[Ipsec] draft-ietf-ipsec-rfc2402bis-07.txt ... Suggest moving the "Flow Label" IPv6 base header field to "immutable" and protecting with AH

The flow label in IPv6 is chosen by the source node, and must be delivered
to the ultimate destination without having been changed in transit, unlike
the DSCP or ECN QoS-related fields for IPv6.

I suggest, since it is constant end-to-end, the field be moved to
"immutable" and protected by AH.

-------------- from draft-ietf-ipsec-rfc2402bis-07 ----------

3.3.3.1.2.1  Base Header Fields

   The IPv6 base header fields are classified as follows:

   Immutable
             Version
             Payload Length
             Next Header
             Source Address
             Destination Address (without Routing Extension Header)

   Mutable but predictable
             Destination Address (with Routing Extension Header)

   Mutable (zeroed prior to ICV calculation)
             DSCP (6 bits, see RFC2474 [NBBB98])
             ECN (2 bits, see RFC3168 [RFB01])
             Flow Label
             Hop Limit

-------------- from RFC 3697 --------------

2.  IPv6 Flow Label Specification

   The 20-bit Flow Label field in the IPv6 header [IPv6] is used by a
   source to label packets of a flow.  A Flow Label of zero is used to
   indicate packets not part of any flow.  Packet classifiers use the
   triplet of Flow Label, Source Address, and Destination Address fields
   to identify which flow a particular packet belongs to.  Packets are
   processed in a flow-specific manner by the nodes that have been set
   up with flow-specific state.  The nature of the specific treatment
   and the methods for the flow state establishment are out of scope for
   this specification.

   The Flow Label value set by the source MUST be delivered unchanged to
   the destination node(s).

-------------------------------
John Spence, CCSI, CCNA, CISSP
Native6, Inc.
IPv6 Training and Consulting
jspenceNOSPAM@native6.com
www.native6.com
-------------------------------

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec