Subject: Re: [shim6] How long is a shim6 header?

From: Brian E Carpenter <[email-masked]>
Date: Sun, 03 Nov 2013 03:39:06 +1300

Sure, I agree about 8 minimum: my suggestion was that 40 was a typical
*large* header.

1280 would be a complete disaster since firewalls will *never* be able
to deal with that at line speed. Please read draft-wkumari-long-headers-02
to understand the concern. We missed this issue during the shim6 design,
I think.

Regards
   Brian

On 02/11/2013 21:22, Sébastien Barré wrote:
> Hi,
> 
> the biggest extension headers are found in signalling packets, in
> particular those that carry locator information.
> Since any number of locators can be advertised to the peer, the Shim6
> signalling packet may grow up to 1280 bytes, the maximum allowed for
> shim6 (ref: rfc5533, section 5.1), including
> the IPv6 header. This leaves up to 1240 bytes for the Shim6 header.
> 
> Now, this is for signalling. If you worry about payload packets only,
> then the Shim6 header is either simply absent (when ULIDs are used, the
> shim6 context at the receiver is looked up based on them), or it
> contains only a context tag and its size is then 8 bytes. (rfc5533,
> section 5.2)
> 
> So, unless I miss something, the Shim6 minimum header size is 8 bytes,
> not 40.
> 
> Hope this helps,
> 
> Sébastien.
>>
>> -------- Original Message --------
>> Subject: [shim6] How long is a shim6 header?
>> Date: Wed, 30 Oct 2013 07:53:41 +1300
>> From: Brian E Carpenter <[email-masked]>
>> Organisation: University of Auckland
>> To: shim6-wg <[email-masked]>
>>
>> Hi,
>>
>> Does anyone have a quick answer to this question: how big is the
>> biggest SHIM6 extension header that is likely to occur in practice?
>>
>> As far as I can see, it's at least 40 bytes.
>>
>> The context for this question is draft-wkumari-long-headers.
>>
>> Regards
>>    Brian Carpenter
>>
>> _______________________________________________
>> shim6 mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/shim6
>>
>>
>>
> 
>

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 05 Nov 2013 06:10:53 +1300

On 05/11/2013 05:45, Erik Nordmark wrote:
> 
> Brian,
> 
> It isn't clear to me whether you are talking about the datapath case
> (where the shim6 header is followed by a ULP header and payload like
> TCP) or a control/signalling case, which has NO_NXT_HEADER.
> 
> In the datapath case the header is exactly 8 bytes.
> In the NO_NXT_HEADER things are variable length - but that isn't a
> concern for wirewalls since there is no next header to inspect.

That's an interesting point. I actually wonder how existing firewalls
respond to NO_NXT_HEADER. I think the answer may be disturbing.

The problem with most current firewalls is that they drop packets
with a shim6 header anyway.

Thanks
    Brian
> 
> Regards,
>    Erik
> 
> On 11/2/13 7:39 AM, Brian E Carpenter wrote: