[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: filtering packets with unknown options
On 12-jul-2006, at 15:05, Joe Abley wrote:
An alternative would be to set the contents of the option to all
zero bits, this should be easier to implement than removing the
header from the packet.
For clarity, I presume you mean set the option type in each TLV the
firewall is unhappy about (in all options extension headers that
might be present) to zero ("skip this option").
Right, although "TLV" isn't exactly a given.
It all still smells a bit nasty, though.
It is not a very pretty solution, but the alternative is that it will
be extremely hard to the point of almost being impossible to deploy
new "stuff" on the internet. Point in case is the "partial ECN" or
something very similar that I can't find any reference to right now.
The idea is to steal the last unused bit in the IPv4 header to extend
the ECN semantics (the "evil" bit...) but IPv6 doesn't have this bit
so that means an extra header, either a new one or a new option in
the destination options header, I forget which. With firewalls
filtering this out, this means a many-year uphill battle before this
can be deployed.