Earlier, Jari Arkko wrote:
> In addition, I'm not sure I understand how a router knows that it is a first
> hop router.
My understanding is that the IPv6 WG's compromise regarding
the "Flow Label covert channel issue" that has been worked out
expressly permits any IPv6 security gateway to rewrite
IPv6 Flow Labels from value A to value B, if required by the
security policy deployed in that IPv6 security gateway,
provided that value B provides the documented required
mathematical properties that support load-balancing purposes.
Since IPv6 Flow Label rewriting is allowed under that situation,
I don't see any value in restricting the rewriting of IPv6 packets
containing a zero IPv6 Flow Label to a non-zero IPv6 Flow Label value
-- again, provided the new non-zero value meets the documented
required mathematical properties.
So I don't think it matters whether the router performing
rewriting is a first-hop router or not. Requiring a check
of whether the router is a first-hop router is just wasted
computational overhead for the router.
>From the perspective of an IPv6 router implementer, the relevant
data are (A) was the IPv6 Flow Label value zero upon receipt
by that router, (B) are the 5 input values easily read
by that router, and (C) is calculating a non-zero Flow Label
value reasonable given other computational demands on that
router at that moment in time.
For an ASIC-based or FPGA-based IPv6 forwarding engine,
- (A) is trivial to check at wire speed
- (B) is true IFF packet is not fragmented
- (C) is irrelevant since one would throw a few lines
of Verilog at the problem
For an NP-based IPv6 forwarding engine,
- (A) is trivial to check at wire speed
- (B) is generally true IFF packet is not fragmented
- (C) depends primarily on how much other processing
(e.g. encapsulation/decapsulation) that particular frame
might require, and secondarily on the number of
NP cycles available while performing at wire-speed
BOTTOM LINE:
If any IPv6 router sees any zero-value Flow Label, the router ought
to be permitted (but NOT required) to rewrite the Flow Label value
to a non-zero value that meets the published mathematical requirements.
Yours,
Ran
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email protected]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------
