Re: Updating to RFC6434 to deal with 8200-style header insertion by IPIP

[Mikael Abrahamsson <[e-mail]>]

On Wed, 1 Nov 2017, Michael Richardson wrote:

> Removing redundant IPIP headers at the end-host provides no benefit to the
> end-host.  The end-host does this in order to facilitate some unknown service
> in the middle that did something.  If we want to enable such things to work
> without prior permission (cf: "permissionless innovation") then we need to
> fix hosts to do this.

I don't think we should. Whatever is done in the middle that does encap, 
should also make sure it's decap:ed before it reaches the end host.

>    > If the device isn't configured to do IPsec (even by default), then I don't
>    > think it should do what you describe.
>
> Yet we skip other extension headers in order to find the ULP.
> In fact, a host that has *NO* IPsec code *at all* will skip it as an unknown
> header....  Because we got this wrong, we couldn't use AH to secure ND or any
> other multicast (like OSPF) without causing of a flag day.  AH became totally
> USELESS.  It was sad.

Right. I forgot that IPSEC is an extension header in IPv6, I tought of it 
as something that was encapsulated. So I take back what I said.

-- 
Mikael Abrahamsson    email: [e-mail]