Re: [9front] [PATCH] ipv6 flow label support

[cinap_lenrek@felloff.net]

the more i learn about the ipv6 flow-label the more
of a rabbit hole it becomes.

so it seems that some load-banalcer people actually dont
use the flowlabel anymore because of middle boxes
filling in random flowlabels across the same tcp
session, breaking the whole scheme. [1]

then linux implements crazy flow-label changes during
tcp retransmission timeouts to work around broken
paths in load balancers to switch to a different path. [2]

more concerning is the use for flow labels to generate
a unique per device id independent of the protocols
and ip addresses used as windows and linux haved used
keyed hash functions that have been shown to be reversible
as the 5-tuple hash input is known by an observer
and you can extract the static key used for the hashing
and use that to identify the device across differnet
ip addresses and protocols. [3]

[1] https://blog.apnic.net/2018/01/11/ipv6-flow-label-misuse-hashing/
[2] https://datatracker.ietf.org/meeting/111/materials/slides-111-rtgwg-sessb-3-selfhealing-network-01
[3] https://ieeexplore.ieee.org/stampPDF/getPDF.jsp?tp=&arnumber=9152759&ref=

arne, is here any particular REASON why we should
not just put ZERO in the flow-label field and pretend
flow-labels dont exist?

this thing seems to have cause enougth damage to
the ipv6 internet.

--
cinap