Subject: Re: [v6ops] Destination options and denial of service attack

From: Philip Homburg <[email-masked]>
Date: Wed, 26 Apr 2017 17:06:55 +0200

In your letter dated Wed, 26 Apr 2017 07:51:29 -0700 you wrote:
>and the default SHOULD
>be to accept all standard extension headers, including the Hop-by-Hop
>Options header and the Destination Options header.

That advice puts extensibility ahead of security. That's very rarely a good
trade-off. So it wouldn't surprise me if most people will decide that it is
perfectly reasonable to violate this SHOULD.

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 27 Apr 2017 08:50:48 +1200

On 27/04/2017 03:06, Philip Homburg wrote:
> trade-off. 

That is a very debatable opinion. In any case, this is *exactly* why RFC7045
is written the way it is - make this a configurable choice per extension
header, with reasonable default settings. (Also see the recent
draft-ietf-opsec-ipv6-eh-filtering discussion.)

> So it wouldn't surprise me if most people will decide that it is

Again, RFC7045.

None of which adresses Tom's issue.

    Brian