Subject: Re: [v6ops] So nobody cares about load balancers? draft-carpenter-v6ops-label-balance-01.txt]

From: Fernando Gont <[email-masked]>
Date: Sun, 04 Mar 2012 10:40:39 -0300

On 02/27/2012 12:54 PM, Bjoern A. Zeeb wrote:
> I think part of the load balancer issues is that the latest documents do not
> make it fully suitable for "hosts" anymore 

What specific use do you have in mind here?

> where an e-to-end (edge-to-host or
> better end-to-end) flow label would be essential (controllable by the host
> ideally) or uniquely by an entire management domain, which already breaks with
> a customer host  (I'll ignore Fernando's immediate concerns there;-)

FWIW, while there has been some debate on the issue of the FL being used
as a covert channel (fwiw, this was covered in
draft-gont-6man-flowlabel-security just for cmopleteness-sake), the
important thing here is that if the FL is not covered by an error
detection code and it is not authenticated, you cannot really depend on
it being immutable -- whether you like it or not.

Allowing for the FL to be rewriten is, in part, admitting the above. But
it also means that you could deploy a box that set the FL on behalf of
old systems that fail to do it, or that do not do it properly. And you
also accept the fact that there might be protocol scrubbers already
clearing the FL to zero.

Thanks,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1