>
> 抄送: 'IPv6 Operations' <[email-masked]>, Hesham Soliman <[email-masked]>, "Tsirtsis, George" <[email-masked]>
> 
>

---

From: David Malone <[email-masked]>
Date: Mon, 18 May 2009 19:56:48 +0100

> as to the security value you can associate with flow labels.

Note that it depends how you use it. Our idea was not to use it as
a hash key (which would certainly be unwise), but as an extra piece
of information that a blind attacker would have to guess to insert
packets into a connection.  It looked like it might work, however
the big stumbling block was that not all flows were actually sending
with a consistent flow label.

	David.

---

From: Hesham Soliman <[email-masked]>
Date: Tue, 19 May 2009 12:00:31 +1000

> with a consistent flow label.

=> But even if they are sending a consistent flow label, to do what you
want, you need to ensure that the recepient can verify the flow label, which
is not possible unless both sender and receiver agree through negotiation or
in a predetermined manner on how to generate it.
Of course if it is a predetermined manner, then you can't use a RNG in the
process and therefore a blind attacker can generate a valid packet anyway
unless the flow label changes with each packet, right?

Hesham

---

From: ZhangDong <[email-masked]>
Date: Tue, 19 May 2009 11:06:14 +0800

>  unless the flow label changes with each packet, right?

Hmm... So the flow label also needs security protection to some extent when it is uesd, right?

Is there any document describe how the flow label is used by applications? 

Dong Zhang

---

From: Hesham Soliman <[email-masked]>
Date: Tue, 19 May 2009 13:43:51 +1000

> Hmm... So the flow label also needs security protection to some extent when it

=> No, I was asking a question about what David said. The flow label doesn't
necessarily need security.

Hesham

---

From: David Malone <[email-masked]>
Date: Tue, 19 May 2009 06:50:25 +0100

> in a predetermined manner on how to generate it.

No - the idea was that the receiver would learn it, in the same way
it learns the TCP ISN or DNS query ID.

	David.