Comment by adrian_b

3 days ago

The extension headers are fine, because they frequently are not needed, so the fact that they are optional allows the IPv6 header to be significantly simpler than the IPv4 header, which has some seldom used fields which are always present.

4 comments

adrian_b

Reply
cyberax  3 days ago

No, they are not fine. Their design means that the router needs to know all possible extension headers to just be able to route the packets. Oh, and you also have to do offset-chasing in the hardware fastpath.

As a consequence, IPv6 with extension headers are just dropped by routers in the public Internet.

  • Dagger2  2 days ago

    https://datatracker.ietf.org/doc/html/rfc2460#section-4:

       With one exception, extension headers are not examined or processed
   by any node along a packet's delivery path, until the packet reaches
   the node (or each of the set of nodes, in the case of multicast)
   identified in the Destination Address field of the IPv6 header.

    That seems like the opposite of needing to know all possible extension headers in order to route a packet.

    • cyberax  2 days ago

      Again, in practice the packets with _any_ IPv6 extension headers are unusable when traversing the public Internet: https://blog.apnic.net/2022/10/13/ipv6-extension-headers-rev...

      The issue is that the extension headers can be used for nefarious purposes, such as hop-by-hop routing. So your fast hardware-based border routers might be EH-agnostic and transmit packets to your core network. And then a helpful Linux box that implements all of IPv6 in software would reflect the traffic right past your firewall.

      Implementing the EHs in hardware is expensive, as you need to do conditional checks. So routers just drop them.

      1 reply →